51–60 of 143 posts
This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…
This is one more reason to run every program in a sandbox rather than with full privileges.
I disagree. This is more another reason to not run programs which are not from the official repository.
https://www.debian.org/security/2008/dsa-1571
I would just like to remind everyone to be cautious, in general. This bug was in the openssl package, and as a consequence was creating incredibly weak keys, for around 2 years before being discovered in what is arguably one of the most critical pieces of software for the OS.
Earlier quoted context omitted.
Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…
Appreciate sf.net isn't as shady now, but ironic it should be listed as that used to spread malware. https://www.howtogeek.com/218764/warning-dont-download-softw...
Why would you use a "Free Download Manager" when wget is right there? Or a web browser, such as Firefox? Or torrent clients to deal with large Linux ISO downloads? Or the various storefronts, like Steam? Or your own distro's package manager? This wasn't packaged on any distro, so this isn't even a meaningful attack: Users had to go out of their way to install it from a foreign source. This is no different than if you…
From their website[1]: > FDM can boost all your downloads up to 10 times, process media files of various popular formats, drag&drop URLs right from a web browser as well as simultaneously download multiple files! No, I still don't a clue what it actually does that the OS and existing tools can't. It sounds like those scam "RAM doubler" programs from the 90s. Run this executable to boost your system's chakras . 1: htt…
I see free. I download!
Earlier quoted context omitted.
Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
Who uses a download manager in the days of high speed internet access and, in general, cloud services?
I'm trying to imagine the kind of user that's both able to blindly install a random .deb downloaded from a website, while also being willing to do so. Linux geeks with no sense of danger on the internet?