Trojaned open source software

Good to get a reminder, that even "trustworthy" sites may be affected by malicious code. I often seem to assume an increased trustworthiness as far as open source downloads are concerned. Of course I download the md5 checksums. But in a pinch, I?ll just install without verifying.
Obviously bad practice, and I for one will modify my habits accordingly.

In a time where all the focus seems to be on software security issues from companies such as Microsoft, and the beginnings of acceptance of OpenSource as a legitamate alternative, we all must be greatly concerned.

Whatever strides OpenSource takes towards support by those that can make its mainstream acceptance a reality can be greatly hindered if such security breaches become more prevalent. And with the open nature of OpenSource, can those players really feal confident that any source code is safe?

I for one hope so. But the OpenSource community must pay more attention to these breaches in order to avoid a black eye.

This is extrememly old news and is merely written with an inflamatory bias. This trojaned code was discovered almost immediately, the code was cleaned, and security warning were issued almost immediately. Anyone other than the most naive users of open source code knew of the problem within one or two days.

There were very few individuals impacted by this and the very nature of open source actually increased the dissemination of the issue as well as the resolution. The same issue from a proprietary software provider would have been much slower in coming out, denied by the provider (usually) and the fix would have taken an extended period of time, after a lengthy 'investigation'.

Sorry Yarden you just lost some of my respect. This isn't so much a compromize as it is a user/human fault: always verify code when you can, it's that simple and there's no exuse not to do it properly (even on a MS machine).

When you write you don't have a habit of using MD5 or similar, you're demoting yourself into the ordinary rabble of Microsoft-style IT-"pros", and that's sad. That ordinarily promotes your job opportunities though :lol