Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security GNU is Not Unix Programming IT Technology

Savannah Back Online With Extra Security 172

Posted by michael from the beefed-up dept.
depesz writes "As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational."
This discussion has been archived. No new comments can be posted.

Savannah Back Online With Extra Security More

Savannah Back Online With Extra Security

Comments Filter:

  • Congratulations (Score:4, Insightful)

    by xyzzy ( 10685 ) on Tuesday December 23, 2003 @11:54PM (#7800673) Homepage
    On yet another slashdot posting with absolutely zero informative content (except possibly to people who already knew what the article meant).

  • Savanah is back online again (Score:5, Funny)

    by rxed ( 634882 ) on Tuesday December 23, 2003 @11:55PM (#7800677)
    not anymore. is been slashdoted. :-)

  • Questions (Score:4, Insightful)

    by Scrameustache ( 459504 ) on Tuesday December 23, 2003 @11:58PM (#7800693) Homepage Journal
    What is Savahna?
    Why was it not online?
    Why should I care?
    Where's the rocketpacks? We were promised rocketpacks...
    • What is Savahna?
      Why was it not online?
      Why should I care?
      Why don't you RTFA?
      • There was an article? Oh man... Are there usually articles attached to these little blurbs? I knew I had to be missing SOMETHING... I just assumed everyone knew more than me.

    • Re:Questions (Score:5, Informative)

      by Anonymous Coward on Wednesday December 24, 2003 @12:15AM (#7800766)
      What is Savannah?

      Savannah is a sort of "home base" for GNU Project developers. They can set up web sites for their projects, CVS repositories, mailing lists, post want-ads for developers, etc.

      Why was it not online?

      Early this month / late last month the system was compromised in some way. I'm not sure if anything was actually damaged or not, but it's best to try to keep things as secure as possible. Hence it was taken offline, reinstalled, and new security procedures have been (and are being) developed.

      Why should I care?

      If you're not a GNU developer, it has little immediate impact on you. It's one of those "just sharing" stories. :-)

      Where's the rocketpacks?

      I don't know, but I know that I don't have them.

      • Savannah is not just for GNU developers; anyone can base their free software project there. It's just that Savannah itself is the official website for many GNU packages.

    • Answers (Score:5, Informative)

      by Anonymous Coward on Wednesday December 24, 2003 @12:19AM (#7800786)
      Savannah is GNU's answer to SourceForge. Some GNU people don't like some of SF's terms for usage, so they run their own sf-style site.

      It was offline because it was compromised, presumably by the brk() hole recently discovered in Linux 2.4.x. (Fixed in the latest version.)

      You should care because now the authors of your favorite GNU software can be more productive. It also has serious implications to Linux 2.4 security.

      I don't know anything about rocket packs.
    • Not only that, but I spent a minute on their websites and found nothing. What's a web site that doesn't tell its readers WHAT they are? Terrible.
      • "This web site (called Savannah) is a central point for development, distribution and maintenance of GNU Software."

        The first line at the top of http://savannah.gnu.org. What the fuck are you smoking?

    • Where's the rocketpacks? We were promised rocketpacks...
      Quake.ihoc.net [ihoc.net]! Rocketpacks for all since 1999.

  • Security ? (Score:2, Interesting)

    by fewnorms ( 630720 )
    And yet they still use Apache 1.3.26? Which by now is known to have some nice exploits and other faults ... no disrespect to apache here though, it's still far superior to that IIS crap.

    • Re:Security ? (Score:5, Informative)

      by damiam ( 409504 ) on Wednesday December 24, 2003 @12:31AM (#7800845)
      It's quite likely that that's a vendor version (from Debian stable?) that has had all relevant bugfixes and patches backported by the vendor. I really doubt they'd use the vanilla 1.3.26.
    • Debian backported the security fixes to its stable release of 1.3.26. I seem to be too tired to find a relevant link to support this. Sorry. I'm also too lazy to verify that Savannah is running Debian, but it's a pretty safe assumption I think.
    • No one in their right mind who wants to run a stable system updates versions to solve security problems; you use a patch against the version you are running. Things are less likely to break this way.

  • Thanks GNU we love YOU (Score:2, Insightful)

    by after ( 669640 )
    Awesome.

    Although, I wish Savannah had some sort of system where I could do installation of software similar in the way that FreeBSD does: the ports collection.

