Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


Top White Papers

  • At first glance, many attorneys assume that the ongoing fees associated with cloud-based software will surpass those of an on-premise solution over time....
    Download

  • Over the years, single sign-on (SSO) has been the easiest, most convenient way for users to access what they need. However, there are identity and access...
    Download

More on LinuxToday


Trojaned App Demonstrates Need for Better Practices, Not More FUD

Jun 15, 2010, 15:41 (0 Talkback[s])

[ Thanks to Jim Lynch for this link. ]

"You've likely heard this one already, but here it is again: over the weekend, the UnrealIRCd team discovered the 'Unreal3.2.8.1.tar.gz file on our mirrors has been replaced quite a while ago with a version with a backdoor (trojan) in it.'

"Still, from the looks of this news, mistakes were indeed made. The Unreal team have already 'fessed up to the fact that (until this happened), archived releases had not been PGP/GPG signed. Which means if the archived version of the software varied in any way from the actual source code, there's no sure way to tell. That's what signing is supposed to do.

"The team also admitted to not checking all of the mirrored files as often as they should have. Which means that while the true source code (in CVS) was clean as a whistle, the source archive files that people downloaded were not clean for a very long time."

Complete Story

Related Stories: