Slashdot Mirror
GitHub Gentoo Organization Hacked (gentoo.org)
Longtime Slashdot reader Chutzpah shares a report from Gentoo Linux, a Linux distribution built using the Portage package management system: June 28 at approximately 20:20 UTC unknown individuals have gained control of the Github Gentoo organization, and modified the content of repositories as well as pages there. We are still working to determine the exact extent and to regain control of the organization and its repositories. All Gentoo code hosted on GitHub should for the moment be considered compromised.
This does NOT affect any code hosted on the Gentoo infrastructure. Since the master Gentoo ebuild repository is hosted on our own infrastructure and since Github is only a mirror for it, you are fine as long as you are using rsync or webrsync from gentoo.org. Update 6/29/18: Gentoo has regained control of the Gentoo GitHub Organization and is working on a procedure for resolution. You can view the update status here.
This does NOT affect any code hosted on the Gentoo infrastructure. Since the master Gentoo ebuild repository is hosted on our own infrastructure and since Github is only a mirror for it, you are fine as long as you are using rsync or webrsync from gentoo.org. Update 6/29/18: Gentoo has regained control of the Gentoo GitHub Organization and is working on a procedure for resolution. You can view the update status here.
fp
It's simply a mirror. It allowed users to contribute in a workflow that they were used to.
Get a hardware token like a Yubikey.
Can anyone who follows Gentoo comment on if there are reasons to believe this is the result of some internal feud or a genuine hack?
chutzpah is a gentoo developer wiki.gentoo.org/wiki/User:Chutzpah
also boo hoo let github fix their issues, unless you were numpties and used shit passwords
I didn't think Microsoft would attack Linux so directly nor so quickly after buying Github.
Details are sparse, but we will update this story once we learn more.
Don't you mean you'll update the story when details emerge? ;)
Anons need not reply. Questions end with a question mark.
It's not hosted there. It was a mirror. Learn2Read.
All your codes are belong to us
blame Microsoft?
chutzpah is a gentoo developer wiki.gentoo.org/wiki/User:Chutzpah
And that spells bias to you?
To me it looks more like "an inside source".
(But I agree that chutzpah's article should have mentioned his connection with gentoo.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Gotta wait for BeauHD to learn more.
Anyway, the headline says "hacked", which is code for "we know jack shit". Which is why BeauHD likes that headline so much.
So far the mainline repositories have only logged two changes. sys-apps/openrc-0.34.11 has been removed from the repository and replaced with sys-apps/systemd-238
No one is quite sure yet who the hackers are or what their motivations are, but the main man page for OpenRC has been changed to an ASCII art picture of the top half of a hand showing a middle finger. Unfortunately it would appear that some bug in the way the ASCII art was formatted and the lines in the bottom half are shown out of order and some of them are missing completely. The user making the edit appears not to know how to code, and registered the username LP while also editing the page's wiki a second time leaving a footnote: corrupted image as designed WONTFIX.
if main repos not affected, 99.999% of all user would not be affected.
Linux security is excellent as long as nobody cares. At the first sign of interest, it falls apart faster than a Windows '95 OSR 1, with which it shares much of the interface some 20 years later.
Hosted, mirrored, whatever. Shouldnâ(TM)t have been touching it.