Custom trac+svn or GitHub (or other alternative)

Recently, I had a small discussion about moving to GitHub (or another similar solution) on IRC. The subject has come up several times (and I thought several times about it) and I'd like to have a more opinions about it.

I'm really tempted to move it since it might decrease cost a little bit and most importantly, it will decrease the amount of maintenance I have to do. However, I have some concerns and I'm open to new ideas.

I like GitHub since it has most of the features of (a base) trac (and I don't need more than that). User management is built-in, as well as anti-spam. There is a big community around it and we can do continuous integration (using Travis CI). And I don't have to spend time cleaning up the spam, updating the server (and making sure it's secure; I guess GitHub have security measures).

Here is what I don't like with GitHub:

1. You don't have control of your code anymore.
2. One way thing: you can import trac (tickets and stuff) to GitHub but I never heard of tools to back that up
3. You depend on them: if they're down, you'll have to wait for their stuff to come back up. If they get hacked, you might be in trouble. They can close your project; If you guys remember WhatsApp, a few days before it was bought by Facebook, GitHub received DCMA letters and had to close a bunch of projects that were related to WhatsApp (or API library).
4. You need an account to create a bug report.

 However, the cons can be somehow alleviated:

1. Hosting my own git repository and syncing to GitHub (as well as other GitHub alternatives)
2. If there is no tool to back up GitHub, I might develop one (and open source it) or pay somebody to create one.
3. Using multiple services. We could have GitHub as main the main location and using other services as back-up (read-only). If GitHub gets down, we can switch any other to read-write. However, we'll need a software to do the sync (and it also depends on the back-up program in the previous point.
4. If they don't have an account: Accept bug reports by email and/or have people post in the forum (you don't need an account to post) and I take care of adding them to GitHub.

So, here are my questions:

1. What is your opinion about using GitHub (and git) for Aircrack-ng instead of trac+svn?
2. What are the alternative to GitHub (free, hosted)? If you've used it, please give me your opinion about it. I'm also willing to pay a few dollars a month if there is a serious one.
3. What are the installable (to your own server) alternatives to GitHub. It's better if it's free/open source but I don't mind paying if the solution is good.

Here is what I found (and heard about): GitLab (to install, as backup, using gitlab-mirrors), BitBucket, Gitorious, Kiln. However, I need more feedback about them.

As I get feedback, I'll update the post.

Forum and trac/svn up

Hi,

June has been a very busy month for me, I didn't really have time to work on the forum and I apologize for that.
I've been working for the past week on bringing back up all those services. Trac and svn were safe to use and brought back up a few days ago and I spent a few more days to clean up the forum and migrate it to a new server. Nothing was lost and your login/passwords are still the same.

Since it is on a new machine, on its own, it should be faster than before and I can tell you that it is also better protected (I listened to your advices) :)
In this case, it also means a new IP and thus it might in some cases take a day or two for DNS to spread. How do you know you reached the new one?
Two ways:

• Open it in a browser, the old forum will return a 403 Forbidden, so if you don't have that, you're good.
• Do a nslookup forum.aircrack-ng.org. It should return 178.32.208.188.

Please send me feedback about the forum in the comments, especially if you have issues with it (I'll try to address them).

Enjoy

Trac and forum up again

You probably noticed earlier today that the trac and forum were working again. They finally fixed the issue (which was according to them probably a bad RAM module or the CPU fan) by replacing completely the server (but keeping the hard drive).

I think that it's the CPU fan that failed, not the RAM module. But whatever, it works again and that was what we all wanted.

Trac and forum down

All started Sunday, around 6AM GMT, our 4-year old dedicated server wasn't responding anymore and even a hardware reboot didn't bring it up. So, I opened a ticket and the technicians noticed the power supply died and quickly replaced it.