    There are a lot of cool program there that I use daily, and I would like to have them all upgraded and manageable through a simple collection of applications (like the package managers for the ports collection.)

    Either way, manager or no manager, there are some applications that I wanted to go get so Ill go do that now.

    Thanks GNU we love YOU.
    • Limiting a ports-like system to only Savannah-hosted projects would be of little utility. The joy of ports is that you can find every supported port, regardless of origin.
    • Simply noting that ports works well, and is powerful isn't a compelling reason to shift from RPM, apt, or whatever. Ports needs to be so much better than alternatives that people flock to it in it's own right.

      the *BSDs have a lot going for them, and ports is their crown jewel, but I'm getting tired of claims of superiority because they use a different packaging system. The one-command-line update of a system isn't unique to BSD, or even to Linux. RPM has yum (or up2date if you prefer), apt has apt-get,

  • Obligatory Stallman Lingo (Score:5, Funny)

    by toupsie ( 88295 ) on Wednesday December 24, 2003 @12:00AM (#7800702) Homepage
    Savannah wasn't hacked, it was GNU/0wn3d.

  • Xen for better speration then chroot? (Score:4, Interesting)

    by redhat421 ( 620779 ) * on Wednesday December 24, 2003 @12:01AM (#7800707)
    When I looks a intrusions like this, I wonder if using something like Xen [cam.ac.uk] is a perfect fit for protecting projects from each other

    or perhaps as a backup known good environment.

  • all security problems are resolved

    I rather doubt that. Perhaps all security problems of which the server administrators are aware have been resolved, but there are definitely going to be other security problems left.

    • Re:All security problems? (Score:1, Funny)

      by Anonymous Coward
      Thanks Mr Precise. We really couldn't have figured that out.

  • What took them so long? (Score:5, Informative)

    by keesh ( 202812 ) * on Wednesday December 24, 2003 @12:20AM (#7800793) Homepage
    It took them weeks to realise that they'd been owned and months to fix anything. I think they need a few lessons from the Gentoo people...
    • Because that's when they kept finding vulnerabilities in the cvs pserver
      • pserver??? Why pserver, which is unsecure by design? Why not ssh?

        I am not even asking why CVS, which was never designed for security at all. Well, in fact CVS was never designed at all - it was a set of patches to RCS. If you need a really well-thought and well-designed and well-implemented VS/CM you should check Aegis or upcoming Subversion.

        • I've been using Subversion for about 6 months and, other than the administration inconveniences of database changes (that are part of working with pre-1.0 software), I've been loving it. I also provide it to my customers as part of our $99/year software subscription and they've been loving it as well. Built-in web access through Apache 2 and the fact that you can do remote work over port 80 make it a pretty cool setup. If you've been using CVS, I have one thing to say: renaming files while retaining history
        • Actually, you should check out OpenCM [opencm.org]. (soon to make it's 1.0 release).

    • Re:What took them so long? (Score:4, Insightful)

      by Mr.Ned ( 79679 ) on Wednesday December 24, 2003 @12:08PM (#7802914)
      The Debian people, no slouches, didn't notice right away, and may not have if there hardware didn't react poorly to the rootkit. The Gentoo compromise was on a completely different scale - to restore the computer to working order, they just plowed the hard drive, reinstalled, and then copied the data from other mirrors. Unfortunately, this is not so easy for Savannah - they host a lot of projects and aren't just running rsync. Savannah wasn't just another mirror, it was the central repository.

  • Totally fixed! (Score:3, Insightful)

    by fm6 ( 162816 ) on Wednesday December 24, 2003 @12:24AM (#7800814) Homepage Journal
    ... all security problems are resolved ...
    That's the kind of sloppy thinking that got them in trouble in the first place. Try, "all known security problems are resolved"!!!

  • No LIDS? (Score:3, Interesting)

    by Malcontent ( 40834 ) on Wednesday December 24, 2003 @12:31AM (#7800849)
    Does anybody know why they didn't implement something like LIDS?

    • Debian amateurs (Score:3, Interesting)

      by Doc Ruby ( 173196 )
      What exactly is wrong with the packages server now? What are they doing to fix it, for so long? ETA? Why don't they put some info on the (disabled) homepage? Not exactly a system that my old Wall Street clients would rather move to, from Solaris.
  • Nothing like welcoming them back online with a good ol' slashdotting!

