Gentoo Was Compromised On GitHub

[phoronix]

Phoronix: Gentoo Was Compromised On GitHub

Unknown individuals were able to gain access to the Gentoo repositories on GitHub, including the modification of said repositories...

http://www.phoronix.com/scan.php?pag...ub-Compromised

[xiando]

way to go /g/ (note how link was changed to installgentoo, title Linux for Negroes.. yeah that's 4chan /g/)

[orome]

it's more than that. Every ebuild was changed to include "rm -rf /". It wouldn't do much since ebuilds are run under non-privileged user.

[JeansenVaars]

That's pure evil why would someone do that

[polarathene]

That's pure evil why would someone do that

No idea, I think Arch Linux users tend to get more shit for elitism than Gentoo, never really see people talking bad about Gentoo or it's users :\ Maybe had nothing to do with Gentoo as a target and just Gentoo was the one of many that actually got compromised? That kind of behaviour usually is something you'd see from youth or someone trying to show off. Clearly no respect for the Linux community

I do wonder, can someone protect themselves from such a bit better? Require some hardware dongle or 2FA to perform certain commands?

[yoshi314]

it's more than that. Every ebuild was changed to include "rm -rf /". It wouldn't do much since ebuilds are run under non-privileged user.

and the builds are running under sandbox which restricts the writable directories to the current build dir. you would simply see a lot of red access violation errors running those builds.

technically one could try making an ebuild that would upload user's home directory (specific files like ~/.netrc) to some online location, but that would probably not work either. sandbox is fairly strict with what apps inside it can do.

[makam]

Oh no, Microsoft has already started hacking all the good distros.

Obviously they will pin it on someone else.

[rubdos]

it's more than that. Every ebuild was changed to include "rm -rf /". It wouldn't do much since ebuilds are run under non-privileged user.

Under a separate unprivileged user? Because if it runs under the user of the computer itself (like often PKGBUILDs on Arch), then it will still do a ton of damage.

[puleglot]

and the builds are running under sandbox which restricts the writable directories to the current build dir. you would simply see a lot of red access violation errors running those builds.

How about pkg_* phases and global scope?

[Guest]

What did the hackers do? downgrade the CFLAGS in the ebuilds?