Oklahoma city threatens to call FBI over 'renegade' Linux maker

The Register ^ | 24th March 2006 20:20 GMT | Ashlee Vance

[N3WBI3]

Oklahoma city threatens to call FBI over 'renegade' Linux maker Our mistake is YOUR problem By Ashlee Vance in Mountain View Published Friday 24th March 2006 20:20 GMT New year, new job? Click here for thousands of tech vacancies.

The heartland turned vicious this week when an Oklahoma town threatened to call in the FBI because its web site was hacked by Linux maker Cent OS. Problem is CentOS didn't hack Tuttle's web site at all. The city's hosting provider had simply botched a web server.

This tale kicked off yesterday when Tuttle's city manager Jerry Taylor fired off an angry message to the CentOS staff. Taylor had popped onto the city's web site and found the standard Apache server configuration boilerplate that appears with a new web server installation. Taylor seemed to confuse this with a potential hack attack on the bustling town's IT infrastructure. SPONSORED LINKS

IT gurus seek Your counsel - Jobsite, The best people for the job

We answer 99.6% of all support calls within 5 seconds. Rackspace Managed Hosting with Fanatical Support

You inspire awe - Jobsite, The best people for the job

I-NET+ CERTIFICATION from the Register's training library

"Who gave you permission to invade my website and block me and anyone else from accessing it???," Taylor wrote to CentOS. "Please remove your software immediately before I report it to government officials!! I am the City Manager of Tuttle, Oklahoma."

Few people would initiate a tech support query like this, but these are dangerous times, and Taylor suspected the worst. (Er, but only the world's most boring hacker would break into a site and then throw up a boilerplate about how to fix the hack.)

CentOS developer Johnny Hughes jumped on the case and tried to explain the situation to Taylor.

"I feel sorry for your city," he replied in an e-mail. "CentOS is an operating system. It is probably installed on the computer that runs your website. . . . Please contact someone who does IT for you and show them the page so that they can configure your apache webserver correctly."

That response didn't go over so well.

"Get this web site off my home page!!!!! It is blocking access to my website!!!!~!," Taylor responded, clearly excited about the situation and sensing that Bin Laden was near.

Again, CentOS jumped in to try and explain some of the technical details behind the problem. It pointed Taylor to this page, saying it was the standard page for a web server and noted that it provides instructions on how to fix the problem. The CentOS staffer suggested that Taylor contact his service provider or have an administrator look into the issue.

That response didn't go over so well.

"Unless this software is removed I will file a complaint with the FBI," Taylor replied.

Later he added,

"I have four computers located at City Hall. All of these computers display the same CentOS page when attempting to bring up Tuttle-ok.gov. Now if your software is not causing this problem, how does it happen??? No one outside this building has complained about this problem. This is a block of public access to a city's website. Remove your software within the next 12 hours or an official complaint to the FBI is being filed!"

And later,

"I am computer literate! I have 22 years in computer systems engineering and operation. Now, can you tell me how to remove 'your software' that you acknowledge you provided free of charge? I consider this 'hacking.'"

After a few more exciting exchanges, CentOS managed to track down the problem for Taylor. It turns out that hosting provider Vidia Communications is running CentOS on some of its servers and had not configured the Tuttle web site properly. CentOS informed Taylor of the situation, and, a day later, Taylor had calmed down.

"The problem has been resolved by VIDIA who used to host the City website," he wrote. "They still provide cable service but do not host the website. The explanation was that they had a crash and during the rebuild they reinstalled the software that affected our website."

"I am sorry that we had to go through the process and accusations to get the problem resolved. It could have been resolved a lot quicker if the initial correspondence with you provided the helpful information that was transmitted in the last messages. My initial contact with VIDIA disallowed any knowledge of creating the problem."

Er, so despite the fact that CentOS went out of its way to figure out the problem for Tuttle, Taylor still places the blame on CentOS for not fixing the problem - that it didn't create - sooner. In addition, Taylor didn't really start off the whole process on the best foot despite Tuttle being a town "Where People Grow - Friendly!" Grow friendly, threaten to bring in the FBI at the drop of a hat - what's the difference?

As of this writing, one Tuttle web site still had not been fixed, although you can find the charming Tuttle man Taylor over here.

Taylor has yet to respond to our request for comment.

It seems that Tuttle has quite the hacking epidemic on its hands. The Tuttle Times newspaper's web site, for example, has had its Forum section cracked. Click at your own risk to see it or have a peek at our screen grab.

To see the full transcript of the web server war, travel over here. It's classic reading. ®

[antiRepublicrat]

Not this crap again...

