Don't panic. SSH exploit in bleeding edge code you shouldn't run on a server

It also reminded me why Open Source communities must be moderated, and pretty strictly. The attack began a couple years ago, with users being abusive to the lone maintainer of the project about not doing things fast enough and not doing what the “community” wanted. And, then “Jia Tan” steps up to “help” the maintainer and relieve the pain of being the lone volunteer maintainer of critical code who’s going through some mental health and life issues. Insidious stuff.

I think I’m going to become more strict about moderation around here, including stuff directed at staff; historically, I’ve mostly only removed stuff that was directed at other users and erred on the side of leaving stuff if it was borderline (some sentimental “free speech” urge). But, making Open Source communities kinder is necessary to avoid this kind of thing, and it starts at home.

So, the line for what counts as abuse around here is moving. Less “benefit of the doubt”, more “be friends or fuck off”.

4 Likes