Bonum Certa Men Certa

Edward Brockelsby: how expelled hacker took over Debian's SSH2 package

posted by Roy Schestowitz on Jun 08, 2024

Reprinted with permission from Daniel Pocock.

Here is the list of changelog entries for the ssh2 package.

Here is the first upload from Edward Brocklesby after he takes over the package. Chilling.

Format: 1.6
Date: Fri, 26 Nov 1999 20:29:30 +0000
Source: ssh2
Binary: ssh2
Architecture: source i386
Version: 2.0.13-4
Distribution: unstable
Urgency: low
Maintainer: Edward Brocklesby <ejb@debian.org>
Description: 
 ssh2       - a secure replacement for rlogin, rsh, and rcp
Closes: 38705 39993 41100 46708 47030 47364
Changes: 
 ssh2 (2.0.13-4) unstable; urgency=low
 .
   * New Maintainer.
   * Suggest ssh-nonfree, not ssh.
   * Change 2222 to 22 in README.Debian (closes: #46708).
   * Don't link ssh against xlib6g.
   * Don't use ssh's own zlib, link with libz1 (closes: #39993).
   * Fix type in /etc/init.d/ssh2 (closes: #41100).
   * Change default $PATH to /bin:/usr/bin (closes: #47364).
   * Add a note about using ssh-keygen2 -r to the manpage (closes: #47030).
   * Suggests ssh-socks as well as ssh.
   * Prints a connection closed message when you log off (closes: #38705).

This was a long time before the Reproducible Builds project started. We have no idea if the binaries uploaded by Brocklesby correspond to the source code. At the time, people were simply trusted to compile the binaries on their home PC and upload them to the archive for everybody else to use. Scary, but true.

More scary, when they realized he was up to something they made no investigation into these binaries whatsoever. Looking at their discussions in hindsight, it didn't even occur to them, Debian people are so mediocre about security. They are obsessed with looking down their noses at people but don't understand what they see in front of them.

It looks like he was simply watching for other maintainers to lose interest and then he would take over their packages. Not every package though, only the packages that were really security critical like SSH, compilers and shells.

The rogue elements of Debian spent over $120,000 to attack me with lawyers after my father died. They made no credible inquiry into the activities of real hackers. They only care about making political attacks on volunteers. Security is above their pay grade.

It is now more than 48 hours after my first disclosure about the Edward Brocklesby affair and there is no comment whatsoever from the Debian security team. The only comments they make are to attack me personally, a reprisal for raising another serious security concern.

Read more articles about the mysterious Edward Brocklesby & Debian affair.

Other Recent Techrights' Posts

Frequent Flyers of the 'Lolita Express' (Where Screwing Underage Girls is Big Business)
In the words of Bill's wife and mother of his 3 children
How "Open Source" Became Microsoft (But It's Actually Proprietary, OSI is an Openwashing Front Group Now)
They're still trying to rewrite history, but it's harder when Richard Stallman (RMS) is alive
Microsoft-Sponsored Inauguration as a Reminder to Boycott Microsoft
If you do not support what's happening politically right now in the US, then stop giving money (or anything else) to Microsoft
Fund-Raising for Initiative Introducing Teens to Free Software Instead of Junk Like Bytedance's TikTok
A crowdfunding campaign coming soon
The Fall of Corporate Media Controlled by Oligarchs Who Boost (or Are Compelled to Boost) Reckless Lies About the Poor While Normalising Rich People's Crimes
No wonder they have layoffs
 
Gemini Links 25/01/2025: Plaintext Weblog Posts and Software Development
Links for the day
More Details Emerge About Upcoming Long-Rumoured Layoffs at IBM
Without leadership there's no coordination
Links 25/01/2025: Microsoft Chaffbot Offline and Advocacy/Dissent in China Muzzled
Links for the day
Bringing Down or Taking Down an Innocent Man is Difficult
One positive thing about all this is that we've come to witness (and meticulously document) how social control media works for the mob
Plagiarism at LinuxSecurity.com, Piggybacking Other People's Hard Work and Googlebombing "Linux"
They are googlebombing Google, and worse yet, they leverage bots to do this
Gemini Links 25/01/2025: Pictographs, Non-voters, and Frustrations
Links for the day
Links 25/01/2025: Microsoft Already Shutting Down Its UK "Experience Centre", "AI Deal" Linked to Atrocities
Links for the day
Red Hat is Required to Promote Microsoft's Proprietary Stuff and Even Produce Puff Pieces (Mindless Fluff) About It
Notice the aspect of bribed "media" or "news" or "press coverage" (pay-to-say)
The Limits of Freedom
This is generally not a new problem
IBM Layoffs (or Replacement With Low-Cost Labourers) Far Greater Than Reported by IBM
they serve to confirm what we've long said not only in relation to IBM but also Microsoft
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, January 24, 2025
IRC logs for Friday, January 24, 2025
Rumour of IBM 'Bloodbath' in Clown Computing
Performance Improvement Plans mean one step ahead or before layoffs
Dr. Andy Farnell: "Richard Stallman Chose to Stand For the Rights of People to Use Technology as They Wish. He Chose Freedom Instead of Riches."
Keeping busy in public transport
(Live-)Stream of Richard Stallman's Latest Talk in Europe (No Longer Live)
The latest public talk and Live-Streamed schedule were announced early on for the public to know about
Gemini Links 24/01/2025: Drehgriffel, Computer Science and Capitalism
Links for the day
Microsoft Lost a Ton of Market Share in Web Servers Last Month (the Last Month of 2024) and Massive Losses Continue in 2025, Shows New Report
Microsoft down sharply
Richard Stallman is Already in India, Giving Talks About Microsoft Chaffbots and More
he's already giving some talks in India
Microsoft (Nick Vidal) and Co-opting "Open Future" With Microsoft-led "Open Source AI Definition" (Openwashing LLM Slop and GPL Violations)
Microsoft is tainting all sorts of groups via the OSI
Drunk on Chatbots, LinuxSecurity.com Spews Out More LLM Slop About "Wine"
They just keep googlebombing "Linux" and "Security" using slop
Gemini Links 24/01/2025: The "Hey Hi" Hype Continues Fading, Tesla/X/Twitter/SpaceX Associate With Nazism
Links for the day
Robbery at the European Patent Office (EPO), Office Staff as 'Prisoners'
publication from the Central Staff Committee, dated yesterday
Techrights in 0.036 Seconds
Combining Gemini and HTTP/S, yesterday we served an impressive number of requests
BetaNews Run by Plagiarism Bots That Googlebomb (for SEO) "Linux"
Google rewards and thus encourages plagiarism
Microsoft, IBM, and Front Groups That Advance Racism for Profit
IBM has profited a lot from racism and it still does
FOSDEM and 'No Nazis'
the issue isn't wealth but principles
IBM Titles Considered Worthless and Many IBM 'Fellows' Are Vanishing (Also: IBM Staff Inside Linux Attacks the Rights of Computer Users for Recognition or Rewards Like "Distinguished Engineer")
James Bottomley is still "a Distinguished Engineer at IBM"
Gemini Links 24/01/2025: "Social" Control Media is Unsatisfying; An Old Call for a Gemini Without TLS
Links for the day
[Meme] Levels of Outrage
Apparently it's hip for criminals to leverage "the law" to silence their exposers
Links 24/01/2025: Earthquake, Landslide, and Official Implicated in Airplane With Landing Gear Issues (Boeing Plane) "Found Dead"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Thursday, January 23, 2025
IRC logs for Thursday, January 23, 2025
CDN Giant: Microsoft Bing and Skype Collapsed Since the LLM Hype, Same as Other Metrics Show
No wonder Microsoft managers suffer anxiety and there are several waves of layoffs even on the same month
Gemini Links 23/01/2025: Experience With Outer Wilds and Gifting a Site
Links for the day
Slopwatch: Fake 'Articles' About Linux by Brian Fagioli and by Brittany Day in BetaNews and linuxsecurity.com (LLM Slop Sites That Are Online Leeches or SEO Operations Working Against Free Software Journalism)
Two new examples for today
Links 23/01/2025: More Overt Constitutional Violations and "TikTok Executive Order" (White Flag to CCP)
Links for the day
Status of New Year's Resolutions
3 weeks later
"The AI Bubble is Popping", Now It's Bailout Time
The hype will quietly fizzle, just like "blockchains"
[Meme] When the Government of the Netherlands Participates in Your Crimes It Lacks an Incentive to Hold You Accountable for Crimes
the EPO's corrupt management boasted (on television) that it would ignore rulings against it even if issued by the highest Dutch court
Links 23/01/2025: US Constitution Already Besieged (Impeachable Offences Pile Up), Arrest Warrant for Assad
Links for the day
Microsoft's Head of Business Development Quits (Days After Two Large Waves of Mass Layoffs)
We recently learned that people close to the management are very stressed this month
[Meme] Reliable Sources
Sooner or later LLMs swallow up their own lies (that they generated), which means that over time those things will only deteriorate further, exacerbating an already-large misinformation pandemic
BetaNews Plagiarising Work in the Linux Space
The originals won't even be listed
Gemini Links 23/01/2025: US Politics and DevOps Career
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Wednesday, January 22, 2025
IRC logs for Wednesday, January 22, 2025