81–90 of 143 posts
Earlier quoted context omitted.
That's how almost all malware was installed though. Linux really isn't any more resistant to malware than anything else.
Really depends on ecosystem and time; I remember when connecting an unpatched XP box to the internet got it infected with zero user interaction.
Earlier quoted context omitted.
From their website[1]: > FDM can boost all your downloads up to 10 times, process media files of various popular formats, drag&drop URLs right from a web browser as well as simultaneously download multiple files! No, I still don't a clue what it actually does that the OS and existing tools can't. It sounds like those scam "RAM doubler" programs from the 90s. Run this executable to boost your system's chakras . 1: htt…
It might just parallelize multiple downloads or something like that?
Why did the authors blanked out “Ukraine” from an (apparent) statement “Glory to Ukraine” in the comments? Seemed weird to me, what’s the point?
Earlier quoted context omitted.
why do you think this can not happen in the official repository?
Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…
Eh, don't expect too much from this. It's just the packager downloading a .tar.gz from the website or cloning the version control, maybe checking if it looks alright for a bit at most, maybe check signatures if they're available (or maybe not), and that's usually it. Especially for updates don't expect a "vetting process" of any meaning.
The main "defence" is time, not any vetting: usually people find out any problems before packagers have time to update the package or before a package becomes "known enough" to be added to Debian (or any other package repo): there will be GitHub issues, Reddit drama, HN threads, news articles, what-have-you.
Things like Chromium has a bunch of eyes, but that's the exception and very much not the rule.
Why did the authors blanked out “Ukraine” from an (apparent) statement “Glory to Ukraine” in the comments? Seemed weird to me, what’s the point?
If you intentionally install something called Free Download Manager, you should not be surprised when it turns out to be malware.
Proving trust is hard.
Earlier quoted context omitted.
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
Who is running random curl scripts without checking the code first? Is this common now?
- Not everyone is proficient in bash.
- Some install scripts can easily go on for thousands of lines, especially if they are designed to work with multiple distro or architecture, or both.
- Said install script might be integrated deep down into someone else's build pipeline.
- ... that's assuming they aren't the type that would blindly download and run random exe from the web in the first place
Pretty common, I would say.
Earlier quoted context omitted.
Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…
the list of contributors is huge, you just need to hack one person https://contributors.debian.org/ not to mention libraries like libxslt that is used by like half the packages even kernel.org was hacked, and git saved us, and luckily it was before the sha1 collision attacks were viable https://www.reddit.com/r/linux/comments/k0mco/kernelorg_comp... https://crypto.stackexchange.com/questions/99767/how-easy-is...
bribes are probably quicker and easier.
Who uses a download manager in the days of high speed internet access and, in general, cloud services?
They can be very useful for: - bypassing antiquated per connection throttles on otherwise fast servers by downloading chunks in parallel - downloading files such as videos from sites that don't really want you to download the file I have never heard of the program in the article, but this one still sees many active users on windows for the above reasons: https://jdownloader.org/ There's even a little community still…
If you intentionally install something called Free Download Manager, you should not be surprised when it turns out to be malware.
Are you saying that maybe it should have been named Linux Download Manager to fool more people, or Debian Download Manager? Proving trust is hard.