61–70 of 146 posts
Second time that this has happened to Transmission this year. Last time a ransomware got included. If you're a Transmission user then be very cautious when installing new versions.
You were only at risk when downloaded fresh copies from the website. Updates were checked by the already installed Transmission.
http://www.macrumors.com/2016/03/07/transmission-malware-dow...
Earlier quoted context omitted.
You were only at risk when downloaded fresh copies from the website. Updates were checked by the already installed Transmission.
Except that time where the auto update mechanism was actually distributing a hacked version http://www.macrumors.com/2016/03/07/transmission-malware-dow...
So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download) Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater? If there was a malicious Developer ID, has it been revoked b…
Anyone with a credit card can sign up for Apple's developer program and start signing apps.
[1] http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-...
Earlier quoted context omitted.
Main reason that I only install stuff like this from my distro's repositories. Anyone know if this would have affected homebrew and such on OSX?
Homebrew packages verify checksums, so very unlikely to be affected.
brew update && brew cask install --force transmission
Earlier quoted context omitted.
And to run it from the clipboard: pbpaste | sh -
If anyone wonders why this is taking too long, you may have done the same daft thing I just did, which was to copy the first command and then copy pbpaste | sh - . The latter will of course create an infinite loop.
Are Transmission releases usually codesigned?
Yes. And updates are checked within the Transmission app.
https://news.ycombinator.com/item?id=12403906
In comparison to Windows, macOS doesn't really seem to show the developer in the normal user flow.
Earlier quoted context omitted.
Yes, totally, if you want to make the best decision, then you have to keep up with the news. That's why I'm interested in other opinions about this, because there's a lot of datapoints you need to factor into a decision. It's not a simple decision. That's work, and we are lazy humans, you're right. But, I don't wait a whole week if the update is from an organization which I think I can trust not to totally botch an u…
It's more like a botched update from Microsoft, Apple, etc. will be noticed by lots of people within one or two days.
I'm not totally disagreeing, I'm just trying to say that calculating a confidence score for software updates is not simple. Maybe it's clearer if I give you a real-world example: I use cryptocurrencies to move moderately large amounts of capital in my business, and so my paranoia-level for software installed on the single, air-gapped laptop that handles cryptocurrencies is sky high and crazy cautious. My other business is separated from that, and I can be much more relaxed about software updates for it, because the risks are much lower.
Earlier quoted context omitted.
If anyone wonders why this is taking too long, you may have done the same daft thing I just did, which was to copy the first command and then copy pbpaste | sh - . The latter will of course create an infinite loop.
Why would copying two strings to the clipboard lead to an infinite loop?
Earlier quoted context omitted.
If anyone wonders why this is taking too long, you may have done the same daft thing I just did, which was to copy the first command and then copy pbpaste | sh - . The latter will of course create an infinite loop.
Why would copying two strings to the clipboard lead to an infinite loop?
(`pbpaste | sh - | pbpaste | sh - | pbpaste | sh - | ... | pbpaste | sh -`)
Earlier quoted context omitted.
If anyone wonders why this is taking too long, you may have done the same daft thing I just did, which was to copy the first command and then copy pbpaste | sh - . The latter will of course create an infinite loop.
Why would copying two strings to the clipboard lead to an infinite loop?
pbpaste | sh - | sh - ...