3 ms·

Mirror is the important word here. I'm pretty sure it didn't impact anybody.

Operyl 8y ago
Really it was just a major inconvenience to the contributors preferring to use GitHub to merge their work in. There was also a repository that was only on GitHub, but I think one of their action items is to change that. Overall, nothing overly bad indeed.
anemic 8y ago
Also the type of the malicious content (rm -fr /*) is "easy" to spot in which I mean there are no rootkits or remote exploitable flaws added. Not very nice to be a victim of that but at least there is no doubt whether you're vulnerable or not. The timeline also suggests that the malicious content was made after the break-in and not planned beforehand?
akerl_ 8y ago
From the incident report it sounds like the gentoo/systemd GitHub repo is not a mirror: the official repo is on GitHub and they're now looking to mirror it onto Gentoo infrastructure. Does anybody know why this is the case?
- noobermin 8y ago
  It probably just happened that way. To note, systemd isn't as popular/required for Gentoo as most people I know still use openrc. There is even a set of hacks (that I very thankfully use!) to use Gnome 3 on a non-systemd system[0]. [0] https://github.com/dantrell/gentoo-project-gnome-without-systemd https://github.com/dantrell/gentoo-project-gnome-without-sys...
- Semaphor 8y ago
  > The main Gentoo repositories are kept on Gentoo hosted infrastructure and Gentoo mirrors to GitHub in order to "be where the contributors are." Doesn't sound to me as if it's not a mirror. Though I guess you could say as their CI depended on this mirror, it had a higher status than normal mirrors.
  - akerl_ 8y ago
    I'm specifically talking about https://github.com/gentoo/systemd https://github.com/gentoo/systemd From their incident report (under https://wiki.gentoo.org/wiki/Github/2018-06-28#What_went_badly https://wiki.gentoo.org/wiki/Github/2018-06-28#What_went_bad... ): "The systemd repo is not mirrored from Gentoo, but is stored directly on GitHub." And from their Action Items: "mirror systemd repo on git.gentoo.org" I'm curious why they seem to treat this repo differently from the others, using GitHub as authoritative and adding a mirror to git.gentoo.org rather than making git.gentoo.org authoritative and mirroring to GitHub.
- deleted 8y ago
  [deleted]

Really it was just a major inconvenience to the contributors preferring to use GitHub to merge their work in. There was also a repository that was only on GitHub, but I think one of their action items is to change that. Overall, nothing overly bad indeed.

anemic 8y ago

Also the type of the malicious content (rm -fr /*) is "easy" to spot in which I mean there are no rootkits or remote exploitable flaws added. Not very nice to be a victim of that but at least there is no doubt whether you're vulnerable or not. The timeline also suggests that the malicious content was made after the break-in and not planned beforehand?

akerl_ 8y ago

From the incident report it sounds like the gentoo/systemd GitHub repo is not a mirror: the official repo is on GitHub and they're now looking to mirror it onto Gentoo infrastructure. Does anybody know why this is the case?

noobermin 8y ago
It probably just happened that way. To note, systemd isn't as popular/required for Gentoo as most people I know still use openrc. There is even a set of hacks (that I very thankfully use!) to use Gnome 3 on a non-systemd system[0]. [0] https://github.com/dantrell/gentoo-project-gnome-without-systemd https://github.com/dantrell/gentoo-project-gnome-without-sys...
Semaphor 8y ago
> The main Gentoo repositories are kept on Gentoo hosted infrastructure and Gentoo mirrors to GitHub in order to "be where the contributors are." Doesn't sound to me as if it's not a mirror. Though I guess you could say as their CI depended on this mirror, it had a higher status than normal mirrors.
- akerl_ 8y ago
  I'm specifically talking about https://github.com/gentoo/systemd https://github.com/gentoo/systemd From their incident report (under https://wiki.gentoo.org/wiki/Github/2018-06-28#What_went_badly https://wiki.gentoo.org/wiki/Github/2018-06-28#What_went_bad... ): "The systemd repo is not mirrored from Gentoo, but is stored directly on GitHub." And from their Action Items: "mirror systemd repo on git.gentoo.org" I'm curious why they seem to treat this repo differently from the others, using GitHub as authoritative and adding a mirror to git.gentoo.org rather than making git.gentoo.org authoritative and mirroring to GitHub.
deleted 8y ago
[deleted]