Novell OpenSUSE Server Hacked

abelikoff writes "Both LinuxWorld Australia and SuSE Linux Forums report that OpenSUSE website got hacked last night." This story was submitted quite a number of times.

Don't blame LINUX

[Work Account]

People always try to blame the software right away but usually it's poor administration.

Linux is near-flawless in terms of security.

Re:Don't blame LINUX

[Anonymous Coward]

"Linux is near-flawless in terms of security."

so it could have been a linux flaw...
buy you're right, on most pc's the weakest link is the user...

Practical upshot? Am I safe?

[thc69]

Pardon my obvious post-placement, trying to get this near the top and visible, but I suspect this is an important question for people to see, assuming answers are posted:

What is the practical upshot of all this? Is the damage limited to the "Give us nuclear rights" web defacement, or was that just a front to make people think nothing else was damaged?

I'm running SuSe 9.3, and this morning, I let the automated update program do it's thing. Did I download and install any breached files?

TFA don't say anything.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Practical upshot? Am I safe?

[Spudley]

No. It was just the WiKi server that went down.

My question is: Why bother hacking a Wiki? Can't you just make your own changes to it anyway?

Re:

[account_deleted]

Comment removed based on user account deletion

Re:Practical upshot? Am I safe?

[_Sprocket_]

Way to hijack a conversation. :P

Your call for isolationism has a certain appeal. I'm generally a believer that far too many people are overly concerned with whats going on in their neighbor's yard. However, isolationism is not a panacea. Interestingly enough, the US' involvement in the Middle East began within decades of the formation of the US in the form of the Barbary Wars even though the new US Government often expressed a belief in isolationism. Yet they soon discovered that the US interacted in the world around them and could not be separate from it.

That's not to say that the US hasn't managed periods of isolationist policies. US history shows some remarkable stretches of isolationism. But such policies only served to create the hardest lesson in recent US history - World War II. The cost associated with World War II was only increased by attempts to limit direct involvement of the US in what was viewed to be an European affair (although Europeans themselves also contributed with their own reluctance to act).

World War II leads directly in to the Cold War and the US' attempts to curtail Soviet influence. And perhaps that is where the US commits the sins we will be paying for today and tomorrow. Although I find it rather interesting that when critics of US policy point to various fumbles and embarrassments, they fail to note Soviet involvement. Which isn't to say that the US is excused for their actions - but rather some perspective would provide a better understanding of why things were done.

So does the US have a "right" to dictate to others what they can and can not do? Hardly. There is such a thing as a sovereignty. But to claim that the US should have no involvement in the world around it is simply setting up the US to become victim to the day when its people and shores are under attack. I hate to sound anything like the Bush Administration. Yet there are certainly others who have less qualms about rights than the US. And history shows how that turns out for anyone who ignores it.

On Iraq, I mostly agree. The current Administration's handling of the situation is unsettling, to say the least. There seems to be a certain degree of willful ignorance and a lack of understanding and planning that shows itself not only in foreign policy, but domestic policy too.

However, Iraq was bound to happen. While critics of the Bush Administration are, more or less, right to criticize the reasoning given for this war - they tend to gloss over the fact that the Iraq war comes at an end of a CEASE FIRE agreed to in the early '90s. No folks, this is not a new thing; US military personnel have been in the region maintaining vigilance for over a decade without daily CNN coverage. That entire time is under a state of war. And during that time, Saddam willfully defied UN mandates and conditions of that cease fire agreement.

Yet Saddam was probably not intended to stay in power. The Senior Bush was wise enough to not completely dismantle the world's fourth largest standing army, and create a vacuum for neighboring influence (such as Iran). And it was probably wise to try and void the troubles we are facing today by giving the Iraqi people a chance to handle Saddam themselves. But Saddam is exceptionally gifted at survival (and also ruthlessly brutal). It would take direct involvement to remove Saddam's regime after all.

There might be a slim chance that the Iraqi government to be will become a secular democracy, with enough economic power behind it to flourish. There are possible echoes of Germany and Japan. But the reality is that the odds are against this happening. Partly due to external influences. And (arguably) largely due to the planning of the Bush Administration.

What about Iran? I don't find it too surprising that Iran's intentions meet a certain degree of skepticism. It seems odd that Iran's quest for energy would have to involve a process that can be directly applied to acquiring massively powerful weapons when it is itself the World's fourth largest producer of fossil fuel (right behind the US - Iraq is at 14th) as well as having ample opportunity to develop other alternative (and less dangerous) alternative energy systems.

