Debian Server Compromised

← Back to Stories (view on slashdot.org)

Posted by ryuzaki0 on Wednesday July 12, 2006 @02:54PM from the fox-in-the-henhouse dept.

Security News writes "According to a post on the debian-devel-announce mailing list "Early this morning we discovered that someone had managed to compromise gluck.debian.org. We've taken the machine offline and are preparing to reinstall it. " gluck is a core development machine."

349 comments

Oh no by Anonymous Coward · 2006-07-12 14:56 · Score: 5, Funny

Oh no, now they have access to all the Debian source!
1. Re:Oh no by NadNad · 2006-07-12 15:07 · Score: 5, Funny
  
  Maybe it's SCO, trying to find their code buried in linux...
2. Re:Oh no by eeg3 · 2006-07-12 15:15 · Score: 5, Insightful
  
  More like, now they have to verify that no backdoors or other malicious code were inserted.
3. Re:Oh no by Anonymous Coward · 2006-07-12 15:43 · Score: 5, Funny
  
  Forget running Debian Unstable. Debian Compromised is where it's at.
4. Re:Oh no by nick+this · 2006-07-12 16:17 · Score: 1
  
  Yeah, but with an anonymous maintainer, who do you email patches to?
5. Re:Oh no by Aranth+Brainfire · 2006-07-12 16:24 · Score: 4, Funny
  
  It doesn't matter, just email them to whoever you like and the maintainer will get them anyway.
  
  --
  "Quoting yourself is stupid." -Me
6. Re:Oh no by bcmm · 2006-07-12 19:56 · Score: 1
  
  I think that's why they're wiping the disk and reinstalling. It's the only sensible course of action when a machine has been compromised.
  
  --
  # cat /dev/mem | strings | grep -i llama
  Damn, my RAM is full of llamas.
7. Re:Oh no by kdemetter · 2006-07-12 20:18 · Score: 2, Funny
  
  no need . if the backdoor was installed , your machine can be patched remotely.
  
  Now that's easy :-)
  
  --
  Slipping shoelaces ?
8. Re:Oh no by rolfwind · 2006-07-12 21:05 · Score: 3, Funny
  
  They should look under /dev/null, it happens to be the same place their case is headed soon:)
9. Re:Oh no by DMNT · 2006-07-12 23:27 · Score: 2, Funny
  
  No, it was SCO trying to bury their code in linux...
  
  --
  ?SYNTAX ERROR
10. Re:Oh no by Arjuna+Theban · 2006-07-12 23:27 · Score: 1
  
  He meant into the Debian source code.
11. Re:Oh no by creepynut · 2006-07-13 00:03 · Score: 1
  
  The Debian source code is in a lot of other places than a single server, provided it was on that server at all.
  
  They install it fresh from a known-clean source and all is well again. That is, aside from finding out what allowed the compromise and take precautions to make sure it doesn't happen again.
12. Re:Oh no by PCeye · 2006-07-13 00:05 · Score: 1
  
  Ahhh Patches! Now I understand why spammers send attachments... Now I know where to send Virtual Girl and Bonsi Buddy
13. Re:Oh no by creepynut · 2006-07-13 00:06 · Score: 2, Funny
  
  "They got into our machine sir, but all they did was run apt-get update and apt-get upgrade. Phew, that was close!"
14. Re:Oh no by dawggy_daddy · 2006-07-13 00:20 · Score: 0, Redundant
  
  Or maybe they want to plant some code for someone to find.
15. Re:Oh no by erichschubert · 2006-07-13 00:58 · Score: 2, Insightful
  
  The bad news is:
  they'll eventually find all their source code in there. Verbatim.
  In /dev/random
  
  Fortunately, we still have some thousand years until they're done with sighting that data.
  
  --
  Debian GNU/Linux - apt-get into it.
16. Re:Oh no by fatphil · 2006-07-13 02:28 · Score: 1
  
  That's the commonly held belief, but when my machine was rooted 5 years back (after two zillion and one attacks, I live on a very busy IP block), I took a different approach. I shutdown, booted from CD and compared fingerprints of all files in the root filesystem with ones backed up only a now read-only floppy. I then manually replaced all the files that had been modified by the rootkit. It was about 2 hours work. A reinstall of the full system would have been much longer. It wasn't a very intrusive rootkit, it didn't modify the zImage for example, and I may have opted for a full reinstall if it had put its claws in too many critical files.
  
  However, if you don't know 100% what you're doing, you should just assume that everything is compromised until proved otherwise, and a full reinstall is the best way to be sure.
  
  To be sure of being susceptible to rooting by exactly the same exploit again, alas.
  
  --
  Also FatPhil on SoylentNews, id 863
17. Re:Oh no by gsurbey · 2006-07-13 04:41 · Score: 1
  
  Are you crazy? E-mailing all those internets to Anonymous Coward will just clog gluck's tubes! All you need to do for a modern DDOS is be sure that in each internet that you send set the evil bit broadcast flag and then pay the ISPs to QOS for rush delivery.
18. Re:Oh no by rand_chars · 2006-07-13 09:06 · Score: 1
  
  Well, people have always been telling me that compromise is an important part of life...
19. Re:Oh no by Anonymous Coward · 2006-07-13 19:39 · Score: 0
  
  finally i can hacked it ... hehehehe
  just kidding :)
20. Re:Oh no by walstib · 2006-07-14 02:54 · Score: 2, Informative
  
  In related stories: Microsoft Windows Servers remain secure.
  
  --
  The most dangerous strategy is to jump a chasm in two leaps. - Benjamin Disraeli
So what does that mean? by TwentyLeaguesUnderLa · 2006-07-12 14:58 · Score: 0, Redundant

Oh no! They're gonna leak the source code! Debian is screwed now...
1. Re:So what does that mean? by dbcad7 · 2006-07-12 15:22 · Score: 1, Insightful
  
  Considering the times posted.., not sure if redundant was justified mod. Maybe a "jinks owe me a coke" mod would be more appropriate, when identical posts are within 2 minutes.
  oops.. now I'll get modded offtopic.
  
  --
  waiting for ad.doubleclick.net
Once is ok, but twice is too much... by ModernGeek · 2006-07-12 14:58 · Score: 3, Insightful

...first we had the hack into the repository severs, and we didn't know whether or not we are running exploited code when we use apt-get to update our programs. Now it seems that internal development machines are being hacked. If the debian team cannot keep their own products secure in their own environments, how can we expect to take them seriously in the enterprise? Granted this was on a development branch and development server, but how many times do you have to upgrade to an "experimental" package to get a function or feature that you need to have in your setup? I might be spreading FUD, but I think I speak for the rest of us when I speak of this vibe I feel from debian.

--
Sig: I stole this sig.
1. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 15:05 · Score: 0
  
  I agree. Two in this lapse of time is already too much.
2. Re:Once is ok, but twice is too much... by lawpoop · 2006-07-12 15:09 · Score: 5, Insightful
  
  You know, the difference between open source and closed source software is that with open source, *we know what's going on*. Debian admins are being very bold and forthright in stating that the machine was hacked.
  
  How many times has windowsupdate.microsoft.com been hacked? Zero? How would you know? What incentives ( and disincentives ) does Microsoft have to tell us if such a thing were to happen?
  
  So if corporate America wants to trust a black box, let 'em. There's no convincing them anyway.
  
  --
  Computers are useless. They can only give you answers.
  -- Pablo Picasso
3. Re:Once is ok, but twice is too much... by The+Bungi · 2006-07-12 15:15 · Score: 4, Insightful
  
  That's nice, but it's usually hard to prove a negative. How do you know RedHat or SUSE haven't been hacked? Because they haven't told you? How can you be sure?
  Oh and BTW, Windows updates are signed, so even if someone managed to crack into it the packages would not install.
4. Re:Once is ok, but twice is too much... by Josh+Triplett · 2006-07-12 15:15 · Score: 5, Informative
  
  first we had the hack into the repository severs, and we didn't know whether or not we are running exploited code when we use apt-get to update our programs.
  
  No, we didn't. The server holding the Debian archive did not succumb to the exploit, because it didn't run on an x86 machine and the people exploiting it only attempted to run x86 code. Furthermore, data on the servers that *did* succumb to the exploit got checked before it became available again.
5. Re:Once is ok, but twice is too much... by sqlrob · 2006-07-12 15:21 · Score: 3, Interesting
  
  Oh and BTW, Windows updates are signed, so even if someone managed to crack into it the packages would not install.
  
  Are you sure about that? Remember, the MS network was compromised a while as well. Do you trust their auditing?
6. Re:Once is ok, but twice is too much... by saleenS281 · 2006-07-12 15:22 · Score: 1
  
  if windowsupdate.microsoft.com were hacked, you can bet your ass there'd be a nice big banner stating so because that is the "golden egg" of hacks.
7. Re:Once is ok, but twice is too much... by YU+Nicks+NE+Way · 2006-07-12 15:25 · Score: 5, Informative
  
  You do understand that everything downloaded from update.microsoft.com needs to be digitally signed, right? In order to actually subvert the downloads, an attacker would not only need to take over the system, but would also need to sign the modified download with a Microsoft key. That's hard: the private keys for signing code are kept on a machine inside a SKIF. Last time I checked, code was taken to be signed by sneakernet, so that there would be a physical airgap between the network and the signing system.
8. Re:Once is ok, but twice is too much... by lawpoop · 2006-07-12 15:27 · Score: 1
  
  ...And a 'golden egg' like that would be shut down almost as soon as it goes up.
  
  Here's an even better prize for a hacker who can get into windowsupdate: a nice big banner across every windows computer that had been updated in the past week, perfectly synchronized across millions of computers all over the world.
  
  --
  Computers are useless. They can only give you answers.
  -- Pablo Picasso
9. Re:Once is ok, but twice is too much... by The+Bungi · 2006-07-12 15:29 · Score: 1
  
  If I'm not I can always download the packages manually and check the signature.
10. Re:Once is ok, but twice is too much... by ModernGeek · 2006-07-12 15:34 · Score: 0, Flamebait
  
  So if corporate America wants to trust a black box, let 'em. There's no convincing them anyway. I think differently. I think that if the debian team proves to be efficient and shows some sort of internal public retribution, that corporations will trust an honest mistake over coverups, exploits and scandals that Microsoft have proven itself. I believe that if we band together, we can educate and push open source forward. The open source community and open source developers are almost over the arrogance that once plagued the idea of open source, and now open source can be taken seriously in the enterprise. If you read the past five years of slashdot, and look back at open source, you will see a lot of matured and a lot has changed since then. It is time that we go to corporations and prove to them that university degrees do not prove intelligence in our field, and that a certification is not worth anything more than the paper it is worth. We have an open system (source forge) that will point a corporation to all the people they need for these IT and CS-related jobs. Lets push the University system down and bring the Open Source system to the top. We are seen as the smartest and best of the best. Lets train and educate our gamer friends, leet friends, geeksquad friends(mmm), and other lower tech people that will in turn teach the masses, and then corporations that open source contribution and involvement is an effective way to measure ones credibility. Maybe we will see more things like MaBell's bell labs where open source developers can be paid to work for a company to contribute to the software they use in the same spirit that Logitech funds Doug Engelbart to pursue his ambitions, but in mass.
  
  --
  Sig: I stole this sig.
11. Re:Once is ok, but twice is too much... by B3ryllium · 2006-07-12 15:39 · Score: 3, Funny
  
  Mwuahahahha! Perfect place to ply the first-ever Carrier Pigeon Protocol hack!
12. Re:Once is ok, but twice is too much... by lawpoop · 2006-07-12 15:45 · Score: 1
  
  Can you really download all of the windows updates as individual executables? I was under the impression that you could only do that for large upgrades, like the service packs.
  
  --
  Computers are useless. They can only give you answers.
  -- Pablo Picasso
13. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 15:49 · Score: 0
  
  You speak as if this is a "Windows Only" feature.
  
  Pretty much every distro has this functionality.
14. Re:Once is ok, but twice is too much... by TrappedByMyself · 2006-07-12 15:53 · Score: 1
  
  You used the example of a Debian server being hacked, with no other supporting facts, to say that Microsoft and corporate America are bad and open source is good.
  
  Thanks for the good propaganda example. Kids, are you paying attention?
  
  --
  
  Help me take back Slashdot. When did 'News for Nerds' become 'FUD and Conspiracy Theories for Extremist Nutjobs'?
15. Re:Once is ok, but twice is too much... by winkydink · 2006-07-12 16:00 · Score: 2, Insightful
  
  Diverting attention from a problem by pointing out the flaws of others is not really helpful.
  
  Yeah, "we know what's going on", just as soon as somebody diffs a bazillion lines of code against a known-good repository. Until the Debian team announces that tidbit of info, the only security you have is the "false sense of" kind.
  
  --
  "I'd rather be a lightning rod than a seismometer." -Ken Kesey
16. Re:Once is ok, but twice is too much... by Waffle+Iron · 2006-07-12 16:00 · Score: 3, Interesting
  
  If you remember, the incident in question involved someone loose for weeks or months on Microsoft's internal networks before they were discovered. It's wouldn't have been impossible for them to modify the code before it got signed. Microsoft had to spend a great deal of effort to try to verify that such a thing didn't actually happen.
17. Re:Once is ok, but twice is too much... by SnowZero · 2006-07-12 16:09 · Score: 3, Informative
  
  You do understand that everything downloaded from update.microsoft.com needs to be digitally signed, right?
  
  Btw, Debian also does digital signatures for every package installed (see here). I don't think they have gone as far as having an air-gap, but it does mean that a regular hacking won't be able to silently corrupt packages.
  
  Debian's system is actually quite cool, since it can check *every* program installed, and not just core OS updates (courtesy of apt controlling 99% of software installation). In fact, you can add additional keys for other package sources (I run some unofficial packages, but those developers also sign their packages with their own keys, so it is covered as well).
18. Re:Once is ok, but twice is too much... by flacco · 2006-07-12 16:23 · Score: 1
  
  if windowsupdate.microsoft.com were hacked, you can bet your ass there'd be a nice big banner stating so because that is the "golden egg" of hacks.
  this is not the kind of hack anyone cares about. i don't care if someone posts a "frodo crew rulez" banner on some site - i do care if someone is putting compromised packages up that find their way onto my machines.
  
  --
  pr0n - keeping monitor glass spotless since 1981.
19. Re:Once is ok, but twice is too much... by flacco · 2006-07-12 16:25 · Score: 4, Informative
  
  but with a compromised dev machine, one could patch in back door code that gets signed as valid.
  
  --
  pr0n - keeping monitor glass spotless since 1981.
20. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 16:31 · Score: 0
  
  Oh and BTW, Windows updates are signed, so even if someone managed to crack into it the packages would not install.
  