Everything worked fine until Monday morning, 9AM GMT, the server started to be unstable. I first thought it was Apache because during my tests, the process used several times 100% CPU when it crashed.
Then I tried stopping Apache and MySQL, the 2 most consuming processes (the CPU usage was on average at 6% without these 2 processes) and even with that, it was crashing after 15 minutes.

I thought that our kernel might be corrupted due to the crash of the server, so I tried using one of their netboot kernel (as well as the hardware testing mode) and it kept crashing.

So, I just opened another ticket for this issue. I really wonder what's going on.

Also, the migration of the forum and trac to the new server was planned at the end of this month but it might happen sooner than expected (I'll try to do it this week-end).

I'll keep you updated.

Monthly news (April 2010)

Project news:
- ebfe, who created airolib-ng, released an exploit for airodump-ng, aircrack-ng, airdecap-ng. You can find more information in his blog (Post 1, Post 2) but it just makes the tools crash, no real exploit released. It will be fixed in the next few days before the release (v1.1).
- Nearly everything has been moved to the new server, only forum, trac and buildbot needs to be moved :).
- Do you remember I wrote that trac didn't display svn commits for some unknown reason? That's now fixed, I just had to comment out a line in trac.ini.
- For those who can't open the website due to URL filtering, use whydoyoublock.me. It's not a mirror, it points to the exact same content as www.aircrack-ng.org.

Forum news:
- Patches to override the regulatory domain for ath5k, ath9k and ar9170.
- The work on the C# GUI for aircrack-ng, WepCrackGUI, continues. And here is a blog post in italian about it.
- Beini now has its own website. Here is the forum thread.
- Wordlist generation:
    * Here and there
    * Here is a script by Zermolo to generate wordlist with only numbers, called permutate and another post in the same thread about the same subject with JTR.
    * Creating custom rules for John.
    * Word field is an incremental word list generator.

Other news:
- I'll speak at Sharkfest. It will take place in the main campus of the Standford University, June 14-17.
- Ever heard about NeoPwn? Version 2 will be based on the Nokia N900 and will be Backtrack Mobile.
- Remember spoonwep and spoonwep 2? Shamanvirtuel is working on spoonwep 3. Public beta release is planned between 15th-30th April.
- If you're using SliTaz, you might be interested to know that they released v3.0 a week ago.

Monthly news (March 2010)

Forum news:
- Beini 1.0 final was released: Forum post.
- I'm happily surprised that the C# (Mono) script developement for aircrack-ng is still active :). By the way, here is the project on sourceforge: wepcrackgui. The current version is 0.6.3
- A new version of minidwep-gtk, developped in shell script, gtk-server, zenity, kdialog, was released. Here is a video of this script in action. It is included in Beini 1.0.

Trac news:
- Various small fixes (makefile, manpage, ...)
- A patch for the r8187 (ieee80211) driver on kernel 2.6.32 (and lower). Installation instructions are updated.
- Compilation is fixed when compiling unstable stuff (wesside-ng/easside-ng and tkiptun-ng) with a recent gcc version (v4.4)

General news:
- Aircrack-ng now has 4 years old. I checked when the first news was posted and it was the 25th February 2006. Surprisingly, the 2 following news happened the 25th February this year :)
- A new paper about TKIP attacks was released by hirte: Enhanced TKIP Micheal Attacks.
- Airdrop-ng from TheX1le is now available in our subversion repository. Here is the video of the talk at Shmoocon 2010.

If you haven't seen it yet, Shmoocon 2010 videos (and sometimes the slides too) are available.

Last but not least, here is a very funny video of a woman calling Leo Laporte's Tech Guy Show claiming her WI-FI access has "disappeared".

Wiki and Trac search engine

The wiki and trac implement OpenSearch and when the browser notice there's an OpenSearch on the website, it add a small notification on which your can click to add the search engine:

Firefox shows it with a light blue shadow on the icon of the search textbox like that:



IE shows changes the color of the search engine selection to orange:



Just click on it, and you can add wiki and trac search engines to your favorite browser:

Trac, bugs, forum and t-shirts

Actually, trac is not completely working. It's better than before, we can commit but now we can't see them in the timeline and also the source browser is not working anymore.
I tried to debug a few days ago but I haven't found why it doesn't work. The path to the svn repository is correct, permissions of trac and on the filesystem are correct so I'm a bit out of ideas.