Re:Practical upshot? Am I safe?

[darco]

> Because it is not a good source of energy in its present state.

That would explain why the French and Japanese have abandoned it.

Nuclear power is orders of magnitude safer than it was decades ago. I'd much rather have a source of energy with a waste that I can dispose of in a controlled fashion rather than one which pours pollutants into the air we breathe. The only reason we don't use more nuclear energy here in the US is because of politics, not science or practicality.

Not to say anything about Iran h

Re:Don't blame LINUX

[grub]

Linux is near-flawless in terms of security.

You don't follow security mailing lists, do you? Most Linux distros have decent security but "near-flawless"?

Re:Don't blame LINUX

[Reziac]

Just for reference... Netcraft says the site was running Apache/2.0.49 for Linux/SuSE.

Which part actually got hacked, the OS or the webserver itself??

Re:Don't blame LINUX

[grub]

Which part actually got hacked, the OS or the webserver itself??

Only those Iranians and the SUSE people know :) Regardless, running something like OpenBSD with its hardened & chroot'd apache could mitigate a lot of the damage. ie.: make most files read only to the httpd process, etc etc.

Re:Don't blame LINUX

[ScrewMaster]

The problem comes in when you are, yourself, an OS vendor. It's really hard (from a marketing/PR perspective) to have your site run a BSD when you happen to sell a major Linux distro. Or have a major online service you bought run Solaris when you happen to make Windows, for that matter. Customers (and potential customers) will rightfully wonder why you don't have confidence in your own product.

Re:Don't blame LINUX

[burnin1965]

Well, actually you can take the same steps in linux to mitigate damage when you server is comprimised. But more importantly, it has more to do with taking those steps than running BSD versus linux. Before you start flaming take a look for yourself....

http://defaced.projectgamma.com/ [projectgamma.com]
http://www.zone-h.com/en/defacements [zone-h.com]

burnin

Re:Don't blame LINUX

[henni16]

Which part actually got hacked, the OS or the webserver itself??

Didn't RTFA but another poster mentionend something like "the Wiki server was hacked".
So I would put my money on an exploit of one of the recent Twiki vulnerabilities.
I know some websites that got hacked because of them.

near-flawless?

[nurb432]

No modern OS is flawless. Due to feature creep and the massive amounts of code involved, none can really be considered 'near flawless'. ( agreed, some are better then others )

Its the job of the administrators to mitigate and compensate for known, and unknown, security flaws.

Re:Don't blame LINUX

[LittLe3Lue]

Nor does he follow history very well.

If there is one thing we can learn from history, its that anything flawless in its day has been prooven flawed eventually.

In the computer world its only that much more of a smack in the face.

Linux exploits are found all the time, and yes, maybe they are found less often, or fixed faster than on other operating systems (..maybe..) but they exist, and always will.

Don't Blame Windows

[Anonymous Coward]

People always try to blame the software right away but usually it's poor administration.

Re:Don't blame LINUX

[dasunt]

People always try to blame the software right away but usually it's poor administration.

Isn't this the same flaw Windows has?

Hey,

[Create an Account]

Your logic and reason are not welcome here.

Re:Don't blame LINUX

[at_slashdot]

"Isn't this the same flaw Windows has?"

Yes. But it's not the only one. Many people can say "I know how to configure Windows, I didn't get any virus or worm yet"

I just say: wait till you get hit (it's "when" not "if") and then that will shatter any confidence you have in Windows and in your ability to secure it.

Re:Don't blame LINUX

[Digital Dharma]

Actually, I disagree. I've been running Windows networks for over a decade without a single virus or spyware infection. Interestingly, we've had a nearly identical amount of successful hacks on both our web-facing Windows and Linux machines. I would say I'm pretty much on par with the Linux admin in terms of skills and knowledge, and we are both in agreeance that no matter what you do, eventually you will get hacked. Just like you will eventually be a victim of some sort of crime in the Real World, if you s

Re:Don't blame LINUX

[_Sprocket_]

Yes, it is the same flaw. But don't worry. I understand that with all the new work in pricing schemes, DRM, aggressive disregard for industry changes, etc Microsoft will be eliminating a large number of users (and thus Admins), thus creating a much more secure Windows environment.

