Slashdot Mirror
SpreadFirefox Security Breached (again)
Kurt writes "The hugely popular SpreadFirefox project, a Firefox community marketing site, has recently fallen victim to a security breach in their TWiki software. This breach has forced the site to shutdown until October 19th. During this time, they will be performing a rebuild of the SpreadFirefox system, to hopefully curb more security breaches."
I noticed this message yesterday. I was wondering what it was about. Where did slashdot get this info? I didn't see it on Mozila's web site yesterday.
Bradley Holt
OSS isn't inherently any more secure than proprietary software. It's just that the nature of the typical OSS developer vs a corporation means that the OSS organization is more transparent when bad things do happen. It doesn't mean that the security breach didn't already happen, though.
Rex is 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
It says the site is down until the 15th not the 19th...
It's not Mozilla software that got hacked. If it's indeed the Wiki part, then it's the MediaWiki software, which is also open source but has nothing to do with Mozilla or Firefox. Either way, that web site is very user based where tons of tools were hosted for the community like public forums and freely editable wikis, so it's not surprising that some of them may have issues. Until the actual mozilla.org site gets hacked, which I highly doubt it will ever happen, there's nothing to worry about.
Shutting your corporate website down for 2 weeks?
Look at this! Now they're even taunting us by appending "(again)" to the duplicate subject entries!
Do you like German cars?
I also recently had my TWiki-based wiki farm broken into, for the 3rd time in 4 years, despite trying to stay up to date at least with Debian releases. Fortunately, I had each wiki set up to run suexec as an individual user, so the damage was reasonably well contained.
Since TWiki's security problems seem intractable (giant Perl codebase that's very difficult to audit and doesn't seem to have been designed to handle security) I decided that enough is enough and followed freedesktop.org's lead in moving the whole farm to MoinMoin. MoinMoin is written in Python rather than Perl, and seems to be better thought out in terms of security, although I had to hack up the source some to get what I wanted. Some open source migration tools will be made available shortly.
I wouldn't recommend to anyone that they run a publically-viewable TWiki installation at this point.
what does watching an opera have to do with t he interweb thingy?
:)`
Look out i gatta go back to clicking up a storm. They are paying me to surf now
But this isn't the Mozilla project. And Mozilla is inherently safer than IE.
Why? Because Mozilla isn't port of the OS. Exploits in IE have tended to open up the entire OS to virus and malware. Exploits in Mozilla tend to crash Mozilla. Same thing with Outlook and Thunderbird.
Finally to answer this statement of yours
"Wake up kids. They're as fallible as anyone at Microsoft and things like this will happen. Whether it is the browser or the websites hosting or the wikis, or whatever, mistakes are going to be made and patches and corrections will need to be done."
If you look at the spreadfirefox.org website you will see this statement "This site is not connected to the Mozilla Foundation"
So... your point is? The cracking of this website that is in not connected to the Mozilla Foundation proves what????
I agree that Mozilla is not perfect just better than IE.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Right. Of course.
Because the guys behind Mozilla/Firefox are clearly the same people as those who write TWiki, right? And the guys who run the Firefox marketing site are clearly exactly the same guys who do the hardcore browser development too.
I'm all for pointing out when anyone fucks up, regardless of if they're saintly Firefox developers or "t3h evil 0ne5" at Microsoft. Nevertheless, if we're going to start pointing fingers at anyone and scoring cheap points, can we at least make sure it's, y'know... their fault?
Short-sightedly knee-jerking and implying a marketing-run website crack is in any way a reflection of the security of an entirely separate developer-run product is just as bad as the people you're having a go at that think FL/OSS developers' shit smells of roses.
Everything in moderation, including moderation itself
...this breach was due to poor server administration in that they didn't keep their software patched up to the latest version.
Yep, agreed.
Same as the majority * of Microsoft hacks. People not changing their SQL Server sa password from the default, or not applying the patch that blocks that particulary vulnerability that was released by Microsoft six months ago, or...
* Note: I fully expect someone to come up and say "but what about...". That's why I chose that phrasing. I'm not arguing Microsoft is perfect, and you can certainly argue whether open-source means you get the advantage of transparency **, or whatever your retort may be. But my contention is that the majority of hacks of Microsoft products come down to poor server administration.
** Which advantage is also extended to the hackers, of course.
From the email sent out, it says that:
It seems safe to assume that personal information is a subset of sensitive data, no?
-Turkey