4 ms·
We still dont have a report on the kernel.org hack of 2011. Many people say, calm down, its git they cant have inserted backdoors etc without messing up the gi
by antocv 13y ago
We still dont have a report on the kernel.org hack of 2011.
Many people say, calm down, its git they cant have inserted backdoors etc without messing up the git history/changelog/hashes/whatever. But what if, git was modified and backdoored previously to hide some objects/changes? How would such an attack work? Lets say you discover a problem in git, which allows you to omit changesets in its output. How would that work to backdoor the kernel?
- phaemon 13y agoOlder versions of git would tell you the hashes were wrong. Implementations of git in other languages would tell you the hashes were wrong. Manually checking would tell you the hashes were wrong. It's just not feasible. EDIT: Plus, git is stored in git, so you'd need to backdoor git first... ;)
- jerf 13y agoAlso, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up ("well, maybe all my compilers (not just gcc, all of them) are also backdoored to backdoor themselves, and each other if you cross-compile, then backdoor git too...").
- yuvadam 13y agoBootstrap operation from hell [1] [1] - https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23ca2e25604af290 https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23...
- ryanthejuggler 13y agoThanks for the link... I've never read the README before, and it's very entertaining. Now I'm going to have "goddamn idiotic truckload of sh*t" echoing through my head all day
- jzzskijj 13y agoI read, when the project was introduced, but forgotten it a long time ago. Goddamn Idiotic Truckload of Sh*t Hub, Inc. would make a memorable name for an incorporation.
- TheCraiggers 13y agoThe kernel hasn't always been tracked in git though. How would we know something wasn't added before the source was imported into git?
- Aloha 13y agoBecause before it was tracked by git, it was in bitkeeper, and it was likely in some other system before that.
- TheCraiggers 13y agoI understand that. But what I don't know are the capabilities of those other, older systems that once tracked the kernel source. Do we have the same assurances there?
- antocv 13y agoGreat question. BitKeeper wasnt as good as git when it comes to changesets and introducing bugs, still it was founded on more social side of changes needing approvals. Before that it was CVS and for that its almost easy to introduce backdoors.
- kbart 13y agoSuch changes would be visible when comparing locally stored tree of older sources with new, supposedly backdored official sources stored on github. Someone should surely notice undocumented changes while doing backports, kernel upgrades etc. Heck, even integrity check by 3rd party tools could help here.
- jabiko 13y agoBesides the whole source code compromise discussion I would really want to know whether there is any incident report planned. Until the redesign kernel.org stated: "We will be writing up a report on the incident in the future.". But since the compromise was more than 2 years ago it seems unlikely.