How secure by default?

[starfishsystems]

Isn't this [poor administration] the same flaw Windows has?

It's a reasonable question to ask.

Yes, fundamentally it's true that configuration management has a significant effect on security. To be precise, this is not a flaw, but a characteristic. A site which is in full control of system configuration will have formal security advantages over one which isn't, and this is universally true regardless of platform.

However, the story is told from a much different perspective when it comes to evaluating the security of a given platform. Configuration remains a major factor in security, but it has to be weighed in light of platform capability. So, for example, a very simple network appliance with a very small configuration space has the prospect of being very secure. An ideal appliance cannot be configured insecurely. In practice, that may or not be the case, depending as always on design tradeoffs and correctness of implementation.

Apart from pure appliances, all computing platforms must, for reasons of generality, offer configuration possibilities that put some security tradeoffs in the hands of site administrators. Such is the case for both Linux and Windows, so indeed poor administration can always result in poor security on a sufficiently general platform.

The practical focus, therefore, has turned to how securely these platforms are configured by default. Interestingly, even though Windows is marketed for nonexpert use, it has a long tradition of being configured insecure by default, exactly the opposite of what would be appropriate for a nonexpert market. It also, in my opinion, embodies a lot of fundamentally insecure design tradeoffs, neglecting principles such as modularity, containment, and least privilege, for example. These are extremely deep design problems, not easily fixed.

Linux and Unix, although designed by developers for developers, and therefore intended for expert use, have a record of delivering much better security by default. I can think of lots of particular exceptions, but they have tended to be minor design tradeoffs that could be, and were, easily corrected. Security incident statistics seem to reinforce these observations very strongly.

In my line of work, I get to see what goes on behind the scenes at a lot of sites. It's not often that I come upon a site which is not suffering to some significant degree from a chronic neglect of configuration management. All discussion of platform characteristics aside, this is a real problem on the ground for security.

The issue, in terms of value for effort, then becomes to identify which of these sites is (a) at most immediate risk, and (b) has the best potential of improvement. In the former case, I find that the answer is Windows, and in the latter, it's Linux.

Don't blame Windows

[goMac2500]

People always try to blame the software right away but usually it's poor administration. Windows is near-flawless in terms of security. Sound familiar?

Re:Don't blame LINUX

[dave420]

Where are people like you when someone's harping on about microsoft security issues? :-P

Re:Don't blame LINUX

[$RANDOMLUSER]

Um, did he just use the word fanboy in a perjorative context?

Re:Don't blame LINUX

[imipak]

Hilarious, thanks for the best laugh I've had all week! :D

*sigh*

[the-amazing-blob]

I still will never understand why people do stupid things like hack websites.

Re:*sigh*

[EvilMonkeySlayer]

I've yet to understand what they said. The grammar and spelling were atrocious.

I got a translation right here:

[SmallFurryCreature]

Thanks to being nerds AND locked in country with extreme muslim laws we are never EVER going to loose our virginity, not even to the goats, so we are going to bug harmless sites to convince the rest of the world that not only we shouldn't have nuclear reactors, we shouldn't have internet access either.

Re:*sigh*

[jupiter909]

Hacking websites is not stupid. It's proof of concept. It is often good when people hack/crack things, it forces for tighter control and security. If not for people hacking and cracking things we would not have things such as online shopping and ssh encrpytion etc. It is all part of a never ended life cycle. More often than not it is poor management/admin than the software/systems themselves. Human error.

Re:*sigh*

[the-amazing-blob]

But if nobody hacked anything, there wouldn't be a need for better security.

I'm too idealist for my own good.

Re:*sigh*

[gowen]

You know, murders are good too, because they encourage us to employ smarter policemen and develop better forensic science.

It doesn't take a genius...

[itistoday]

to understand why people hack websites. Here, I'll list out some possibilities for you:

• Bragging rights
• Revenge
• Getting a message across (free advertising)
• etc. etc.

ouch

[Anonymous Coward]

They could just run OpenBSD [openbsd.org].

Re:ouch

[KillShill]

wouldn't it be more prudent to run CLOSEDBSD?

Re:ouch

[burnin1965]

I take it your admitting to be the Iranian hacker? You seem to be aware of a linux exploit which allowed you to hack into the opensuse.org web server.

