4 ms·

For those who are interested in the actual technical error: https://github.com/coreos/coreos-overlay/pull/1965 https://github.com/coreos/coreos-overlay/pull/196

by jo909 10y ago

For those who are interested in the actual technical error: https://github.com/coreos/coreos-overlay/pull/1965 https://github.com/coreos/coreos-overlay/pull/1965 Very easy to make such a mistake, and it never made it into a stable release.

zymhan 10y ago
> it never made it into a stable release. True, but... > Based on log data from the CoreOS Linux Update Service roughly 3% of online, auto-upgrading, hosts were affected. If hosts are configured to autoupdate to a release, you're treading a fine line if that release could have issues like wide-open SSH access. Though I'd hope that no one is hosting sensitive data on an OS in alpha, that compromise may be used as a jumping-off point for a more serious attack.
- jo909 10y ago
  I guess having a lot of machines using the newest alpha releases is a double edge sword. It is great to have many users that are able to report bugs early, but then again a security issue like this is actually a somewhat serious issue. I really hope people that use anything of alpha status know what they are in for. Maybe a bug like this every now or then is required to remind people of the inevitable consequences of doing so. According to https://twitter.com/mjg59/status/732221095051296770 https://twitter.com/mjg59/status/732221095051296770 it affected about 1400 machines.
- danielweber 10y ago
  You shouldn't have anything security-critical on bleeding-edge or alpha, particularly because you are the canary in the coalmine. I like to encourage people to be those canaries, for my own selfish benefit, but they should be careful.
eeiieeiieeii 10y ago
You didn't even link what was actually merged, that PR is still open.
- jo909 10y ago
  That is the PR that explains the error and fixes it properly. It is not merged yet, current git master has the flawed version IIRC. But releases are seperate branches/tags, where the error was reverted in a more crude way: https://github.com/coreos/coreos-overlay/pull/1964 https://github.com/coreos/coreos-overlay/pull/1964 The actual "fix" was to pull those releases completely from the update server, so everybody effectively downgraded to an older unaffected release.

by jo909 10y ago

zymhan 10y ago

> it never made it into a stable release. True, but... > Based on log data from the CoreOS Linux Update Service roughly 3% of online, auto-upgrading, hosts were affected. If hosts are configured to autoupdate to a release, you're treading a fine line if that release could have issues like wide-open SSH access. Though I'd hope that no one is hosting sensitive data on an OS in alpha, that compromise may be used as a jumping-off point for a more serious attack.

jo909 10y ago
I guess having a lot of machines using the newest alpha releases is a double edge sword. It is great to have many users that are able to report bugs early, but then again a security issue like this is actually a somewhat serious issue. I really hope people that use anything of alpha status know what they are in for. Maybe a bug like this every now or then is required to remind people of the inevitable consequences of doing so. According to https://twitter.com/mjg59/status/732221095051296770 https://twitter.com/mjg59/status/732221095051296770 it affected about 1400 machines.
danielweber 10y ago
You shouldn't have anything security-critical on bleeding-edge or alpha, particularly because you are the canary in the coalmine. I like to encourage people to be those canaries, for my own selfish benefit, but they should be careful.

eeiieeiieeii 10y ago

You didn't even link what was actually merged, that PR is still open.

jo909 10y ago
That is the PR that explains the error and fixes it properly. It is not merged yet, current git master has the flawed version IIRC. But releases are seperate branches/tags, where the error was reverted in a more crude way: https://github.com/coreos/coreos-overlay/pull/1964 https://github.com/coreos/coreos-overlay/pull/1964 The actual "fix" was to pull those releases completely from the update server, so everybody effectively downgraded to an older unaffected release.