Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

201–210 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#201
post #88

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

https://cyberduck.io/ They have some issues with SSL certificate, though.

Cyberduck refuses to implement a two pane interface with a local browser.

https://trac.cyberduck.io/ticket/2778

Juggling multiple windows is really annoying. The entire UI is awful besides that also.

Re: Trojan found in Filezilla downloaded from SourceForge

#203
post #197

Earlier quoted context omitted.

> and email clients support folders and filters if you want that instead. Because who doesn't like mucking around with their client's filtering?

Ever heard of Sieve? ;)

Ever heard of it's 2015 and I'd like to be able to opt-in to specific mailings if necessary.

Isn't there a decent mailing list package that hybridizes a GitHub "issue" type system with a traditional "email firehose" approach?

Re: Trojan found in Filezilla downloaded from SourceForge

#205

Earlier quoted context omitted.

Though ublock origin can use it, it's the ublock badware risks filter list which is blocking sourceforge : https://github.com/gorhill/uBlock/wiki/Badware-risks

You are linking to uBlock Origin ("uBO") -- that filter list is specific to uBO. The other "uBlock"[1] (abandonware) does not support strict blocking, which is what blocks SourceForge. [1] https://github.com/chrisaljoudi/uBlock

Sorry if I didn't make myself clear, what I was trying to point out is that for ublock origin to block sourceforge the badware risk filter list has to be enabled. Also I suppose this list can used with other blocking software.

Oh and gorhill, much much thanks for your time and work on this.

Re: Trojan found in Filezilla downloaded from SourceForge

#206
post #16
post #7

It's done intentionally to make the owners a bit of money. They have direct download links on their website (click show all on download page), avoid the green Sourceforge link.

Nope, all links direct to Sourceforge.

Sorry I meant direct to the FileZilla installer rather than the Sourceforge installer. Both are hosted on Sourceforge.

Re: Trojan found in Filezilla downloaded from SourceForge

#207

Earlier quoted context omitted.

In that case you can't just store the hash of the password, you will need to password itself.

Hmm. Yeah. I’ve thought about it for the last few hours, and decided that the best solution is to just use RSA in client.

How would that work? If you would use a private key to authenticate to the server you would still need to protect this key with a password. Otherwise stealing the private key will get an attacker access to the server just as simple.

Re: Trojan found in Filezilla downloaded from SourceForge

#208
post #139

Earlier quoted context omitted.

High-profile projects actually can't stop. If you attempt to stop using Sourceforge, they will consider your account "abandoned" and continue mirroring the new site and serving downloads with their malware dropper included. So if you want to keep the malware out of your releases, you need to maintain control of your project by keeping SourceForge up to date. The GIMP project learned this the hard way: http://www.gimp…

Yeah I still can't believe how scummy sourceforge is. I wonder how new oss projects can protect themselves against this type of behavior. Anyone know if any oss licenses include a restriction against this kind of repackaging or any kind of malicious use clause?

That would be contradiction of terms. Anything with such restrictions is, by definition (look it up!), not Open Source.

Re: Trojan found in Filezilla downloaded from SourceForge

#209

Earlier quoted context omitted.

I agree. Mailman is fantastic as it is. There's a technical brevity and image it gives off, and that's an important aspect of design. This isn't really a statement about usability or what's beautiful in design. I design user interfaces and creating a new UI for basically what mailman does would really just be an attempt at grabbing a different target audience. mailman has an image behind it. People associate with dif…

Have you considered contacting Guiness World Records regarding the size of that horse you stand atop of? If you genuinely do want to practice great design, start by considering user needs and the reason why "reskinning" as you call it might be wanted, instead of dismissing anything you don't immediately understand as "pah, must be junior designers, those with fancy gradients and far less experience than me". No, seri…

Arrogance is telling someone they don't understand something, when they tell you "no."

> "User needs"

Do you actually design anything?

Re: Trojan found in Filezilla downloaded from SourceForge

#210

Earlier quoted context omitted.

They used to put all that stuff – ftp, network utilities, etc in one package. Granted, I haven’t used Windows in 4 years, but I remember fighting with getting ftp on Windows without admin.

Are you sure you aren't mis-remembering and were installing the Unix Services for Windows, to utilise Linux-like command line utilities? As the person said above, ftp.exe has been in Windows since the MS Dos days, and is a core utility. I've never seen it not been available on any version in any situation. Now an FTP server definitely needs to be installed. Always has. But we're talking about the ftp.exe client.

ftp.exe should be there, but telnet.exe is no longer installed by default. One must go to "Add/Remove Features" (or similar) and enable it first. Maybe that's what he's confusing it with.
Post reply on HN