Or I suppose its more likely you don't have a clue and there is a greater probability that the exploit was in the php application they were running on top of linux+apache and rather than being hacked the website was defaced.

And if that turns out to be the case then it would have made no difference whether they were running on linux, BSD, or any other OS. The s

Re:ouch

[DrSkwid]

Hmm let me see, run latest version, get owned or run older but audited version and keep control.

New features or safety

Safety or new features

gaw, what a choice!

Re:ouch

[Metzli]

Exactly how is OpenBSD "hopelessly obsolete?"

How does this help ?

[Anonymous Coward]

How does hacking this website help to put your voice ? Other than geeks, how many people check that website. If they had hacked CNN or BBC, it would have been noticed significantly. Soon this would go into oblivion. Makes me wonder what has nuclear progam to do with open source linux ?

Re:How does this help ?

[wetdirtmud]

I didn't know they had computers in Iran. Maybe they only use them for hacking, and not for checking up on news, or reading about the diffrences between Government Agencies and Operating Systems.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:How does this help ?

[WindBourne]

Because, this will make the regular news. That will include CNN, and BBC.

Why? because it does not happen often to a major linux site. It would be like having millions stolen from a site that runs a none Windows such as a unix site. It will make news just because it is none windows.

Rights or not

[michaelzhao]

The Iranian hackers should first learn English. I was banging my head on the table reading that grammatically incorrect junk.

Re:Rights or not

[meadandale]

"All your uranium are belong to us!"

Step away from the fissionable material...It is obviously causing you brain damage.

Re:Rights or not

[dustmite]

Right, so how good is your Arabic again?

Re:Rights or not

[Halfbaked Plan]

Probably, if he hacks an Arabic site and plans to blather on the pages, he'll have a competent Arabic speaker help compose the text. Really, that's the point.

Re:Rights or not

[klykken]

You might have confused the Arabic language with the Persian language (Farsi). They share the same alphabet but are entirely different.

Re:Rights or not

[ratbag]

So I realize it's a joke and everything, but the official Iranian language is not Arabic. Rather it is Persian [wikipedia.org].

Rob.

Re:Rights or not

[Otter]

Often, that's a good comeback, but this time...the crackers' message is in English. michaelzhao's response is in English. Where does Arabic come into the equation?

Especially since Iranians a) speak Farsi, not Arabic, and b) aren't Arabs.

how rude.....

[The_Candyman]

Of corse this had to happen just a few days before OpenSuSe released the latest version 10.0 final. Now I'm assuming that there will be a delay there to make sure nobody added any "extra" software. I've been waiting for it to come out since I tried beta 1 of 10.0.

Re:how rude.....

[SpooForBrains]

Or, looked at another way, pretty awesome way to get a whole bunch of extra visitors to ones website ...

I'm convinced!

[Necrotica]

The US and EU better let Iran develop a nuclear energy program or these senseless acts of web terrorism will never stop!

Novell Wiki was hacked too.

[Utopia]

http://wiki.novell.com/ [novell.com]
Site is currently down.

Details of the hack?

[Trigulus]

Was this a targeted attack? Did they just fall victim to a script? Unpatched vulnerability? Weak password? what? Im just asking cause none of the links provided answer this.

Re:Details of the hack?

[DrSkwid]

passwords are weak by design

ssh scan

[perp]

This server probably had a weak root password and was hacked by one of the several automated ssh bruteforcers out there http://www.linux.com/article.pl?sid=05/09/15/16552 34 [linux.com]

I see these attacks all the time on all Internet facing servers.

Lol thanks, that explains a lot of log entries

[SmallFurryCreature]

Got some really weird attempts to login on ssh from egypt. Nothing special except it did seem odd to try to do this with SSH seeing has how any sensible person would use keys, if you still have to guess the username AND then a 3kb key I wish you good luck.

Goes to show that you always need to check your machine. I had no need for remote ssh access so why did I leave it enabled.

Oh well, luckily I have no business with the arab nations so they are now all banned. Blame the ISP in question for not reacting.

Re:Lol thanks, that explains a lot of log entries

[rve]

Iran is not an arab nation!

sshd should ofcourse be all:deny except a list of IP's you trust, and not allow:all except a list of IP's you don't trust.

Re:ssh scan

[schon]

Why the hell do they allow root logins over SSH in the first place?

