Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

Post reply on HN
Print view View original

51–60 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#51

Post by scrollaway »

unixhero wrote: post #45
noselasd wrote: post #35

Earlier quoted context omitted.

The alternative is pretty much only online forums. Which imo. doesn't offer a lot of advantages, and most forum software is exceptionally bad (though yes, a few new and nicer ones are coming along)

Discourse NodeBB and Vanilla comes to mind

None of them appropriately support mailing lists, though. Email-based communication is a big deal for devs which contribute on maybe 5+ projects at once and have to manage comms in one central place.

As for Discourse's mockery of a mailing list mode, let's not even talk about it.

Re: Trojan found in Filezilla downloaded from SourceForge

#52

Post by Asbostos »

halfdan wrote: post #22

Absolute money quote: "As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now."

There's the argument that if someone has access to the passwords then they've already got enough control over the computer to do whatever other damage they like - like reading them out of memory after they're decrypted.

Base64 at least provides some protection against somebody looking at it with their eyes and memorizing them, which is perhaps a more likely scenario - family members, kids, etc.

Re: Trojan found in Filezilla downloaded from SourceForge

#53

Post by dagw »

agildehaus wrote: post #24

SourceForge and Filezilla are both on their way out, hence their owners desire to monetize their remaining users while they still can. WinSCP is a decent alternative. As is Swish: http://www.swish-sftp.org/ https://github.com/alamaison/swish

I've found WinSCP's performance lagging quite a bit behind FileZilla, especially when it comes to up/downloading 1000s of files at a time.

Re: Trojan found in Filezilla downloaded from SourceForge

#54

Post by StavrosK »

scrollaway wrote: post #9
vermilingua wrote: post #6

As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

Why can the passwords not be hashed?

Re: Trojan found in Filezilla downloaded from SourceForge

#55

Post by scrollaway »

StavrosK wrote: post #54
scrollaway wrote: post #9

Earlier quoted context omitted.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

Why can the passwords not be hashed?

The client needs them in plain text to be able to connect. "Remember password" is a feature, there. Like I said, correct solution is to use the keyring, but the dev team is incompetent, so ...

Re: Trojan found in Filezilla downloaded from SourceForge

#56

Post by danielbarla »

StavrosK wrote: post #54
scrollaway wrote: post #9

Earlier quoted context omitted.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

Why can the passwords not be hashed?

The application needs the original password so that it can pass it on to the FTP server.

Re: Trojan found in Filezilla downloaded from SourceForge

#57

Post by scrollaway »

joopxiv wrote: post #38
vermilingua wrote: post #6

As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.

Was about to post the same thing. If this crap is posted by a contributer I'm moving away from it as fast as possible.

It is.

Re: Trojan found in Filezilla downloaded from SourceForge

#58

Post by hannob »

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Savannah provides mailing lists. I don't want to advocate savannah too much, because the site isn't pretty, their interface is sometimes strange, they don't default to https, there are lots of reasons not to like it technically. But it's probably a place where you don't have to expect evils like supporting bundled Crapware. The FSF is behind it.

Re: Trojan found in Filezilla downloaded from SourceForge

#59

Post by vermilingua »

StavrosK wrote: post #54
scrollaway wrote: post #9

Earlier quoted context omitted.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

Why can the passwords not be hashed?

FTP is inherently insecure, everything is transmitted in plaintext. Because the server cannot check a password against a hash (due to the limitations of FTP), the client needs to store the password, and can't keep only a hash.

That being said, Base64 is woefully inadequate, just google 'base64 decode'; and this response (from someone who appears to be a contributor) is just not a defence.

Re: Trojan found in Filezilla downloaded from SourceForge

#60

Post by scrollaway »

hannob wrote: post #58
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Savannah provides mailing lists. I don't want to advocate savannah too much, because the site isn't pretty, their interface is sometimes strange, they don't default to https, there are lots of reasons not to like it technically. But it's probably a place where you don't have to expect evils like supporting bundled Crapware. The FSF is behind it.

Hosting isn't the problem for us, UX is. We intend to self-host since we want to use @lists.lxde.org as an endpoint.
Post reply on HN