  What, and Debian's packages aren't? What do you take them for, complete idiots?
21. Re:Once is ok, but twice is too much... by DShard · 2006-07-12 16:36 · Score: 1
  
  Here is the best prize: The hacker has access to some percent of 99 percent of the machines connected to the internet. A rootkit install with a keylogger and file scanner can get you the keys to lots of insignificant machines. Some of them are going to have bank, social security and investment information. A hacker with any sense of greed is going to sell or already have sold this hack. It only requires the window of time from hacked to fixed to grab it all. Hacking windowsupdate would be the biggest heist in history.
22. Re:Once is ok, but twice is too much... by Mathinker · 2006-07-12 16:40 · Score: 2, Insightful
  
  Your point about non-OSS being more of a "black box" because of commercial disincentives is OK, but you compared a Debian development machine to windowsupdate.microsoft.com which is stupid considering both that Debian and Microsoft sign their releases.
  
  This compromise is more like Microsoft's internal development network being compromised, which has happened.
  
  Unless, of course, the current compromise includes Debian's private key, which I doubt.
23. Re:Once is ok, but twice is too much... by The+Bungi · 2006-07-12 16:44 · Score: 2, Funny
  
  So? The last time GNU.org was rooted they didn't get wind of the break-in until a month after it happened.
24. Re:Once is ok, but twice is too much... by drsmithy · 2006-07-12 16:53 · Score: 1
  
  Here is the best prize: The hacker has access to some percent of 99 percent of the machines connected to the internet.
  I think you're vastly overestimating the proportion of machines that use Windows Update.
25. Re:Once is ok, but twice is too much... by _Sprocket_ · 2006-07-12 16:59 · Score: 1
  
  Alright - so you hack a new version of apt-get. This evil-apt-get accepts a bogus key as legit. Now all you need to do is drop in evil-apt-get in as an update. Oh... and have it signed by the legitimate key less the old (legitimate) apt-get already installed and running on the target's system question the validity of our "updated" apt-get.
26. Re:Once is ok, but twice is too much... by ComputerizedYoga · 2006-07-12 17:07 · Score: 2, Informative
  
  Yes. But it really really sucks. A lot. If you're a major control freak (or just like avoiding auto-updates and such) you could probably go that route. Useful for people on dialup ... download important updates, maybe dump them to a jumpdrive or burn a cd when you've got a couple of them.
  
  I think they also do monthly iso-images that are just compilations of all the update installers in a given month, for the same reason -- not everyone's got a good net connection at home.
27. Re:Once is ok, but twice is too much... by dzym · 2006-07-12 17:11 · Score: 2, Insightful
  
  If the server actually holding the code is compromised a hacked apt-get that accepts bogus keys is probably going to be the least of your worries.
28. Re:Once is ok, but twice is too much... by _Sprocket_ · 2006-07-12 17:21 · Score: 5, Insightful
  
  The point being that digitally signed binaries aren't a guarantee. They're darned nice. Makes things more difficult to slip in a rogue binary. But they're not the end-all, be-all in assuring some rogue code isn't slipped in there somewhere.
  
  And yes - that goes for closed, proprietary software houses as well as the public, open groups.
29. Re:Once is ok, but twice is too much... by _Sprocket_ · 2006-07-12 17:25 · Score: 1
  
  Yeah. Some Open Source "advocates" suck just as bad as the proprietary software marketers when it comes to security propaganda. :P
30. Re:Once is ok, but twice is too much... by DShard · 2006-07-12 17:34 · Score: 1
  
  change that percent to eighty or even fifty, You still have a lot better options than a prank. The last thing anyone in that position is likely to do is announce his presence. The percentages are significant enough to make silence golden.
31. Re:Once is ok, but twice is too much... by _Sprocket_ · 2006-07-12 17:36 · Score: 1
  
  If the server actually holding the code is compromised a hacked apt-get that accepts bogus keys is probably going to be the least of your worries.
  
  True. I misread the parent's comment. D'oh.
32. Re:Once is ok, but twice is too much... by rawtatoor · 2006-07-12 17:46 · Score: 2, Funny
  
  Moderation.... gone... awry
33. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 17:56 · Score: 0
  
  Yeah, I dunno what happened there. Shoulda been a funny. Ah well :) Maybe I should link to the appropriate RFC for extra points :)
34. Re:Once is ok, but twice is too much... by jamesh · 2006-07-12 17:57 · Score: 0, Flamebait
  
  How many times has windowsupdate.microsoft.com been hacked? Zero?
  
  I know it (or at least one of the servers in the cluster) has been defaced at least once by one of the first 'big' iis worms a few years ago. I know because I saw it :)
  
  Of course a defacement(?) is completely different to a compromise that tries to be undetected, and I don't imagine that Microsoft would make any announcements about it if that happened to them, not until people spotted that they were downloading worms...
35. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 18:07 · Score: 0
  
  That's SCIF (Sensitive Compartmented Information Facility), not SKIF.
36. Re:Once is ok, but twice is too much... by Schraegstrichpunkt · 2006-07-12 18:22 · Score: 1
  
  It wasn't the repository that was compromised...
  
  --
  http://outcampaign.org/
37. Re:Once is ok, but twice is too much... by dfn_deux · 2006-07-12 18:28 · Score: 1
  
  Even better, on the hacked *dev* machine one just needs to hack the compilers so that they automagically backdoor things at compile time. Voila!
  
  --
  -*The above statement is printed entirely on recycled electrons*-
38. Re:Once is ok, but twice is too much... by asuffield · 2006-07-12 18:28 · Score: 5, Insightful
  
  If the debian team cannot keep their own products secure in their own environments, how can we expect to take them seriously in the enterprise?
  
  The previous attack was one that can be applied against any platform: somebody used their password over an unencrypted channel (presumably a non-Debian channel, since all the project ones should be encrypted), and somebody else sniffed it and used it to gain access. You can't really do anything about that.
  
  The secondary attack was a local kernel exploit that was first discovered when it was used to attack the debian.org hosts. The attacker(s) came up with something genuinely new (the brk() exploit), there's not a great deal to be done about that either. While the Debian team did make a few mistakes that were cleaned up at that time, none of them were involved in the attack - it wasn't admin error, like you imply.
  
  Goodness knows what this one was.
39. Re:Once is ok, but twice is too much... by Nik+Picker · 2006-07-12 18:36 · Score: 4, Insightful
  
  Converserly, We know nothing about the code we buy from propriatery developer nor do we ( or most likely they ) know anything about the code in the thridparty libraries that may have been included inthe purchased application. We know nothing about the security of the servers providing the updates nor the features included in those updates. We KNOW NOTHING. Yet we accept , almost glibly, the stanards and security of those systems accepting that since its for enterprise it must me more reliable.
  
  So when an group of administrators working on a server which provides software and updates to products for which you can read and see the content and know the features is compromised, you feel its poor quality.
  
  it seems the effort and the acceptance of responsibility do nothing more than increase the level with which we should be accepting these open systems. They appear to have a demonstrably better level of reporting and culpability than many closed servers.
  
  --
  And thats why Firecrackers and kittens don't mix.
40. Re:Once is ok, but twice is too much... by Nik+Picker · 2006-07-12 18:38 · Score: 1
  
  WoW .. this is totally not comment i replied to .. something is broken !
  
  --
  And thats why Firecrackers and kittens don't mix.
41. Re:Once is ok, but twice is too much... by HiThere · 2006-07-12 18:40 · Score: 0
  
  Well...they're signed, but an unfortunately large number of them are signed by an unknown key. (Apt tells me to run update to fix the problem...immediately after I've run update.)
  
  Sorry, I'd like to give Debian lots of credit for this, but they only get partial credit. And that may be being generous. (I'm not sure, not being a security specialist...but my suspicion is that something signed by an unknown key isn't trustworthy.) I sure hope they start fixing THAT soon. (That worries me more than the break in. Break-ins can happen anywhere...and THOSE they are known to be working on fixing.)
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
42. Re:Once is ok, but twice is too much... by redcane · 2006-07-12 19:01 · Score: 3, Informative
  
  You can import the appropriate keys using PGP. If I recall correctly a google search for the error messages apt is emitting will find you some discussions on this matter, including fixes.
43. Re:Once is ok, but twice is too much... by zCyl · 2006-07-12 19:08 · Score: 4, Insightful
  
  first we had the hack into the repository severs, and we didn't know whether or not we are running exploited code when we use apt-get to update our programs
  
  If only there were some tool anyone in the world could use to assess the difference between source versions to see if anything malicious had been inserted...
44. Re:Once is ok, but twice is too much... by umghhh · 2006-07-12 19:22 · Score: 1
  
  Wait wait did you say 'burn it' ??? Do you have a licence to do that?
  
  But seriouly - these things are bound to happen - no amount of security will provide 100% of it. MS or debian whatever - it will happen.
  The question may be (if you dare to ask it) how many times did this kind of threat occured (and was then reported) in MS case?
  Who do you trust (more)?
45. Re:Once is ok, but twice is too much... by DrSkwid · 2006-07-12 19:27 · Score: 1
  
  So where are the signatures ?
  
  --
  There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
46. Re:Once is ok, but twice is too much... by DrSkwid · 2006-07-12 19:31 · Score: 0, Troll
  
  No, YOU'RE an idiot, a golden idiot, with no knobs on.
  
  --
  There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
47. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 19:49 · Score: 0
  
  Because I care about security.
48. Re:Once is ok, but twice is too much... by mverwijs · 2006-07-12 19:56 · Score: 2, Interesting
  
  ...only attempted to run x86 code.
  
  So they hacked in, and only ran x86 code? Sounds like a script kiddie to me.
  
  /me ponders on the enormity of that thought.
49. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 20:02 · Score: 0
  
  How many times has windowsupdate.microsoft.com been hacked?
  
  I don't know, but I base my estimate on "infinity minus the number of times it has provably not been hacked".
  
  I might say "minus the number of times Microsoft says it has not been hacked multiplied by the probability of Microsoft telling the truth", but counting the number of times they have been lying in court, that would end up with the same result anyway.
50. Re:Once is ok, but twice is too much... by mverwijs · 2006-07-12 20:24 · Score: 0, Redundant
  
  Of course, this [1] tells me that it, in fact, *is* a i386 machine. So parent is *wrong*:
  
  # Host name: gluck.debian.org # Admin contact: debian-admin@lists.debian.org # Architecture: i386 # Distribution: sarge Debian GNU/Linux # Access: developer only # Sponsor: Hewlett-Packard # Sponsor admin: # Processor: Dual Intel P4 2800
  
  [1] http://db.debian.org/machines.cgi?host=gluck
51. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 20:24 · Score: 0
  
  Mr Balmer dont you have anything else to do ???
52. Re:Once is ok, but twice is too much... by Josh+Triplett · 2006-07-12 20:38 · Score: 2, Informative
  
  Of course, this [1] tells me that it, in fact, *is* a i386 machine. So parent is *wrong*:
  Yes, gluck, the machine compromised recently, uses x86 hardware. My post responded to someone mentioning the 2003 break-in and claiming the archive server got compromised, while in fact the archive server didn't get compromised because it ran on non-x86 hardware.
53. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 20:42 · Score: 0
  
  apt-get install debian-archive-keyring
54. Re:Once is ok, but twice is too much... by wertarbyte · 2006-07-12 20:43 · Score: 2, Informative
  
  Oh and BTW, Windows updates are signed, so even if someone managed to crack into it the packages would not install.
  
  So are Debian packages. Check "man apt-key" about that.
  
  --
  Life is just nature's way of keeping meat fresh.
55. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 21:00 · Score: 0
  
  Like Americans say "Follow the money" to find who
  is behind something.
  Debian is the most used OS on servers.
  Now who advertises his short pach time, has a brand
  new enterprise OS and comes first to mind to
  inexperienced or new admins or companies.....
  Someone comes to mind...
56. Re:Once is ok, but twice is too much... by Waffle+Iron · 2006-07-12 21:26 · Score: 1
  
  Is your attention span so short that you can't read past the first 1/2 sentence of a message?
57. Re:Once is ok, but twice is too much... by Firehed · 2006-07-12 21:57 · Score: 1
  
  Even 1% of all machines would be well into the millions. If Sir Bill applies updates as diligently as he encourages us to, it could well be not only the most famous hack in computer history, but also the most profitable. Of course, someone with an eleven-digit bank account (oh how depressing, my bank account NUMBER is only nine digits!) isn't likely to keep account info on any computer, let alone one connected to the internet. Regardless, take five bucks from those millions - most wouldn't notice it - and you've got a pretty nice financial situation. Perhaps even enough to buy those top-notch lawyers you'll need afterwards.
  
  --
  How are sites slashdotted when nobody reads TFAs?
58. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 22:11 · Score: 0
  
  Actually you can do something about passwords being sniffed. you don't use them for authentication, and you use pubkey auth or otp.. I wouldn't be suprised if gluck was pwned in a similar way this time. password gathered one way or another and local exploitation of the latest kernel bug on 2.6.13 to 2.6.17.3 inclusive.
  
  way to go debian!
59. Re:Once is ok, but twice is too much... by Barbwired · 2006-07-12 22:19 · Score: 2, Insightful
  
  > Even better, on the hacked *dev* machine one just needs to hack the compilers
  
  AFAIK, gluck.debian.org is not a developement machine, it is mainly a webserver that hosts web pages.
  
  --
  Geeks aren't made, we are born like that by default
60. Re:Once is ok, but twice is too much... by orbitalia · 2006-07-12 22:19 · Score: 1
  
  Windows Update has already been compromised, people just haven't reacted to it yet.
  
  When did you last do a traceroute to www.windowsupdate.com or windowsupdate.microsoft.com ?
  
  The DNS records have been changed so it points to an NSA host instead, windowsupdate.microsoft.com.nsact.com
  
  Can you say cable tap?
61. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-12 22:24 · Score: 0
  
  "However, the compromised system had both an IDS and a file integrity checker installed and we have a very detailed forensic trail of what happened once the box was breached, so we are reasonably confident that the portage tree stored on that box was unaffected."
62. Re:Once is ok, but twice is too much... by orbitalia · 2006-07-12 22:26 · Score: 1
  
  windowsupdate.microsoft.com.nsact.net even :D
63. Re:Once is ok, but twice is too much... by db32 · 2006-07-12 22:34 · Score: 1
  
  Oh and BTW, signatures are done with the private key. So while yes they are signed...this is the same bunch that had a huge chunk of their source code lifted from them. Now I know personally I would protect my source code for my flagship product a bit more than the private key that can be killed and reissued. Coarse...I would protect both a little more than what they did, but that is a different story altogether. So you have to assume if what is arguably their most valuable asset was lifted right off of their network, under their noses, their private key could be out in the wild too.
  
  Granted, rather unlikely, but you always need to be a bit paranoid with security or you will wind up installing packages signed with MS key by Vladamir Ping Chang the Chinese Russian Super H4x0r!
  
  --
  The only change I can believe in is what I find in my couch cushions.
64. Re:Once is ok, but twice is too much... by fbjon · 2006-07-12 23:01 · Score: 1
  
  That's SCIF (Sensitive Compartmented Information Facility), not SKIF.
  Perhaps they run KDE.
  
  --
  True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
65. Re:Once is ok, but twice is too much... by Tony+Hoyle · 2006-07-12 23:29 · Score: 1
  
  apt should be doing this automatically.
  