Any security admin worth their salt would have turned this off when it was installed - not to reduce break-ins (although it does help mitigate a weak root password), but to provide an audit trail for people who are allowed to use root.

*sigh*

Re:ssh scan

[Homology]

Why the hell do they allow root logins over SSH in the first place?

Yeah, much better with a bunch of sudo-users so instead one root password you now have bunch of them. Besides, they should disable password login in any case.

Re:ssh scan

[Dave2 Wickham]

SSH in as user, then su. Adds an extra layer of security to get through, provided there's no easy writable suid file and any root apps are kept up to date, and that kind of attack is harder to automate.

Re:ssh scan

[DeadMeat (TM)]

Why the hell do they allow root logins over SSH in the first place?

Allowing or disallowing root logins is configurable in OpenSSH. Incidentally, SuSE ships with root login over SSH disabled by default.

Re:ssh scan

[jaclu]

I have a hard time to see the gain in security by disalowing root but allowing users to login and then sudo.

In the case of three admins, you would end up with three accounts that could be exploited, rather increasing if anything the risk of direct ssh exploits.

Once the bad guy is in, he has all the local exploit possibilities to gain root, so your already in trouble if they get in.

So as long as you do ssh with passwords, disalowing root-login dosent really buy you any security, but it hassels the admins each and every day.

On the other hand, prefered method would be to login with keys and disallow passwords completely whenever possible.

Re:ssh scan

[Gogo0]

Part of the security comes from non-root logins being unknown.

One could try to use a non-root user to bruteforce their way into my system, but they'll either get one (probably created by an application) with /dev/null as a shell or they will be trying usernames that dont exist.

Re:ssh scan

[despisethesun]

I have a hard time to see the gain in security by disalowing root but allowing users to login and then sudo.

You must not have much experience with sudo. One of the benefits of it is that it allows you to give root permission to people for specific tasks that they would need that access level for. While there are certainly a lot of people who set their sudoers file to "allow all" for everyone, if sudo is properly implemented no one should be able to do anything they don't NEED to do as root. Sudo also has the benefit of keeping track of what users used it to do what tasks, making it easier to trace the path an attack came from.

Gogo0 also mentioned an added benefit to this scheme so I'm not going to repeat it here.

Re:ssh scan

[drsmithy]

I have a hard time to see the gain in security by disalowing root but allowing users to login and then sudo.

The two biggies are greater control over what can and can't be executed with root privileges and an audit trail.

Re:ssh scan

[Nikademus]

That means, they were not smart enough to:
1: change default ssh port
2: disallow direct root logins via ssh

Those 2 simple principles prevent many things.

Re:ssh scan

[VStrider]

and last but not least

3. install a port knocking [portknocking.org] daemon, like fwknop [cipherdyne.org], or knockd [zeroflux.org]

Re:ssh scan

[nlinecomputers]

Well I disable root access to that, use only ssh2, use keys, use deny all users/allow only users to limit who can logon, and use a nonstandard port.

Not perfect but works well for me.

Re:echo "PermitRootLogin no" /etc/ssh/sshd_config

[mark_lybarger]

might wanna work on your syntax a bit before posting suggestions like that.my machine responds with: PermitRootLogin ermitRootLogin no /etc/ssh/sshd_config now with something like: echo "PermitRootLogin no" >> /etc/ssh/sshd_config maybe you'll get the job done. but then again, maybe not.

different hacks, different times

[sjvn]

The LinuxWorld Australia story is actually about an earlier break-in of a Novell system that was being used for World of Warcraft related stuff, not the OpenSUSE site at all.

Steven

OpenSUSE website Hacked? No.

[blanks]

The open SuSE website wasnt hacked, it was a damn gamming machine they had on their network.

From TFA:

"The employees that set it up apparently had no idea of security," Brandon said. "But what is really surprising is that Novell would allow employees to set up game servers on their corporate network and then allow the public to access it."

"There was no major breach of security here," Barney said. "Needless to say, we are taking the appropriate steps" to address the situation.

That IS the breach of security.

[khasim]

Allowing "users" to setup their own box, on your network, outside your firewall, using your IP address IS a breach of security.

Re:OpenSUSE website Hacked? No.

[gregorio]

The open SuSE website wasnt hacked, it was a damn gamming machine they had on their network.

From TFA:

Click the "hacked" link in the submitter's text.

