This is pretty scary now that CM has started to do OTA updates again. What server is that mechanism checking and trusting? Is there any cryptographic verification for update packages? Whose keys are used (the keys of the bad dude?)?
CyanogenMod.com hijacked. Transition to CyanogenMod.org
61–70 of 113 posts
Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#62Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#63Earlier quoted context omitted.
There is, so far as I've discerned, an automated bot running that changes submission titles to the HTML title of the URL. No human intervention, no human judgment.
This seems easy enough to test. Someone just needs to put up a page which changes the in-page TITLE to something new for every hit, and then let someone submit it. Then see if it changes, and what it changes to, and when. Then work backwards from the server logs to see who or what is doing it. If it's a bot, you could have some random gunk in there, and it would flip over automatically. If it's human, they might not…
Or make the title of the article a time stamp.
Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#64I think this would be a good time for Anonymous to step in and wipe this guy off the map.
Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#65Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#66It seems a nice idea, buying the CM.com domain and donating it to the project. Wonder if this sleazeball had a change of heart, or was he planning on embezzling referral traffic the whole time?
I read: And due to the small size (and lack of funds), the CyanogenMod.com domain was bought by a third-party back in 2009 and donated to CM, when CM was a much smaller project and had no online presence besides XDA. I must be missing something (and speaking from a US perspective), but was $10 really unattainable in order to secure a domain? Three years worth would have been $30-ish dollars now. Genuinely curious wha…
$10,000 dollars for a domain seems a bit much by itself. When you add the factor that you should have right to it and it was basically stolen.. there's no way they should pay that.
Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#67I'm mixed on whether this is a good way to handle reporting something like this to the public. On the one hand, they didn't release the guy's name, which is completely and entirely appropriate, and I commend them for doing so. On the other hand, giving so many details—many of which are not relevant to the public, and probably were not intended for the public—gives this PSA somewhat of a "well, screw you too" vibe. I…
Tell us the name of this rogue. I don't want to ever do business with the person, but how to know?
It's public via whois.
Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#68Does anybody know how this "rogue" webmaster took undue advantage of the CyanogenMod brand? The Facebook post states something about referral deals with community sites. Any idea what that would mean in practical terms? Just curious.
According to the conversation linked to by CM member koush[1], in one instance he approached a CM distributor requesting a 'contribution':
"Hi, we noticed that you are selling these cards with CyanogenMod builds. We do not however seem to have any agreements in place for this and feel it's only fair that you start contributing to the CyanogenMod project to continue selling your products."
Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#69Re: CyanogenMod.com hijacked. Transition to CyanogenMod.org
#70I'm mixed on whether this is a good way to handle reporting something like this to the public. On the one hand, they didn't release the guy's name, which is completely and entirely appropriate, and I commend them for doing so. On the other hand, giving so many details—many of which are not relevant to the public, and probably were not intended for the public—gives this PSA somewhat of a "well, screw you too" vibe. I…
Tell us the name of this rogue. I don't want to ever do business with the person, but how to know?
Avoid doing side business with anyone claiming to represent Cyanogen, for starters. I'm sure they haven't released his name at the advice of a lawyer (or they just have good legal sense). They shouldn't do anything that would jeopardize their ability to pursue legal action against the hijacker.