Devuan, April Fools, and self-destruction

An April Fools joke that went sour seems to be at least the proximate cause for a rather large upheaval in the Devuan community. For much of April 1 (or March 31 depending on time zone), the Devuan web site looked like it had been taken over by attackers, which was worrisome to many, but it was all a prank. The joke was clever, way over the top, unprofessional, or some combination of those, depending on who is describing it, but the incident and the threads on the devuan-dev mailing list have led to rancor, resignations, calls for resignations, and more.

Devuan was famously announced in 2014, after the Debian Technical Committee decided on systemd as the default init; Devuan is meant as an alternative Debian without systemd. It has made two releases since its inception, based on the Debian 8.0 ("jessie") and 9.0 ("stretch") releases. Devuan has gone its own way with code names since jessie, however, with "ASCII" as the name for the release based on 9.0 and "Beowulf" for the under-development version based on Debian 10.0 ("buster").

The split with Debian was rather acrimonious, with lots of heated rhetoric on both sides, but since then things have largely settled down. The two distributions have gone their separate ways, kept to their own mailing lists for the most part, and both kept working on their releases, package maintenance, and the like. There have even been some signs of rapprochement between some members of the two communities, in part to ensure that Debian's support for System V init (sysvinit) did not wither and die.

Attackers?

But on March 31, "stanz" posted a note to devuan-dev noting that the home page was redirected to one that claimed the site had been "pwned" by a group called the "green hat hackers" (Wayback Machine capture). Among the messages on the page, which included ASCII art of the green hat hackers "logo" and a great deal of promotion for the Gopher protocol, was: "WE TURNED ALL DEVUAN'S SHITTY WEBSITES INTO PROPER GOPHERHOLES". The response from Enzo "KatolaZ" Nicosia, who is one of the Caretakers of Devuan and one of its most active contributors, was even more worrisome:

That set off a bit of a panic on the list along with posts showing up on Reddit and Slashdot. Some immediately suspected it was an April Fool's prank and there were certainly some clues to that (two "prime" numbers were actually Unix timestamps that pointed to April 1 UTC dates in 1970 and 2019). But the fact that Nicosia was prolonging the "joke" (there are a couple of other messages like that in the thread) likely worsened the problem. He did eventually admit to the prank on the list.

That admission led to some technical admiration for the work that Nicosia had done but also to some predictable complaints about the whole affair. Joking about a security incident for a distribution's infrastructure is no laughing matter in many circles. The "joke" explanation could also be covering up a real attack or real attackers might have been able to take advantage of the chaos to actually compromise Devuan in some way. When the Devuan web sites were restored, Nicosia did apologize as part of the restoration announcement:

In that message, he also made it clear that no attack had taken place and that no Devuan servers were compromised. Another of the Devuan Caretakers, "Evilham", posted a note to try to calm things down a bit, while acknowledging that the trustworthiness of Devuan was severely negatively impacted by this action. Mike Bird suggested legal action against the perpetrator and for Devuan to completely rebuild its infrastructure, replacing the existing security tokens and keys. Bird's larger point is that Nicosia has "proven himself unworthy of trust" so it is hard to be sure his explanation of the incident is valid. Others reject that, including Evilham, who wrote:

Another of the Caretakers, Denis "Jaromil" Roio, who was also one of the early leaders and a member of the Veteran Unix Admins (VUA) group that founded Devuan, also posted to the list. He explained that it was "the most [skillful] prank I've witnessed in my life", that Devuan comes with no warranty, and that Nicosia has been "by far the developer making the most significant contributions to this project". He found the attacks on Nicosia to be unwarranted. That did not pacify Bird, whose aggressive responses eventually led Roio to put him in the moderation queue. But there were still some other rumblings of discontent, though many, perhaps most, were mollified by the apology from Nicosia.

Nicosia steps away

In any case, however, Nicosia posted on April 11 that he was stepping away from the project:

He suggested that readers of his post not reply to it and to spend that time making Devuan better instead. As might be guessed, though, people were unable to resist replying, generally in support of Nicosia, with the occasional complaint about the "attack". But then things took a turn for the worse, when Roio accused yet another Caretaker, Daniel Reurich ("Centurion" or "CenturionDan"), of being the reason behind Nicosia stepping down:

For his part, Reurich replied in the thread that he was concerned with how the joke/attack looked to outsiders, particularly businesses that use Devuan:

Reurich continued, saying that he had withdrawn that request for resignation, though he made some additional comments in the private thread that "continued to stoke the fire". He apologized to the Devuan community and to Roio, as well as making it clear he would welcome Nicosia back. Reurich concluded with a plea rather similar to Nicosia's:

Part of the underlying problem here seems to be the tension between those who are using Devuan for production servers for themselves or their customers and those who are part of the project, at least partly, to have fun. Reurich seems to be in the business camp, while Nicosia leans more toward the fun side of things. Roio seems to be trying to find some middle ground, but his response to Reurich did little to bury the hatchet. Roio accepted the apology, but felt it was insufficient. In the meantime, he created a new web site that is meant to list those providing professional, enterprise support for Devuan; it is meant to "clearly separate community efforts from commercial ones and establish a clear relationship between the two", he said.

After that, things seemingly spiraled out of control. Reurich did an upgrade on the continuous integration host that went awry and his explanation of that seemingly intermingled private messages from the Caretakers' mailing list. Roio took exception to much of what Reurich had said, which led Reurich to consider resigning from the project. Most of the posts in reply to that were supportive of Reurich and of him remaining in the project, though Roio's response was not particularly welcoming to that idea.

There is a lot of drama, which, for the most part, Nicosia has stayed out of (as he said that he planned to do when he stepped away). He has popped up a time or two, mostly to suggest participants in the threads find better things to do with their time—hopefully by working on Devuan. But the project is already down one Caretaker and another may be on his way out, which is not likely to be good for the project. It is a bit ironic that an action meant to put a smile on people's faces—however misguided that may have been—has led to something of a crisis for Devuan.