damn 10k ? thats a lot, how did you get them ?
Hmm. Using a script. That's explained in the article)
I found 10k GitHub repositories distributing Trojan malware
31–40 of 268 posts
Re: I found 10k GitHub repositories distributing Trojan malware
#32> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…
This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match
I use keepass (FOSS under GPL, fully offline).
It does not detect domains.
Re: I found 10k GitHub repositories distributing Trojan malware
#33I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.
If all projects on github were closed source with public "trust me bro" binaries the situation would be of course much better.
Re: I found 10k GitHub repositories distributing Trojan malware
#34I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.
The problem the article is describing seems to have little to do with open source. There were GitHub repositories that had links added in their READMEs to a zip file containing compiled binaries.
GitHub is not a curated software repository. It's essentially no different from some random stranger linking to some binaries on a forum. (There are communities that seem to have no concerns about running unknown binaries from strangers in forum threads, but I wouldn't recommend it.)
Re: I found 10k GitHub repositories distributing Trojan malware
#35I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.
[deleted]
Re: I found 10k GitHub repositories distributing Trojan malware
#36Re: I found 10k GitHub repositories distributing Trojan malware
#37Earlier quoted context omitted.
Aha, wasn't that argument more about that closed source software is more likely to hide stuff you don't agree with, than FOSS? Not necessarily that FOSS won't have any viruses or malware, but it's at least less likely. That was my take away, but long time ago I read the book admittedly, I might misremember or transformed it automagically over time.
This is my takeaway as well. Having the source code open makes it auditable, if not by you, maybe the community. The free software license specifically gives the software an extra advantage in that changes to the software must be shared openly, if distributed as as binaries.
> source code open makes it auditable, if not by you, maybe the community
I think part of why this social engineering works so well is it takes advantage of that "many eyes" trust, where people are prone to delegating the responsibility of checking to the community and not do due diligence on themselves. I know I'm susceptible to it if I see a Github repo with more than 10k stars on it.
Re: I found 10k GitHub repositories distributing Trojan malware
#38> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…
speaking only to search quality: try Kagi.
Re: I found 10k GitHub repositories distributing Trojan malware
#39Earlier quoted context omitted.
Yeah but the downsides of passkeys make them so much worse anyway.
Pretty happy with having a yubikey on my keychain. Log in someplace new? plonk in your yubikey and off you go!
I used to keep a yubikey in a spare slot on my laptop. One day it fell out and subsequently escaped through an unnoticed hole in my backpack.
I've never lost a password because my backpack was overly abused.
Re: I found 10k GitHub repositories distributing Trojan malware
#40Hi Claude fable, why u not protecting me from malware? Am i not american enough? Not rich enough? Yieks..