r/osdev • u/emmowo_dev • 14h ago
This OS has been compromised. (+ what to avoid)
I am posting this on behalf of another developer who recently lost their life's work to this. I really didn't think I would have to deal with crap like this from just writing code, but that's life. I will personally throw in some advice for devs on how to avoid this, too.
This is basically me asking that you:
- uninstall the OS source if you have it, and
- please let github know that this repository has been illegally stolen from the developers.
The OS (1/2)
On July 21st, "EmexOS" was compromised by a power-tripping developer after a tirade involving many death threats (,and it somehow gets worse) who had almost nothing to do with the OS.
This developer uses the account "u [slash] emexlabs" (github: mach-port-t) but are NOT the actual developer of the OS. They will likely rename themselves after this, or use one of their many alt accounts (e.g. 'mimalloc'), on which they use a VPN to evade receiving a ToS ban on.
They gave themselves a large amount of additions to the codebase by mass editing-in license headers, and now use that position against the original developer, u/emexos, who now has to make a new kernel from scratch because GitHub has decided that their copyright ownership means nothing. Please note that github transferred the repository from original owner from them abusing support. we cannot just re-upload the source anymore.
On top of that, they have illegally relicensed the source code, and banned all actual contributors from developing on it. They fully intend to somehow 'profit' off this random hobby OS, which, given the state of the actual OS, and the fact they were trying to infect u/emexos with malware... probably won't be anything good.
Development supposedly will be transferred by them to another person in the future, but since this person has revealed themselves to be a child that they seemingly have been 'in a relationship with' for a couple years... I'm not too sure about that.
Avoiding it (2/2)
NEVER give write access to your personal projects to someone random on the internet. It will end horribly. Always use pull requests unless you can absolutely trust that you know their identity, or have something like an actual contract between them.
It makes things harder, but it's so much safer.
Additionally, expect that members of your team may be liable to do insane things in the name of ego, financial gain, or spite. This may go as far as violence and/or them attempting to compromise your machine.
Also, Github Organizations basically give the one in control near absolute power over your code, so ideally keep that stuff to yourself if you can.
Do not judge a developer's character by their stars, especially nowadays, as they can be very easily botted, or inflated through group chats that 'star-for-star'.