[antiRepublicrat]

How about linking all the threads of Linux lies we've been bombarded with lately, the ones about Dell Google IBM all changing their Linux policies or products that were pure fantasy?

Freepers post articles they find. Articles are then dissected, explored and researched by FReepers, often resulting in the support or debunking of the article. This happens with many subjects, not just open source. This is a Good Thing.

[Golden Eagle]

Yeah, since it's open source it must be perfect! /arrogance

http://boston.internet.com/news/print.php/3291571

[antiRepublicrat]

Firefox isn't American

Firefox was begun by an American company using American programmers. It was then spun it off into an open source project, but retained the full-time programmers to work on it, who were of course the majority contributors. It was later spun off into its own American non-profit organization, and while more coding comes in from outside there's still a core of American programmers to run it.

I'd say Firefox is more American a lot of proprietary software due to the popularity of shipping programming off to India.

[antiRepublicrat]

Yeah, since it's open source it must be perfect! /arrogance

Watch out, you're slipping to the dark side. That site you pointed to is running Linux, Apache and PHP. Why don't you quit using open source software for recreational stuff?

And just think, it could have been a better patch if they had the source code to work with, but instead they had to reverse engineer in order to correct the screw-ups that Microsoft won't. Remember the WMF patch that was released, and worked? That forced Microsoft to finally release a patch ahead of schedule.

[Salo]

Thanks for the link, but for right now, this patch is the only game in town if you use IE.

[Golden Eagle]

Right, like you always say these guys just like to JOKE about being communist. They're really not, obviously. /ignorance

[Golden Eagle]

Not even needed, just disable running external scripts from all sites unless absolutely necessary, like you're supposed to.

[antiRepublicrat]

Right, like you always say these guys just like to JOKE about being communist.

I'm not explaining this to you again. It's no use beating a dead idiot.

[antiRepublicrat]

Not even needed, just disable running external scripts from all sites unless absolutely necessary, like you're supposed to.

Standard Microsoft mantra, "We gave you this cool feature, but you'd better turn it off if you don't want to get 0wn3d."

[Golden Eagle]

Your obsession with Microsoft is glarring again.

We disable Java scripting at the perimeter too, like any good experienced admin would do for a large enterprise. Sorry to hear these simple principles exceed your understanding of computer security.

[amigatec]

I just live in Mass.

I am so sorry!!

You have my deepest sympathy.

[antiRepublicrat]

Your obsession with Microsoft is glarring again.

We only use Microsoft because we know you love them. They're especially good to show off your hypocrisy.

We disable Java scripting at the perimeter too

That's "Javascripting," not "Java scripting." Javascript is not a scripted version of Java. The rest of us figured that out in the mid 90s.

And just think, if you weren't stuck on Microsoft's IE, you would have much less of a security risk in letting it through, allowing people to do what they need without getting blocked. And you can even alleviate your open source paranoia by going with a superior, more secure closed-source browser.

Sorry to hear these simple principles exceed your understanding of computer security.

We've firmly established that you don't even know the major tools of computer security, so don't even go there.

[amigatec]

Guess I have some searching to do. Any idea when that might have been? I'll go scouring to see if I can find it...

It was probably 2 years ago, Nick Danger was having some real fun with him, until somebody told GE that FR didn't even exist until late '97.

[Xenalyte]

This thread contains one of the best flame wars EVER.

[birbear]

My ex sent the CentOS website that had the transcript on it last week. Neither of us are IT people and we cracked up laughing at the stupidty of the "City Mangler".

I then showed it to my friend who works in the IT department of the of the Finance Dept for the State of California. He said it was typical user mentality.

The media has us in such a heightened state of alertness of identity theft and hacking, that it's no wonder people jump to that conclusion when the usual screens don't appear when we expect them to.

"22 years of system experience" is absolutely meaningless. I have 23 years of experience with computers and I barely keep up with the information on the Open Source and Tech ping lists. I know enough to know I don't know everything. But this city administrator needs to be flamed early and often for his reactions.

Granted, the CentOS person did act like a typical IT jerk. He/she should have known that the user he was dealing with didn't have a clue and should have geared his responses down. I know too many IT people who use their "smarts" to intentionally talk over people's heads. Because they get a thrill out of it. If either of these two were level headed people the situation wouldn't have escalated as it had.

[birbear]

Looks like I can't send a messge to Jerry Taylor, the City Mangler.

Darn.

[Bloody Sam Roberts]

You have my deepest sympathy.

Thanks.

I have petitioned Mrs. B.S. Roberts for a move to a less maddening state in the Union but no luck. She won't hear of it.

[N3WBI3]

[ShadowAce]

LOL!