<p>Perhaps I should also tell the story of when one of the servers involved in <a href="https://hachyderm.io/tags/PuTTY" class="mention hashtag" rel="tag">#<span>PuTTY</span></a> was actually broken into.</p><p>How the attackers got in wasn&#39;t interesting. Came from another already-compromised machine via an authorised SSH key, used the kernel vulnerability of the day to get root, installed a rootkit. The usual.</p><p>The machine&#39;s administrator shut it down, rebooted from trusted media, and painstakingly re-secured it by finding and checking all the files that differed from a pre-compromise backup. Eliminated the rootkit, and found the hidden directory they&#39;d used as a base while they set it up.</p><p>In that directory was a file called &#39;putty.tgz&#39;, which the admin passed on to me to analyse. My blood ran cold. I expected it to be a set of carefully doctored PuTTY binaries, that they&#39;d intended to substitute for the real versions, and pwn everyone who downloaded PuTTY.</p><p>But it wasn&#39;t.</p><p>putty.tgz turned out to be a copy of ~/src/putty from my own home directory on that machine. I could tell it was from there, because I hardly ever do any actual development there, and the revision I happened to have checked out was about a year old. And that revision was exactly what was in the tarball.</p><p>These attackers had broken in to a machine involved in PuTTY development … and _stolen the source code_.</p><p>And not even a preview of anything unreleased; they got an older version than they could have got straight out of source control.</p><p>I really hope it was several days before anyone pointed out their mistake. If there&#39;s any justice, they would have been bragging to _everyone_ about this achievement, so that by the time they realised it was completely pointless, it was far too late to pretend it had never happened!</p>