3 ms·

Most of the things you listed are issues with JIRA and Confluence, not the ASF's practices. Everything else on your list has already been fixed. The ASF infra

Most of the things you listed are issues with JIRA and Confluence, not the ASF's practices. Everything else on your list has already been fixed. The ASF infra group did almost everything right but they still got burnt by esoteric details. The sshd conf had PasswordAuthentication set to no, but enabling PAM auth caused regular password auth to work. Did you know about that caveat? And your top concern was that Slicehost didn't immediately shut down a machine? tptacek never said that. He said it was a little disturbing that Slicehost took two days to turn off an instance that was exploiting a previously-unknown vulnerability in JIRA. From the incident report https://blogs.apache.org/infra/entry/apache_org_04_09_2010 https://blogs.apache.org/infra/entry/apache_org_04_09_2010 : We notified Atlassian of the previously unreported XSS attack in JIRA and contacted SliceHost. Atlassian was responsive. Unfortunately, SliceHost did nothing and 2 days later, the very same virtual host (slice) attacked Atlassian directly. ( http://blogs.atlassian.com/news/2010/04/oh_man_what_a_day_an_update_on_our_security_breach.html http://blogs.atlassian.com/news/2010/04/oh_man_what_a_day_an... ) Apache's infrastructure group got their shit together quickly. The hacked Slicehost instance wasn't a threat to them anymore. Slicehost's inaction helped get Atlassian hacked, which I think is a bit disturbing. Would it have really slowed the hackers down for more than an hour anyway? Oh, you're right. Let's just leave hacked systems running. Shutting them down will only slow down hackers for an hour.

justinsb 17y ago
Wow - you're certainly living up to your username :-) Shutting down a server doesn't stop the hackers using one of the other thousands of servers they have compromised. In this regard, trying to respond to an attack by shutting down the server is essentially a waste of time: the only winning move is not to play. There were multiple mistakes made (and I'm not trying to cast blame), and I think we should be aware of the repeatable lessons for software development: hashes need to be salted, XSS matters, password lockout matters etc. If there's a lesson from Slicehost, it's that you shouldn't rely on someone else bailing you out.
- tptacek 17y ago
  You cannot run a hosting provider and ignore reports that your own hardware is being used to launch criminal attacks. It's that simple.

justinsb 17y ago

Wow - you're certainly living up to your username :-) Shutting down a server doesn't stop the hackers using one of the other thousands of servers they have compromised. In this regard, trying to respond to an attack by shutting down the server is essentially a waste of time: the only winning move is not to play. There were multiple mistakes made (and I'm not trying to cast blame), and I think we should be aware of the repeatable lessons for software development: hashes need to be salted, XSS matters, password lockout matters etc. If there's a lesson from Slicehost, it's that you shouldn't rely on someone else bailing you out.

tptacek 17y ago
You cannot run a hosting provider and ignore reports that your own hardware is being used to launch criminal attacks. It's that simple.