Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

181–190 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#181

As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

[deleted]

Re: Trojan found in Filezilla downloaded from SourceForge

#182
post #139

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…

Yeah I still can't believe how scummy sourceforge is. I wonder how new oss projects can protect themselves against this type of behavior. Anyone know if any oss licenses include a restriction against this kind of repackaging or any kind of malicious use clause?

Re: Trojan found in Filezilla downloaded from SourceForge

#183

Earlier quoted context omitted.

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

I don't know what you mean by fast, but https://www.ruby-forum.com/ seems to load pages faster than most websites, and as fast as D's forums.

The individual posts load really quickly, but the main page doesn't (well not as fast as the other one mentioned). Either way, both are fast and I wish more websites were like this, not just forums!

Re: Trojan found in Filezilla downloaded from SourceForge

#184

Earlier quoted context omitted.

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework. Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods. Node is a step in the right direction for both problems: for the first, Node-based backen…

> Instead, it's all either slow, slow backend frameworks like Ruby, or even Usually this is a matter of bad coding or overprovisioning of whatever is being used to host the site and the DB. Most maintained languages running on modern hardware can sustain reasonable loads without any significant performance issues. While client-side bad-performing frameworks abound, the last I looked into it, Ruby+Rails isn't that muc…

It depends heavily on what you are doing. Most CPU intensive Tasks are fast on everything. However on Memory intensive Applications Ruby and Python are really really aweful slow.

Re: Trojan found in Filezilla downloaded from SourceForge

#185
post #22

Absolute money quote: "As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now."

There's the argument that if someone has access to the passwords then they've already got enough control over the computer to do whatever other damage they like - like reading them out of memory after they're decrypted. Base64 at least provides some protection against somebody looking at it with their eyes and memorizing them, which is perhaps a more likely scenario - family members, kids, etc.

Base64 provides no protection from malware that infects your machine and actively looks for this kind of stuff. Stored passwords from websites, ftp programs, key safes, etc.

Re: Trojan found in Filezilla downloaded from SourceForge

#186

As far as the password storage goes, you are not up-to-date. They are stored base64-encoded now. Yes, much better.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

I'm confused...who said they could be hashed?

Re: Trojan found in Filezilla downloaded from SourceForge

#187
post #168

Earlier quoted context omitted.

"Since the content they host is open-source, this is technically legal, but it's scummy as all hell." If the project is licensed under GPLv3 (or any other strong copyleft license), wouldn't they be illegally hosting it because they are bundling their malware dropper with software that isn't compatible with the license?

Simple bundling is not a GPL violation, only linking.

Is there any license that prohibits this then? If not, should one be created?

Re: Trojan found in Filezilla downloaded from SourceForge

#188
post #157

Earlier quoted context omitted.

"So I'm pitching this to bored devs and entrepreneurs: Help us, and many other projects, by creating a "Github for mailing lists" with a web client featuring a clean high quality UI, easily browsable/linkable archives, etc. Make it open source, make it self-hostable, stuff in enterprise support. Make it quick and easy to create new lists." Uggh ... really ? So the simple, clean, extremely fast loading HTML indexes of…

I agree. Mailman is fantastic as it is. There's a technical brevity and image it gives off, and that's an important aspect of design. This isn't really a statement about usability or what's beautiful in design. I design user interfaces and creating a new UI for basically what mailman does would really just be an attempt at grabbing a different target audience. mailman has an image behind it. People associate with dif…

Have you considered contacting Guiness World Records regarding the size of that horse you stand atop of?

If you genuinely do want to practice great design, start by considering user needs and the reason why "reskinning" as you call it might be wanted, instead of dismissing anything you don't immediately understand as "pah, must be junior designers, those with fancy gradients and far less experience than me".

No, seriously, what the hell.

Re: Trojan found in Filezilla downloaded from SourceForge

#189
post #139

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…

Then we should all probably point our collective fingers at google. Let's not pretend they couldn't blacklist sourceforge links for pulling this kind of BS.

Re: Trojan found in Filezilla downloaded from SourceForge

#190

Earlier quoted context omitted.

You're mis-remembering or something... There's no such thing as a "Core Networking Utilities" package on Windows (never has been) and ftp has been a command line tool since at least Windows 95. I don't particularly like the built in FTP command line utility (even with scripts). But it has existed a very long time indeed.

Eh, yes, it is. On the Windows 7 Home Basic and Home Premium edition, it’s not pre-installed, and you have to go to System Settings -> Programs and Features -> Install or Remove Features to install it.

I have Windows 7 Home Premium on my Mac via Parallels, and just I just typed in "ftp" into cmd and it came straight up.

The only packages I have installed are "Media Features" ".Net Framework 3.5.1" "Print and Document Services" "Windows Gadget Platform" "Windows Search" and XPS Services/Viewer. All of which are default features.

Which package are you even suggesting contains the ftp.exe client? Because I don't even see one. Also why would anyone go to the trouble of putting a 47 Kb binary inside of a feature package? It makes absolutely no sense at all.

Post reply on HN