Live data from Hacker News

Why sqlite3 temp files were renamed 'etilqs_*' (2006)

github.com

71–80 of 146 posts

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#71

I often search for weird files in my %userprofile% (there are a lot random ones) just out of curiosity, despite I know they're not malicious. It doesn't help that if you Google any filenames, or even any semi-obscure file extensions, there would always be plenty of blogspam articles saying they're "possible virus". And oftentimes, there is no legit article to say what they really are even if you try, if they're from…

Could put the file(s) on a linux machine and run `file` on them

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#72
post #13

Love it. Too bad there aren't enough Mac users to prompt a similar backlash against Macs littering every computer they visit on the network with .DS_Store and other turds.

This isn't remotely comparable. Those .DS_Store files are created in arbitrary directories by the Apple file manager or something. The SQLite temp files are created in the OS-specific temporary directory (e.g. C:/Users/username/AppData/Local/Temp or whatever on Windows) which is specifically intended for that purpose. SQLite isn't doing anything wrong; that's where it's supposed to store temporary data that doesn't f…

You misunderstood what the comment in the code was saying.

Firstly, it not that anti-virus software was misclassifying it -- it's that a particular one, Mcafee, was USING sqlite. And more importantly, it didn't put the file(s) in the proper %temp% folder. Instead, it created it as `C:\temp\{name}.sqlite_`. This is why users found them suspicious and complained to devs.

Also keep in mind putting random files or folders under root of C:\ was, while never recommended, a common practice in 2000s (some still do so even today). So what Mcafee was doing is hardly unheard of. But people still freak out when they see these in their C:\ (TBH, understandable).

> %userprofile%

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#73
post #23

Earlier quoted context omitted.

Daniel Stenberg has also gotten some ... interesting ... emails because people found the curl license somewhere and assumed he was responsible for $stuff. https://daniel.haxx.se/blog/2016/01/11/tales-from-my-inbox-p... https://daniel.haxx.se/blog/2016/01/19/subject-urgent-warnin... https://daniel.haxx.se/blog/2018/02/16/why-is-your-email-in-... https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

The last one has to be an elaborate troll. Only a 4chan user would type "RIP Terry A. Davis" anywhere.

Check the ‘apology’ follow up. The person claims to be schizophrenic. Even the apology mail makes no sense and is full of paranoia and read like a group stalking delusion.

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#74
post #37

Earlier quoted context omitted.

It is a web app that has exclusive ownership over its SQLite databases. Exactly one SQLiteConnection instance per for the lifetime of the application.

Does that mean you have to bring the whole app down if you need to manually insert something in sql?

I am not an expert, but if I had written an app that was designed like that, the app would have a /debug url that let me log in[0] and then do all kinds of fun things[1], including running raw SQL from the app's context.

[0] And I would be very careful about the security angle, because this is effectively a very dangerous back door into the whole system. Useful, but something to be careful about.

[1] Dump live activity stats, performance info, ability to run arbitrary queries against any database(s), ability to run arbitrary code in the app itself if available in a reasonable way (ex. if the app is in a dynamic language, just an eval(), possibly embed tcl/lua if not).

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#75
post #42

Earlier quoted context omitted.

I meant use the name of the program that embeds SQLite, for example, McAfee, Google Chrome etc. This way the user could easily understand which program has created the files.

Why spend time and effort on all of that when applications can just configure it themselves if they want to?

If it were possible to determine the program name in a way that was portable and not too painful, it would be a nice feature for the library to automatically set a better default, both to save work for devs using it and to save sqlite devs the hassle of their library getting blamed for things that aren't its fault. Now, I don't think those conditions are likely to be met, but that doesn't mean it wouldn't be nice if it were practical.

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#76

Earlier quoted context omitted.

> Sounds like a loud minority to me. Imagine for a moment the cross section of Windows users that 1) have McAfee running 2) poke around the Windows temp folders and/or run some sort of "cleaner" to "optimize" their system and 3) don't recognize the name "sqlite". I can imagine the exact type of user, peak Dunning-Kruger and utterly insufferable. Even just seeing their e-mails before deleting them would be maddening.…

I was that person once. I was 12 and couldn't understand why MS-DOS disk maintenance tools shouldn't be used on PC-DOS because obviously repair tools can only fix things

Children really are peak Dunning-Kruger.

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#77

I don't know, the more time passes the more I convince myself that the net benefits of antivirus software do not (an maybe never) exceed their downsides. In decades I've heard so many stories about AV software behaving suspiciously, using borderline shady tricks to monitor user activity, causing severe performance degradation, etc

There was a time when they made sense, but it's been many years since the benefits of running a third party antivirus program outweighed the drawbacks.

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#78

I don't know, the more time passes the more I convince myself that the net benefits of antivirus software do not (an maybe never) exceed their downsides. In decades I've heard so many stories about AV software behaving suspiciously, using borderline shady tricks to monitor user activity, causing severe performance degradation, etc

How about that time Avast gave you RCE by simply adding HTML to the CN field of an invalid certificate?[^1] Or when TrendMicro added an unauthenticated listener that would exec anything you sent it?[^2]

[1]: https://www.theregister.com/2015/10/06/google_zero_hacker_re... [2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=69...

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#79
post #30

Love it. Too bad there aren't enough Mac users to prompt a similar backlash against Macs littering every computer they visit on the network with .DS_Store and other turds.

You mean like those thumbs.db files windows leaves on every computer they visit on the network?

Windows XP is the last Windows version that does this.

Re: Why sqlite3 temp files were renamed 'etilqs_*' (2006)

#80
Similar story: Friend and I put out a kernel driver (uxstyle.sys) that would patch Microsoft's theming digital signature checks. It was free, buggy, and bugchecked the OS on upgrade. It was unsurprisingly added to compatibility blocks in Windows. I fixed the bug and asked Microsoft to loosen the block (version X and below). Microsoft refused citing a EULA violation. Valid or not, I renamed the driver to elytsxu.sys to circumvent their check and the app worked well enough until third-party theming fell out of favor.
Post reply on HN