OpenMandriva Exposes Attempted Distribution Sabotage by Trusted Contributor
OpenMandriva: Statement regarding attempted distribution sabotage
I am revealing a disturbing incident where Davide Beatrici, a contributor we trusted, sabotaged our distribution after a conflict. He deleted years of repository work on GitHub and published empty packages that could have broken user systems. We are now restoring our infrastructure and warning the open source community about his unacceptable actions to prevent others from making the same mistakes.
He deleted part of our repository from GitHub—things we'd been working on for many years, and I myself had been working on for a decade.
- crote
How did it go from "He even performed a backup/mirror of several dozen of our repositories." to "He deleted part of our repository from GitHub. (..) [He published] an empty package in the cooker repository, which obsoleted all gnome and cosmic packages."?
I feel like there's a few steps missing there. How does it go from "a new person joins the community" to "he's able to nuke everything"? Sure, he might be reasonably well-known, but in the post it doesn't sound like he was a core maintainer, or even a very active community member. Do they just randomly hand out admin access to anyone?
- whalesalad
TIL Mandriva/Mandrake Linux is still around.
- pndy
Nearly a month ago AUR malware happen, now this - it starts to feel like there's some organized attempt to paint Linux distros as dangerous.
- aforwardslash
I had no idea mandriva/openmandriva still existed. I still have a mandrake cd somewhere, mostly because I cannot seem to be able to depart from physical media :)
- lrvick
In the Stagex Linux distribution it is not possible for any single person to release anything. We require multiple independent review and reproduction signatures from the maintainer team.
We strongly urge other distros to take similar measures. Trusting a single person with effectively remote code execution privileges on every user workstation is never going to end well.