[OhSoHumble]

It's hard to maintain open source software that needs infrastructure. Everyone is a volunteer and it's not like the Mandriva project has the resources to fully vet people as well as have a high quality RBAC and access control system. This guy sounds like maintained a large project, offered to help, and Mandriva saw the Trojan horse as a way to alleviate a lot of their problems.

And it didn't sound like he was able to "nuke everything" - it sounds like he had access to their repository infrastructure (which is reasonable given he was volunteering to host it) and then lashed out.

If anything, I think it's a bigger organizational red flag that they agreed to privately host their source code on some random git forge and not a larger, more communal one. I mean, even if they didn't want to use GitHub (did this even cost money for them) then there are other providers to choose from.

It just sounds like the Mandriva maintainers are trusting and good folk who may be overworked running an open source project and that led to a bad apple entering the bunch. It's hard for me to be mad in that kind of situation.

[account42]

> the Trojan horse

I don't think that categorization is warranted - at least the linked announcement doesn't give any indication that the guy joined with the intent to cause trouble and its only after his friend got in trouble that he misused the access he had. No amount of vetting can prevent something like that entirely and only disconnected backups (thanks, git) will help you in the end.

> If anything, I think it's a bigger organizational red flag that they agreed to privately host their source code on some random git forge and not a larger, more communal one.

Did they agree to it? The linked post only says that it was offered and being discussed.

> even if they didn't want to use GitHub (did this even cost money for them)

Money is hardly the only reason why an open source project could have a problem with using GitHub.

[crote]

That's the thing: according to the post he offered it, but the offer wasn't accepted. They stayed on Github, and it was the Github repos which were compromised. They did entertain his desire to let him host a read-only mirror - but that's hardly critical, and having complete strangers mirroring Linux ISOs or package repos has been a thing for ages.

The post makes zero mention of him ever joining or being part of the core infra ops team. So where did the admin access come from?

[_notreallyme_]

I don't know if this is the case here, but I have witnessed several instances in the open source community where someone offer to help with a boring/fastidious task and some temporary admin privileges are granted to them in order to make it easier.

But then, temporary become permanent because either the task never complete or because people just forgot. It's always when the problems start to appear that the temporary privileges are finally revoked.

In my case the problems were mostly due to incompetence, but sometimes a malicious action happens...

[lenerdenator]

> It just sounds like the Mandriva maintainers are trusting and good folk who may be overworked running an open source project and that led to a bad apple entering the bunch. It's hard for me to be mad in that kind of situation.

It's hard to be mad, but people in FLOSS need to start taking this sort of cautionary tale to heart, particularly when it comes to Linux distros.

If you don't have a good way to sustain maintenance and development of a software project in the current era - one with LLM spam, social engineering, and apparently, jackass contributors - you need to start looking into ways to wrap the project up and focus your energies on more established projects that might need help.

I know that sounds mean, but this isn't just a hobby project anymore. This is an operating system. People put their entire lives on their computers. It's not a failure, you can do everything right and end up in a situation like we see here.

[account42]

People don't need to do anything when they are volunteering their free time - they can run a distro that is not up to your standards if they want to.

[lenerdenator]

Then I don't want to hear sob stories about how someone nuked half of the public repo, or how someone managed to put a backdoor in some low-level dependency that half of the world's servers rely on. I also don't want them to expect to be taken seriously, either.

It's not the 00s anymore. You are not special if you can post code that compiles to a central repository where people can duplicate and modify it. There are entire colleges in most developed nations that have 18-year-olds who can do the same thing now. The key to being taken seriously is figuring out how to do that sustainably and responsibly.

[phantompeace]

Why did you consciously click into this article and comments section if you don't want to hear about it? You're free to scroll on at any time.