Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

Post reply on HN
Print view View original

161–170 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#161

Post by rsync »

aldanor wrote: post #21
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Why mailing lists are still quite massively popular in 2015?..

"Why mailing lists are still quite massively popular in 2015?.."

Because (your email client) is always going to be much, much faster and easier to navigate than "some dudes cute forum setup".

Replying to and managing conversations is much easier when you can do it with one or two keystrokes rather than mousey-mousing ten clicks all over the place (and oh their ad tracking js is stalling out again...)

I maintain that all web forums should have a mailing list interface so that you can use the forum without using the web at all ... but I suppose that breaks their revenue model ...

Re: Trojan found in Filezilla downloaded from SourceForge

#162

Post by shanemhansen »

vortico wrote: post #121
jnbiche wrote: post #114

Earlier quoted context omitted.

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

I don't know what you mean by fast, but https://www.ruby-forum.com/ seems to load pages faster than most websites, and as fast as D's forums.

According to a quick check the forum.dlang.org initial page view takes 200ms. ruby-forum takes 738ms. If you want to talk RUM/page load metrics forum.dlang.org takes 800ms for the load event to fire, the ruby forum takes 1.6s.

Re: Trojan found in Filezilla downloaded from SourceForge

#163

Post by kbenson »

kuschku wrote: post #151
eli wrote: post #97

Earlier quoted context omitted.

To be clear: it's not just the infrastructure; the set up a Google Apps mailing list you use the Google Groups UI.

Well, they already shut down the free tier of Google Apps, which was also used by some OSS projects. So it’s possible.

Didn't they grandfather in those that were in before that point?

Re: Trojan found in Filezilla downloaded from SourceForge

#164

Post by andrewmcwatters »

rsync wrote: post #157
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

"So I'm pitching this to bored devs and entrepreneurs: Help us, and many other projects, by creating a "Github for mailing lists" with a web client featuring a clean high quality UI, easily browsable/linkable archives, etc. Make it open source, make it self-hostable, stuff in enterprise support. Make it quick and easy to create new lists." Uggh ... really ? So the simple, clean, extremely fast loading HTML indexes of…

I agree. Mailman is fantastic as it is. There's a technical brevity and image it gives off, and that's an important aspect of design. This isn't really a statement about usability or what's beautiful in design.

I design user interfaces and creating a new UI for basically what mailman does would really just be an attempt at grabbing a different target audience.

mailman has an image behind it. People associate with different images, and certain looks and feels make certain people gravitate towards them.

The type of people I would want in my mailing list are the type of people that appreciate how mailman looks as-is.

I try to practice great design where it matters most. A reskin of such software would be more aligned with the goals of junior designers and people who rehash weather apps with nice gradients on dribbble.

Re: Trojan found in Filezilla downloaded from SourceForge

#165

Post by eco »

daurnimator wrote: post #87
IshKebab wrote: post #79

Earlier quoted context omitted.

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

FWIW, I find the information density of this site quite low. When I visit these archives I'll generally read with via the gmane frame interface.

Hit Settings in the top right then choose Horizontal or Vertical split.

Re: Trojan found in Filezilla downloaded from SourceForge

#166

Post by beagle3 »

IshKebab wrote: post #79
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

In the same vein, nim forums are written in nim and are exceptionally fast and responsive http://forum.nim-lang.org

Re: Trojan found in Filezilla downloaded from SourceForge

#168

Post by Relys »

paulmd wrote: post #139
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…

"Since the content they host is open-source, this is technically legal, but it's scummy as all hell."

If the project is licensed under GPLv3 (or any other strong copyleft license), wouldn't they be illegally hosting it because they are bundling their malware dropper with software that isn't compatible with the license?

Re: Trojan found in Filezilla downloaded from SourceForge

#169

Post by johannes1234321 »

baldfat wrote: post #118
aldanor wrote: post #21

Earlier quoted context omitted.

Why mailing lists are still quite massively popular in 2015?..

> Why mailing lists are still quite massively popular in 2015?.. IRC is still an underused tool in my opinion. The ability to just talk about one issue in a Mail List and keep track of the communication is great. I can't think of another tool that manages communication as well as a mail list (Forums are just not as good in communication notifications like a mail list.) P.S. I still hate Mail List and don't use them a…

> IRC is still an underused tool in my opinion

IRC, like other chat and IM tools is synchronous. That is useful to get an issue solved quickly. But mailing list are asynchronous. People can think before answering and don't have to be around at the same time. Also threaded nature of mail makes it better to archive discussions and referencing them later. An IRC log is full of other noise and little structure.

Re: Trojan found in Filezilla downloaded from SourceForge

#170

Post by Relys »

gargalatas wrote: post #101

Unfortunately Filezilla has this trojan for some years now! The trojan send all your identities to a server. This is tested 100%. We had many passwords stolen this way and we are 100% sure that it's filezilla. Just take this test: Try to download the Filezilla and when the download page shows click on the Direct Link. Then compare the two executables, one that downloaded automatically and the one that it downloaded v…

You're 100% sure? I would expect to see registry diffs before/after FileZilla was installed, disassembled code of the subroutine accessing your passwords in the malicious program, and a network packet capture of your data being sent over the wire.
Post reply on HN