No big deal

[LittleLebowskiUrbanA]

Looks like that SSH login/password brute force scanning attack that's been going for the past year or so. So some employees setup an easily SSH login on a gaming server? So what. Only part I can't figure out is why was the box public?

Re:No big deal

[Antique Geekmeister]

It's a gaming server: you need to make the IP addresses public, or at least make a tunnelable port on your external facing NAT address, to publish the server for others.

Such servers, even if allowed on a corporate network, should be in a locked down DMZ area of their network, and any such machines should not have the same logins or passwords as other machines. Public SSH key access is preferred if the machine has to have user accounts.

Re:No big deal

[LittleLebowskiUrbanA]

Agreed about the DMZ. Although as a sysadmin, I would not ever allow a gaming server on MY network.

This would not have happened if ...

[ravee]

This would not have happened if the people at Novell had used Ubuntu Linux. :)

They have a website

[gcnaddict]

the hacker team has a website [ihsteam.com] to add to that, its likely being hosted in iran so no one can do jack shit

Re:They have a website

[kd5ujz]

Now I have seen everything. A "Hacker" sight, that runs a packaged content managment setup and ad banners. Nothing against content managment scripts, but this is just unusual.

Nope, it isn't in Iran

[Toba82]

It's not being hosted in Iran. It's hosted in the US by Virtuoso Net Solutions inc. I sent this email to [e-mail] yesterday about 7 PM (I sent them my real info, obviously):

Dear Sir/Madam:
The OpenSuSE website was defaced either today or yesterday by an Iranian
hacker clan whose website is located on your servers. I checked the
whois data for the hacker clan's domain (ihsteam.com):

Majid NT
Bl Sajjad-milad 7 no. 12

Maybe they were just tired of the poor performance

[alhaz]

The OpenSuSE server has been sucking wind for weeks, and i know for a fact that trouble tickets have been submitted about it within Novell.

Maybe they were just trying to lend a hand with the administration . . . .

Blog of the hacker

[Vario]

The head of the defacement crew has a blog that is kind of interesting to look at: http://www.c0d3r.org/ [c0d3r.org]

He is a movie fan and was just accepted to a university.

Some bits of information can be found here:
http://www.zone-h.org/en/defacements/view/id=29173 90/ [zone-h.org]

Besides the OpenSuSE website they also hacked into wiki.novell.com and forge.novell.com.

Too bad that the Iranian hackers used OpenSuSE for their political stuff. It seems a bit misplaced, what does a linux distribution has to do with the question whether

Re:Blog of the hacker

[KillShill]

yes that is a very good question...

Told you so

[CSHARP123]

I had told novell not to run their websites on Windows OS. They wont listen. See now

Not Good for Iran

[KidSock]

Dear Hackers,

If you're going to hack websites, don't try to justify your idiotic hobby by turning it into a political posterboard. It has the opposite effect you're looking for. The thing that scares people most is unpredictable behavior. If Iran were calm, clear in stating there intentions, and followed all the diplomatic protocols with a smile there would be no way for anyone to stop them from builting reactors (wheather it be for processing fuel for weapons or not). But stupid stuff like this make Iranians look like evil subversives. Just look at the graphic they posted. It looks like the shadow of some kind of daemon with horns. This is not a good image for Iran.

Or if it's a different group impersonating iranians, you're just losers.

The SSH root password was god

[TehBeer]

let me guess, iptables not enabled, no firewall service up, no bfd, SSH was up unfiltered and the root pass was a 3 letter word like god, to quote the movie "hackers" with angelina jolie. Hack the gibson. Hack the planet. Go Iran. Just kidding.

Alot of people are reluctant to use a firewall, even though you can easily do it with SuSE and YaST2.

I have the pay version of SuSE9.3 Pro, which is well worth the $99 price tag.
I mostly run fedora core boxes though, and this is a really good alternative to other ipta

The public image of the open source community.

[CyricZ]

I think it is time for the open source community, as a whole, to better consider its public image. Incidents like this, involving one of the premiere Linux vendors, do unfortunately tarnish the image of our community quite badly. And then you have rogue open source developers publically insulting users [slashdot.org]. Such incidents make people remember open source software for all the wrong reasons.

