I thought more eyes on the source means that OSS is impenetrable. Guess not.
Main GNU source repository server compromised
11–20 of 47 posts
Re: Main GNU source repository server compromised
#12What a moran whoever did this.
Re: Main GNU source repository server compromised
#13I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as sim…
Maybe someone had an idea for putting a vulnerability into a GNU utility.
Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection.
Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs so you can safely construct a query string out of them.
"Hey, those web guys say sanitizing inputs is effectively impossible. Should we really be doing this?"
"Snort. That's what they say about manually deallocating memory, too."
"Oh yeah! What a bunch of wimps! I'll get right to work on the query builder."
Re: Main GNU source repository server compromised
#14Ouch. This is bad. It illustrates how much of a pain SQL injections are, if they can affect the GNU project which has some of the most incredibly talented hackers worlwide... Props to them for having a working backup strategy though.
Actually, no... you have to be pretty ignorant to be subject to them. Use bind variables in your queries and you are done. That it's still one of the top 2-3 exploits tells you how horrible most developers really are.
Re: Main GNU source repository server compromised
#15Ouch. This is bad. It illustrates how much of a pain SQL injections are, if they can affect the GNU project which has some of the most incredibly talented hackers worlwide... Props to them for having a working backup strategy though.
lol, pwned twice in 7 years, "incredibly talented hackers" lololololo
Re: Main GNU source repository server compromised
#16What a moran whoever did this.
“But he has nothing on at all,” said a little child at last. “Good heavens! listen to the voice of an innocent child,” said the father, and one whispered to the other what the child had said. “But he has nothing on at all,” cried at last the whole people. That made a deep impression upon the emperor, for it seemed to him that they were right; but he thought to himself, “Now I must bear up to the end.” And the chamberlains walked with still greater dignity, as if they carried the train which did not exist.
Re: Main GNU source repository server compromised
#17Ouch. This is bad. It illustrates how much of a pain SQL injections are, if they can affect the GNU project which has some of the most incredibly talented hackers worlwide... Props to them for having a working backup strategy though.
lol, pwned twice in 7 years, "incredibly talented hackers" lololololo
I believe it's more that they are a visible target, being in the media and spreading their message as much as they do. Were they a small company that hosted internal webapps (for example) they probably wouldn't have been targeted as much. Imagine, for a moment, if these two attacks in seven years were successful, how many unsuccessful attacks there were as well.
Most, if not all, software after a certain point of complexity has vulnerabilities (yes, even mine). This has absolutely nothing to do with how talented their hackers may be and more with the inevitability of someone, somewhere, working hard to find, and abuse, exploits.
edit: I typed more than I intended to here, but my gist is that you're really taking light of the situation here, trivializing all of the work that has gone into gnu projects when you quote "incredibly talented hackers" and follow it up with a useless throwaway phrase like "lololololo". I thought HN was better than this.
Re: Main GNU source repository server compromised
#18Earlier quoted context omitted.
lol, pwned twice in 7 years, "incredibly talented hackers" lololololo
I believe it's more that they are a visible target, being in the media and spreading their message as much as they do. Were they a small company that hosted internal webapps (for example) they probably wouldn't have been targeted as much. Imagine, for a moment, if these two attacks in seven years were successful, how many unsuccessful attacks there were as well. Most, if not all, software after a certain point of com…
SQL injection
Re: Main GNU source repository server compromised
#19Ouch. This is bad. It illustrates how much of a pain SQL injections are, if they can affect the GNU project which has some of the most incredibly talented hackers worlwide... Props to them for having a working backup strategy though.
lol, pwned twice in 7 years, "incredibly talented hackers" lololololo
All the programmers are working on other web-based stuff. We need more volunteers, how about YOU konad?
Re: Main GNU source repository server compromised
#20GNU hackers fail again.