  I'm on stable now (which doesn't have the issue) after having too many issues with unstable, but they really need to fix it before it goes stable. The apt package itself should contain the keys, or they should be available from a verifiable source.
66. Re:Once is ok, but twice is too much... by Tony+Hoyle · 2006-07-12 23:33 · Score: 1
  
  It'd be really cool.. until el presidente ordered a missile strike against your country for 'harbouring terrorists' (wouldn't be worth trying in the US since you'd be bundled into a van and dumped in cage in gitmo before you'd even realized the hack had worked...)
67. Re:Once is ok, but twice is too much... by slugstone · 2006-07-12 23:47 · Score: 1
  
  Yes, windows updates are signed. But how can you tell that the signed are not cracked? I will trust RedHat or Suse before Mircosoft.
68. Re:Once is ok, but twice is too much... by zuluechopapa · 2006-07-12 23:54 · Score: 1
  
  ... this is silly. I'm perfectly safe. Murder is illegal in this state.
  /obligatory simpsons quote.
  :)
  
  --
  even the magic 8 ball has an opinion on email clients: Outlook not so good.
69. Re:Once is ok, but twice is too much... by EddyPearson · 2006-07-12 23:56 · Score: 1
  
  People in the "enterprise" do not use "experimental" packages if they have even the remotest idea of what they're doing, becuase they'll get "hacked". Its bloody stupid to suggest otherwise. There are plenty of 0day(ish) exploits floating around for the Unstable Debian sources as they stand (Though not nearly as many as fedora).
  
  --
  You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
70. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 00:02 · Score: 1, Informative
  
  The previous attack was one that can be applied against any platform: somebody used their password over an unencrypted channel (presumably a non-Debian channel, since all the project ones should be encrypted), and somebody else sniffed it and used it to gain access. You can't really do anything about that.
  The mistake debian made was they allowed plain-text passwords. In this day and age thats pretty silly. They should have disabled all authentication methods but the RSA or DSA key exchanges of ssh. Even if some junior developer had a losing password (or one they resused / revealed) the attacker couldn't get in without also getting a copy of that developer's private key file. Guessing the standard 1k RSA key be brute force would take 10^308 tries. That should put it out of the range of simple guessing.
71. Re:Once is ok, but twice is too much... by Zigg · 2006-07-13 00:41 · Score: 1
  
  You can stop trying to spread your FUD now. Try something like, oh I don't know, WHOIS?
  
  NSATC.NET (which you still didn't get right) belongs to Digital Island. An Akamai competitor. Perfectly reasonable for Microsoft to be running a very high-traffic site there, no?
72. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 00:42 · Score: 1, Insightful
  
  >but with a compromised dev machine, one could patch in back door code that gets signed as valid.
  
  Assuming that the only copy of the source was on that one machine. It's pretty easy to tell if two copies of the source are different and I reckon it would be pretty easy to tell which one was suspect, probably the one on the box that was hacked. Now this might be totally different if the development took place in a closed environment but in this case I can't see how it could possibly be a problem.
73. Re:Once is ok, but twice is too much... by hackstraw · 2006-07-13 00:53 · Score: 1
  
  Oh and BTW, Windows updates are signed, so even if someone managed to crack into it the packages would not install.
  
  In 2000 or so, someone convinced Versign to give them a Microsoft certificate. Is it that guy who broke into the machine and signed the updates?
74. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 01:46 · Score: 0
  
  thankyou martin luther king
75. Re:Once is ok, but twice is too much... by LWATCDR · 2006-07-13 01:53 · Score: 1, Insightful
  
  Ummm... How was it hacked? I thought Debian was an ultra stable distro that placed security and stablity over cutting edge?
  Yes this does worry me a good deal.
  
  --
  See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
76. Re:Once is ok, but twice is too much... by top_iguana · 2006-07-13 02:01 · Score: 1
  
  Geeks...UNITE!
77. Re:Once is ok, but twice is too much... by orbitalia · 2006-07-13 02:05 · Score: 1
  
  Yeah I know its part of a backbone operation, but some more evidence.
  
  http://www.wired.com/news/technology/0,70619-0.htm l
  
  almost all backbone providers already cooperate with the NSA - just as recently it was revealed all telephone traffic is being monitored..
  
  Not sure it's FUD really.. Savvis communications are one of the worst offenders for sharing ALL their data directly with the government, they even advertise how good they are at filtering traffic in realtime.
78. Re:Once is ok, but twice is too much... by muellerr1 · 2006-07-13 02:14 · Score: 1, Troll
  
  From your post I deduce that you didn't go to college, and can't afford any certifications. And you might be twelve. And English is your second language. God, where to start? How about your awesome web site, www.moderngeek.com? I really like your use of 'Index of /' in the design--very avant-garde.
  
  So if corporate America wants to trust a black box, let 'em. There's no convincing them anyway. I think differently. I think that if the debian team proves to be efficient and shows some sort of internal public retribution, that corporations will trust an honest mistake over coverups, exploits and scandals that Microsoft have proven itself.
  You'd be easier to understand if you weren't translating from English to Russian and back again before posting. What are you trying to say here? Even if I pretend to understand the gist of it, you appear to be contradicting yourself.
  
  It is time that we go to corporations and prove to them that university degrees do not prove intelligence in our field, and that a certification is not worth anything more than the paper it is worth.
  
  I don't think your post is worth the paper it's worth. It certainly isn't your brilliant writing that will prove your intelligence. Just suck it up and get a degree, you might learn how to write a coherent thought.
  
  Lets push the University system down and bring the Open Source system to the top. We are seen as the smartest and best of the best.
  Look, open source developers aren't considered the 'best of the best' (did you watch Top Gun a lot?) just dedicated. Just because you spend your free time coding doesn't automatically make you a more competent programmer. Sure there are many good ones, but there are many more mediocre ones. Also, I think your university vs. open source paradigm is funny. It reminds me of Time Cube.
  
  Lets train and educate our gamer friends, leet friends, geeksquad friends(mmm), and other lower tech people that will in turn teach the masses, and then corporations that open source contribution and involvement is an effective way to measure ones credibility.
  Holy shit, 'train and educate...lower tech people that will in turn teach the masses'? Didn't you just finish saying that 'open source developers are almost over the arrogance that once plagued the idea of open source'?
  
  I believe that if we band together, we can educate and push open source forward.
  If only everyone on Slashdot (who I'm sure thinks just like me) would vote in elections we could elect our own Open Source Presidential Savior who will spread my Open Source ideals throughout the entire world! Rise up, my open source compatriots! Let's show Corporate America(TM) how it's done! I envision a future where everyone is paid according to their worth, and hunger and poverty will be eliminated through the power of Open Source! Hallelujah!
  
  Fucking moron. You and the two mods who thought you were interesting.
  
  --
  steampunk web design
79. Re:Once is ok, but twice is too much... by garoo1980 · 2006-07-13 02:15 · Score: 1
  
  Well its pretty subjective but I've never seen Microsoft's site be down before. I've seen bad links once in a while but I've never ever heard "Oh Microsoft's site is down today"
80. Re:Once is ok, but twice is too much... by ttrafford · 2006-07-13 02:26 · Score: 1
  
  The keys are in the 'debian-archive-keyring' package.
81. Re:Once is ok, but twice is too much... by fatphil · 2006-07-13 02:33 · Score: 1
  
  Signing is irrelevant if the hackers can simply reproduce MS's process of signing.
  If they have hypothetically ownz0red MS's machines, there's no way of knowing if that signing process hasn't also been hijacked.
  
  FatPhil
  
  --
  Also FatPhil on SoylentNews, id 863
82. Re:Once is ok, but twice is too much... by thePowerOfGrayskull · 2006-07-13 02:43 · Score: 1
  
  Oh and BTW, Windows updates are signed, so even if someone managed to crack into it the packages would not install.
  Of course, if someone hacked the win update server they could possibly have gotten beyond it -- which means signatures could have been updated using Microsoft's own key.
  Now, I'll wait for someone to point out that the update server is probably firewalled from the network. Then I can one-up them, too! But first I'll ruin the obligatory Mario Bros "1up" reference by mentioning it here! And then... well, I trust that my plan becomes clear at this point.
83. Re:Once is ok, but twice is too much... by GmAz · 2006-07-13 02:46 · Score: 1, Insightful
  
  Oh look, a linux fanboy defends linux by saying that it was bold that the admins told us they were hacked. Now its ok because we know. A Windows server gets hacked and its laughter and pointing of fingers with more laughing to continue. I have a feeling this is just one of the first linux hacking jobs. Hackers have realized that Windows is hackable and they are moving their attention to linux.
  
  --
  Click Click Bloody Click PANCAKES!
84. Re:Once is ok, but twice is too much... by WoodstockJeff · 2006-07-13 02:46 · Score: 1
  
  Wow, it's amazing how many security updates are listed on that link that would appear to apply to my computers! Windows update keeps telling me I only need the latest installer and Windows Genuine Advantage tool... Since security updates aren't supposed to require installation of the WGA spyware app, and Windows Update says that's the only thing available, that should mean I'm up-to-date, security-wise, right? Why won't it show me all these updates? (hmm... I wonder why the sarcasm tag doesn't work here...)
85. Re:Once is ok, but twice is too much... by ghostbar38 · 2006-07-13 02:55 · Score: 1
  
  Hey, the packages need to be signed for been in a official repository, if you don't use one of those then you maybe in troubles... Don't be so amarillism ;)
  
  --
  ghostbar page.
86. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 02:57 · Score: 0
  
  That would of course be assuming that anyone was dumb enough to use Debian as an enterprise OS.
87. Re:Once is ok, but twice is too much... by dfn_deux · 2006-07-13 03:48 · Score: 1
  
  From the headline " gluck is a core development machine."
  
  --
  -*The above statement is printed entirely on recycled electrons*-
88. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 04:03 · Score: 0
  
  You mean you don't read every line of code of open source software that you install to validate it? I thought every Linux user was a master software QA tech who could validate millions of lines of code in the blink of an eye.
89. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 05:01 · Score: 0
  
  Microsoft's update servers dont need to be compromised. MS has done all the work for them anyway
90. Re:Once is ok, but twice is too much... by Barbwired · 2006-07-13 05:32 · Score: 1
  
  Don't believe all you read on the internet ;)
  
  It is mainly a web server, but yes, it carries cvs repositories. But no, I, as a Debian Developer myself, would not call gluck a *core* developement machine.
  
  Read the anouncement by James Troup. He describes the services affected by the downtime.
  
  --
  Geeks aren't made, we are born like that by default
91. Re:Once is ok, but twice is too much... by Dave2+Wickham · 2006-07-13 06:32 · Score: 1
  
  Just to follow on from what others have said, the Debian signing key changes yearly, which is probably why you had a number of unknown signature warnings.
92. Re:Once is ok, but twice is too much... by scwizard · 2006-07-13 06:34 · Score: 1
  
  The secondary attack was a local kernel exploit that was first discovered when it was used to attack the debian.org hosts.
  Woah. That must mean that the hackers must have spent a really long time trying to get at Debian. Why would they be so committed to this type of thing?
  
  --
  ~= scwizard =~
93. Re:Once is ok, but twice is too much... by Ruvim · 2006-07-13 07:21 · Score: 1
  
  That's unless someone hacked into the certificate servers...
94. Re:Once is ok, but twice is too much... by HiThere · 2006-07-13 08:01 · Score: 1
  
  That's the way it's *supposed* to work, and I'm willing to grant that it may well work that way on stable. I'm running testing.
  
  (OTOH, I was shocked whin an install of debian-keyring didn't tell me "you already have the newest version installed". Something strange here... but AFTER installing it, and running update again:
  Reading package lists... Done
  W: GPG error: http://security.debian.org/ etch/updates Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 010908312D230C5F
  W: GPG error: ftp://mirrors.kernel.org etch Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 010908312D230C5F
  W: You may want to run apt-get update to correct these problems
  
  Just like before [though *I think* there were two unknown keys before I did the install].)
  
  FWIW, I do have some non-debian repositories in my sources...but previously it has complained about packages not-being signed with a known key that I have KNOWN were from the Debian repository. Now it isn't saying what package it's referring to, so I can't tell if this is still true. (I'm also quite certain that I've installed debian-keyring before, though I'm only "rather certain" that it's been since I last did a clean install.) I'd been presuming that this was a common problem with Etch...
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
95. Re:Once is ok, but twice is too much... by Dave2+Wickham · 2006-07-13 08:51 · Score: 1
  
  I'm running testing too, and the page I linked to does say that they messed up the 2005->2006 key change in various ways, which they hope to have addressed for next year. debian-archive-keyring is a new package, introduced after the 2005->2006 changeover, and the wording on the page seems to suggest that it will play more of a role at the 2006->2007 changeover.
  
  Personally, I'm not going to install the keys package (I don't want to get the keys from the same location as I'm getting the files...), so I'm not sure how it actually should work, but to add a key to the apt keyring manually, you can run the following:
  $ gpg --keyserver pgpkeys.mit.edu --recv-key [key ID] $ gpg -a --export [key ID] | sudo apt-key add -
  where [key ID] is an ID such as 2D230C5F (the current Debian key ID).
96. Re:Once is ok, but twice is too much... by tehlinux · 2006-07-13 11:04 · Score: 1
  
  Well shut my mouth! It's also illegal to put squirrels down your pants for the puposes of gambling.
  
  --
  Most linux users don't know this, but the man pages were named after Chuck Norris. Chuck Norris fsck'ing hates noobs!
97. Re:Once is ok, but twice is too much... by Anonymous Coward · 2006-07-13 12:26 · Score: 0
  
  You can't commit code at Microsoft without other eyes seeing it during the code review process. If you wanted to inject some malicious code you'd need to compromise the source control system itself without breaking anyone's symbol files or source code syncs, or else obfuscate the malicious code really, really well (and no, disguising it as an accidental buffer overflow is not going to get past the code review).
98. Re:Once is ok, but twice is too much... by asuffield · 2006-07-13 15:29 · Score: 1
  
  It's far more likely that they found a new exploit and thought "now who shall I try this on today?"
99. Re:Once is ok, but twice is too much... by uNople · 2006-07-13 15:59 · Score: 1
  
  Aaah, I look foward to the time when Slashdot has a +5, Sarcastic modding option. Seriously though, how many people manually audit the code they install on their system?
100. Re:Once is ok, but twice is too much... by HiThere · 2006-07-13 18:21 · Score: 1
  
  Thanks. The archive-keyring did the job.
  
  I more or less agree with you about the key coming from the same server as the files...but this is a development system rather than a production system, so I don't mind an occasional re-install. (Mind it or not, it's GOING to happen!)
  
  OTOH, if it WERE a production server, how SHOULD keys be distributed?
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
101. Re:Once is ok, but twice is too much... by wouterke · 2006-07-15 07:15 · Score: 1
  
  Except that gluck.debian.org, while it is a developer machine, does not touch any file that could eventually end up at ftp.debian.org.
  
