Earlier quoted context omitted.
Air France représente !
Do you mean Air Rance
Ah, I see you’re a man of culture as well
Canonical Ltd source code repositories have been compromised
71–78 of 78 posts
Re: Canonical Ltd source code repositories have been compromised
#72Are these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?
First, I would like to challenge the assumption that Debian primarily uses SVN for packaging. We can get a rough idea from the use of Vcs-$name package metadata in the testing distribution: On my system this gives: 4 Arch 72 Bzr 5 Cvs 5 Darcs 24168 Git 21 Hg 21 Mtn 603 Svn Which shows that git is the overwhelming favorite and about 40 times more popular than SVN for packages which provide VCS metadata. The sources ca…
Surprised to see the same number for Monotone than for Mercurial.
Re: Canonical Ltd source code repositories have been compromised
#73While it’s troubling that this happened isn’t it sort of cool that it’s out in the open for everyone to see? At least due to open source the community can know what happened and even look for changes.
What sucks is that I just updated WSL immediately before coming to this article. Hopefully it's ok.
Re: Canonical Ltd source code repositories have been compromised
#74Re: Canonical Ltd source code repositories have been compromised
#75Earlier quoted context omitted.
Hijacking top comment... We can confirm that on 2019-07-06 there was a Canonical owned account on GitHub whose credentials were compromised and used to create repositories and issues among other activities. Canonical has removed the compromised account from the Canonical organisation in GitHub and is still investigating the extent of the breach, but there is no indication at this point that any source code or PII was…
Launchpad doesn't look very trustworthy either: https://launchpad.net/projects/+all
Launchpad is public, think GitHub but for packages. The Canonical Launchpad repositories weren't tampered. Presumably a lot fewer people have commit access to LP since it's used for package distribution.
Re: Canonical Ltd source code repositories have been compromised
#76Earlier quoted context omitted.
Probably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.
The LXC and LXD repositories are under https://github.com/lxc which is a different Github organization with a much much smaller set of members (17 currently) than CanonicalLtd. We require 2FA for all accounts under the lxc organization and only grant the access that's actually needed by those contributors. So while it's not impossible that one of our members' credentials may get compromised, especially when consideri…
Thanks for pointing this out!
Re: Canonical Ltd source code repositories have been compromised
#77Earlier quoted context omitted.
Probably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.
The LXC and LXD repositories are under https://github.com/lxc which is a different Github organization with a much much smaller set of members (17 currently) than CanonicalLtd. We require 2FA for all accounts under the lxc organization and only grant the access that's actually needed by those contributors. So while it's not impossible that one of our members' credentials may get compromised, especially when consideri…
I am more afraid of someone compromising the linuxcontainer.org image servers. I wonder what security they have on place...
Re: Canonical Ltd source code repositories have been compromised
#78So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
Hijacking top comment... We can confirm that on 2019-07-06 there was a Canonical owned account on GitHub whose credentials were compromised and used to create repositories and issues among other activities. Canonical has removed the compromised account from the Canonical organisation in GitHub and is still investigating the extent of the breach, but there is no indication at this point that any source code or PII was…
I just recall the takeover of the Lubuntu project by this kid, kicking out all others and his attempt to threaten others in the project at Christmas time as a ubuntu tm licensee for his website impostering as a Ubuntu trade mark owner. His forged evidence provided worked with Github staff to get others blocked. I don't trust Ubuntu accounts anymore and I don't trust Canonical because they let it happen.