[–]▶ No.1011900>>1012342 >>1013000 [Watch Thread][Show All Posts]
>All Gentoo code hosted on github should for the moment be considered compromised,” wrote Gentoo administrators.
Does this incident undermine Gentoo's security credentials?
https://techcrunch.com/2018/06/29/hackers-too-over-the-gentoo-linux-github-repository/
▶ No.1011902>>1011927
Just a mirror, nobody uses it for anything serious.
▶ No.1011925
>“The Gentoo Infrastructure team have identified the ingress point, and locked out the compromised account,” wrote the admins. “Three Github repositories containing the Gentoo code, Musl, and systemd. All of these repositories are being “reset back to a known good state.”
>systemd repo
?
I guess they meant "Three Github repositories - the Gentoo code, Musl, and systemd", rather than "repositories containing Gentoo code...systemd" which infers the systemd repo contains Gentoo code, thus implying Gentoo has systemd.
▶ No.1011927>>1011929 >>1011943 >>1011971 >>1012061 >>1012167
>>1011902
moving the goal post lol
if their git repo was easily compromised, what else in gentoo has been compromised? clearly they don't know what they're doing
source-based distros are just a meme anyway
▶ No.1011929
>>1011927
Whatever (((you))) say.
▶ No.1011939
>"hackers"
>guessed the admin's password
▶ No.1011943>>1011947
>>1011927
>source-based distros are just a meme anyway
>compiled-by-someone-else-based distros are better for you goy
▶ No.1011947>>1011955
>>1011943
yeah dude, everything is a conspiracy
compiling is a conspiracy to hide backdoors, obviously
and nobody has ever obfuscated backdoors in source code before
oh wait...
the idea that compiling everything yourself solves all security issues is dumb, especially if you're on a modern intel processor anyway, with its own OS running within it, out of reach for your OS (beyond ring 0, hidden management shit running minix)
▶ No.1011955>>1011961
>>1011947
>spotting malware in source code is as hard as spotting it in a binary blob.
yeah dude, whatever.
>no conspiracy
>glowniggers poz you below ring 0
pick one.
Pro tip: It's the second and ring -4 is a known known
▶ No.1011961>>1011969 >>1011971 >>1011973 >>1012008 >>1012105 >>1012339 >>1013002
>>1011955
>spotting malware
Reminder you're never going to read even a tiny fraction of the millions of lines of code in your kernel, let alone the hundreds of millions of lines in the rest of your system.
Reminder the Linux kernel, let alone the mountains of software for it, have never been subject to a full independent audited
Reminder no production OS has been formally proven.
▶ No.1011969
>>1011961
>Reminder you're never going to read even a tiny fraction of the millions of lines of code in your kernel
Only niggers are too lazy to read.
▶ No.1011971
>>1011927
>moving the goal post
no one is moving any goal posts. github is just a mirror and you shouldn't use it.
>if their [github mirror of their actual git repo] was easily compromised, what else in gentoo has been compromised? clearly they don't know what they're doing
Fixed that for you.
Their response was very professional. Also, why don't you verify your repository snapshots like a white man would?
>source-based distros are just a meme anyway
nice bait. you should go back to >>>/reddit/ and take your shitty spacing with you. thanks.
>>1011961
typical macfag doesn't know how to read.
▶ No.1011973>>1011979
>>1011961
>automatically grepping for base64 junk in text files as hard as manually decompiling blobs with IDA-pro
yeah sure
▶ No.1011979
>>1011973
>binary distro
>source distro
<muh blobs
The goalposts are back there
▶ No.1011985>>1012321
>faggots in this thread playing it entirely straight
<this is 6 month old news and was fixes just an hour after it happened
How can /tech/ be so dumb?
▶ No.1012008>>1012105
>>1011961
Software is modular. Linux isn't one big .c file with millions of lines of code.
▶ No.1012061>>1012101
>>1011927
>if their git
*github, thanks, go away.
▶ No.1012101>>1012113
>>1012061
github is a hub for git repos, dumbass
git is what you use with github
▶ No.1012105>>1012274
>>1012008
>>1011961
Just ask one anon deliberately put some codes in the source and ask another anon to find it in the source code.
▶ No.1012113>>1012211
▶ No.1012167
>>1011927
dumbshit, you're trying to imply that a weakness in sjwhub is a weakness in gentoo. gtfo glownigger.
▶ No.1012182>>1012324
THIS IS FROM 6 MONTHS AGO RETARD
We already had a thread on this.