  Now move along, nothing to see here...
Good thing... by eeg3 · 2006-07-12 14:59 · Score: 0, Flamebait

...everyone has moved to GNU/Ubuntu.
1. Re:Good thing... by Simon+Simian · 2006-07-12 15:20 · Score: 1, Funny
  
  Have they? Fuck! I always miss these mass exoduses. I'm still running Gentoo and Slackware.
2. Re:Good thing... by Anonymous Coward · 2006-07-12 15:48 · Score: 0
  
  I'm sorry.
3. Re:Good thing... by GoRK · 2006-07-12 15:58 · Score: 4, Insightful
  
  Well I suppose you probably know this but for the others out there who may miss the subtlety ---
  
  Ubuntu draws sources heavily from the unstable and/or testing branches of Debian in order to devote more time and energy to testing and the important fixed-length release cycle. They also are partially reliant on the Debian project for security updates. There would be little to no forward movement of Ubuntu currently without the Debian project. Indeed this may change as time goes on, but to me there are a lot of benefits to this model and I hope they stick with it. Previously most every debian-derived distribution has perished by trying to shed their ties and reliance on the core Debian project.
4. Re:Good thing... by Anonymous Coward · 2006-07-12 17:00 · Score: 0
  
  You know the story about people shitting upstream fucking it up for the people in the downstream. Maybe ignorance is bliss, though.
Try an alternative by Anonymous Coward · 2006-07-12 14:59 · Score: 0, Insightful

http://www.openbsd.org/
1. Re:Try an alternative by Anonymous Coward · 2006-07-12 16:46 · Score: 0, Troll
  
  Just make sure you pay your "tribute" to Theo or he will withhold security fixes. Remember, kids, OpenBSD is only "free" if you value the time you don't have to listen to developers bitch and whine.
2. Re:Try an alternative by Anonymous Coward · 2006-07-13 01:23 · Score: 0
  
  ...you don't have to listen to developers bitch and whine.
  
  Yes, because there is never any whining among the debian-devel crowd...
Does that mean... by Anonymous Coward · 2006-07-12 15:00 · Score: 0

it's unglücklich?
No fear... by gravyface · 2006-07-12 15:00 · Score: 5, Funny

It's Debian... they found an old DAT tape from three years ago, restored it, and realised that nothing's changed in the source tree. *ducks*

--
body massage!
1. Re:No fear... by the_humeister · 2006-07-12 15:40 · Score: 5, Funny
  
  And after recovering the DAT tape from the safe-deposit box at the bank, they went to the ATM machine and entered their PIN numbers to get some money.
2. Re:No fear... by uhoreg · 2006-07-12 17:06 · Score: 0
  
  ...they found an old DAT tape from three years ago...
  Well, considering that DAT stands for Digital Audio Tape, I find that a bit unlikely...
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
3. Re:No fear... by chill · 2006-07-12 17:22 · Score: 3, Informative
  
  Well, considering that DAT stands for Digital Audio Tape, I find that a bit unlikely...
  
  How old are you? Gotta be under 25, easy.
  
  4mm helical scan DAT tapes were very, very popular for enterprise data backup. Do a quick google on "dat tape backup" and enlighten yourself.
  
  -Charles
  
  --
  Learning HOW to think is more important than learning WHAT to think.
4. Re:No fear... by arose · 2006-07-12 17:27 · Score: 1
  
  I'm can't wait to read your explaination of the difference between digital audio and binary data.
  
  --
  Analogies don't equal equalities, they are merely somewhat analogous.
5. Re:No fear... by Anonymous Coward · 2006-07-12 18:20 · Score: 0
  
  we've all heard that before, STFU up
6. Re:No fear... by EonBlueTooL · 2006-07-12 21:47 · Score: 1
  
  "And after recovering the DAT tape from the safe-deposit box at the bank, they went to the ATM machine and entered their PIN numbers to get some money." That went straight over my head.
7. Re:No fear... by clickclickdrone · 2006-07-12 22:49 · Score: 1
  
  >they found an old DAT tape from three years ago, restored it No DAT tape from 3 years ago restores. I call bluff!
  
  --
  I want a list of atrocities done in your name - Recoil
8. Re:No fear... by clickclickdrone · 2006-07-12 23:44 · Score: 1
  
  I'll just try that again with a break..
  >they found an old DAT tape from three years ago, restored it
  
  No DAT tape from 3 years ago restores. I call bluff!
  
  --
  I want a list of atrocities done in your name - Recoil
9. Re:No fear... by M1FCJ · 2006-07-13 00:31 · Score: 1
  
  They still are - I still do all of our backups to a 4mm DDS3. With DDS4 and 5, the capacity is still usable with the mantra "only backup what you can't replace"... At home I have DDS2 and DDS3 - DDS2 for backing up small stuff (mainly code) and DDS3 for pictures.
  Although slow, a DDS3 still takes 12GB uncompressed and beats burning a new DVD every night (only 4.3GB).
10. Re:No fear... by WilliamSChips · 2006-07-13 01:42 · Score: 1
  
  Yes, but Debian isn't based on NT Technology.
  
  --
  Please, for the good of Humanity, vote Obama.
11. Re:No fear... by uhoreg · 2006-07-13 02:24 · Score: 1
  
  How old are you? Gotta be under 25, easy.
  Nope. I'm just a lot more familiar with the audio recording world than backups. Thank you for enlightening me.
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
12. Re:No fear... by identity0 · 2006-07-13 05:30 · Score: 2, Funny
  
  See, if they'd kept the source code on an Microsoft MS Windows machine with NT Technology and NTFS Filesystem, they would have been completely safe. Heck, they could have even placed it on a IBM Machine on a Wireless Wi-Fi hotspot at a Starbucks, with all the code on a USB Bus memory stick, and no one would have been able to touch it!
  
  I know people around here swear by the GPL Licenced Linux Unix or the BSD Distribution, but we must admit we have been defeated. I, for one, welcome our Debian-cracking overlords.
13. Re:No fear... by Aneurysm · 2006-07-13 07:02 · Score: 2, Funny
  
  The poster was referring to redundant acronyms. DAT stands for Digital Audio Tape, so saying that they backed up from a DAT tape is really saying Digital Audio Tape Tape. The poster also lists common redundant acronyms that people use, Personal Identification Number Number and Automated Teller Machine Machine. PIN is the worst, I often hear people talking about their Personal PIN Numbers.
You have my sympathies by Anonymous Coward · 2006-07-12 15:02 · Score: 3, Funny

Aw man, that's too bad. I think we should all wish the Debian team g'luck.
1. Re:You have my sympathies by alewar · 2006-07-12 22:34 · Score: 1
  
  actually, in german gluck = luck/happines
2. Re:You have my sympathies by Anonymous Coward · 2006-07-12 23:40 · Score: 0
  
  No, that would be Glück or Glueck if you can't type umlauts.
Again? by Mc_Anthony · 2006-07-12 15:04 · Score: 0

Hasn't this happened a few times already? Or am I thinking of a different distro?
1. Re:Again? by stevey · 2006-07-12 17:33 · Score: 2, Insightful
  
  It happened once in 2003, but I can't recall any other incidents. That time it was a previously unkown Linux kernel hole which was used to gain root along with a sniffed password.
  
  This time it looks like another kernel hole - but we've not had public confirmation. Could have been been an exploit for CVE-2006-2451...
2. Re:Again? by one_red_eye · 2006-07-12 18:46 · Score: 1
  
  Maybe they're still using ssh-1.2.30 http://www.securityfocus.com/news/4831
Perhaps now. by DAldredge · 2006-07-12 15:04 · Score: 2, Insightful

Perhaps now they will spend less time griping about Ubuntu and more time working on their security.
1. Re:Perhaps now. by thomasweber · 2006-07-12 18:41 · Score: 1
  
  They did. As Ubuntu already had the splendid idea of saving the root[1] password in plain text on the hard disk, they just needed to come up with something different.
  
  [1] root as in 'the first user' who can use sudo.
2. Re:Perhaps now. by BluenoseJake · 2006-07-13 01:46 · Score: 1
  
  Doesn't take large balls to be an ass when you're anonymous, eh?
3. Re:Perhaps now. by DAldredge · 2006-07-13 06:59 · Score: 1
  
  I have my own fan club - he/they follow me around. The sad part is they are too stupid to put any creativity into their insults.
4. Re:Perhaps now. by Anonymous Coward · 2006-07-13 08:00 · Score: 0
  
  I'll give you that DJewhater, this new guy isn't very funny. Hopefully the rest of the gang will be back from vacation soon.
Question by Frogbert · 2006-07-12 15:10 · Score: 4, Interesting

I realise that debian stable release has packages that are very old in order to stay stable. Does this mean that they lack patches later versions of programs use? Or are patches typically backported to the stable release packages?
1. Re:Question by Anonymous Coward · 2006-07-12 15:18 · Score: 0
  
  Security patches are backported to stable and on some occasions, functionality backports occur, although this is rare. I think something happened with Sarge, samba and Windows XP 64-bit compatibility in the last point release but I could be (very) wrong.
  
  I do remember that woody (the one before sarge) had a version of Gaim by the end that couldn't connect to MSN at all.
2. Re:Question by Nutria · 2006-07-12 15:21 · Score: 5, Informative
  
  I realise that debian stable release has packages that are very old in order to stay stable. Does this mean that they lack patches later versions of programs use? Or are patches typically backported to the stable release packages?
  
  http://www.debian.org/security/
  
  Security (not feature) patches are backported if possible, and if the patches are too extensive, an upgraded version goes into Stable.
  
  --
  "I don't know, therefore Aliens" Wafflebox1
3. Re:Question by macemoneta · 2006-07-12 15:54 · Score: 4, Insightful
  
  I use Fedora Core, and know that there are (at least) a couple of features active in the distribution to address zero-day exploits; ExecShield and SELinux (or other mandatory access control system).
  
  I have not used Debian; are these security facilities part of the distribution? If not, perhaps they should be given an expedited path.
  
  --
  Can You Say Linux? I Knew That You Could.
4. Re:Question by merreborn · 2006-07-12 17:18 · Score: 0, Offtopic
  
  The current debian stable version of mysql 4.1 is a year and about 6 releases behind, having received only security patches. That means it's still got all the functionality bugs.
  
  It can be a real bitch.
5. Re:Question by Anonymous Coward · 2006-07-12 19:23 · Score: 0
  
  Debian has SELinux, it's just not enabled by default.
  
  http://wiki.debian.org/SELinux
6. Re:Question by wouterke · 2006-07-15 07:27 · Score: 1
  
  SELinux is being worked on (there is some support in Sarge, but it is not complete). ExecShield is not AFAIK.
This has been said before... by ModernGeek · 2006-07-12 15:14 · Score: 2, Insightful

...but with your high UID, I'm going to assume you don't know this already. The attitude that you posses is what used to plague the old open source world to the point that no utility or tool would be used in the enterprise. After a while, the open source maturity matured and everyone came to the realization that these things need to be taken care of, and that even though the open source software is free, you need to treat the users of that software as if they are paying customers. There is reward. Donations and other things can up your credibility to the point of a serious career. Soon enough, a history in the world of open source will guarantee one a job in the enterprise, because university diplomas don't seem to be working when it comes to judging ones capabilities. Change your perspective.

--
Sig: I stole this sig.
1. Re:This has been said before... by tomstdenis · 2006-07-12 16:02 · Score: 1
  
  Hehehe, that's cute. Now if only MSFT would treat its customers as paying customers....
  
  Besides I think it's well established that Debian is woefully behind the curve. Use Gentoo. Be done with :-)
  
  Tom
  
  --
  Someday, I'll have a real sig.
2. Re:This has been said before... by kashani · 2006-07-12 16:14 · Score: 4, Funny
  
  Ahem.
  
  As a Gentoo user over the age of 30 I'd like to apologize for the under 20 Gentoo user's previous post. I'll slap him around on IRC later. ;-)
  
  kashani
  
  --
  - Why is the ninja... so deadly?
3. Re:This has been said before... by flacco · 2006-07-12 16:19 · Score: 1
  
  As a Gentoo user over the age of 30 I'd like to apologize for the under 20 Gentoo user's previous post. I'll slap him around on IRC later. ;-)
  
  ahh, good. i was just starting to stand up.
  
  --
  pr0n - keeping monitor glass spotless since 1981.
4. Re:This has been said before... by tomstdenis · 2006-07-12 16:24 · Score: 1
  
  I'm over 20 years old, have used both Debian and Knoppix and hate both. I moved to Gentoo solely because of USE flags [well that and I like the idea of building my own source].
  
  The problem with Debian is that they really have to participate more on the bleeding edge. Think about it. As an OSS developer you have some distro call you "unstable" and makes a default policy to ignore you. How likely are you to keep working on your tool that nobody wants to use? Sure sometimes you get stuck with a broken tool but more often than not reverting is trivial and the "unstable tools" usually work just as well [if not better].
  
  Imagine if Windows disallowed "beta" software. There would be a lot of tools out there that would probably not exist [including a score of video games] due to lack of interest.
  
  Tom
  
  --
  Someday, I'll have a real sig.
5. Re:This has been said before... by ComputerizedYoga · 2006-07-12 17:15 · Score: 4, Informative
  
  I've got a lot of other problems with debian which prevent me from using it. However, their security track record is not really one of them. Given the huge project with a very large number of machines and developers, and their long track record with very few incidents, I don't think it's fair to pick too much on this one.
  
  That, and Gentoo is hardly immune to this sort of thing either.
6. Re:This has been said before... by Anonymous Coward · 2006-07-12 17:48 · Score: 0
  
  Unstable \Un*sta"ble\, a. [Cf. {Instable}.]
  Not stable; not firm, fixed, or constant; subject to change
  
  Idiot.
7. Re:This has been said before... by killjoe · 2006-07-12 17:50 · Score: 1
  
  Yes but users don't pay. They just bitch. that's the problem with open source. Not enough people want to help but everybody wants to leech.
  
  --
  evil is as evil does
8. Re:This has been said before... by Apro+im · 2006-07-12 19:19 · Score: 4, Informative
  
  That's why, as a l337 hax0r, you can run a mixed system. Nobody stops you from installing unstable packages, right from apt, even! (Check out that -t flag!) Or even better, you can actually build your own source.
  
  The argument for Gentoo that "I like the idea of building my own source" in the sense of "I like getting down and dirty into my system" is really kind of bull. I ran Gentoo for a while, and I thought they had done some amazing work. Portage/emerge is just amazingly well done, and it's nice to have code that's been optimized for my hardware requirements. It's not exactly scalable (maintaining a large set of diverse hardware is a lot harder), and it can lead to untenable situations and instability, but it's still damn cool. And you know what's really cool about it? It's the convenience of apt, for source packages! Please disabuse yourself of the notion that you are "building your own source" -- the Gentoo maintainers are very diligently, very cleverly packaging the source so that you can specify a set of system parameters and then let it build. If you really want to get nitty gritty, run Slackware (although, I guess they have package management now, too). Gentoo has lots of merits, but the truth is, most Gentoo users know no more or less about how things work than an average Liinux user.
  
