5 ms·

I would guess most people did not install Webmin via some binary distribution package but rather by using their distros package manger meaning they most likely

I would guess most people did not install Webmin via some binary distribution package but rather by using their distros package manger meaning they most likely got built from the unmodified source code using completely unrelated and probably uncompromised build servers. Just saying this could have been worse.

LukeShu 7y ago
It is my understanding that while git was unaffected, the source release tarballs were. Distro packages tend to prefer the source release tarballs to doing git checkouts. I know that FreeBSD's webmin package was affected.
- mercora 7y ago
  After reading your comment i wanted to see for myself how its done on Debian or Ubuntu and realized there are no official packages of Webmin for these distros. So my assumption that most people got a package build from the unmodified source might have been wrong as a whole and my comment is indeed misleading on multiple levels. Thanks for clarifying.
- moviuro 7y ago
  I don't get how this could happen. Why would anyone trust their build server to package the release tarball? Were they ever signed and checked by the devs? The way I understand releases and tarballs, I'd do it like this: - git on my machine (supposedly safe) - bundle the source code, sign it however necessary - upload and publish the tarball + signature & checksums That way, unless my own machine was compromised, it should be OK.
  - johannes1234321 7y ago
    The typical reason is that one has a build chain which predates docker and those things, where it wasn't guaranteed that doing it on different machines yields the same result, but having a master host gives consistent result, independent from who does it. In modern times the reason is that the release is produced in a CI pipeline. So once a build is green and matches allmothe rreleas criteria that tested build is released. In both cases using a git checkout for longer time is not a got idea and builds should be done as exports into clean directories.

LukeShu 7y ago

It is my understanding that while git was unaffected, the source release tarballs were. Distro packages tend to prefer the source release tarballs to doing git checkouts. I know that FreeBSD's webmin package was affected.

mercora 7y ago
After reading your comment i wanted to see for myself how its done on Debian or Ubuntu and realized there are no official packages of Webmin for these distros. So my assumption that most people got a package build from the unmodified source might have been wrong as a whole and my comment is indeed misleading on multiple levels. Thanks for clarifying.
moviuro 7y ago
I don't get how this could happen. Why would anyone trust their build server to package the release tarball? Were they ever signed and checked by the devs? The way I understand releases and tarballs, I'd do it like this: - git on my machine (supposedly safe) - bundle the source code, sign it however necessary - upload and publish the tarball + signature & checksums That way, unless my own machine was compromised, it should be OK.
- johannes1234321 7y ago
  The typical reason is that one has a build chain which predates docker and those things, where it wasn't guaranteed that doing it on different machines yields the same result, but having a master host gives consistent result, independent from who does it. In modern times the reason is that the release is produced in a CI pipeline. So once a build is green and matches allmothe rreleas criteria that tested build is released. In both cases using a git checkout for longer time is not a got idea and builds should be done as exports into clean directories.