51–60 of 146 posts
So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download) Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater? If there was a malicious Developer ID, has it been revoked b…
I'm not a Transmission user, but this makes me wonder, as a sort of Ask HN question: How long do you wait before updating software? If you always update as soon as possible, then you risk getting hit by a compromise like this one, or you could suffer other unintentional bad effects of a botched update. But the longer you delay updating, the more you raise your risk of becoming a victim of a new vulnerability that's j…
Earlier quoted context omitted.
I haven't read much about this, so perhaps I'm not understanding clearly, but if the downloaded binary from Transmission's "website server" was replaced, then how is that not a compromise? I genuinely feel for the developers, and I personally would not blame them if I was affected, but unless the data was intercepted enroute from their server, then I think they have to accept some degree of responsibility for the who…
Well, they do accept some kind of responsibility: it is spelled out clearly in the license what they accept, and you can choose whether you prefer the terms defined in GPL, or MIT (Transmission is dual-licensed).
I ask that because I think they'd be insane to accept responsibility.
I searched on their site, briefly, but I couldn't find this.
I haven't checked MIT license but the GPL 3.0 has got this clause about liability limitation.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
To me it sounds like it means whatever happens after you use our software, it's not our fault! Which sounds like a reasonable license for open source free software, to me.
Service announcement: You were only at risk when you downloaded fresh copies from the website. As with the previous incident, updates within the app were safe and checked.
Second time that this has happened to Transmission this year. Last time a ransomware got included. If you're a Transmission user then be very cautious when installing new versions.
Earlier quoted context omitted.
Deluge is pretty good, that's what I tend to go for.
I like Deluge, but I really wish its default API (protocol) wasn't so difficult to use. It's bencoded Python objects as far as I can tell. If you've never heard of bencoding, that's because it's only used by Deluge.
Simple file check if you are infected: if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud…
I didn't bother checking after I read that the autoupdate wasn't compromised, but never hurts to check - and I was not really going to do it until I saw your post.
Simple file check if you are infected: if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud…
And to run it from the clipboard: pbpaste | sh -