  For me, in the end, the speedup I was getting just wasn't making up for the hours it would take each time I ran a system-wide upgrade and the unexpected conflicts because the USE flags that made each package special for MY computer were screwing up MY computer something fierce.
9. Re:This has been said before... by Spliffster · 2006-07-12 19:31 · Score: 3, Insightful
  
  i second that and would add: any commercial os vendor would just never tell you wenn this happens (except the stolen source code is beeing published on the net, heh).
10. Re:This has been said before... by Anonymous Coward · 2006-07-12 19:58 · Score: 0
  
  The attitude that you posses is what used to plague the old open source world... After a while, the open source maturity matured...
  
  Disclaimer: "Open Source 2.0" is a registered trademark of Tim O'Reilly.
11. Re:This has been said before... by Anonymous Coward · 2006-07-12 21:19 · Score: 0
  
  From your link:
  
  "This box is not an official Gentoo infrastructure box and is instead donated by a sponsor."
  
  so no, the same hasn't happened to gentoo, not that it couldn't. The debian box was a dev machine. This one was an rsync machine.
12. Re:This has been said before... by Anonymous Coward · 2006-07-12 22:51 · Score: 0
  
  It isn't even assured that the box ran gentoo. I've seen rsync*.gentoo.org servers running FreeBSD, even by that time.
13. Re:This has been said before... by Anonymous Coward · 2006-07-12 23:47 · Score: 0
  
  It's like a giant pyramid. In the future, the open source developers at the top are all going to be rich, so long as we keep expanding the base with more and more developers. While anyone can create their own pyramid and potentially rise to the top, when we eventually run out of developers, or when they are all from India or something, that's when we have to start worrying (because at that point, the only way someone can rise higher in a pyramid is if someone else is sinking lower). You know, these kinds of schemes are illegal when they involve money...but if the trade is open-source-code and career-karma, it's still legal. Same carnage when a project goes bust (fails to attract new suckers at the bottom destroying the "time" investments of everyone who has not yet reached the top), but totally legal.
14. Re:This has been said before... by vadim_t · 2006-07-13 00:47 · Score: 2, Interesting
  
  Gentoo, IMO, is nice for many reasons that have nothing to do with speed:
  
  First, USE flags allow precise control of what you want to be installed. If a package supports gnome, and I don't want gnome stuff, I just add "-gnome" in the USE flags. Debian would either force me to install Gnome libraries, or have to provide several versions.
  
  Second, compiling from source means I can get a benefit from things like stack protection in GCC instead of having to wait for Debian to rebuild every package, which may never happen.
  
  Third, since Gentoo builds everything from source, if you want to build something yourself, especially things like KDE, you already have all the tools in place. In comparison, in Debian it requires hunting for -dev packages and running ./configure 20 times until it works. There's apt-run, but it's not perfect, and tends to install completely unnecessary compatibility packages and such.
  
  Also, you can often get versions not in the official repository by simply bumping the ebuild's version number manually.
15. Re:This has been said before... by plague3106 · 2006-07-13 00:48 · Score: 0, Troll
  
  Very nice fanboy, turning a Debian server compromise into a Mircosoft bash.
16. Re:This has been said before... by Anonymous Coward · 2006-07-13 01:04 · Score: 0
  
  This is what I observe. An acquaintence of mine wrote a series of IRC bots in PHP for a radio station. She recently discovered a memory leak in "PHP 5.1.4's nested SimpleXMLObject array handling." What did she do? Did she dutifully go to bugs.php.net and report it? Did she fix it in the source (since she's more than able) and submit a patch? Nope! She just bitched and moaned about how Open Source is shite.
  
  I told her that she's free to stop using PHP. There are hosts out there that support .NET and will happily run on proprietary systems. But nope, she insists on using Open Source software and bitching at it. I find this terribly amusing.
17. Re:This has been said before... by jrock-jr · 2006-07-13 01:25 · Score: 1
  
  I'm truly curious how the distro's manage security on their servers. Does the project dedicate someone to look after security on their machines or is this something that is neglected? By that i mean do admin/developers just get caught up in 'developing' that they forget security? No doubt being a devel server, i can understand somewhat but can anyone explain the process a little better?
18. Re:This has been said before... by zootm · 2006-07-13 01:42 · Score: 1
  
  As an OSS developer you have some distro call you "unstable" and makes a default policy to ignore you.
  
  If the distro's main aim was stability, as a developer I'd have to consider them extremely unwise to do otherwise. Debian doesn't "participate on the bleeding edge" because their goals are stability over "bleeding edge" features. The fact that Gentoo works the other way around doesn't mean in any way that Debian's attitude is "worse", it's just different.
  
  The fact that there is more than one distribution in the world allows us to have distributions with different perspectives on important features. You treat it as if it's a matter of right and wrong as opposed to a matter of differing priorities.
19. Re:This has been said before... by swillden · 2006-07-13 02:09 · Score: 1
  
  In comparison, in Debian it requires hunting for -dev packages and running ./configure 20 times until it works.
  No, it doesn't. The way to get all the build dependencies of a package is to run:
  apt-get build-dep <pkgname>
  
  Building a package from source and installing it therefore requires three commands:
  sudo apt-get build-dep <pkgname> apt-get source -b <pkgname> sudo dpkg -i <newpackage>
  
  If that's too difficult, you can install apt-src and then do it with a single command:
  apt-src -bi install <pkgname>
  
  That will download and upack the source package (recording the location in a database), download and install any needed build-time or run-time dependencies, compile the source and install the resulting .deb file.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
20. Re:This has been said before... by vadim_t · 2006-07-13 02:35 · Score: 1
  
  I'm talking about compiling from the original source. As in getting a tar.gz, ./configure ; make install
  
  Gentoo does much better at this because this is effectively what Gentoo does when you emerge anything.
  
  Why would I do that? Well, like I said, if I really want the latest KDE version, I can go to the KDE website, and download their nice build system, which will download the source, build it, and install it into $HOME. I did this in Gentoo, and it works wonderfully well.
21. Re:This has been said before... by Anonymous Coward · 2006-07-13 03:20 · Score: 0
  
  My reason for running gentoo is that once the system is installed, you can download and make/make install virtually any tarball under the sun and it will work.
  (Yes there are Linux programs that are source code only and not in portage or debian or binary repositories or anywhere else)
  The reason they will work is that because it's built from source code gentoo needs every damm lib dev lib and all the rest installed to work at all
  . This is a good thing!
  On other distros I'd be chasing obscure dev libs for ages. For using more obscure software Gentoo is the chorizo in my mariana.
22. Re:This has been said before... by WhiteDragon · 2006-07-13 04:24 · Score: 1
  
  When using apt-src or apt-get source, do you get the same version that is available as a binary, or are newer versions generally available?
  
  --
  Did you mount a military-grade, variable-focus MASER on an unlicensed artificial intelligence?
23. Re:This has been said before... by swillden · 2006-07-13 04:34 · Score: 1
  
  I'm talking about compiling from the original source. As in getting a tar.gz, ./configure ; make install
  Using the existing Gentoo ebuild, I assume? You can get the same effect by taking the 'debian' directory from the deb source dir and copying it into the unpacked original source. It doesn't always work, of course, if there's enough difference between the packaged version and the tarball you downloaded. Usually it does, and it seems like this issue would have to be the same as with ebuilds.
  Odds are, the build dependencies you need for the new version are the same as those required for the packaged version as well.
  Why would I do that? Well, like I said, if I really want the latest KDE version, I can go to the KDE website, and download their nice build system, which will download the source, build it, and install it into $HOME. I did this in Gentoo, and it works wonderfully well.
  Not using the ebuilds? There's nothing stopping you from doing that in any distro, including Debian. You do have to have all of the build dependencies, which I guess is less painful in Gentoo, but only because Gentoo doesn't separate -dev packages (which does have advantages as well, which is why Debian *does* separate -dev packages).
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
24. Re:This has been said before... by swillden · 2006-07-13 04:36 · Score: 1
  
  You get the same version as the binary, though you do have the option of patching it, changing flags, etc. If you want a newer version, you can usually graft the 'debian' directory from the debian source tree into the downloaded source tree and use dpkg-buildpackage to compile it and generate a deb.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
25. Re:This has been said before... by 0xB00F · 2006-07-13 05:56 · Score: 1
  
  Very few people point this out, but the best thing about using apt-src is that after you are done building from source, you can remove the -dev packages from your system and leave only the runtime dependencies.
  
  Compare this with Gentoo which also pull in and build all the packages required to build a package from source. But after it's done building, your system is littered with header files and libtool link libraries that will never be used until you build the package from source again. This is one of my major gripes with Gentoo and is one of the reasons why I stopped using it. It got to the point where about 40% of my /usr filesystem was used by header files and compile time libtool libraries. You might argue that one could simply get a bigger hard disk. But using 40% of that disk for things that you need only once in a while is ridiculous.
26. Re:This has been said before... by vadim_t · 2006-07-13 06:36 · Score: 1
  
  Not using the ebuilds? There's nothing stopping you from doing that in any distro, including Debian.
  
  Yup, not using ebuilds, because sometimes there's stuff I'd like to use nobody got around packaging yet. Generally, I first build manually, then if it's useful enough, make an ebuild (since it's trivial for simple cases) and submit.
  
  Of course I can do that in Debian as well, all I'm saying is that in Gentoo it's a lot more convenient because everything is there already.
  
  You do have to have all of the build dependencies, which I guess is less painful in Gentoo, but only because Gentoo doesn't separate -dev packages (which does have advantages as well, which is why Debian *does* separate -dev packages).
  
  This is exactly what I'm saying. Since Gentoo already builds everything from source, and the process involves going through all the steps you'd have to do yourself when compiling manually, all the required stuff to do it is already in place.
  
  Gentoo 99% of the time works like this:
  wget ftp://mirrors.kernel.org/gnu/screen/screen-3.9.11. tar.gz tar -xzvf screen-3.9.11.tar.gz cd screen-3.9.11 ./configure && make install
  For Debian it very often is:
  ./configure apt-get install zlib-dev ./configure apt-get install openssl-dev ./configure apt-get install ncurses-dev ...
27. Re:This has been said before... by makomk · 2006-07-13 08:37 · Score: 1
  
  In that case, it was one of the Gentoo rsync servers that was compromised - there's quite a large number of them, they're nearly all run by third parties, and they're a huge security problem in that if you compromise one you can use it to compromise any system which syncs from it. It's fortunate that this was caught quickly...
  
  There's been various discussions about ways of digitally signing the Portage tree so that this isn't a problem in future, but they've all run into implementation issues and given up, AFAIK.
28. Re:This has been said before... by swillden · 2006-07-13 09:46 · Score: 1
  
  Since Gentoo already builds everything from source, and the process involves going through all the steps you'd have to do yourself when compiling manually, all the required stuff to do it is already in place.
  Some would say "all the stuff is cluttering up your disk whether you need it or not". There are advantages and disadvantages, otherwise the Debian developers wouldn't go to so much effort to separate out the -dev packages. Although I haven't done it, I believe if you run your ./configure under apt-file, it will automatically download and install all of the needed packages by noticing when the configuration process tries to read a header file that isn't present. If apt-file can also automatically mark those -dev packages it installs as "installed to satisfy dependency", then the next run of aptitude should automatically removed them. That might be the best of all worlds -- no -dev stuff cluttering the system, but builds will still have what they need.
  I might have to fiddle with that and see if I can get it to work that way.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
29. Re:This has been said before... by vadim_t · 2006-07-13 11:15 · Score: 1
  
  Yeah, I know about that one. Two things about it:
  
  It's slow, as it seems to trace the execution of the program, and it installs lots of unnecessary stuff. Due to the braindeadness of autoconf you can't just get a list of stuff it NEEDS, which results basically in 3 options:
  
  1. Repeatedly run ./configure, and install whatever it wants each time it does
  2. Use apt-run to trace it, and install tons of unnecessary junk like obscure compatibility libraries
  3. Do the above, and guess when it's safe to say no. If you get it wrong, start again, which is annoying when it runs noticeably slower under apt-run.
  
  And sure, I'm not saying the Debian way is bad or anything. All I'm saying is that the Gentoo way is convenient. When I suddenly have the need to try to compile some obscure program in portage, I can 99% of the time build it at once. With Debian, I'd probably have said "Ah, screw it" and not bothered to start with.
Were they 'living on the edge'? by Peter+Cooper · 2006-07-12 15:15 · Score: 1

The "unstable" distribution is where active development of Debian occurs. Generally, this distribution is run by developers and those who like to live on the edge.

That's what you get for running UNSTABLE :)
1. Re:Were they 'living on the edge'? by uhoreg · 2006-07-12 16:04 · Score: 1
  
  That's what you get for running UNSTABLE :)
  According to db.debian.org, gluck is running sarge.
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
Things are chaning... by ModernGeek · 2006-07-12 15:19 · Score: 5, Funny

...they aren't as grim as you may think. Soon enough, universities will be obsolete, and corporations will judge one based on open source contributions. If we all move aggressively toward this stance, the MCSEs will hit the road, and open source pioneers will rule the world of research, development, and jobs all funded by large corporations. All the source will be open, and the developers will work for companies like Verizon and the government as researchers. The same way that students pay universities to do the same thing for them, the difference is that the companies will pay you and you won't be paying a university. A large company that does not employ open source developers will be seen as bad in morale the same way a company is seen as bad for outsourcing manufacturing jobs to Mexico. If we take open source and ourselves seriously, all of this can happen. The old attitude of "don't use it if you don't like it" is going away, and things will be set straight if we push things forward.

--
Sig: I stole this sig.
1. Re:Things are chaning... by murdocj · 2006-07-12 15:33 · Score: 0
  
  I so wish I had mod points to mod this "funny"
2. Re:Things are chaning... by jt2377 · 2006-07-12 15:57 · Score: 1
  
  Jesus F'christ! this ghey post got modded interesting and not funny? Talk about Opensource FUD! look there are some good and bad of both closed source and open source. you should use the best of both world and not spreading this bullshit Opensource FUD with nothing to back it up!
3. Re:Things are chaning... by finity · 2006-07-12 16:09 · Score: 0, Redundant
  
  Too much cyberpunk for you...
4. Re:Things are chaning... by HotBlackDessiato · 2006-07-12 16:09 · Score: 0, Redundant
  
  Fess up, who modded this funny?
  
  --
  "If you don't have eyes you shouldn't have wings" -- Carl Pilkington
5. Re:Things are chaning... by dzym · 2006-07-12 17:14 · Score: 1
  
  Was going to be me, but then I posted in this thread.
6. Re:Things are chaning... by Anonymous Coward · 2006-07-12 22:38 · Score: 0
  
  You would have preferred 'absolutely ridiculous'?
7. Re:Things are chaning... by discord5 · 2006-07-12 23:55 · Score: 1
  
  [quote]open source pioneers will rule the world of research, development, and jobs all funded by large corporations.[/quote] Nice troll, and you even got away with it
8. Re:Things are chaning... by Tim+C · 2006-07-13 04:32 · Score: 1
  
  Soon enough, universities will be obsolete, and corporations will judge one based on open source contributions.
  
