101–110 of 110 posts
It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.
It looks like they have a dump of the Fosshub user database. Audacity was also affected: http://www.audacityteam.org/hacked-download/
Earlier quoted context omitted.
The PC platform as a whole is going through a severe case of "second system effect".
Even back in the 1990s, there was ACPI. ACPI 1.0 for example dates back to the end of 1996 (of course before then there was drafts): http://uefi.org/sites/default/files/resources/ACPI_1.pdf But of course ACPI took years to catch on, during which low cost PCs from for example eMachines was coming.
Earlier quoted context omitted.
Even back in the 1990s, there was ACPI. ACPI 1.0 for example dates back to the end of 1996 (of course before then there was drafts): http://uefi.org/sites/default/files/resources/ACPI_1.pdf But of course ACPI took years to catch on, during which low cost PCs from for example eMachines was coming.
I seem to recall Torvalds having some less than kind words about ACPI.
Earlier quoted context omitted.
I don't see much value in published file hashes when they're hosted on the same site that hosts the files. If someone compromises the download link they're probably in a good position to update the hashes too.
The purpose of the hashes isn't to prove the file hasn't been tampered with, its confirm that the file wasn't corrupted during download.
Earlier quoted context omitted.
I watched the video in this thread. I would not consider that a prominent warning at all. UAC uses a near identical prompt and I need to click through it daily (average of 2-3 times an hour while doing development). It is not something I would have noticed.
Seriously, I've clicked through that on purpose many times with a lot of open-source projects, in development stuff, hell, I've gotten unsigned programs from companies!
Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.
A classic Bootsector virus to go with the classic Windows shell...
Presumably you could do the same thing these days with any USB flash drives that had been left plugged in.
Earlier quoted context omitted.
Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).
Per the developer at that forum thread: "To be safe, always check the digital signature of EXEs you downloaded, before you run them. The official Classic Shell installer has a signature for "Ivaylo Beltchev", and the fake one doesn't even have a signature." And per another user (silmar), my sentiments: "The problem with signed installers is: many software developers don't sign, so you install even if Windows warns yo…
Earlier quoted context omitted.
I don't think SEO is what pluma is concerned about
So what are they concerned about then? There's some moral wrong to watching crooks be crooks?
Linking may not imply endorsement but their twitter account clearly shows they want the public hate as attention, so whether you want it or not, you're doing them a favour by naming them, even if to scold them.
This is akin to associating every mass killing with a terrorist organisation (whether accurate or not) and showing detailed videos of those killings when the entire point of a terrorist organisation is spreading terror.
Earlier quoted context omitted.
I'm not sure it's appropriate to give that kind of people unwarranted publicity.
What "kind of people"? They had the power to abuse that data and ship malware to millions, but decided just to give people a scare. That’s just the average grey-hat, or how most hackers were in the 90s. Compared with the profit-obsessed and abusive hackers and companies on the web today, which try to shove actual malware, sometimes installers with tons of preselected options, sometimes bitlocker, they’re not bad.
Deleting the partition table is not grey hat, it's black hat. The bad guy in a Western isn't suddenly neutral just because he isn't literally Josef Stalin.
Earlier quoted context omitted.
I usually check the hashes of all software I download. How do I check the hash if the vendor doesn't publish it, you might ask? Simple, calculate it and Google it. If you find what look like legitimate hits associating this file with this hash, call it good. And it does work in this case - try googling both the published good and bad hash :)
In this case a distribution site which hosts both the hash and the file was hacked. This test is only good for "is the integrity of the download good" not for "is this created by the original developer". An authenticode or PGP signature is much better.