Devuan, April Fools, and self-destruction

Posted Apr 25, 2019 17:50 UTC (Thu) by augustz (guest, #37348)
In reply to: Devuan, April Fools, and self-destruction by mgb
Parent article: Devuan, April Fools, and self-destruction

Wasn't the "temporary stunt software" static html in pre tags? It looked like the page was fully static. That might have actually resulted in a reduced attack surface?

Did you offer to pay for the audit of the system you felt was necessary or do it yourself, or was this a demand being made on a group of volunteers?

If you have this high level security need / worry in your business - I might suggest using a more commercially oriented / backed distribution.

It's seems a bit unfair to threaten a group of volunteers with jail time after choosing to use something they provided for free.

Devuan, April Fools, and self-destruction

Posted Apr 25, 2019 19:00 UTC (Thu) by mgb (guest, #3226) [Link] (3 responses)

> Did you offer to pay for the audit of the system you felt was necessary or do it yourself, or was this a demand being made on a group of volunteers?

One does not demand of F/LOSS volunteers.

If one no longer has an adequate level of trust one stops using that software.

Devuan, April Fools, and self-destruction

Posted Apr 26, 2019 11:40 UTC (Fri) by nix (subscriber, #2304) [Link] (2 responses)

Sorry, wasn't it you who said:

> I know nothing of Italian law but whether or not the incident
> should be referred for criminal prosecution is a question you
> should already be discussing with your lawyers or the police.

This seems inconsistent with your position here, that just stopping using it is enough.

Devuan, April Fools, and self-destruction

Posted Apr 26, 2019 12:30 UTC (Fri) by mgb (guest, #3226) [Link] (1 responses)

> This seems inconsistent with your position here, that just stopping using it is enough.

Devuan servers were compromised. Devuan devs were locked out. Devuan devs believed their servers had been hacked. Devuan devs took steps to disconnect other servers from the compromised servers.

What happened next was entirely Devuan's choice. They could have sought advice from their lawyers or the police. They could have audited or rebuilt their servers to ensure their integrity. Their choice was to do nothing.

The choice for Devuan users is different. If they no longer trust Devuan they can stop using it. That is the choice we made.

Everyone makes their own choices. Choices have consequences.

Devuan, April Fools, and self-destruction

Posted May 22, 2019 8:08 UTC (Wed) by rickmoen (subscriber, #6943) [Link]

Devuan servers were compromised.

No.

You have long been aware of this claim being flat-out incorrect, but keep repeating it. We were both there. (I'm not a Devuan Project insider, but am a longtime sympathetic participant with no horse in this race otherwise, as you probably recall.) As you are fully aware, exactly zero Devuan servers were compromised. One of the caretaker pretended, as the substance of a meticulously implemented, hilarious, and deeply unwise prank that they had been, and then revealed the prank within the customary one-day period, and then apologised for the unwise choice of prank framing (inside a supposed security breach).

The biggest damage was then done by, to be blunt, you and a few other people who flew off the handle and did the Internet-maximal-noise dance at great length and to stupefying effect. If you were hoping to be thanked for that, I fear you will be a long time waiting.

Rick Moen
rick@linuxmafia.com