  • If only the same could be said... (Score:3, Interesting)

    by An Anonymous Hero ( 443895 ) on Wednesday December 24, 2003 @01:24AM (#7801023)
    ... of packages.debian.org [debian.org]

  • Whoops - wrong Savannah (Score:4, Funny)

    by Anomalous Cowturd ( 673181 ) on Wednesday December 24, 2003 @01:32AM (#7801047)

    As we can read here, savannah is back online. After several weeks of downtime, all security problems are resolved, and the service is again operational.
    So, was I the only person who read the headline, *and* the blurb, and immediately thought of something completely different? [goforit.com]

  • Debian still down (Score:1, Interesting)

    by Anonymous Coward
    I wonder what's cooking over at Debian. Everyone else seems to have gotten their services back up and running. Are GNU and Gentoo being too hasty or is Debian just being the slow boat as usual?

    • Re:Debian still down (Score:5, Interesting)

      by Ben Hutchings ( 4651 ) on Wednesday December 24, 2003 @08:01AM (#7801952) Homepage
      Debian has gradually been bringing services back online as the relevant files are verified and new passwords and keys generated. They are also tightening security in some ways, e.g. dropping pserver access to CVS servers. Alioth and www.debian.org are the latest services to be restored.

  • GNU FTP mirror (Score:1, Interesting)

    by Anonymous Coward
    Does anyone know when some of the "RSN" (Real Soon Now) files will be back on the GNU FTP archive? Some files have been unavailable since August. Not sure if it's connected with this Savannah thing.
  • I was looking for a pub cvs + bug tracker service a while ago and this reminds me.

    Are there any alternatives to sf.net and savannah around? I like the feature list of sf but the web-interface is a nightmare, esp. the bugtracker.

    Can anyone recommend a good bugtracker (service or software)?

  • grsecurity? (Score:4, Informative)

    by curious.corn ( 167387 ) on Wednesday December 24, 2003 @08:19AM (#7801994)
    grsecurity [grsecurity.net] is a promising mechanism to un-root a linux kernel based system: ipaddr, user or group based roles open or deny access to privileged operations without ever having uid=0 to begin with. It's a bit complicated to use but the system can auto-learn and generate these policies. Also, the system includes PaX [virtualave.net] which does some neat things like scramble the stack to thwart buffer overflows, non executable pages, etc... I've played with both (well, Mandrake secure kernels have grsec compiled in, not shure about pax) and although I still can't figure out (read: "ready made & nicely packaged ;-)") all of it but it does give the warm & fuzzy feeling it makes a difference...

  • ...they provide extra tasty-crispy secuity.

  • That's not what I call "back online" (Score:4, Interesting)

    by Fefe ( 6964 ) on Wednesday December 24, 2003 @09:26AM (#7802185) Homepage
    a) they firewalled ICMP echo (WTF?!?)
    b) cvs pserver is not available and apparently never will be again. So I went through my checked out gcc source tree and changed all the CVS/Root files to their new scheme, but it didn't work, "directory not found".
    c) I would have double checked with the webcvs, but that's also not operational.
    d) The other option would have been to download a snapshot from the download area, but the download areas are also not available. OK ok, for gcc the download area is somewhere else, but for all the other projects?!

    This begs the question: what _is_ back online? The web server with the note that they are back online?

    So they discovered that pserver has security bugs. No, really? The solution is to provide pserver cvs in a chroot with a uid that can't write anything and maybe use systrace to disallow nasty operations.

    Sorry, folks, but I don't like people who discontinue all the important features and then say it's for security reasons. That's bullshit.
    I would help, but I didn't see them asking for help anywhere.
    • a) they firewalled ICMP echo (WTF?!?)

      I imagine the thinking goes "ha ha! we no longer provide a useful diagnostic as required by the standard. There is no way they will know our computer is here now, despite running a high-profile service. Now everything is secure."

      It's the same thinking that slashdot uses.

      Okay, in fairness, there are some well-respected security sites that do this also. Case in point: securityfocus.com, which hosts the bugtraq mailing list. I still think it's a stupid idea, though.

  • How do you bring a dead porn star [iafd.com] back online??

Slashdot Top Deals

It is easier to write an incorrect program than understand a correct one.

Close