About the commits, I updated to 1.0 and tagged it and also committed a few patches to fix bugs:
- Client first seen and last seen in kismet netxml file
- Compilation on cygwin 1.7
- OSX patch: Ticket 653: Tap support for Darwin/OS X
- Other small things

The next bugs I'll take care of are:
- Ticket 704: Fix broadcast and multicast detection in aircrack-ng: it still require some work.
- Ticket 498: Aircrack-ng does not support dictionaries over 2Gb
- I'd like to fix another compilation bug on OSX (Ticket 687) but I don't have access to any Mac so if anyone could give me an access to a mac with Darwin and another with Leopard, that's great :). If anybody is getting rid of a Mac with darwin/leopard, we are really interested.
- Ticket 713: Invalid channel parsed from packets with mac80211 drivers

I haven't chosen the other bugs yet, but I still have in mind that WPA handshake detection has to be fixed/enhanced and I remember a bug with airbase-ng not giving the Information Elements in the right order.


There are a few interesting programs and scripts in the forum, and I'd like to give them more visibility (and even small scripts). What are your ideas/opinion about it?


I haven't forgotten the t-shirts. They will be there soon. I might do a few with the new logo for Shmoocon.



Edit (16 Jan 2010): Added one more bug to the list

Happy new year, news, etc ...

Hello everybody,

First of all, we wish you a happy new year.

There was no news here and no commit on trac since some time but we never stoppped working. Although svn commit wasn't working for us (see previous blog entry for more details), we used the tickets to store all patches that have to be committed.

But I now have some good news, trac is working again. Don't ask me why, I have absolutely no idea, and I didn't change anything (except doing the usual updates).
So that means I'll commit everything to sync svn with 1.0 final and then start committing all patches that were added to tickets since August (that's when svn commit stopped working) and others that were planned for 1.1. That will take a few days :)


I'll also try to update this blog at least once a month to tell you what happened during the last month in our forum, trac and on IRC.

Here are a few things that happened recently:
- Online WPA cracking services: with cloud computing that was launched begin december then now with GPU.
- Injection and packet capture with aircrack-ng seems to work with the Nokia N900. I also read that it will have USB host soon.
- Beini 1.0-RC5.1: A wireless network security testing system,it is based on Tiny Core Linux.
- GUI for aircrack-ng in C# using Mono.
- minidwep-gtk a GUI for aircrack-ng in shell script.
- Slitaz Aircrack-ng: the base Slitaz cooking version plus the latest Aircrack-ng SVN version, wireless drivers patched for injection and other related tools.


I am also currently installing a new server (Core i5 2.66Ghz, 8Gb Ram, 2x 80Gb SSD) for aircrack-ng. That will allow us to organize better the different parts and give a better service to our ever growing community ;).

Our webhoster offers ESXi and I first wanted to use it to virtualize our stuff but it takes too much time to stabilize it (and IP management is a bit tricky/expensive) and since I didn't wanted to wait any longer, I switched to vmware server for the different parts:
- trac and buildbot.
- forum.
- downloads: videos, patches, storage, archive, nightly builds, ... (we currently have around 20Gb of stuff).
- photos and videos of the conventions (btw, I'll soon post the pictures I took during 26C3 and of other conventions).
- a few other virtual machines for testing.
The main website and wiki will not be moved.


Last but not least, I would also like to thank again everybody who help us, not only the donations (although important to pay the servers and domains), but everybody who contributes to the project: in the forum, irc, in the wiki (documentation and translations), bug reports and bug fixes, improvements, ...


More to come in the following days :)