Hacker News Reader

Comment by corobo | Hacker News Reader

It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.

View on HN

It looks like they have a dump of the Fosshub user database.

Audacity was also affected: http://www.audacityteam.org/hacked-download/

Damn. You have no idea how close I was to reinstalling Audacity last night.

Downloaded it a couple days ago in my case! Close call, though I do backup my important files offsite.

I keep two offsite backups!

It sounds to me like one or two people reused passwords between fosshub and some other site that had its database breached.

In FossHub statement on reddit they said that they think they got credentials that were saved inside Redis through probably a zero day exploit. Probably something to be verified

I also hate that Fosshub doesn't even use HTTPS, even though they could get a Let's Encrypt certificate for free. They only offer file signatures, but even those are MD5 and SHA1, and both types should've been deprecated a while ago.

I don't see much value in published file hashes when they're hosted on the same site that hosts the files. If someone compromises the download link they're probably in a good position to update the hashes too.

The purpose of the hashes isn't to prove the file hasn't been tampered with, its confirm that the file wasn't corrupted during download.

Then just use checksum instead of an obsolete cryptographic hash.

Reply on news.ycombinator.com