4 ms·

So eleven years ago someone put a backdoor in the Telnet daemon. Who? Where's the commit?

• parl_match 9mo ago
  It wasn't a backdoor, just a very serious security bug. Congrats on jumping straight to conspiracy and paranoia, though.
  • alt187 9mo ago
    It's only a conspiracy and paranoia if it's wrong. 11 years ago was 2015.
    • its_magic 9mo ago
      > GNU organization > giant security flaw Checks out.
    • parl_match 9mo ago
      It is wrong. The author is known, was acting in good faith, and simply fucked up really badly. I don't know what 11 years ago has to do with anything, besides the awful lifespan of such a severe bug.
• greyface- 9mo ago
  https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c288b87139a0da8249d0a408c4dfb87 https://codeberg.org/inetutils/inetutils/commit/fa3245ac8c28...
  • ieie3366 9mo ago
    That's crazy. This is core business critical software but they just YOLO critical changes without any automated tests? this PR would be insta-rejected in the small SAAS shop I work at.
    • avaer 9mo ago
      There's a famous XKCD about this: https://xkcd.com/2347/ https://xkcd.com/2347/ In this case the hero's name is apparently Simon Josefsson (maintainer).
      • idiotsecant 9mo ago
        I feel like we should just start saying 2347. Everyone knows what you mean.
    • AlienRobot 9mo ago
      https://xkcd.com/2347/ https://xkcd.com/2347/ Ah, someone beat me to it!
    • direwolf20 9mo ago
      If you think you can do better you're welcome to do better. I say this without a hint of sarcasm. This is how open source works. It's a do–ocracy, not a democracy. Whoever makes a telnet server gets to decide how the telnet server works and how much testing it gets before release.
      • its_magic 9mo ago
        Maybe the lesson here is to stop letting the GNU folks do things, if this is what they do. This is only one example of craziness coming out of the GNU camp.
        • nomel 9mo ago
          Or, flip the responsibility to what it has always been understood to be, when using open source software from random volunteers (some being bad actors) on the internet for anything remotely critical: audit the source.
        • db48x 9mo ago
          GNU doesn’t provide labor, only organizational tools like mailing lists and whatnot. The projects that GNU supports are still run by individual volunteers. If you want it done better then please volunteer so that you can be the one doing it better.
  • its_magic 9mo ago
    That link goes to a page full of random garbage. No commits there to be seen. Apparently the owners of that website don't like my choice of user agent, and have decided to punish me accordingly.
    • gzread 9mo ago
      Same here. It says please wait while verifying.
      • its_magic 9mo ago
        I just checked, and it's confirmed: I am definitely using a web browser. It seems my browser and this site have a different definition of web standards, however. So exhausting to be surrounded by people with a paranoid, irrational fear of robots, who don't give a shit who they harm in their zeal to lash out and strike the evil bots.
• Arubis 9mo ago
  Telnet's cleartext and always has been. A backdoor seems like overkill.
  • direwolf20 9mo ago
    You still have to know the password or snoop on someone typing the password. But with this vuln, you don't. You can just get root instantly.
• mmooss 9mo ago
  > backdoor Do you mean that it's intentional? Why do you think so?