5 ms·

I'm concerned about all the critical websites powered by drupal, including Whitehouse.gov.

mkempe 12y ago
Actually, the White House was hacked two weeks ago. [1] Not much is officially known, some think that the hackers managed to penetrate a lot of their systems (some employees leaked info before the announcement). [1] http://www.usatoday.com/story/theoval/2014/10/29/white-house-computer-hacks-russia/18104231/ http://www.usatoday.com/story/theoval/2014/10/29/white-house...
- snowwrestler 12y ago
  That's their internal network (LAN), not their web servers.
  - mkempe 12y ago
    Surely you are not claiming that there is no possible connection? if/once the Drupal Web server was hacked, the hackers could not possibly have served malware to admin users, or reached into other machines?
    - eli 12y ago
      Anything is possible, but I think it would be unwise to assume they are related.
geerlingguy 12y ago
I presume most of the bigger Drupal sites are run by teams that care about security enough to follow security lists closely and have release management in place that would allow hotfixing within hours, if not minutes, of a critical vulnerability being announced.
snowwrestler 12y ago
Whitehouse.gov is still on Drupal 6 and not affected by this vulnerability. The petition site is D7. But last I checked they have some pretty heavy hitters on that project. They probably knew about and patched the vulnerability before it was even publically released.
- mkempe 12y ago
  The following White House announcement seems to say that they have already transitioned the main site to Drupal 7. [1] Do you have contrary evidence or insider knowledge? [1] http://www.whitehouse.gov/blog/2014/10/24/welcome-white-house-then-and-now http://www.whitehouse.gov/blog/2014/10/24/welcome-white-hous...
  - snowwrestler 12y ago
    Not insider knowledge but at the DC Drupal event in early August the WH devs gave a talk about the 2014 State of the Union live stream, and at that time said that the main site was still D6. Perhaps they deployed the D7 upgrade since then.
    - mixologic 12y ago
      Definitely drupal 7 : http://www.whitehouse.gov/misc/drupal.js http://www.whitehouse.gov/misc/drupal.js
      - snowwrestler 12y ago
        I stand corrected!

Actually, the White House was hacked two weeks ago. [1] Not much is officially known, some think that the hackers managed to penetrate a lot of their systems (some employees leaked info before the announcement). [1] http://www.usatoday.com/story/theoval/2014/10/29/white-house-computer-hacks-russia/18104231/ http://www.usatoday.com/story/theoval/2014/10/29/white-house...

snowwrestler 12y ago
That's their internal network (LAN), not their web servers.
- mkempe 12y ago
  Surely you are not claiming that there is no possible connection? if/once the Drupal Web server was hacked, the hackers could not possibly have served malware to admin users, or reached into other machines?
  - eli 12y ago
    Anything is possible, but I think it would be unwise to assume they are related.

geerlingguy 12y ago

I presume most of the bigger Drupal sites are run by teams that care about security enough to follow security lists closely and have release management in place that would allow hotfixing within hours, if not minutes, of a critical vulnerability being announced.

snowwrestler 12y ago

Whitehouse.gov is still on Drupal 6 and not affected by this vulnerability. The petition site is D7. But last I checked they have some pretty heavy hitters on that project. They probably knew about and patched the vulnerability before it was even publically released.

mkempe 12y ago
The following White House announcement seems to say that they have already transitioned the main site to Drupal 7. [1] Do you have contrary evidence or insider knowledge? [1] http://www.whitehouse.gov/blog/2014/10/24/welcome-white-house-then-and-now http://www.whitehouse.gov/blog/2014/10/24/welcome-white-hous...
- snowwrestler 12y ago
  Not insider knowledge but at the DC Drupal event in early August the WH devs gave a talk about the 2014 State of the Union live stream, and at that time said that the main site was still D6. Perhaps they deployed the D7 upgrade since then.
  - mixologic 12y ago
    Definitely drupal 7 : http://www.whitehouse.gov/misc/drupal.js http://www.whitehouse.gov/misc/drupal.js
    - snowwrestler 12y ago
      I stand corrected!