Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

Post reply on HN
Print view View original

121–130 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#121

Post by vortico »

jnbiche wrote: post #114
IshKebab wrote: post #79

Earlier quoted context omitted.

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

I don't know what you mean by fast, but https://www.ruby-forum.com/ seems to load pages faster than most websites, and as fast as D's forums.

Re: Trojan found in Filezilla downloaded from SourceForge

#122

Post by dijit »

chanux wrote: post #93
bigbugbag wrote: post #70

Earlier quoted context omitted.

A decent alternative to filezilla would have to be cross-platform, neither swish nor winscp are (they're win only). An alternative to sourceforge implies not using sourceforge but swish does.

Cyberduck is for windows and Mac. They have a command line tool that is cross platform. https://cyberduck.io

the windows implementation of cyberduck is horrendous, as a windows user (it was forced on me) I have been looking for alternatives for a while..

It hangs on start, randomly doesn't connect, does odd things with bookmarks (they don't work sometimes, but manually entering info does)

I don't recommend cyberduck on windows to anyone, I've been looking for an alternative for a while.

if a dev is reading my machine is:

* OS: Microsoft Windows 7 Enterprise * CPU: Intel(R) Xeon(R) CPU E5-1650 v2 @ 3.50GHz (3.00 GHz) * RAM: 32691 MB Total (16885 MB Free) * VGA: NVIDIA GeForce GTX 760 * Uptime: 123.24 Hours * Version: 4.7.3

Re: Trojan found in Filezilla downloaded from SourceForge

#123

Post by astrodust »

scrollaway wrote: post #51
unixhero wrote: post #45

Earlier quoted context omitted.

Discourse NodeBB and Vanilla comes to mind

None of them appropriately support mailing lists, though. Email-based communication is a big deal for devs which contribute on maybe 5+ projects at once and have to manage comms in one central place. As for Discourse's mockery of a mailing list mode, let's not even talk about it.

If you're managing 5+ projects at once, your inbox must be a train-wreck of garbage from these mailing lists.

GitHub has email notifications for issues, but you can opt out of any particular discussion if it gets too pedantic or doesn't relate to you. This helps massively reduce inbox clutter.

The thing that bugs me about mailing lists the most is you get all the email, all the time, forever.

Re: Trojan found in Filezilla downloaded from SourceForge

#124

Post by jkot »

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Self-hosting seems like overreaction for most open source project. I would just make regular backups/exports. Dealing with spam filters etc is a nightmare.

My project is using Google Groups just fine. Do not list your group in public directory to prevent spam.

Redis is moving from mailing list to Reddit. That seems to work for them.

Re: Trojan found in Filezilla downloaded from SourceForge

#125

Post by astrodust »

scrollaway wrote: post #25
cuillevel3 wrote: post #14

Earlier quoted context omitted.

Does http://librelist.com/ match your requirements? "It is a place for FOSS communities to discuss all the things they want without ads, censorship, signup requirements, bundled apps, or requirements that you use any particular email client or service."

Not even close. Librelist's UX does not at all match what I describe.

Does it install trojans in your binaries?

Re: Trojan found in Filezilla downloaded from SourceForge

#126

Post by scient »

jnbiche wrote: post #114
IshKebab wrote: post #79

Earlier quoted context omitted.

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

I don't think you know what you are talking about sadly.

Re: Trojan found in Filezilla downloaded from SourceForge

#127

Post by vardump »

IshKebab wrote: post #79
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

Excessive pagination is annoying, but speed... the speed is amazing. 240 ms from initial mouse click to fully rendered page. Due to fast response, I really liked to use that site.

Very nice.

Re: Trojan found in Filezilla downloaded from SourceForge

#129

Post by blablabla123 »

gargalatas wrote: post #101

Unfortunately Filezilla has this trojan for some years now! The trojan send all your identities to a server. This is tested 100%. We had many passwords stolen this way and we are 100% sure that it's filezilla. Just take this test: Try to download the Filezilla and when the download page shows click on the Direct Link. Then compare the two executables, one that downloaded automatically and the one that it downloaded v…

...well not mine anymore, I uninstalled it... ;)

It's easy to blame Sourceforge. But Filezilla is not a SourceForge project and they can choose whatever hosting they want. I wonder what else they missed on.

Re: Trojan found in Filezilla downloaded from SourceForge

#130

Post by zamalek »

joopxiv wrote: post #40
scrollaway wrote: post #9

Earlier quoted context omitted.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

Someone explained that after he got some malware on his computer and subsequently all his websites were hacked. The response? Once you've got malware on your computer, you've lost already, game over. You need to prevent the infection in the first place. OMFG...

> botg: All third-party offers can easily be declined. Nothing unwanted is being installed without your consent.

Talk like that can only mean that they know about the malware bundling.

Extremely interesting in combination with that quote of yours. Essentially: "the malware we install on your machine will get access to your passwords anyway."

Looks like Filezilla will not die a hero's death.

Post reply on HN