Bogus Pull Requests to OpenCPN

[CarCode]

The absolutely rock bottom has been hit now. Hackers try to break the code at github.

[bdbcat]

All...
Related Pull Request has been Closed.
OpenCPN is under positive github control. No unauthorized code changes have been made.


Thanks for watching
Dave

[teppokurki]

Would you mind changing the title so that it is less clickbaity and more informative, like "Bogus Pull Requests to OpenCPN"?

At least to me "hacked" means that somebody succeeded in something. No need to cause unnecessary alarm.

[Pete7]

Done,

Pete

[CarCode]

Originally Posted by Pete7

Done,
Pete

Would you like to inform the thread opener when you alter his text?
Otherwise you risk to violate some laws and that might be expensive for you.

[xentac]

Translating the Chinese using Google Translate shows someone trying to do some tests and accidentally creating a pull request:

整合前版本至5.2.x，以后可用此分支开发 means "Integrate the previous version to 5.2.x, and use this branch for development in the future"

编译时使用z.txt内的命令 means "Use the commands in z.txt when compiling"

[StuM]

Originally Posted by CarCode

Would you like to inform the thread opener when you alter his text?
Otherwise you risk to violate some laws and that might be expensive for you.

You may like to check who owns CF and the rules you agreed to when you subscribed

[CarCode]

Originally Posted by StuM

You may like to check who owns CF and the rules you agreed to when you subscribed

What do you think will happen when someone change, alter or modify the text of a message in Facebook, Twitter or similiar media especially in these days ?


OpenCPN has been always a target of hackers perhaps because its security is so weak. 4 years ago the web pages of opencpn.org has been hacked already:

[StuM]

Originally Posted by CarCode

What do you think will happen when someone change, alter or modify the text of a message in Facebook, Twitter or similiar media especially in these days ?

"Public discussion about moderation or moderator decisions is not allowed. If a moderator deletes or edits one of your posts and you disagree with the action, contact the moderator concerned."

[Pete7]

Originally Posted by CarCode

Would you like to inform the thread opener when you alter his text?
Otherwise you risk to violate some laws and that might be expensive for you.

Feel free to advise me of the rules I violated and which country they apply to.

Meanwhile a fellow member made a suggestion to make your post more accurate and I agreed. As a CF moderator I then made the change. End of story.

Pete

[Pelagic]

So could someone please explain to the layman, what this Chinese interference means and if they were to succeed in the future, are OpenCPN users vulnerable in what ways?

Living in Asia, this is not just a theoretical question.

[bdbcat]

Pelagic...
In lay terms:
1. A github account holder tried (accidentally?) to modify the OCPN source code.
2. The OCPN source code is under positive github control, meaning that no changes can be made to the code without my explicit approval of the changes. Such approval only happens after a review of the specific changes requested.
3. So, no changes to the source code were made. The system worked as it should.


4. At no time were the distributed Releases of OCPN touched. These are also under my direct and explicit control.


So, I would not be unduly worried about unauthorized tampering with OCPN internals. In any event, the OCPN core code base is all open source, and is available for public inspection and analysis by anyone, at any time.


Thanks
Dave

[rgleason]

Carcode wrote:
"4 years ago the web pages of opencpn.org has been hacked already"


Carcode I do not recall seeing this problem and I was on the website almost every day.

[CarCode]

Originally Posted by rgleason

Carcode I do not recall seeing this problem and I was on the website almost every day.

I am fortunately able to make screenshots and to store them.