5 ms·

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And t

by Sandman 16y ago

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection.

deleted 16y ago
[deleted]
dkarl 16y ago
Maybe someone had an idea for putting a vulnerability into a GNU utility. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection. Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs so you can safely construct a query string out of them. "Hey, those web guys say sanitizing inputs is effectively impossible. Should we really be doing this?" "Snort. That's what they say about manually deallocating memory, too." "Oh yeah! What a bunch of wimps! I'll get right to work on the query builder."
- deleted 16y ago
  [deleted]
- rryyan 16y ago
  Going further: how about a vulnerability in every program compiled with gcc? I'll just leave this here: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html
- riffraff 16y ago
  I'm pretty sure savannah is php, forked from the original *forge code, so not really a fault of the people who wrote ls and gcc.
tptacek 16y ago
People in 1997 never expected that <insert project here> could be vulnerable to an attack as simple as a buffer overflow; after all, all it takes to not be vulnerable to overflows is "counting", and who has problems counting with a computer? Tens of billions of dollars in losses later: do you feel safe hitting arbitrary pages with your web browser?
prodigal_erik 16y ago
The code might be much worse than anything they would have written themselves. http://en.wikipedia.org/wiki/GNU_Savannah http://en.wikipedia.org/wiki/GNU_Savannah explains they started with a fork of the SourceForge code, and they seem to still be on it (the Python/Django rewrite isn't complete). It's not obvious what SourceForge was written in, but http://sourceforge.net/apps/trac/sourceforge/wiki/Open%20Source%20software%20used%20at%20SourceForge.net http://sourceforge.net/apps/trac/sourceforge/wiki/Open%20Sou... shows an awful lot of PHP dependencies, and the site dates back to 1999, a time when the worst of PHP's myriad design flaws (such as register_globals and magic_quotes) were widely embraced.

by Sandman 16y ago

deleted 16y ago

[deleted]

dkarl 16y ago

Maybe someone had an idea for putting a vulnerability into a GNU utility. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection. Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs so you can safely construct a query string out of them. "Hey, those web guys say sanitizing inputs is effectively impossible. Should we really be doing this?" "Snort. That's what they say about manually deallocating memory, too." "Oh yeah! What a bunch of wimps! I'll get right to work on the query builder."

deleted 16y ago
[deleted]
rryyan 16y ago
Going further: how about a vulnerability in every program compiled with gcc? I'll just leave this here: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html
riffraff 16y ago
I'm pretty sure savannah is php, forked from the original *forge code, so not really a fault of the people who wrote ls and gcc.

tptacek 16y ago

People in 1997 never expected that <insert project here> could be vulnerable to an attack as simple as a buffer overflow; after all, all it takes to not be vulnerable to overflows is "counting", and who has problems counting with a computer? Tens of billions of dollars in losses later: do you feel safe hitting arbitrary pages with your web browser?

prodigal_erik 16y ago

The code might be much worse than anything they would have written themselves. http://en.wikipedia.org/wiki/GNU_Savannah http://en.wikipedia.org/wiki/GNU_Savannah explains they started with a fork of the SourceForge code, and they seem to still be on it (the Python/Django rewrite isn't complete). It's not obvious what SourceForge was written in, but http://sourceforge.net/apps/trac/sourceforge/wiki/Open%20Source%20software%20used%20at%20SourceForge.net http://sourceforge.net/apps/trac/sourceforge/wiki/Open%20Sou... shows an awful lot of PHP dependencies, and the site dates back to 1999, a time when the worst of PHP's myriad design flaws (such as register_globals and magic_quotes) were widely embraced.