Canonical Ltd source code repositories have been compromised
1–10 of 78 posts
Re: Canonical Ltd source code repositories have been compromised
#2I only see a list of files. Can you link to something more specific?
Re: Canonical Ltd source code repositories have been compromised
#3I only see a list of files. Can you link to something more specific?
some stranger repos have been created and there is this issue https://github.com/CanonicalLtd/CAN_GOT_HAXXD/issues/1
Re: Canonical Ltd source code repositories have been compromised
#4It shows 10 empty repositories with names
CAN_GOT_HAXXD_%d and age 2 hours.
Re: Canonical Ltd source code repositories have been compromised
#5It looks like they have already recovered everything.
Re: Canonical Ltd source code repositories have been compromised
#6We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof.
Always sign your commits!
Re: Canonical Ltd source code repositories have been compromised
#7Are these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?
Re: Canonical Ltd source code repositories have been compromised
#8Are these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?
Debian stores packaging in Git too, these days, sometimes exclusively.
Re: Canonical Ltd source code repositories have been compromised
#9We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
That’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.
Re: Canonical Ltd source code repositories have been compromised
#10We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
... and today PGP was poisoned