Now, perhaps this is just a case of amateurs being allowed to join a community that mainly consisted of academics and professionals. The high standards that the open source community once enjoyed are being degraded on a daily basis by developers who cannot write secure code (ie. many PHP developers), by developers who blatantly insult and ridicule their users (ie. the KOffice example earlier in this post), or companies that provide insecure, open source-based products.

Is there much that can be done about this? I'm not sure.

Re:The public image of the open source community.

[CyricZ]

The insults themselves do not bother me. What bothers me is that he threw out those insults at a KOffice user while representing himself as a KOffice developer. That, obviously, does tarnish the image and reputation of the KOffice and KDE projects, and the entire open source community.

That incident would be no different than an Apple employee actively stating that he was working on iTunes, only to turn around and publically insult an iTunes user. It would make Apple look horrible.

Public insults are not the

Re:Oh sweet sweet irony...

[UWSarge]

If it was a website about Linux, it probably wouldn't even need to be hacked to make the front page of /. if it was running Windows

Re:Oh sweet sweet irony...

[$RANDOMLUSER]

The point is, it was a Suse website, running Suse that got hacked.
If a Microsoft windows 2003 site, running Windows 2003 was the victim, then yeah, I think it would make the front page.

Re:Oh sweet sweet irony...

[ArsenneLupin]

If a site running Windows Server 2003 was hacked, would it make the front page of /.?

No, it wouldn't. People would get pissed about having to dig through 100000 stories of "Yet another cheesy Windows server hacked" until they found a real story.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:Oh sweet sweet irony...

[MSG]

I'm pretty sure that when Microsoft's WindowsUpdate servers were cracked by a worm, it made the front page.

Re:script kiddies

[ettlz]

...any jackass can type "./the_great_script"...

Don't you mean ./t3h_l33t_5cr1pxx0r?

Re:Linux Secure By Design?

[scronline]

Speaking from personal experience, 85% of all hacks come from poor administration. ie. not patching flaws, weak passwords, poor security measure such as file permissions and lack of firewalls. The remaining 15% come from a mixture of things, and like it or not, 14.999% of that is Windows. Security through obscurity doesn't work when you have thousands of people pounding at your code just trying to find a way in.

All these Worms on the net is a perfect example. And when you get down to it, even some of the poor administration is Microsoft's fault for making it "so easy you don't need an experienced technician...." When in fact they bury stuff so deep unless you know where it is, the necessary changes don't get made leaving everything as default.

I can't even begin to count how many times I've gone to a customer's location where they had an employee that was a self proclaimed geek that did all the setup and everything was not only wrong, it opened gaping holes on their network. Including things like having a USER logging in as Administrator on the server and using it as a workstation.

Plus I won't go into all the people who hold an MCSE that never touched a computer until they went to a 2 week bootcamp on how to pass the tests.

But, point in fact, any closed source application is subject to flaws that don't get patched because it's a small enough flaw that putting a programmer on it to fix it would cost more than keeping the flaw hidden.

Re:Linux Secure By Design?

[william_w_bush]

Ok, I'm not sure the argument was ever that linux was secure by design. You need the best security, you should probably go secure solaris or openbsd.

The argument is not so much pro-linux, as much as it is "Windows? Are you fucking crazy?"

Linux can be very secure if configured and admin'd properly, and given the same resources far more secure than windows. The argument is that it's the closest to a mainstream alternative with market presence and a large application base.

Not holier than thou, just holier than

Re:Linux Secure By Design?

[slavemowgli]

"secure by design"? You're thinking of OpenBSD, not Linux. Not that Linux' security is bad, but the Linux kernel developers do not have the same paranoid attitude towards security that the OpenBSD developers have.

Re:As you can see

[LnxAddct]

It's a little worse than that. The IHS guys aren't just script kiddies, their lead guy's blog is here [c0d3r.org]. He is apparently very active in writing exploits and gives code to all of them. He was just accepted into a university, but worse, one of his blog entries is about how he likes slackware and is trying to write some code to help the project out. Now I don't know about you, but I find that suspicious as hell. Unless someone goes over every line of code submitted with a magnifying glass than it can be fairly easy to sneak in a little area for a buffer overflow or something. (Preventive measures like SELinux and exec-shield are necessary and even they don't fully solve the problem). I can only hope that the slackware community does decent background checks on submitters, and also good code checking. The last thing we need is for Open Source to start being purposely made vulnerable and attacked from within.
Regards,
Steve