Re: Debian Server Compromise -- A Fire Drill ??
On Fri, 5 Dec 2003 00:48:58 +0000
ben_foley@web.de wrote:
> On Thu, Dec 04, 2003 at 04:57:55PM -0500, ScruLoose wrote:
> > On Thu, Dec 04, 2003 at 01:50:35PM -0700, Dave wrote:
> > > On Thu, 04 Dec 2003 20:20:21 +0100, Terry Hancock <hancock@anansispaceworks.com> wrote:
> >
who benefits from the publicity
> surrounding this? there's got to be a reason why no calling card was
> left, i.e., the caller has a vested interest in not claiming credit,
> which would tend to suggest a contract job. as to the issue of whether
> the attacker had previous knowledge of the debian servers, only a fool
> wouldn't do everything to acquaint him/herself with the environment
> where they plan to engage in mischief.
In detection, this is the crux,-who benefits.
In this scenario, I believe that it is those who are incapable of surviving within the level playing field environment.
The first thing to be compromised in this situation is Debians' reputation for security. Has anything else been found? Planted?
If you are incapable of raising your own standard, you lower the reputation of the opposition. Thus far, that is the only thing the enemy has achieved. Perhaps that is the only thing they were after.
But, we will not assume that.
>
> given the regular stream of ridiculous garbage coming from redmond about linux, while new holes are found in their os and apps on an almost weekly basis, this seems like the next stage in the
> campaign to buttress the losses they've been taking all the while linux
> has found favor. apart from the money issue, linux, and particularly debian,
> represents the absolute opposite to their culture. this distro, as a
> product of volunteerism on the part of people who have nothing to gain
> apart from their own satisfaction in making the thing work, represents a
> huge philosophical challenge to those who view the world in terms of how
> much they can extract from it.
>
> the attacks are, on
> the one hand, a wake-up call, but, on the other, a statement from the
> opposition that proves both the significance and the ascendance of human
> cooperation as a power, with no other incentive in mind than to do the
> best that can be done.
There is another statement here that is actually a positive for Debian.
The action is an admission that the enemy is incapable of competing within the level playing field environment.
The negative is that they cannot afford to stop at this stage. They will come again, and not necessarily from the same direction.
>
> on the subject of disclosure of methods, i've been trusting the team for
> almost five years, since i first came across debian. i have no reason
> not to trust them now. i'm amazed at the speed of the recovery, given
> that everything that had to be done was done by folks who do this in
> their spare time. my thanks and respect. debian keeps on rockin'.
>
> ben
>
Regards,
David.
Reply to: