Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canonical Ltd source code repositories have been compromised

github.com

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Canonical Ltd source code repositories have been compromised

#21

Post by kevinoid »

giancarlostoro wrote: post #7

Are these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?

First, I would like to challenge the assumption that Debian primarily uses SVN for packaging. We can get a rough idea from the use of Vcs-$name package metadata in the testing distribution:
On my system this gives:

      4 Arch
     72 Bzr
      5 Cvs
      5 Darcs
  24168 Git
     21 Hg
     21 Mtn
    603 Svn
Which shows that git is the overwhelming favorite and about 40 times more popular than SVN for packages which provide VCS metadata.

The sources can be pulled directly from Debian as tarballs using [syncpackage]. Ubuntu maintainers are free to use their preferred VCS for maintaining Ubuntu-specific packaging. Using the same VCS as the Debian maintainer (or upstream developer) is often convenient, but not required.

[syncpackage]: https://manpages.ubuntu.com/manpages/precise/man1/syncpackag...

Re: Canonical Ltd source code repositories have been compromised

#22

Post by tpetry »

jolmg wrote: post #14
pilif wrote: post #9

Earlier quoted context omitted.

That’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.

Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a…

Github could simply reject commits with email addresses not added to your account. As you need to verify every email you add to your account this problem would be solved instantly.

Re: Canonical Ltd source code repositories have been compromised

#23

Post by detaro »

tpetry wrote: post #22
jolmg wrote: post #14

Earlier quoted context omitted.

Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a…

Github could simply reject commits with email addresses not added to your account. As you need to verify every email you add to your account this problem would be solved instantly.

and be replaced by a bunch of other problems instead. E.g. no publishing of existing repos on Github if they happen to contain a commit with a non-linked address...

Re: Canonical Ltd source code repositories have been compromised

#24

Post by justinjlynn »

rasengan wrote: post #6

We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!

> We are lucky that they decided to vandalize instead of hiding something.

We do NOT know this.

Re: Canonical Ltd source code repositories have been compromised

#25

Post by chrisseaton »

rasengan wrote: post #6

We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!

> We are lucky that they decided to vandalize instead of hiding something.

How on earth do you know they haven't done both?!

Re: Canonical Ltd source code repositories have been compromised

#26

Post by jolmg »

tpetry wrote: post #22
jolmg wrote: post #14

Earlier quoted context omitted.

Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a…

Github could simply reject commits with email addresses not added to your account. As you need to verify every email you add to your account this problem would be solved instantly.

One wouldn't be able to upload an existing open source repo with loads of existing contributors. That seems to really go against Github's mission of being a universal, easy-access hub for open source git repositories.

Re: Canonical Ltd source code repositories have been compromised

#27

Post by dClauzel »

SuperH00man wrote: post #12
johannes1234321 wrote: post #11

Earlier quoted context omitted.

Removed or made private (I see a 404 error only)

Somebody on twitter took some screenshot https://twitter.com/dclauzel/status/1147525512794988544

Yes, somebody did ;)

Re: Canonical Ltd source code repositories have been compromised

#28

Post by infinity0 »

hlieberman wrote: post #19
rincebrain wrote: post #8

Earlier quoted context omitted.

Debian stores packaging in Git too, these days, sometimes exclusively.

That’s true, but somewhat misleading. Though most Debian maintainers use a VCS for packaging, it’s incidental to what actually ends up in the Debian package tree. That’s all still based off of tarballs submitted off of a developer’s machine.

Much less misleading than the previous post.

> Woulda thought they used SVN primarily since they pull from Debian

Re: Canonical Ltd source code repositories have been compromised

#29

Post by russell_h »

rasengan wrote: post #6

We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!

They still pretty visibly log the push event with the identity of the user whose credentials were used, so what you're describing is pretty easy to spot.

Re: Canonical Ltd source code repositories have been compromised

#30

Post by DuskStar »

morpheuskafka wrote: post #13
rasengan wrote: post #6

We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!

If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.

I trust that GitHub key less than personal keys for exactly that reason.
Post reply on HN