8 ms·

There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg_might_be_compromised/ https://old.reddit.com/r/xubu

by crtasm 1y ago

There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg_might_be_compromised/ https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

hamdingers 1y ago
> Thanks everyone. We're beholden to our hosting environment for upgrades and it looks like there was a bit of a slip-up here. It's being worked on, but for now the Downloads page is disabled. Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. One does not accidentally prepare a zip file with a malicious exe and xubuntu-specific language, upload it to a server, and point a torrent link at it.
- justin66 1y ago
  Mistakes were made!
  - mito88 1y ago
    I heard tings
- lioeters 1y ago
  > looks like there was a bit of a slip-up Indeed that is a suspicious or at least untrustworthy way to deflect the seriousness of a malware infection that potentially affects all users of an OS distribution.
  - zarzavat 1y ago
    Either way, nobody should use this distro ever again. It should be forked from a known good commit under a new maintainer.
    - integralid 1y ago
      Nobody injected any malicious code into the repository. This is a website being hacked. As you certainly know, after reading TFA.
      - zarzavat 1y ago
        Nobody has yet identified any malicious code in the repository. How do you prove that the person hacking the website is not an associate of (or the same as) the person running the website? If this were proprietary software then the software would be expected to die. Since this is open source, there is the option for the original project to die and for a fork to rise form the ashes.
        esseph 1y ago
        I've been using Open Source since before the term was coined, and no, that's not my expectation at all.
        AAAAaccountAAAA 1y ago
        Has a single website security incident ever brought an end to any software project, proprietary or otherwise?
- OsrsNeedsf2P 1y ago
  > Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. You're making an assumption that this moderator is anything more than a Xubuntu enthusiast who wants to downplay outrage on Reddit. Keep in mind Xubuntu is mostly a community effort, not a large corporation with seniors who know how to handle this "best".
  - hamdingers 1y ago
    I am not making any assumptions, you are failing to do research. Start by googling the username of the account. They are the Xubuntu Marketing and Website lead. This is the domain they are responsible for and, given their long history, they should know better.
    - roryirvine 1y ago
      To what extent is Xubuntu affiliated with Ubuntu? This sort of thing must risk harming Canonical's reputation, so you'd think they'd want to use whatever leverage they have to enforce better practices.
      - AAAAaccountAAAA 1y ago
        It is an official flavor[1], that is, maintained as a community effort, but endorsed by Ubuntu. The related packages are hosted in Ubuntu's universe repository[2]. There is indeed a risk of reputation damage. 1. https://ubuntu.com/desktop/flavors https://ubuntu.com/desktop/flavors 2. https://packages.ubuntu.com/search?keywords=xubuntu-desktop https://packages.ubuntu.com/search?keywords=xubuntu-desktop
    - Vinnl 1y ago
      I used to be responsible for the Xubuntu.org website, way back when. I was a teenager back then. Which is to say, I'm fairly sure that they're still just a volunteer community member.
      - 1y ago
- sim7c00 1y ago
  WHOOPSY DAISY
LambdaComplex 1y ago
Calling this "a bit of a slip-up" while neither confirming nor denying the presence of malware is weird at best and incredibly suspicious at worst.
- DoctorOetker 1y ago
  perhaps the attacker has compromised maintainer credentials / logins?

by crtasm 1y ago

There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg_might_be_compromised/ https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

hamdingers 1y ago

> Thanks everyone. We're beholden to our hosting environment for upgrades and it looks like there was a bit of a slip-up here. It's being worked on, but for now the Downloads page is disabled. Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. One does not accidentally prepare a zip file with a malicious exe and xubuntu-specific language, upload it to a server, and point a torrent link at it.

justin66 1y ago
Mistakes were made!
- mito88 1y ago
  I heard tings
lioeters 1y ago
> looks like there was a bit of a slip-up Indeed that is a suspicious or at least untrustworthy way to deflect the seriousness of a malware infection that potentially affects all users of an OS distribution.
- zarzavat 1y ago
  Either way, nobody should use this distro ever again. It should be forked from a known good commit under a new maintainer.
  - integralid 1y ago
    Nobody injected any malicious code into the repository. This is a website being hacked. As you certainly know, after reading TFA.
    - zarzavat 1y ago
      Nobody has yet identified any malicious code in the repository. How do you prove that the person hacking the website is not an associate of (or the same as) the person running the website? If this were proprietary software then the software would be expected to die. Since this is open source, there is the option for the original project to die and for a fork to rise form the ashes.
      - esseph 1y ago
        I've been using Open Source since before the term was coined, and no, that's not my expectation at all.
      - AAAAaccountAAAA 1y ago
        Has a single website security incident ever brought an end to any software project, proprietary or otherwise?
OsrsNeedsf2P 1y ago
> Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. You're making an assumption that this moderator is anything more than a Xubuntu enthusiast who wants to downplay outrage on Reddit. Keep in mind Xubuntu is mostly a community effort, not a large corporation with seniors who know how to handle this "best".
- hamdingers 1y ago
  I am not making any assumptions, you are failing to do research. Start by googling the username of the account. They are the Xubuntu Marketing and Website lead. This is the domain they are responsible for and, given their long history, they should know better.
  - roryirvine 1y ago
    To what extent is Xubuntu affiliated with Ubuntu? This sort of thing must risk harming Canonical's reputation, so you'd think they'd want to use whatever leverage they have to enforce better practices.
    - AAAAaccountAAAA 1y ago
      It is an official flavor[1], that is, maintained as a community effort, but endorsed by Ubuntu. The related packages are hosted in Ubuntu's universe repository[2]. There is indeed a risk of reputation damage. 1. https://ubuntu.com/desktop/flavors https://ubuntu.com/desktop/flavors 2. https://packages.ubuntu.com/search?keywords=xubuntu-desktop https://packages.ubuntu.com/search?keywords=xubuntu-desktop
  - Vinnl 1y ago
    I used to be responsible for the Xubuntu.org website, way back when. I was a teenager back then. Which is to say, I'm fairly sure that they're still just a volunteer community member.
    - 1y ago
sim7c00 1y ago
WHOOPSY DAISY

LambdaComplex 1y ago

Calling this "a bit of a slip-up" while neither confirming nor denying the presence of malware is weird at best and incredibly suspicious at worst.

DoctorOetker 1y ago
perhaps the attacker has compromised maintainer credentials / logins?