As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.
FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373
Trojan found in Filezilla downloaded from SourceForge
181–190 of 217 posts
Re: Trojan found in Filezilla downloaded from SourceForge
#182Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…
High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…
Re: Trojan found in Filezilla downloaded from SourceForge
#183Earlier quoted context omitted.
The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…
I don't know what you mean by fast, but https://www.ruby-forum.com/ seems to load pages faster than most websites, and as fast as D's forums.
Re: Trojan found in Filezilla downloaded from SourceForge
#184Earlier quoted context omitted.
The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…
> Instead, it's all either slow, slow backend frameworks like Ruby, or even Usually this is a matter of bad coding or overprovisioning of whatever is being used to host the site and the DB. Most maintained languages running on modern hardware can sustain reasonable loads without any significant performance issues. While client-side bad-performing frameworks abound, the last I looked into it, Ruby+Rails isn't that muc…
Re: Trojan found in Filezilla downloaded from SourceForge
#185Absolute money quote: "As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now."
There's the argument that if someone has access to the passwords then they've already got enough control over the computer to do whatever other damage they like - like reading them out of memory after they're decrypted. Base64 at least provides some protection against somebody looking at it with their eyes and memorizing them, which is perhaps a more likely scenario - family members, kids, etc.
Re: Trojan found in Filezilla downloaded from SourceForge
#186As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.
FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373
Re: Trojan found in Filezilla downloaded from SourceForge
#187Earlier quoted context omitted.
"Since the content they host is open-source, this is technically legal, but it's scummy as all hell." If the project is licensed under GPLv3 (or any other strong copyleft license), wouldn't they be illegally hosting it because they are bundling their malware dropper with software that isn't compatible with the license?
Simple bundling is not a GPL violation, only linking.
Re: Trojan found in Filezilla downloaded from SourceForge
#188Earlier quoted context omitted.
"So I'm pitching this to bored devs and entrepreneurs: Help us, and many other projects, by creating a "Github for mailing lists" with a web client featuring a clean high quality UI, easily browsable/linkable archives, etc. Make it open source, make it self-hostable, stuff in enterprise support. Make it quick and easy to create new lists." Uggh ... really ? So the simple, clean, extremely fast loading HTML indexes of…
I agree. Mailman is fantastic as it is. There's a technical brevity and image it gives off, and that's an important aspect of design. This isn't really a statement about usability or what's beautiful in design. I design user interfaces and creating a new UI for basically what mailman does would really just be an attempt at grabbing a different target audience. mailman has an image behind it. People associate with dif…
If you genuinely do want to practice great design, start by considering user needs and the reason why "reskinning" as you call it might be wanted, instead of dismissing anything you don't immediately understand as "pah, must be junior designers, those with fancy gradients and far less experience than me".
No, seriously, what the hell.
Re: Trojan found in Filezilla downloaded from SourceForge
#189Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…
High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…
Re: Trojan found in Filezilla downloaded from SourceForge
#190Earlier quoted context omitted.
You're mis-remembering or something... There's no such thing as a "Core Networking Utilities" package on Windows (never has been) and ftp has been a command line tool since at least Windows 95. I don't particularly like the built in FTP command line utility (even with scripts). But it has existed a very long time indeed.
Eh, yes, it is. On the Windows 7 Home Basic and Home Premium edition, it’s not pre-installed, and you have to go to System Settings -> Programs and Features -> Install or Remove Features to install it.
The only packages I have installed are "Media Features" ".Net Framework 3.5.1" "Print and Document Services" "Windows Gadget Platform" "Windows Search" and XPS Services/Viewer. All of which are default features.
Which package are you even suggesting contains the ftp.exe client? Because I don't even see one. Also why would anyone go to the trouble of putting a 47 Kb binary inside of a feature package? It makes absolutely no sense at all.