211–220 of 560 posts
Would've been good if it named the hosting provider. That's the most informative part.
I'm pretty surprised that they got away with unsigned updates and shared hosting as long as they did. I wonder how many similar popular projects are out there on dodgy infrastructure.
Vindicated once again for turning off any update checks the moment I install any new piece of software. Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location…
Earlier quoted context omitted.
Probably the real motive.
“ The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.” How do they know it was a Chinese group or even a state sponsored one?
Vindicated once again for turning off any update checks the moment I install any new piece of software. Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location…
It is baffling to me, as well. You know how you get a remote-code-execution vulnerability? You give a bunch of software permission to fetch code remotely and execute it.
And there isn't really a way to confirm if it is configured in a secure way.
You either trust the developer or not.
Earlier quoted context omitted.
Probably the real motive.
“ The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.” How do they know it was a Chinese group or even a state sponsored one?
I get that this is a difficult situation for a small developer, but ending with this line did not fill me with confidence that the problem is actually resolved and make me trust their software on my system.
Earlier quoted context omitted.
Nah, it doesn't mean they support the status quo. It just means some political tactics are pointless, incompetent, and counterproductive. Political opinions about how things should be don't automatically dictate the actions that should be taken in support of those opinions. I can be mad about a law or a court decision and still have the good sense to, for example, not throw red paint on a lawmaker or judge. Some beha…
It intrinsically does. Whatever stance changes nothing or prefers to change nothing is a vote for the status quo, by definition.
So the hosting provider was hacked? Who was their hosting provider? This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected
The latest and greatest cryptography powering everyone’s favorite SAML-based single-sign on.
Vindicated once again for turning off any update checks the moment I install any new piece of software. Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location…
How do you deal with the opposite, software that you forget to update but contains vulnerabilities discovered/exploited later?