  That's all very well for developers, not so good for engineers, architects, doctors, chemists...
  
  --
  It's official. Most of you are morons.
Maybe Debian devs will finally come around by b3x · 2006-07-12 15:30 · Score: 5, Funny

and move that source repository to a more secure Windows 2003 Server platform.
1. Re:Maybe Debian devs will finally come around by iNezy13 · 2006-07-13 02:36 · Score: 1
  
  Ha-Ha-Ha yeah.......right. Are you serious? A Windowze Server is just as good at security as...the Microsoft website. By the way, ever run a whois search on them? You come up with results like:
  
  MICROSOFT.COM.ZZZ.IS.PWNED.AND.HAX0RED.BY.SUB7.NET
  and: MICROSOFT.COM.SHOULD.GIVE.UP.BECAUSE.LINUXISGOD.CO M
  
  So in short, don't use Windowze servers...use some type of *NIX. Trust me, it's a world of difference.
  
  --
  
  "C'est la vie. Get your own."
2. Re:Maybe Debian devs will finally come around by CETS · 2006-07-13 02:56 · Score: 1
  
  Are you trying to imply Microsoft's website has security issues because other people have registered domains with microsoft.com in them? This has nothing to do with Microsoft. In your example it sub7.net that has registered this name and not a case where someone hacked. Go register your domain, abcxyz.com and the create microsoft.descriptorhere.abcxyz.com
3. Re:Maybe Debian devs will finally come around by marcosdumay · 2006-07-13 09:54 · Score: 1
  
  "and move that source repository to a more secure Windows 2003 Server platform."
  
  No way! They are probably waitting for Vista, to launch a new stable at a more secure server...
  
  --
  Rethinking email
obligatory: by Anonymous Coward · 2006-07-12 15:32 · Score: 5, Funny

I felt a great disturbance in the Force, as if millions of nerds suddenly cried out in terror and were suddenly silenced.
1. Re:obligatory: by Anonymous Coward · 2006-07-12 18:01 · Score: 0
  
  You misspelled "hundreds."
Changelogs by Doc+Ruby · 2006-07-12 15:41 · Score: 1

That's one reason why I like Ubuntu's Update Manager: it shows the changelog for each package it's offering to upgrade. And one reason why the recent lack of changelogs is troubling.

Of course an attacker could fake changelogs, though it's an extra step. It might be nice to include signed authentication of at least the changelog, if not the package itself, to ensure authenticity of upgrades. Debian's apt (and its descendants, like Ubuntu) seem perfectly suited for automating such authentication without adding any user complexity.

--
--
make install -not war
1. Re:Changelogs by uhoreg · 2006-07-12 16:00 · Score: 4, Informative
  
  Changelogs don't provide any form of security, and package changelogs have been standard in Debian since many, many years ago. (Long before Ubuntu was a gleam in Mark Shuttleworth's eye.) Changelogs should only be treated as a convenience to the user.
  
  And apt supports GPG signing of the Release file, which contains an MD5 and SHA-1 hash of the Packages file, which contains MD5 hashes of the packages. (In other words, apt already does package integrity checking.)
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
2. Re:Changelogs by SnowZero · 2006-07-12 16:01 · Score: 3, Informative
  
  It might be nice to include signed authentication of at least the changelog, if not the package itself, to ensure authenticity of upgrades.
  
  Debian has been checking digital signatures on every package installed for almost a year now. See here.
  
  Of course, I run testing, so I have no idea when this got into stable.
3. Re:Changelogs by Doc+Ruby · 2006-07-12 16:18 · Score: 1
  
  There is no explicit security in the changelogs. As I pointed out, faking changelogs is just an inconvenience to an attacker, but it is more than "nothing".
  
  The lack of changelogs I mentioned was occasional, in the Ubuntu Update Manager.
  
  And including the signing in the Update Manager GUI would add security to the process.
  
  If you were less smug about the apt features you might be more interested in the lack of their implementation in Ubuntu, where they would do some good. Even if Ubuntu isn't operating on more hosts than Debian already, that relative popularity won't last.
  
  --
  --
  make install -not war
4. Re:Changelogs by Doc+Ruby · 2006-07-12 16:32 · Score: 1
  
  Does Ubuntu? Its GUIs like Update Manager allow extra features without extra user complexity, as I mentioned. But I don't see signing features - yet.
  
  --
  --
  make install -not war
5. Re:Changelogs by uhoreg · 2006-07-12 17:02 · Score: 2, Informative
  
  As I pointed out, faking changelogs is just an inconvenience to an attacker, but it is more than "nothing".
  It may be slightly better than nothing, but it isn't that much better that it's worth mentioning. Any attacker who knows enough to build a fake .deb package will know enough to put something in the changelog, and it may add maybe a minute to the attack.
  If you were less smug about the apt features you might be more interested in the lack of their implementation in Ubuntu
  Ubuntu uses apt for updates. apt will not upgrade a package if the signature/hash doesn't verify properly, and it currently complains if the signature doesn't exist, and asks the user to confirm. I highly doubt that checking the signature is not done at all in Ubuntu Update Manager, because if that were the case, Ubuntu would have to specifically tell apt to ignore the security features.
  Note that the security features will only be noticeable when a check fails. If all the checks pass, then you'll never notice the features at all (unless you notice that it downloads the Release.gpg files, if Ubuntu shows what files it downloads).
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
6. Re:Changelogs by MarkSyms · 2006-07-12 19:53 · Score: 1
  
  Yes it does and update manager will refuse to install packages that apt can't verify the signatures for.
7. Re:Changelogs by acaspis · 2006-07-12 21:19 · Score: 1
  
  And apt supports GPG signing of the Release file
  So lets hope the private key wasn't on the hacked server, or that the intruder didn't bother backdooring GPG for passphrases.
  AC
8. Re:Changelogs by cortana · 2006-07-12 22:05 · Score: 1
  
  It is not in the current stable release (Debian 3.1 AKA sarge). However, users of sarge can download a backport of apt 0.6 from http://backports.org/.
What was exploited..? by paulmer2003 · 2006-07-12 15:43 · Score: 3, Interesting

Does anyone know what in particular was exploited? TFA dosent give a flying fuck of information.
1. Re:What was exploited..? by Anonymous Coward · 2006-07-12 16:05 · Score: 2, Informative
  
  Does anyone know what in particular was exploited?
  
  Not public information yet. If you're subscribed to debian-devel-announce, you'll be the first to know.
2. Re:What was exploited..? by keeboo · 2006-07-12 16:07 · Score: 2, Informative
  
  The announcement says:
  
  We're still investigating exactly what happened and the extent of the damage.
  We'll post more info as soon as we reasonably can.
  
  If the ones affected can't say, who can then.
  (yeah, yeah... "the ones who attacked the server").
3. Re:What was exploited..? by arivanov · 2006-07-12 18:02 · Score: 1
  
  Can be many things.
  
  This is a machine to which nearly all debian developers have some form of access.
  
  --
  Baker's Law: Misery no longer loves company. Nowadays it insists on it
  http://www.sigsegv.cx/
4. Re:What was exploited..? by cortana · 2006-07-14 12:38 · Score: 1
  
  http://www.us.debian.org/News/2006/20060713
Why? by ATAMAH · 2006-07-12 15:55 · Score: 1

Why is it "cooler" to compromise a server than it is to find and report a vulnerability?
And, if one is so set on doing some damage - why go after a free service??
1. Re:Why? by Anonymous Coward · 2006-07-12 16:03 · Score: 0
  
  Oh nothing. What's that over there?
  *sound of a chair sliding across the ground*
  *thump as chair hits /.-er's head*
  phone call: "Don't worry, Bill. We got this one. Our secret is safe."
  "OK. How about you take a long weekend, Steve? You've certainly earned it."
2. Re:Why? by Anonymous Coward · 2006-07-12 16:04 · Score: 0
  
  Yeah why would anyone want to attempt to compromise software that is used by thousands (hundreds of thousands?) of people. I definately see no real benefit there. /sarcasm
3. Re:Why? by Anonymous Coward · 2006-07-12 17:29 · Score: 0
  
  You are talking about the USA, right?
4. Re:Why? by Anonymous Coward · 2006-07-12 18:07 · Score: 0
  
  Editor&Publisher: Ever since the case of the raping and killing of an Iraqi and the alleged murder of three of her family members by U.S. troops went public, the age of the rape victim had been in dispute, ranging from about
  15 to 25. Two days ago, Reuters and others news agencies produced proof that she was 14, based on a passport and identity card. Most news organizations then started calling her a girl -- but some persist in referring to her as a "woman."
  http://www.editorandpublisher.com/eandp/news/artic le_display.jsp?vnu_content_id=1002803062
5. Re:Why? by Anonymous Coward · 2006-07-12 18:17 · Score: 0
  
  Henry: "Give it a few more days and fox news will be calling her a slut."
Oh lord... by Ayanami+Rei · 2006-07-12 15:56 · Score: 1

Please someone moderate up this funny +1. Bonus points if you use a computer with NT Technology.

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
1. Re:Oh lord... by Anonymous Coward · 2006-07-12 16:18 · Score: 0
  
  ITYM "a computer with new NT technology".
2. Re:Oh lord... by ArcherB · 2006-07-12 16:25 · Score: 1
  
  What's really sad is that I didn't get it until I read your NT Technology bit.
  
  --
  There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
3. Re:Oh lord... by Guy+Harris · 2006-07-12 20:31 · Score: 1
  
  Bonus points if you use a computer with NT Technology.
  
  ...with a DSL line for its Internet connection.
4. Re:Oh lord... by paul248 · 2006-07-12 20:41 · Score: 1
  
  And an LCD display.
5. Re:Oh lord... by Anonymous Coward · 2006-07-13 00:39 · Score: 0
  
  Ack, someone call the AAAAA!
Dear Hackers by SnowZero · 2006-07-12 16:16 · Score: 3, Interesting

Dear Hackers,

If you manage to hack into the main repository, please fix this bug. A well-tested patch has been available for almost 6 months, and it is even attached to the bug report. The bug has been fixed in Ubuntu, but Debian users are still waiting, more than a year after the bug was first filed.

If you hack, do it for the right reasons.
1. Re:Dear Hackers by Anonymous Coward · 2006-07-12 18:30 · Score: 0
  
  Oh, I completely agree. I've had to run a patched/compiled pam for more than a year now (in unstable no less!) for this exact reason! So friggin annoying.
  
  I guess the *better* approach, though, is to proactively encourage the developer/maintainer to resolve this...
  
  Is there a known reason why this *hasn't* been resolved yet?
2. Re:Dear Hackers by cerberusss · 2006-07-12 19:33 · Score: 1
  
  Why is this scored interesting? With every goddamn story about Firefox, Debian, Windows, RedHat or something, some sod comes crawling out of the woodwork to complain about his/her pet bug. Frankly, it's getting tiresome. Maybe you don't understand, but NOT EVERYONE CARES ABOUT YOUR PROBLEM.
  
  --
  8 of 13 people found this answer helpful. Did you?
3. Re:Dear Hackers by cortana · 2006-07-12 21:59 · Score: 1
  
  "this module is rejected upstream" seems like a pretty good reason to reject the patch to me.
4. Re:Dear Hackers by crawling_chaos · 2006-07-13 01:38 · Score: 1
  
  From the bug report:
  we do not care, as this should be done through pam with the merged efforts for 2.6.12
  Understood. Now please understand that many of us "do not care" about Debian anymore having been subject to such asshattery by maintainers and zealots. How would you like to take such a response to your boss on an issue after fighting tooth and nail to have Debian placed on your production servers? It could be what we call a Career Limiting Event. Certainly MS declines to fix bugs, but they at least are polite about their announcements.
  While this attitude remains in the community it is really hard to take Debian as anything more than a hobbyist's toy. If that's what you want, that's fine, but do not sing to me its praises as an enterprise alternative. I'll stick with a distro that has a professional organization behind it instead.
  
  --
  You can only drink 30 or 40 glasses of beer a day, no matter how rich you are.
  -- Colonel Adolphus Busch
5. Re:Dear Hackers by cerberusss · 2006-07-13 01:57 · Score: 1
  
  My point was actually that the grantparent post was way off-topic with him waffling about his bug. Of course I agree this looks unprofessional. However, if you've logged a bug with Redhat, you'll know that often the "fix" was "reported upstream, closing". How professional this organization.
  
  --
  8 of 13 people found this answer helpful. Did you?
6. Re:Dear Hackers by swillden · 2006-07-13 02:33 · Score: 1
  
  How would you like to take such a response to your boss on an issue after fighting tooth and nail to have Debian placed on your production servers?
  Why would you care about this patch on your production servers? Its purpose is to make audio and video playback smoother for non-root users.
  I realize you're using it as an example, but it's a bad one. The maintainer doesn't care precisely because (a) it's not an important feature for very many (I don't have it, and media playback is smooth for non-root users even on my slowest machine -- a 400MHz K6), (b) capable users can fix it themselves and (c) the fix will be coming from upstream soon enough.
  Important issues rarely languish like this, and if you really need something fixed sooner, you can always buy support from one of the many available support vendors. Then you'll have a professional organization standing behind it -- but it won't be free. And neither are the other options that give you that support.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
7. Re:Dear Hackers by Anonymous Coward · 2006-07-13 03:01 · Score: 0
  
  Boo fucking hoo. If you go around installing the realtime module on production servers maybe you need to get fired, huh?
8. Re:Dear Hackers by Anonymous Coward · 2006-07-13 04:07 · Score: 0
  
  From the bug report:
  
  we do not care, as this should be done through pam with the merged efforts for 2.6.12
  
  Context, context. "this" was the original request to configure the default kernel in an insecure way. It was pointed out that when 2.6.12 was released, it would be capable of doing the same thing, but without the insecurity.
  
  Now, there is a question to be had about how 2.6.12 has come and gone and this has not been fixed, but if my boss had come up to me and told me to do something terribly insecure, I'd tell him it can't be done and that I don't care about whether or not his baseball game stream played smoothly or not, and if he didn't accept this, I'd resign before he had the chance to fire me.
9. Re:Dear Hackers by SnowZero · 2006-07-13 22:19 · Score: 1
  
  Realtime LSM != real time rlimits
  
  In other words, the only alternative to this patch was rejected by upstream. They did so in favor of the rlimits approach, which Ubuntu and Fedora both support, but Debian is still dragging behind for unknown reasons. Read the rest of the bug and this becomes clear.
10. Re:Dear Hackers by cortana · 2006-07-14 12:47 · Score: 1
  
  It really doesn't become clear. I have to say though, if you want a bug to be fixed, trolling Slashdot is not the way to get it done.
  
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 13588;msg=67
  
  [15:49] <vorlon> marga: as I've commented elsewhere, my mental schedule of
  not working on pam this week now has a mental note added to it indicating
  that I'm doing so with spite
11. Re:Dear Hackers by SnowZero · 2006-07-14 15:53 · Score: 1
  
  The original post was meant as a joke. I really would not expect hackers to go in and fix bugs. I have no idea why the post was modded the way it was, as though this were some sort of serious suggestion.
  
