Are there any good alternatives to Transmission on OS X?
RTorrent https://pmukhanov.wordpress.com/2014/01/19/installing-rtorre...
Text console based, so it can run headless and/or in the background in a screen/tmux session.
Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
71–80 of 146 posts
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#72So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download) Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater? If there was a malicious Developer ID, has it been revoked b…
According to this article [1], the compromised app was indeed signed – but with a different Developer ID than usual. Anyone with a credit card can sign up for Apple's developer program and start signing apps. [1] http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-...
So Apple/the bank/a warrant can return his name?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#73Earlier quoted context omitted.
I like Deluge, but I really wish its default API (protocol) wasn't so difficult to use. It's bencoded Python objects as far as I can tell. If you've never heard of bencoding, that's because it's only used by Deluge.
The .torrent file format itself uses bencoded fields.
Ah crap. I meant rencoded. https://github.com/aresch/rencode
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#74Is there any evidence the developers aren't doing this themselves as a false flag attack on their own product to profit off of the malware?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#75Earlier quoted context omitted.
Maybe per person, but probably not in aggregate.
Android users have way more money in aggregate, but iPhone apps make more money. This is because iPhone users have a lot more disposable income, while Android users are cheap.
Or they re more willing to spend frivolously.
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#76Earlier quoted context omitted.
Only if you want an interface filled with ads.
Pay for it then? Netflix scratches my entertainment itch now, but prior to it launching in Australia I almost went ahead and paid for uTorrent. It's a good, lightweight client. Software that works well deserves to be financially supported.
Some peoples tastes are broader than the mainstream American TV on offer by Netflix
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#77Earlier quoted context omitted.
Main reason that I only install stuff like this from my distro's repositories. Anyone know if this would have affected homebrew and such on OSX?
Homebrew packages verify checksums, so very unlikely to be affected.
Depending on where they get their checksums. Anyone can submit an app update, so long as the official download link matches the provided checksum then it will get merged. The only benefit here is the delay introduced in receiving the update.
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#78> Am I at risk?
Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#79So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download) Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater? If there was a malicious Developer ID, has it been revoked b…
Interesting question. According to https://developer.apple.com/support/certificates/ : >> If your membership expires, users can still download, install, and run your Developer ID–signed applications. However, once your Developer ID certificate expires, you must be an Apple Developer Program member to get new Developer ID certificates to sign updates and new applications. What I understand is that codesigning costs $9…
I really thought Apple had added a free option (maybe even specifically for open source projects?), but I can't find it anywhere. Can anyone else find that info, or am I misremembering?
Re: Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A
#80Earlier quoted context omitted.
If anyone wonders why this is taking too long, you may have done the same daft thing I just did, which was to copy the first command and then copy pbpaste | sh - . The latter will of course create an infinite loop.
Why would copying two strings to the clipboard lead to an infinite loop?
It won't, but running
pbpaste | sh -
I had replaced what I wanted to execute with just "pbpaste | sh -"
So it passed "pbpaste | sh -" to the sh to run. Which would have then taken "pbpaste | sh -" and passed it to sh to run, which ...