DNS Spoofing?

Ruby
1

Has the IP for rubyforge.org changed in the past 12-24 hours?

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The RSA host key for rubyforge.org has changed,
and the key for the according IP address 50.56.192.79
is unknown. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle
attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
e0:48:2e:9e:f9:26:67:61:7d:29:db:6e:32:13:a1:2f.
Please contact your system administrator.
Add correct host key in /.ssh/known_hosts to get rid of this message.
Offending key in /.ssh/known_hosts:3
RSA host key for rubyforge.org has changed and you have requested strict
checking.
Host key verification failed.
cvs [status aborted]: end of file from server (consult above messages if
any)

2

It is not a local issue, I tried from 3 systems at 2 different
locations.

tom

3

I can confirm the new fingerprint fro Germany (local ISP) London
(England, my v-server)

Marc W.

4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 22.02.2012 14:24, schrieb Marc W.:

I can confirm the new fingerprint fro Germany (local ISP) London
(England, my v-server)

RubyForge.org is down entirely AFAIK. The website says:

====================================
RubyForge is offline for an upgrade.

In the meantime, why not skim through ruby-doc.org? Or you may want to
peruse this excellent Ruby news site.

Valete,
Marvin
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPRPjYAAoJELh1XLHFkqhacwwH/jy8yHUkpLFQItYaBfMvsvgM
xVp269h0oELwMpvoWs8oBAP1cUnI1SKGeKQqSho4eJQTjZSo9uYUZ5Ht92a4LppW
oqO74+MQpVVu4imt1OkH9I5UkVoXPfSCuwOhsUaFY6yQDV1muvIIy2TLQ35V2Gp1
D181nHT2JJwpVoRRMlPtVZguqbK1YMWJMVTuK77piwUJxYGD/SBqkBvzHyTA6H5/
w5i84VLuHnIZ501qTwtoS7Lym0sufQzQR7srNmaprFtxPR4S7ZaOehf9qxEydQh/
qbDYvaYJSbyarOh8kMOMOq0+d8NBzUQW2IFOg8kI4y4Xp9pyjuj8YmChi6VjzSA=
=bxTG
-----END PGP SIGNATURE-----

5

The site seems to be up.

Is anyone else seeing this?

How could the IP address and host key change at the same time?

New server and new location?

Not very likely!