| [eclipse.org-committers] Eclipse IT Update: Security + PHP, GitLab, Bugzilla |
Hello Eclipse Foundation (EF) Committers and Leaders,
The EF's IT team is behind many of the services used by EF-hosted OSS projects. This is a status update on what's happening within the team.
Around the globe, developers, security teams and IT teams are facing important new challenges: serious software vulnerabilities are being reported at accelerating rates thanks to AI, and public exploits are emerging at unprecedented speed, with or without a mitigation or corresponding fix. Vulnerability response has shifted dramatically: the generous 90-day patch window of the past is gone, replaced by a zero-day, and even zero-hour threat reality.
The EF is adapting to this new reality. In a recent security event involving PHP, the EF, as well as countless operators worldwide, opted to disable a dozen of its affected web properties to protect them from the immediate threats for which there was no fix. This allowed time for patches to propagate to official streams and for those fixes to be applied to our infrastructure.
We expect occurrences of such events to be increasingly frequent. In each case, you can expect the EF to put the safety of your data and the integrity of our services first and foremost, even if this means taking services offline for extended periods when no mitigation is available. The IT team is currently prioritising the modernisation efforts of many aspects of its core technical stack, so that we can better react to such events and manage our assets more efficiently. We will aim to communicate these events on the Eclipse Services Status page [1].
You can also expect us to examine the entirety of our services portfolio, as we focus our offering on those services that are useful and valuable to you, and complementary to what is currently being offered in the industry.
The Eclipse GitLab instance [2], used by about 20% of our projects, has recently been discovered by the various bots and AI scrapers, as its traffic levels have increased by 100x in the last 6 months. The EF IT team is working on a 3-pronged approach: 1. Stabilise the current environment [done, and ongoing] 2. Deploy commercial-grade Web-app firewalls and bot protections [in progress] and 3. Onboard an expert team for GitLab infrastructure administration [in progress]. These investments will help ensure the continued performance and reliability of the GitLab service, and help improve responsiveness to security issues and software updates.
The venerable Eclipse Bugzilla [3], with its 20+ year history, 583,000 bugs and millions of comments, has been taken offline temporarily. It was scheduled for deprecation over 5 years ago, but hasn't quite crossed the finish line. The compute environment for Bugzilla is archaic, and the risks associated to its continued operation were, for a time, considered low and tolerable. However, under the new reality of AI-augmented scanners, probes and exploit agents, those risks are no longer tolerable and present a real threat to our data and services.
A static copy of the entirety of Bugzilla is awaiting deployment, and we're targeting the date of December 15, 2026. We are aware that Bugzilla represents a treasure trove of information (and apparently, the bots agree!) and we apologise for this inconvenience. You can follow progress on HelpDesk issue #679. [4]
Thank you for reading. If you have any follow-up comments or concerns, please forward them to me directly at denis.roy@xxxxxxxxxxxxxxxxxxxxxx to keep traffic to this list to a minimum.
[1] https://status.eclipse.org/
[2] https://gitlab.eclipse.org/
[4] https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/work_items/679
Denis Roy
Head of Information Technology | Eclipse Foundation
Eclipse Foundation: The Community for Open Innovation and Collaboration
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature