12 ms·
It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular s
by corobo 10y ago
It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.
- caf 10y agoIt looks like they have a dump of the Fosshub user database. Audacity was also affected: http://www.audacityteam.org/hacked-download/ http://www.audacityteam.org/hacked-download/
- theandrewbailey 10y agoDamn. You have no idea how close I was to reinstalling Audacity last night.
- ocdtrekkie 10y agoDownloaded it a couple days ago in my case! Close call, though I do backup my important files offsite.
- theandrewbailey 10y agoI keep two offsite backups!
- Buge 10y agoIt sounds to me like one or two people reused passwords between fosshub and some other site that had its database breached.
- Ecio78 10y agoIn FossHub statement on reddit they said that they think they got credentials that were saved inside Redis through probably a zero day exploit. Probably something to be verified
- mtgx 10y agoI also hate that Fosshub doesn't even use HTTPS, even though they could get a Let's Encrypt certificate for free. They only offer file signatures, but even those are MD5 and SHA1, and both types should've been deprecated a while ago.
- flurpitude 10y agoI don't see much value in published file hashes when they're hosted on the same site that hosts the files. If someone compromises the download link they're probably in a good position to update the hashes too.
- 0x0539 10y agoThe purpose of the hashes isn't to prove the file hasn't been tampered with, its confirm that the file wasn't corrupted during download.
- bashinator 10y agoThen just use checksum instead of an obsolete cryptographic hash.