Trojan found in Filezilla downloaded from SourceForge • Hacker News Board

Re: Trojan found in Filezilla downloaded from SourceForge

#141

Post by DanBC » Thu, Dec 03, 2015, 4:17 PM UTC

joopxiv wrote: post #106

lmm wrote: post #80

Earlier quoted context omitted.

That's correct though. Even if the passwords weren't stored at all, malware could just install a keylogger and record them when you typed them in.

The fact that there are ways to obtain passwords even when they are not stored unencrypted is not really a reason to make it as easy as possible for malware to get every password on your system.

No, you're wrong. If you've run malware on your machine then it's not your machine anymore.

This is exactly the thing that Google spent months trying to tell people when it was refusing to include password access to the password list. That extra password does nothing to increase security, and may be counter productive.

Re: Trojan found in Filezilla downloaded from SourceForge

#142

Post by gtk40 » Thu, Dec 03, 2015, 4:23 PM UTC

yitchelle wrote: post #94

Asbostos wrote: post #26

Earlier quoted context omitted.

On Windows, you don't always need a 3rd party FTP program. Windows Explorer (not IE) already does FTP. Just open any folder and type ftp://example.com into the path bar.

I guess so does Firefox and Chrome. They have a FTP client if all you want is to download.

Explorer allows write access though (uploading, &c).

Re: Trojan found in Filezilla downloaded from SourceForge

#143

Post by GrinningFool » Thu, Dec 03, 2015, 4:26 PM UTC

paulmd wrote: post #139

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…

When I had a project that I started on sf and later moved off, I kept the sf project technically alive, but removed all downloads. I updated with links to the project site.

This was a BlackBerry project, though, and it wasn't something you could install on a desktop - that may have been a contributing factor, but I never had any problems with them continuing to host the content after I deleted it.

Re: Trojan found in Filezilla downloaded from SourceForge

#144

Post by GrinningFool » Thu, Dec 03, 2015, 4:29 PM UTC

jnbiche wrote: post #114

IshKebab wrote: post #79

Earlier quoted context omitted.

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

> Instead, it's all either slow, slow backend frameworks like Ruby, or even

Usually this is a matter of bad coding or overprovisioning of whatever is being used to host the site and the DB. Most maintained languages running on modern hardware can sustain reasonable loads without any significant performance issues. While client-side bad-performing frameworks abound, the last I looked into it, Ruby+Rails isn't that much worse or better than any other.

Re: Trojan found in Filezilla downloaded from SourceForge

#145

Post by pmilot » Thu, Dec 03, 2015, 4:40 PM UTC

jnbiche wrote: post #114

IshKebab wrote: post #79

Earlier quoted context omitted.

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

The language used for a server backend is far from a guarantee of efficiency and performance. It's very easy to write a D or Rust backend that doesn't optimize queries and handles caching badly; you'll get just as terrible response times from those as you would on the "typical" slow websites that you refer to.

Re: Trojan found in Filezilla downloaded from SourceForge

#146

Post by erlend_sh » Thu, Dec 03, 2015, 4:41 PM UTC

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

> So I'm pitching this to bored devs and entrepreneurs: Help us, and many other projects, by creating a "Github for mailing lists"

Hi. I'm from the Discourse team, and I recently "soft-pitched" an idea that seems very much in line with what you're looking for.

https://meta.discourse.org/t/becoming-the-new-standard-discu...

Regardless of the above, we're gonna be doing a significant push for better mailing list features during the months to come, so any feedback you or any other open source projects may have, please nudge me on meta.discourse.org or send me an e-mail (my first name, erlend, at the company domain).

Re: Trojan found in Filezilla downloaded from SourceForge

#147

Post by lmm » Thu, Dec 03, 2015, 4:45 PM UTC

joopxiv wrote: post #106

lmm wrote: post #80

Earlier quoted context omitted.

That's correct though. Even if the passwords weren't stored at all, malware could just install a keylogger and record them when you typed them in.

The fact that there are ways to obtain passwords even when they are not stored unencrypted is not really a reason to make it as easy as possible for malware to get every password on your system.

Encrypting stored passwords gives users a misleading false sense of security.

Re: Trojan found in Filezilla downloaded from SourceForge

#148

Post by kuschku » Thu, Dec 03, 2015, 4:46 PM UTC

joopxiv wrote: post #108

kuschku wrote: post #95

Earlier quoted context omitted.

Except if you require hash of (password+timestamp modulo 60000)

In that case you can't just store the hash of the password, you will need to password itself.

Hmm. Yeah.

I’ve thought about it for the last few hours, and decided that the best solution is to just use RSA in client.

Re: Trojan found in Filezilla downloaded from SourceForge

#149

Post by elipsey » Thu, Dec 03, 2015, 4:51 PM UTC

The Filezilla forum admin in that thread obstinately blames users for "accidentally" accepting a bundeled "offer", when users are clearly warning project admins that the installer is infected with malware.

Does sourceforge share revenue from bundeled installs with projects?

Re: Trojan found in Filezilla downloaded from SourceForge

#150

Post by robgibbons » Thu, Dec 03, 2015, 4:56 PM UTC

It's funny, I literally just messaged the maintainer of the Minibian project, politely asking that he move the Minibian project away from Sourceforge, when I saw this post on HN. It's too bad to see Sourceforge ending up like this, after it was so useful years back.