  I'm not planning on abandoning Debian, which I've used almost exclusively since 1998. However I do think there are problems in the system, and I feel there is no reason not to make fun of them. It's very much like a political cartoon or joke, which often address serious issues but do so in a lighthearted way. Anyway, the problem as I see it is that maintainers hang on far too long when they can no longer maintain a package. Part of this has to do with how hard it would be to come back later if they had time again. For very many Debian bugs, it's not as though it's been a week or something, we're talking about issues that are often over a year old (2.6.12 was out 12 months ago). Maintainers need to be able to step aside more easily, or share duties when they fall behind. That is not well supported in the current system and climate.
  
  Another issue, although one that has been mitigated somewhat is the multiple-architectures problem. Debian added architectures with little or no practical use, yet every one adds significant overhead for a package maintainer (how many people use Debian's on an s390?) At least now those architectures can be released separately from the mainstream ones, so they won't hold up a release, and there is some better support for compile farm testing. It really showed a lack of forsight IMHO that this was not addressed before the arches were added.
  
  I really want to see Debian thrive. However, if people cannot even admit that there is a problem, then there is no way we'll ever get to a solution.
12. Re:Dear Hackers by cortana · 2006-07-14 23:24 · Score: 1
  
  If it was a joke, then fine. However realise that the web is a very lossy medium when considering how accurately intended sarcasm/humour can be interpreted by those reading a post. :)
  
  Your beef with the Debian development is not incorrect, and you are not the only one who feels this way. However a more appropriate venue to discuss this problem in general would be debian-devel@lists.debian.org.
  
  Also, I'm not sure what relevance of the age of the kernel bug is, since the kernel upstream rejected the LSM patches; you really want to track http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3 13588.
  
  While having Debian's PAM package lagging so far behind upstream is annoying, PAM is also a package that is of critical importance to the operation and security of a machine running Debian. It is the kind of package that is probably better off being maintained by a fairly conservative maintianer.
  
  I can't really comment on the multiple-arch problem. As far as I'm concerned it does not exist; my packages get autobuilt automatically and so supporting the twelve architecture imposes no burden on me. Maintaners of buggier packages may have to debug and fix problems that manifest themselves on other archs, but this process results in software that runs on more systems and is less buggy, so it seems to me that the only ones who complain about it are lazy maintaners who don't really care about doing a good enough job. If they choose to part ways with the project, I will not complain.
At risk of stating the obvious... by MostAwesomeDude · 2006-07-12 16:17 · Score: 2, Informative

...Anybody who didn't understand the real meaning of "compromise" needs to re-read the article, substituting "compromised" with "rooted." The attackers didn't kill the server or knock out a service. They rooted the box, and the Debian devs are trying to cover themselves somewhat by ambiguating the exact nature of the attack.

--
~ C.
1. Re:At risk of stating the obvious... by Anonymous Coward · 2006-07-12 16:39 · Score: 2, Insightful
  
  Yes, at risk of stating the obvious, you stated the obvious. It's unfair to claim that Debian developers are "trying to cover themselves somewhat" just because they didn't state the obvious.
2. Re:At risk of stating the obvious... by PitaBred · 2006-07-13 06:49 · Score: 1
  
  They're trying to "cover themselves" in the sense of not divulging information about the hack until the people who need to know about it first are informed, probably the kernel developers, any users whose passwords may have been compromised, etc. They don't know what has happened entirely, so they don't want to start saying things until they have actual information. I don't blame them. They'll come out with it when they have the whole thing straight. At least they're not just sweeping the whole thing under the rug and saying "Sorry for the temporary outage, we're having some technical issues!" or some other such bullshit.
  
  --
  My blog. Good stuff (when I remember to update it). Read it.
3. Re:At risk of stating the obvious... by glwtta · 2006-07-13 07:43 · Score: 1
  
  You have got to be freakin' kidding.
  
  a) Eerybody who read this understood what "compromised" means. The lengths you go to to assign malice to the Debian devs are a little silly.
  b) "ambiguate" is not a word.
  c) "compromise" can never mean the things you list.
  
  When we say that something's been compromised, we mean that it is known to have been exposed to malicious action, but we don't know what the extent of the damage is, so its integrity has been lost.
  
  --
  sic transit gloria mundi
4. Re:At risk of stating the obvious... by MostAwesomeDude · 2006-07-13 19:26 · Score: 1
  
  a)Don't assume so much. Not all Slashdot readers are that tech-savvy. Additionally, I'm typing this from a Debian laptop. I don't dislike Debian, but I was trying to add a bit of clarity to an ambiguous term. b)"Ambiguate" is the reverse of "disambiguate." It's what happens when somebody assigns multiple meanings to a single term. c) Unlike this post, my first post did not contain a list.
  
  --
  ~ C.
5. Re:At risk of stating the obvious... by glwtta · 2006-07-17 09:21 · Score: 1
  
  Don't assume so much. Not all Slashdot readers are that tech-savvy.
  
  This has nothing to do with technology, the word was used in its general sense.
  
  I was trying to add a bit of clarity to an ambiguous term.
  
  Whatever. I suppose that if you managed to find it confusing, I can't really argue that it's not. I guess I had more of a problem with you claiming that the devs did this on purpose, when in fact you just don't know what the word means.
  
  "Ambiguate" is the reverse of "disambiguate." It's what happens when somebody assigns multiple meanings to a single term.
  
  Ah yes, just like 'to able' means to fix something, 'ease' is a state of healthfulness, and 'cord' is agreement. I doubt you'll find a single dictionary that lists "ambiguate" and it's not part of common usage - therefore, not a word. Probably because it just sounds stupid.
  
  Unlike this post, my first post did not contain a list.
  
  Oh please, "kill the server or knock out a service" is a list of two actions that the attackers could have performed.
  
  --
  sic transit gloria mundi
services? by planckscale · 2006-07-12 16:19 · Score: 1

So is it reasonable to assume that the services that were running: (cvs, ddtp, lintian, people, popcon, planet, ports, release), and are no longer available on debian's machines are to blame for the compromise? Can I feel safe if these services aren't running on my box and only port 80 is exposed?

--
Namaste
1. Re:services? by Anonymous Coward · 2006-07-12 19:51 · Score: 0
  
  No, it would be reasonable to assume that cvs, ddtp, lintian, people, popcon, planet, ports, release are no longer running on gluck because it is being wiped. I expect data for these services to be manually checked against last known good backups once gluck has been reinstalled from scratch (that's what we did last time around).
  
  Above mentioned services were all that was offered by gluck (services as in *.debian.org for * in above list, _not_ IP services). I'm quite certain I never logged on to gluck in the past. Locking down all other machines is what hurts more ...
  
  Michael
Re:I refuse to belive this by CaptainTux · 2006-07-12 16:24 · Score: 4, Insightful

Your sarcasm is a bit silly. I don't believe the article even mentions that this was an OS leval attack. Most likely, and from the fact that they pulled all these services offline, the attack happened on a piece of software running on the OS and wasn't a problem with the OS itself. So the didn't hack Linux. They hacked a service. Probably.

--
Anthony Papillion
Advanced Data Concepts, Inc.
"Quality Custom Software and IT Services"
Funny, considering... by Anonymous Coward · 2006-07-12 16:26 · Score: 0

Security support for Debian 3.0 to be terminated. Coincidence? *duck*
Why all the flak? by Dryanta · 2006-07-12 16:30 · Score: 5, Insightful

Hey I'm sure that everyone working on Debian's dev servers have lower uids than most of us, and I find the flak to really be undeserved. It's Linux not OpenBSD; the focus of the operating system favors usability over security. If you don't like it, move to a bsd or commercial *nix platform. Also, any machine that maintains services will eventually obtain some sort of vulnerability even with heavy-handed administration and monitoring. I think the speed at which the compromise was detected in addition to the service being taken offline immediately is cause for thanks to the security team!
1. Re:Why all the flak? by HiThere · 2006-07-12 18:53 · Score: 2, Insightful
  
  Why all the flak?
  
  Because heros aren't allowed to have flaws. Read your Greek myths. If a hero is found to have a flaw, he will be destroyed. (P.S.: They are all found to be flawed.)
  
  --
  
  I think we've pushed this "anyone can grow up to be president" thing too far.
RSA auth to blame? by twistah · 2006-07-12 16:46 · Score: 0, Offtopic

They said:
"...we've locked down
most other debian.org machines, limiting access to DSA only, until
they can be fixed for what we suspect is the exploit used to
compromise gluck."

Are they saying they think the exploit is in the RSA functionality of SSH? If so, it might be prudent to turn it off for now, but this could be a knee-jerk reaction. (To turn it off, change RSAAuthentication to "no" in /etc/ssh/sshd_config and restart SSHD, though I don't know if it's worth it.)
1. Re:RSA auth to blame? by Anonymous Coward · 2006-07-12 16:53 · Score: 0
  
  DSA = Debian Security Admins
2. Re:RSA auth to blame? by uhoreg · 2006-07-12 16:59 · Score: 2, Informative
  
  DSA = Debian Security Admins
  Actually, it's Debian System Administrators. (Not to be confused with Debian Security Advisory.)
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
No by laptop006 · 2006-07-12 17:17 · Score: 2, Informative

DSA = Debian Systems Administration (team)

--
/* FUCK - The F-word is here so that you can grep for it */
well after all... by jackstack · 2006-07-12 17:26 · Score: 0, Offtopic

it is called 'open source'... bass drum - cymbal drum - *duck*
1. Re:well after all... by Anonymous Coward · 2006-07-12 23:17 · Score: 0
  
  That's the same thing the BIO-engineer said when he raped the girl.
Det som inte dödar, härdar by bunbuntheminilop · 2006-07-12 17:32 · Score: 2

Or, for everyone else
That which does not kill you, makes you stronger
--Friedrich Nietzsche
1. Re:Det som inte dödar, härdar by Anonymous Coward · 2006-07-13 07:06 · Score: 0
  
  Like cerebral aneurysms! Wait...
Involved people tend to have agendas. News at 11. by Anonymous Coward · 2006-07-12 17:59 · Score: 0

whoopee it's a conspiracy, a coverup, an alien plot, a tampered tinfoil and ufia, ok everybody let's panic
Oh craaap! by Schraegstrichpunkt · 2006-07-12 18:25 · Score: 1

Somebody just Vorbis-encoded all my backup tapes!

--
http://outcampaign.org/
GO HAXOR! by Schraegstrichpunkt · 2006-07-12 18:29 · Score: 1

Way to stick it to The Man!

Oh wait...

--
http://outcampaign.org/
Re:zazazaza by Anonymous Coward · 2006-07-12 18:57 · Score: 0

i have se with yuor mother and sister at teh saem time

Marco? Is that you?
--Zizou
Gluck is not the core machine by NoGoodNicks · 2006-07-12 19:05 · Score: 2, Insightful

Gluck is not a "core" machine, not even a special development system. It has been abandoned as CVS server by most subprojects since they moved to the Alioth service. The most important task was the homepage server.
"...with your high UID"... by beh · 2006-07-12 19:07 · Score: 2, Informative

Oh boy... Low UIDs hardly instill authority!

Take it from someone with a waaaaaaayyyyy lower UID as yours! ;-)

But to your original point - I'm not too sure you can rule out future break-ins at all. It would only be REALLY stupid, if both breakins happened through the same setup fault.

But I don't think debian has a full time security admin who constantly and ACTIVELY monitors every debian.org box, like other big name companies might be able to afford to.

Secondly, the sheer multitude of packages, and frequent updates/upgrades of packages will make it fairly impossible to keep a machine 100% break-in proof.

Of course, I don't like break-ins - especially on servers of a distribution I'm actively using; but I think it's wrong to panic about it either.

More importantly - while I see the need to reinstall quickly, has anyone there found out HOW the break-in occured? Has the hole been located? (...and is it known how to fix this particular one, before the same guy just uses the same "back door" again?)
1. Re:"...with your high UID"... by monsted · 2006-07-12 20:29 · Score: 1
  
  Oh boy... Low UIDs hardly instill authority!
  
  Of course it does - we're better than them.
2. Re:"...with your high UID"... by empaler · 2006-07-12 20:49 · Score: 1
  
  Oh boy... Low UIDs hardly instill authority!
  
  Of course it does - we're better than them.
  
  But... But... I know a guy who once had, like, a 3-digit UID, and he said that I totally didn't suck for having a 6-digit one...
3. Re:"...with your high UID"... by smash · 2006-07-12 20:49 · Score: 1
  
  Respect my authoritah!!!
  :D
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
4. Re:"...with your high UID"... by monsted · 2006-07-12 21:06 · Score: 2, Interesting
  
  He was lying!
  
  I wonder if i could sell a 4-digit /. UID on eBay just like they did with ICQ numbers years ago (where 5-digit IDs sold for small fortunes).
5. Re:"...with your high UID"... by morie · 2006-07-12 21:39 · Score: 1
  
  You could. when Karma was still measured in points someone sold a UID with 50 (maximum) karma on Ebay.
  
  Taco couldn't appreciate it though, the karma was set to countdown to 0 along with the ebay-timer
  
  You were around, or did you just buy that low uid on Ebay?
  
  --
  Sig (appended to the end of comments I post, 54 chars)
6. Re:"...with your high UID"... by monsted · 2006-07-12 22:46 · Score: 1
  
  I was around for this one. I had a 5-digit ICQ number too.
7. Re:"...with your high UID"... by windex · 2006-07-13 00:01 · Score: 1
  
  Most importantly, Debian is in a position to tell people when it happens and be up front.
  
  MultiMillionDollar Linux Co Inc, however, might decide that for the customer confidence issue.. nothing happened! Honest. :D
8. Re:"...with your high UID"... by bano · 2006-07-13 03:16 · Score: 1
  
  I win...
9. Re:"...with your high UID"... by smash · 2006-07-13 16:14 · Score: 1
  
  Heh, 3 digits, respect...
  I was here before UIDs, just didn't bother to get one for like a week.
  Wonder how many of the old crowd still frequent this place?
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I have a physical airgap by kliese · 2006-07-12 20:03 · Score: 2, Funny

Last time I checked, code was taken to be signed by sneakernet, so that there would be a physical airgap between the network and the signing system.

I have a physical airgap between my wireless router and laptop. Does that mean I'm safe?
1. Re:I have a physical airgap by YU+Nicks+NE+Way · 2006-07-13 01:22 · Score: 1
  
  I was very careful in my phrasing, and talked about a physical airgap between the network and the signing system. In the case of the wireless router and laptop, you're certainly protected if the laptop doesn't have a connection to an interface to the wirelss network.
Secure Debian? by kanzels · 2006-07-12 20:03 · Score: 1

I have many friends relying on Debian servers, now they're a little bit worried about security. I think Debian is more about stability, that doesn't always mean secure.

