21–30 of 110 posts
Earlier quoted context omitted.
It looks like they have a dump of the Fosshub user database. Audacity was also affected: http://www.audacityteam.org/hacked-download/
Damn. You have no idea how close I was to reinstalling Audacity last night.
Earlier quoted context omitted.
From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.
Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.
OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.
This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.
Obligatory xkcd: https://xkcd.com/1200/
Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.
This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.
There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about. Obligatory xkcd: https://xkcd.com/1200/
Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.
I watched the video in this thread. I would not consider that a prominent warning at all. UAC uses a near identical prompt and I need to click through it daily (average of 2-3 times an hour while doing development). It is not something I would have noticed.
Earlier quoted context omitted.
There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about. Obligatory xkcd: https://xkcd.com/1200/
Yeah, user account access is bad enough on its own.