Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

71–80 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#71
post #3

AFAIK this practice (and not on the FileZilla project alone) is why uBlock Origin is blocking SourceForge.

Though ublock origin can use it, it's the ublock badware risks filter list which is blocking sourceforge : https://github.com/gorhill/uBlock/wiki/Badware-risks

Re: Trojan found in Filezilla downloaded from SourceForge

#72
post #29

Earlier quoted context omitted.

Yes, Google Groups is very close to what's needed - unfortunately, it's proprietary and Google doesn't really maintain it, it's only a matter of time it goes the way of Reader.

FWIW, Google Groups powers email distribution lists for Gmail for Work. Or at least, the two are strongly linked. At this point, unlike Reader, there's real cash behind the functionality. It's possible they could just fold it into Gmail, I guess, but with other mail interfaces like Inbox popping up in the Google ecosystem it seems if anything they're trying not to shoehorn too much more into a flagship product. My gu…

As someone using Gmail for Work: This is one of the things I absolutely detest about Gmail for Work. The Groups interface is absolutely horrendous, and we don't want groups, we want simple email distribution lists.

Re: Trojan found in Filezilla downloaded from SourceForge

#73

This has been known about for some time. The Filezilla guys know about it. http://sourceforge.net/blog/devshare-relaunch-power-to-end-u...

Shouldn't this be a criminal offense?

It's usually hidden in the EULA. Very hidden.

It's not just Filezilla or sourceforge doing this. Lenovo do this routinely. They used to bundle something called BrowserGuard, which contains a PUP by Conduit. Conduit have since been partially acquired by another company Perion. I followed that rabbit hole last year, Lenovo point blank refuse to acknowledge it is spyware.

And it IS spyware. I created a Perion account to see what they actually had going on. They have an online form you can upload your executable to and it wraps their malware in the form of a toolbar. I tested it by uploading notepad.exe, and sure enough it works quite easily.

They capture your location and a whole bunch of data about your computer. They also have remote update facilities built into it. It's pernicious, and the company structure has been designed to make it very hard to determine who owns it. And Lenovo were very happy to use them.

Oh, and here is an article that confirms the autoupdate:

https://support.lenovo.com/au/en/documents/ht101178

Re: Trojan found in Filezilla downloaded from SourceForge

#74

Earlier quoted context omitted.

Why can the passwords not be hashed?

The client needs them in plain text to be able to connect. "Remember password" is a feature, there. Like I said, correct solution is to use the keyring, but the dev team is incompetent, so ...

Or a master password if using the keyring is too complicated for them.

Re: Trojan found in Filezilla downloaded from SourceForge

#75

Earlier quoted context omitted.

Discourse NodeBB and Vanilla comes to mind

None of them appropriately support mailing lists, though. Email-based communication is a big deal for devs which contribute on maybe 5+ projects at once and have to manage comms in one central place. As for Discourse's mockery of a mailing list mode, let's not even talk about it.

Are you familiar with DFeed [1] used by the D-Lang forum [2]? It is, in my opinion, one of the most usable web frontends for mailing lists (as well as a few other sources).

[1] https://github.com/CyberShadow/DFeed

[2] http://forum.dlang.org/

Re: Trojan found in Filezilla downloaded from SourceForge

#76
post #36

> If someone really wanted to download FileZilla and skip the malware do just that. > Then after installation is complete install Malware bytes and Avira. Scan with both and restart the computer. > Then run with ADWcleaner and and remove the infections and restart. should be good from there and enjoy FileZilla. Do people really think this works? I mean, there's no-one on HN who thinks this works, right?

Even if it works, that sounds telling somebody to park their car crashing it into a wall and then scraping off the pieces.

Re: Trojan found in Filezilla downloaded from SourceForge

#78

Earlier quoted context omitted.

None of them appropriately support mailing lists, though. Email-based communication is a big deal for devs which contribute on maybe 5+ projects at once and have to manage comms in one central place. As for Discourse's mockery of a mailing list mode, let's not even talk about it.

Are you familiar with DFeed [1] used by the D-Lang forum [2]? It is, in my opinion, one of the most usable web frontends for mailing lists (as well as a few other sources). [1] https://github.com/CyberShadow/DFeed [2] http://forum.dlang.org/

Never heard of it. Looks quite good. I will keep an eye on it, thank you.

Re: Trojan found in Filezilla downloaded from SourceForge

#79

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin.

http://forum.dlang.org/

(The forum is a front-end to the mailing lists / newsgroups.)

Re: Trojan found in Filezilla downloaded from SourceForge

#80
post #40

Earlier quoted context omitted.

FTP passwords can't be hashed. The right solution would be to support platform keyrings but ... https://trac.filezilla-project.org/ticket/1373

Someone explained that after he got some malware on his computer and subsequently all his websites were hacked. The response? Once you've got malware on your computer, you've lost already, game over. You need to prevent the infection in the first place. OMFG...

That's correct though. Even if the passwords weren't stored at all, malware could just install a keylogger and record them when you typed them in.
Post reply on HN