The OSU Open Source Lab is a donation-funded organization that supports the open source software community by providing project hosting, development, and mirrors for many open source projects. Apache, the Linux Foundation, Drupal, Busybox, Plone, PHPbb, Sahana, OpenMRS, and many others rely on the OSL for some or all of their infrastructure.
http://osuosl.org/donate
Full disclosure: I work for the OSL.
The post on kernel.org states that it was possibly due to a compromised user account. They stated that they discovered it through some errors related to Xnest/dev/mem and that they captured some of the exploit code. I believe they're still looking at everything to figure how how the intruders got in and what they touched.
Kudos to the kernel.org team for their prompt action and immediate disclosure.
Right... which is why we here at the OSL give them the opportunity to gain that experience in a real-world production environment while providing the mentorship they need. It dovetails nicely with the theoretical knowledge they're getting in their CS classroom work.
I beg to differ. I've been a sysadmin for 15 years. The professionalism and quality of the work done by the students here at the OSL is quite often indistinguishable from many of the people I've worked with over the years. Many of the people working on our hosted projects can't tell whether they're working with our professional staff or student workers.
We teach them to be sysadmins. They may not be sysadmins when they come to us, but they sure as hell are professional sysadmins when they leave.
Actually, we're more than a mirror. While mirroring is a major part of the services we provide, we also provide hosting for many projects' core infrastructure - Apache, Linux Foundation, Drupal, kernel.org, etc. Google is a major supporter of the OSL because we provide a place for projects whose needs have outgrown the more "off-the-shelf" structured hosting provided by Google Code or Sourceforge and need a more customizable environment.
As to the single point of failure concern - I disagree for several reasons:
We are not funded by the university. The OSL's activities are funded almost entirely by donations (both personal and corporate) and agreements with the projects we host. While we are all university employees, our wages are not paid using university dollars. Also, as part of the administrative computing organization at the university (as opposed to part of an academic department), the OSL falls under the university's CIO instead of a dean or department. The financial independence and organizational structure provides us with a significant amount of autonomy and insulation from the vagaries of university politics.
OSU President Ed Ray has stated time and time again that the role of a land grant university in the 21st century is to provide leadership and assistance in information technology - much the same way the land grants provided support to agriculture and industry in past centuries. The OSL helps OSU fulfill that goal.
On the FOSS community side, the OSL provides a vendor-neutral environment. We're not tied to any one distribution or manufacturer - we work with Dell, HP, and IBM all equally. The same goes for SuSE, Ubuntu, Gentoo, Red Hat, etc. IIRC, our neutrality one of the reasons master.kernel.org and the Linux Foundation reside at the OSL. We (and the university) consider that neutrality a very valuable asset.
It would take something more than a "pissed off dean" to summarily shut the OSL down.
Slashdot Mirror
The OSU Open Source Lab is a donation-funded organization that supports the open source software community by providing project hosting, development, and mirrors for many open source projects. Apache, the Linux Foundation, Drupal, Busybox, Plone, PHPbb, Sahana, OpenMRS, and many others rely on the OSL for some or all of their infrastructure. http://osuosl.org/donate Full disclosure: I work for the OSL.
How did the so called user account compromise result in root access? Care to explain?
I'm not privy to the details, but I expect disclosure will be forthcoming as soon as they've traced and patched whatever vulnerability was exploited.
The post on kernel.org states that it was possibly due to a compromised user account. They stated that they discovered it through some errors related to Xnest /dev/mem and that they captured some of the exploit code. I believe they're still looking at everything to figure how how the intruders got in and what they touched.
Kudos to the kernel.org team for their prompt action and immediate disclosure.
(keep in mind, they have a mirror in the midwest provided by (I think) TDS)
That is correct. We have two FTP mirrors hosted by TDS (Chicago and New York) in addition to the systems we have on campus in Crovallis.
Quack like the open source ducks you are, Oregon! ;->~
Umm. Wrong school. OSU Beavers, not those silly Ducks down the valley. :-)
99.99 of sysadmin'ing comes from experience
Right ... which is why we here at the OSL give them the opportunity to gain that experience in a real-world production environment while providing the mentorship they need. It dovetails nicely with the theoretical knowledge they're getting in their CS classroom work.
Two OSL staff have created and taught a system admin course at OSU: http://cs312.osuosl.org/ The content is available under Creative Commons.
We're actively working with the EECS faculty to incorporate both system administration and open source topics into the course offerings.
I beg to differ. I've been a sysadmin for 15 years. The professionalism and quality of the work done by the students here at the OSL is quite often indistinguishable from many of the people I've worked with over the years. Many of the people working on our hosted projects can't tell whether they're working with our professional staff or student workers.
We teach them to be sysadmins. They may not be sysadmins when they come to us, but they sure as hell are professional sysadmins when they leave.
I work for the OSU OSL.
Actually, we're more than a mirror. While mirroring is a major part of the services we provide, we also provide hosting for many projects' core infrastructure - Apache, Linux Foundation, Drupal, kernel.org, etc. Google is a major supporter of the OSL because we provide a place for projects whose needs have outgrown the more "off-the-shelf" structured hosting provided by Google Code or Sourceforge and need a more customizable environment.
As to the single point of failure concern - I disagree for several reasons:
It would take something more than a "pissed off dean" to summarily shut the OSL down.
-Greg