And that's why you go with Wordpress...
Drupal.org compromised
31–40 of 86 posts
Re: Drupal.org compromised
#32This is one of those cases where I completely forgot that I had an account, and now it has been compromised. I'm scratching my head wondering what information/password I had associated with it.
Makes a case for actively destroying accounts on services that you're no longer planning on using.
Re: Drupal.org compromised
#33This is one of those cases where I completely forgot that I had an account, and now it has been compromised. I'm scratching my head wondering what information/password I had associated with it. Makes a case for actively destroying accounts on services that you're no longer planning on using.
Or not sharing passwords between services.
Re: Drupal.org compromised
#34This is one of those cases where I completely forgot that I had an account, and now it has been compromised. I'm scratching my head wondering what information/password I had associated with it. Makes a case for actively destroying accounts on services that you're no longer planning on using.
Or not sharing passwords between services.
You're right, though I don't share passwords between services, I'm curious just the same.
Re: Drupal.org compromised
#35Drupal.org compromised. If I visit drupal.org, will I experience the compromise firsthand via some zero-day exploit? A situation like this really calls for an independent site to make security-related announcements from where you can reasonably trust the independent site to not have been affected.
The site isn't being used to distribute an exploit. There were problems in the past and the page linked in this story describes what happened and what members of drupal.org should do to protect themselves.
Re: Drupal.org compromised
#36And that's why you go with Wordpress...
Drupal is at first a CMS and WordPress is at first a blogsystem.
You can not really compare them in the full spectrum of possible sites.
Re: Drupal.org compromised
#37They don't seem to mention this, but I'd say everyone that uses d.o git repos should definitely verify their set of authorized keys.
Definitely, as well as check your repos for malicious code. Unlike GitHub, Drupal doesn't send out a notification when a key is added, edited, or removed.
Re: Drupal.org compromised
#38Moderately miffed that the email they sent out notifying how THEY allowed my password to be compromised included a lecture telling ME how to construct a strong password. Not the time, or place. Besides, they claim it was salted, so it shouldn't really matter at this point whether my password was "Password123" or "@DJDF*$@!(DGEWGIRGHdfhEWROighMMMM...PIZZA".
I'm not convinced by their salted claim, I thought Drupal 6 (what drupal.org is on) only did MD5() for passwords? Drupal 7 has the more securely hashed passwords.
Re: Drupal.org compromised
#39This is one of those cases where I completely forgot that I had an account, and now it has been compromised. I'm scratching my head wondering what information/password I had associated with it. Makes a case for actively destroying accounts on services that you're no longer planning on using.
Or not sharing passwords between services.
Preferably both. Not sharing passwords is the obvious one, but if I stop using something I'd like to be able to delete everything related to me (except perhaps logfiles or whatever else needs to be retained for operational reasons up to a few weeks). And without having to call someone on the phone please or email support@ please.
Re: Drupal.org compromised
#40According to the OP, the compromise happened because of malicious software being placed onto association.drupal.org via a third party app used by that subdomain, and not because of a vulnerability in Drupal itself.
So...it'd be nice to know the details of what this third party app was and also, some basic details of the configuration of association.drupal.org. Not anything specific, but rather, how is the subdomain stack different than the one used on drupal.org?