1. That's just a mirror
2. You can't actually set emerge to just use that repository as it doesn't have all the metadata needed
3. The attacker was retarded and just added rm -rf / in the scripts. Emerge builds stuff in a sandbox so rm -rf / will just cause an error as that's outside of the sandbox
4. The attacker force pushed their changes so when trying to update git would error out unless this was a fresh clone.
▶ No.1012211>>1012215 >>1012224
>>1012113
yeah, really
>Git (/ɡɪt/) is a version-control system for tracking changes in computer files and coordinating work on those files among multiple people. It is primarily used for source-code management in software development, but it can be used to keep track of changes in any set of files.
>GitHub Inc. is a web-based hosting service for version control using Git. It is mostly used for computer code. It offers all of the distributed version control and source code management functionality of Git as well as adding its own features.
>Repositories can be published via Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), rsync (removed in Git 2.8.0[31]), or a Git protocol over either a plain socket, or Secure Shell (ssh). Git also has a CVS server emulation, which enables the use of extant CVS clients and IDE plugins to access Git repositories. Subversion and svk repositories can be used directly with git-svn.
imagine being this retarded
▶ No.1012215>>1012312
▶ No.1012224
▶ No.1012274
>>1012105
He'll just look up the Git commits.
▶ No.1012312
>>1012215
yeah, really
>Git (/ɡɪt/) is a version-control system for tracking changes in computer files and coordinating work on those files among multiple people. It is primarily used for source-code management in software development, but it can be used to keep track of changes in any set of files.
>GitHub Inc. is a web-based hosting service for version control using Git. It is mostly used for computer code. It offers all of the distributed version control and source code management functionality of Git as well as adding its own features.
>Repositories can be published via Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), rsync (removed in Git 2.8.0[31]), or a Git protocol over either a plain socket, or Secure Shell (ssh). Git also has a CVS server emulation, which enables the use of extant CVS clients and IDE plugins to access Git repositories. Subversion and svk repositories can be used directly with git-svn.
imagine being this retarded
▶ No.1012321>>1012470
>>1011985
It's a reminder that anonymous maintainers can cause a great deal of harm with little effort.
How many developers downloaded the code and hadn't checked the news until the damage was done. An hour is a long time for a CIA nigger.
See https://medium.com/@SwiftSafe/rogue-developer-infects-widely-used-nodejs-module-to-steal-bitcoins-3b2260cc3889
▶ No.1012323
>>1012148
<Let's talk about the new vidya GPU.
▶ No.1012324
>>1012182
Thank you for clarifying.
▶ No.1012339
>>1011961
Holy fucking shit look at all that driver bloat LOL
Linux BTFO
Linux BTFO
Linux BTFO
Linux BTFO
Linux BTFO
▶ No.1012342
>>1011900 (OP)
dumbfucks on 8ch r willing to sell their mommies for gentoo & templeos. guess u all must b the bastard children of whore_son terry! now comes the oops moment. just a matter of time b4 this site will be gone for good. merry jew_mas. ;)
▶ No.1012461
Whose to say they haven't fucked with other distros?
▶ No.1012463
▶ No.1012470
>>1012321
I read somewhere about how criminals will offer money (up to $1 per install!) to firefox and chrome extension developers so that they can push a malicious update for ransomware or spyware or something, and then the developer pretends that it was just a "compromise" rather than selling out
it doesn't matter if they get rid of it afterwards, the damage was already done
▶ No.1012471>>1012473 >>1013133
>we use gentoo because it's more secure!
>gentoo gets compromised
>this isn't a security problem!
>the security of the repository doesn't matter!
the absolute state of this board
total damage control
cognitive fucking dissonance
▶ No.1012473>>1012481 >>1012989 >>1013001
>>1012471
>>we use gentoo because it's more secure!
Said noone ever. We use Gentoo because its extreme customizability makes it easy to avoid freedesktopware.
▶ No.1012481>>1012978
>>1012473
people pretend source-based distros are more secure because apparently tinfoil hat-wearing freetards think all compilers are malicious
▶ No.1012978
>>1012481
Have (You) compiled your own compiler after thoroughly reading its source code?
▶ No.1012989
>>1012473
>avoiding freedesktopware
Why?
▶ No.1013000
>>1011900 (OP)
old news lmao
▶ No.1013001
>>1012473
People use Gentoo because it's the most stable distro at this point. I haven't had a Gentoo install break ever since I started using it over 10 years ago. I can't say the same for Debian and especially CentOS.
▶ No.1013002
>>1011961
OpenBSD is intended to be easy to read/audit, it's an readability-performance tradeoff.
It's the only software I know of where code audits are regularly done. You've disproven your post with one of your pictures, as OpenBSD is a production OS that is formally proven.
▶ No.1013031>>1013037
here's an idea : Stop using cloud shit or github, you bloody immigrants.
▶ No.1013037
>>1013031
>t. unemployed gamer.
▶ No.1013133
>>1012471
>A single unoffical mirror gets compromised that's hosted on a proprietary platform*
Ftfy