101–110 of 146 posts
Earlier quoted context omitted.
Probably a good idea to turn off auto-update from Transmission's preferences and only use brew update && brew cask install --force transmission to update. Even though they're also meant to be checksummed, I can't know whether an attacker also compromised the checksum mechanism.
Do we need to --force just for updating?
> Am I at risk? Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.
Nice idea with a major problem: If they did this, the absence of such a message could suggest that you were not affected, when in fact you could be (changed IP, cleared browser, etc). False negatives are pretty bad in this case, better for users to check themselves.
So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download) Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater? If there was a malicious Developer ID, has it been revoked b…
According to this article [1], the compromised app was indeed signed – but with a different Developer ID than usual. Anyone with a credit card can sign up for Apple's developer program and start signing apps. [1] http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-...
That's the terrible part about all of this. Having signed applications without any verification of the signer is pointless.
A simplistic, yet more secure approach, would be to have domain validated keys that could be used to sign applications. Browsers could then verify that the application downloaded from example.com was signed with a key for example.com. I think OSX already stores "This was downloaded from the scary internets!" in a separate resource fork so this info could go there as well. Maybe even cut out the middle mad and put them in DNS SRV records so you don't even need a central CA. If DNS gets compromised the client's have bigger problems already.
Unfortunately like all things like this, it'd be forever before it's widespread enough to be useful.
Earlier quoted context omitted.
Well, they do accept some kind of responsibility: it is spelled out clearly in the license what they accept, and you can choose whether you prefer the terms defined in GPL, or MIT (Transmission is dual-licensed).
Do you mind linking to that? Please quote the relevant part of license if you have time. I ask that because I think they'd be insane to accept responsibility. I searched on their site, briefly, but I couldn't find this. I haven't checked MIT license but the GPL 3.0 has got this clause about liability limitation. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL AN…
Are there any good alternatives to Transmission on OS X?
RTorrent https://pmukhanov.wordpress.com/2014/01/19/installing-rtorre... Text console based, so it can run headless and/or in the background in a screen/tmux session.
Earlier quoted context omitted.
Why not this? curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash
Your line downloads and executes the latest version of the gist, it could have changed from a file check to a virus installer by the author (unlikely, but I have to point it out). To be a bit more safe (while trusting that GitHub is not compromised) pin a known, verified version: curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/a26e5a025ea21d3a0af536eeca49619272d0068f/quick-osx-…
"The infected file was available for download somewhere between a few hours and less than a day."
Earlier quoted context omitted.
Why not this? curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash
Yeah, let's download and blindly run stuff directly from the internet (that may have changed since we last saw it) without saving and trying to read what it does first. If you can copy/paste the curl | bash, is it really more difficult to copy/paste the original snippet into a text editor[0], and from there, into bash? [0] https://thejh.net/misc/website-terminal-copy-paste