--
Pixel image editor - http://www.kanzelsberger.com
1. Re:Secure Debian? by danielmsantana · 2006-07-13 01:40 · Score: 0
  
  stability without security? How do you have stability in a vulnerable system? That doesn't make ANY SENSE AT ALL.
Yeah, but... by Nuffsaid · 2006-07-12 20:36 · Score: 0

...did the server run Windows?

--
Nuffsaid
________

Don't know about his cat, but Schroedinger is definitely dead.
WikiDebian? by femto · 2006-07-12 20:55 · Score: 4, Funny

Maybe we need WikiDebian? "The free operating system that anyone can edit."

I'm not joking. If it works for Wikipedia, why not Debian??
1. Re:WikiDebian? by Anonymous Coward · 2006-07-13 01:18 · Score: 0
  
  I tried installing a wikibased linux *penis*, and overall *lolololIMSOCOOL!!!!!!111one* I've been happy with *bush sucks* the performance. I get a *revert to remove graffitte**revert to readd factual text*revert to remove graffiti that got readded*it's not grafitti dammit*citation needed* few odd things happening. This post look ok? Last edited by 23.25.41.126
2. Re:WikiDebian? by alerante · 2006-07-13 02:57 · Score: 1
  
  Let's just hope nobody tries to update their machine during a vandal spree.
  
  "Package httpd has been renamed to httpd-ON-WHEELS! Update? [Y/n]"
3. Re:WikiDebian? by femto · 2006-07-13 13:35 · Score: 1
  Sure vandalism would have to be addressed, but I will make two points:
  
  Random vandalism is unlikely to make it through the build process.
  
  Crucial programs, such 'login' and 'gcc' would no doubt be *very* carefully monitored for vandalism and backdoors. As I read somewhere recently (can't remember where) the crucial thing is to provide the tools to make it very easy for contributors to monitor each other's contributions. Eg. providing watch lists and providing only relevant information in them. One would have to think very carefully about accepting anonymous edits. Maybe the wiki would maintain a 'web of trust' to rank contributions, though this could also lead to a false sense of security and vunerability to 'sleeper agents'?
Ha...Big Deal by William+Robinson · 2006-07-12 21:39 · Score: 1

My Windows 2003 server gets break-in every fortnight. You guys worry too much!!

--
hilarious
Declouding some FUD by cortana · 2006-07-12 21:50 · Score: 2, Informative

first [in 2003] we had the hack into the repository severs, and we didn't know whether or not we are running exploited code when we use apt-get to update our programs

http://www.debian.org/News/2003/20031121

The archive is not affected by this compromise!

The vulnerability they were hit by was a previously unknown vulnerability in the kernel.
Times Are changing, again by Neolith1982 · 2006-07-12 22:09 · Score: 1

The dicussion about linux vs windows security is quite old now...
See it this way:
Windows appears to be so much more insecure because so many peolple are using it, and so it becomes an interresting target for small, little hobby hackers. But now suddenly (as read on /.) linux gets more known among "normal" computer users; nearly as well known (or even more) then MacOS. So we, the linux community, get into the situation, that more peole are trying to hack linux PCs. Therefor more exploits are showing up. (More people are looking after them with the aim to use them). I remember the euphoric comments on the "linux beats MacOS" thread, a time ago. (find it by yourself, I don't have the time in the moment) What we are expierience here, is the othe side of this phenomenon, and so, when we want to get linux more used by "normal" users, we have to pay the price, that hackers are more frequently try to break in our systems.
So what...

--
How shall I know what I think before I read what I wrote?
1. Re:Times Are changing, again by Anonymous Coward · 2006-07-13 01:24 · Score: 0
  
  A part of the problem is most people equate open source with more secure and closed source with bug riddled. How many people who have installed Linux on their computers have looked over every single line of code? Quite frankly its immpossible, bet you most people have never looked at any part or maybe only a small part of it, how do you know that this little chunk of code here won't interact with this chunk of code there and provide an exploit? Lot of the time these exploits show up in something nobody ever even thought of (like the recent windows one involving images) How do you know that some dev didn't implement a backdoor somewhere? Again people are going on trust in total strangers... kinda like trusting total strangers in Redmond eh?
2. Re:Times Are changing, again by Anonymous Coward · 2006-07-13 01:59 · Score: 0
  
  The dicussion about linux vs windows security is quite old now.
  
  Actually, the dicussion about Linux vs Windows security is quite stupid. It is like discussing the merits of two last place football teams.
  
  Anyone who exposes a Linux or Windows box directly to the Internet is a moron.
3. Re:Times Are changing, again by b0s0z0ku · 2006-07-13 02:56 · Score: 1
  
  What we are expierience here, is the othe side of this phenomenon, and so, when we want to get linux more used by "normal" users, we have to pay the price, that hackers are more frequently try to break in our systems.
  The *other* flipside is that, until a few years ago, few in the media knew or cared about open-source Unixoid OSes. So hack attempts, holes, and exploits got less publicity. Plus the Unices are generally used by more knowledgeable people who could more easily spot a rooted system than the average ("Task Manager, wassat?") Windows user. So many exploits probably got nipped in the bud without ever getting reported - what self-respecting 1337 g33k would *admit* getting pwn3d?
  -b.
Re:I refuse to belive this by cortana · 2006-07-12 22:24 · Score: 1

Ah, but the Debian operating system includes the applications and services, not just the base system. :)
Re:I refuse to belive this by Anonymous Coward · 2006-07-12 23:32 · Score: 0

the attack happened on a piece of software running on the OS and wasn't a problem with the OS itself. So the didn't hack Linux. They hacked a service. Probably.

Heh, you're funny.

If IE allows access to the wrong places by incorrect handling of and such geeks scream "Windows" got hacked *again*. Not IE.

If Outlook allows systementry, not "Outlook" has been hacked, but "Windows".

If crashing a certain program allows execution of malicious code, not the program got crashed, but "windows" got hacked.

If IIS gets penetrated, you hacked "windows", not "IIS".

But when it's on a *nix system all of the sudden; "oh.. but..; bit it has nothing to do with the OS. It's just that part of the distro! We are INVINCIBLE! And absolutely so perfect and secure that it can't be us, it must be some other cause! Yes, it's something else!".

It's important to be self-critical at the right times.
Who did it? by miffo.swe · 2006-07-12 23:39 · Score: 1

Have anyone of you heard of who does theese kinds of breakins? Establishing where they come from is a big step towards preventing them.

--
HTTP/1.1 400
1. Re:Who did it? by Anonymous Coward · 2006-07-13 02:10 · Score: 0
  
  Apparently the attack was signed by one daniel@solle.se.
  
  Not that they would spoof their identity or anything...
2. Re:Who did it? by b0s0z0ku · 2006-07-13 02:59 · Score: 1
  
  Have anyone of you heard of who does theese kinds of breakins? Establishing where they come from is a big step towards preventing them.
  Not really. The system should be secure against malicious connections originating anywhere. Security through isolation is a really poor answer that'll likely block legit users along with the hackers...
  -b.
3. Re:Who did it? by glwtta · 2006-07-13 07:23 · Score: 1
  
  The system should be secure against malicious connections originating anywhere.
  
  I believe the OP was making more of a "Know your enemy" kind of point, rather than "Block that IP range at the firewall so it never happens again". That would be pretty retarded.
  
  --
  sic transit gloria mundi
4. Re:Who did it? by miffo.swe · 2006-07-13 11:41 · Score: 1
  
  You understood me right, what i was out for was if the attacks are from users within or from the outside. That is, is it someone with a developer account that has been very sloppy with his password or is it a breakin because of bad software etc.
  
  --
  HTTP/1.1 400
So are .debs by Anonymous Coward · 2006-07-12 23:42 · Score: 0

They're signed too. So what's the point?
ROCK Linux by Anonymous Coward · 2006-07-13 00:23 · Score: 0

if you want to get more down and dirty than both slack and gentoo, use rocklinux.org`s
build boot strap system, svn checkout the source and compile the bugger :)
The mods actually got one right... by Anonymous Coward · 2006-07-13 01:45 · Score: 0

...by modding the parent "redundant."

Linux boxes getting owned is very redundant.
Re:This has been said before...Gentoo Rocks by Ash+Vince · 2006-07-13 02:00 · Score: 1

Thought I would throw in my two cents as a user of gentoo since 1.4 (I think this might be 4 or 5 years).

Firstly, if you use gentoo for any period of time, you should be compiling your own kernel. The knowledge of how to do this quickly and easily is something most linux users dont need to ever aquire (I didnt in the 2 or 3 years I ran Redhat, Mandrake, Caldera and Slackware).

In reply to what you were saying about unexpected conflicts due to USE flags, I have to say that things seems to have improved greatly. Or more likely is that with 4 years experience I now understand how they work properly. I know that when I encountered similar issues, at least some of them were cause by human error (mine).

But in comparison to how many time I used to trash my Redhat installation by knackering the rpm database with dependancies compilied from source (hance not in the rpm database) or when it simply died (database became unreadable and corrupt) there is no competition, Gentoo wins hands down.

But the real advantage of Gentoo is keeping your whole system right on the bleeding edge but still working. The packages that make it into the portage repository and get marked as stable are usually far more up to date than any other distribution. And Gentoo makes it very easy to update an existing system to that bleeding edge, even via the command line (emerge -u world).

Now I am sure all of this is possible with other distributions, but it isnt as straightforward, or as well documented (Gentoo seems to have the best docs of any distribution I have ever seen).

The only critisism I have of gentoo at the moment is the stupid graphical installer they have just started using for new systems. But I am sure this will improve in future, the current release is the first one to use it.

--
I dont read /. to RTFA, I read /. to offend people in ignorance.
They are reinstalling by ghostbar38 · 2006-07-13 02:24 · Score: 1

So there's no chance that malicious code were inserted ;), plus, there's no chance to use the exploit anymore cause the lock everything ;)

--
ghostbar page.
All releases are signed. by gnuman99 · 2006-07-13 02:51 · Score: 2, Informative

apt-get archives are now signed too. In Etch (testing) and Sid (unstable) apt will check the integrity of the packages for you, but the entire archive is signed. Just look at woody or sarge,

http://http.us.debian.org/debian/dists/woody/
http://http.us.debian.org/debian/dists/sarge/

Then locate the file Release.gpg. That is the signature for the release file.
Re:I refuse to belive this by Phillup · 2006-07-13 03:12 · Score: 1

The difference is, most of the Windows programs you just mentioned have some kernel level components... or are considered part of the OS by the vendor.

And under penalty of perjury... they have claimed so in a court of law.

They CAN NOT BE REMOVED according to the vendor.

Not so with the linux code...

So... the "working definition" of Operating System being used is: If it can not be removed, it is the OS.

HTH

--

--Phillip

Can you say BIRTH TAX
Re:You have looked at ... by Anonymous Coward · 2006-07-13 03:39 · Score: 0

http://bugs.debian.org/apt

haven't you ?
Village Idiot says: by krewemaynard · 2006-07-13 04:17 · Score: 1

Thank goodness *I* use Ubuntu! *whew*

--
I saw it on Slashdot, it must be true!
The good thing is that we can... by gwolf · 2006-07-13 04:25 · Score: 1

...Having a good checkout from a couple of days ago:
mv cvs_repo old_cvs_repo export CVSROOT=:ext:user@cvs.debian.org:/cvsroot/cvs_repo cvs co cvs_repo #and take care to checkout the same revisions... not too hard diff -ru cvs_repo old_cvs_repo|grep -v CVS
Re:This has been said before...Linux From Scratch by shoor · 2006-07-13 04:37 · Score: 1

I've tried Gentoo a bit myself, and I am a long time slackware user (the first distro I tried, and I keep
coming back to it). But, for getting down and dirty, I recommend Linux From Scratch and
Beyond Linux From Scratch.

--
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
There's other OSs you know. by Anonymous Coward · 2006-07-13 05:20 · Score: 0

Debian can't be taken seriously for security. That doesn't mean you should pretend its ok just because windows is worse. There are operating systems out there that give a flying fuck about security. Try openbsd or a reasonable linux distro like openwall.
grsecurity, PaX, execshield, etc... by Anonymous Coward · 2006-07-13 05:37 · Score: 0

Why aren't these techniques in use on a Linux distribution's Internet servers? Granted, they're not a magic bullet, but you can do a pretty damn good job of stopping attackers right in their tracks.
That which doesn't kill you... by Dareth · 2006-07-13 06:45 · Score: 1

... is just delaying the inevitable
and may well make you wish you were dead!

--

I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
1. Re:That which doesn't kill you... by bunbuntheminilop · 2006-07-13 09:56 · Score: 1
  
  LOL! :)
Re:So what !? I don't use debian so it can be Owne by Mind+Booster+Noori · 2006-07-13 07:04 · Score: 1

Man, no Debian packages where compromised, so no Debian users where compromised, so the only guys affected where those maintainingn and using gluck. Troll.

--
Mind Booster Noori
It was a local root exploit by Urban+Garlic · 2006-07-13 08:11 · Score: 2, Informative

For anyone still following this story all these hours later, there's a new post on debian-news with a bit more detail about what happened here.

The short version is, it was a privilege-escalation exploit triggered from a compromised user account, the server in question is now restored, but several others are locked down pending inspection. Also, it says the regular and security archives were not in danger. The exploit was a known issue in the 2.6.16.18 kernel running on gluck at the time of the exploit.

Interestingly, the window between the compromise and the lockdown was less than two hours.

--
2*3*3*3*3*11*251
1. Re:It was a local root exploit by uhoreg · 2006-07-13 08:59 · Score: 3, Informative
  
  See also this posting on debian-project for more technical details.
  
  --
  To get something done, a committee should consist of no more than three persons, two of them absent.
Re: Not worried about Debian users? by Anonymous Coward · 2006-07-13 11:43 · Score: 0

At any point in time, was the server gluck serving CVS, or web services to debian users where its sources could have been compromised?
In Soviet Russia... by Mondor · 2006-07-13 19:26 · Score: 1

From the point of view of Russian language, that was natural event, nothing unexpected.
Some sailors say - how you name a ship, she will float that way.
While in German language "gluck" means "happiness", in Russian it means "glitch".
I see it as a good thing by trigggl · 2006-07-14 00:29 · Score: 1

The more mainstream Linux(actually applies in this case because it was a kernel vulnerability) gets, the more hackers that will be trying to get in. This can only help make the kernel/OS better. Essentially, you have more people testing your security for free. Of course, in this case, it was a known hole and they just failed to update.
I have had someone break into my Debian system once. I got cocky and left a few ports open on my router. I left the ftp and ssh ports open and my slackware partition mounting automatically. Later, I realized my user account in slackware was showing up as user "ftp" in Debian. That will never happen again. I noticed in the log files that someone was trying to break in and was keeping an eye on my gkrellm. Finally they figured it out, and instantly high internet traffic was going both ways. I had to turn the router off to give myself time to think. Those ports have been closed ever since. Accessing my computer from work is not that important. I haven't been hacked since. I keep an eye on all ports I use including Bittorrent.
Of course, my computer is not a server, so I'm not too worried. I try to keep sensitive information off of any computer. That is what the safe is for.

--
Ops, I shuld have usd the prevuwe but in.