3 ms·

What factual information do you dispute from their responses?

by ksk 8y ago

craftyguy 8y ago
I'd dispute the whole "we are shipping this extra software, we don't really know what it does, but they are paying us so I don't see what the problem is ¯\_(ツ)_/¯" (paraphrasing)
mcbits 8y ago
I dispute "The hash doesn't match because the filename doesn't match." He did backpedal and say he really meant they don't match because the files are different. (Well, duh.) I also dispute "It's a tautological false-positive, by the very definition of the term, _everything_ is potentially unwanted." That's not the definition. Here is a definition in line with what just about everyone means by the term: "A potentially unwanted program (PUP) is a piece of software that is also downloaded when a user downloads a specific program or application. PUP is similar to malware in that it will cause problems when it is downloaded and installed."[0] Or my own shorter definition: "Software that nobody would want on their computer if they knew what it is and does." It sounds like that's exactly what was detected. I don't dispute, but I'm curious about his claim that AV vendors maliciously flag their competitors' legitimate software. I wouldn't be the least bit surprised if that's true, but it's the first time I've heard of it. [0] https://www.techopedia.com/definition/4061/potentially-unwanted-program-pup https://www.techopedia.com/definition/4061/potentially-unwan...
- ksk 8y ago
  Well, the central question in my mind anyway, is whether FileZilla distributes malware. I don't see any data on that yet.. maybe it will come. Meanwhile I'm not going to join other HN members in calling people I don't know "scum".
  - justinclift 8y ago
    FileZilla doing this has been known for at least a few years: https://web.archive.org/web/20140816230250/http://blog.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/ https://web.archive.org/web/20140816230250/http://blog.glust... Back then, they were doing it as part of the (previous incarnation of) SourceForge's "DevShare" offering. eg malware authors got SourceForge to bundle crapware with popular Win installers, and gave the developers a cut of the take. It seems like the FileZilla people didn't like that revenue stream being cut off, and went to the source directly afterwards. :(
9935c101ab17a66 8y ago
A) The hash/filename comments, that's ridiculous and obviously meant to mislead (yes, the BOTG person tries to walk it back, but it was still bullshit) 2) The lack of actual rebuttal — a tonne of valid points were made about the bundled binary, the dats, the phoning home, the unsigned executables, etc. None of them were addressed. 3) the nonsense about digital signatures Do you really truly think they did an adequate job responding to the complaints/criticisms/questions? Seriously?
- ksk 8y ago
  OK I just re-read the thread. What did they walk back? Someone posted hashes of different files and asked why they don't match. >The lack of actual rebuttal — a tonne of valid points were made about the bundled binary, the dats, the phoning home, the unsigned executables, etc. None of them were addressed. https://forum.filezilla-project.org/viewtopic.php?p=161493#p161493 https://forum.filezilla-project.org/viewtopic.php?p=161493#p... Maybe the dude didn't go into excruciating detail but I understood the reply. Which part of the reply was factually incorrect? >3) the nonsense about digital signatures Could you link to the comment ? >Do you really truly think they did an adequate job responding to the complaints/criticisms/questions? Seriously? I don't know which complaints you're referring to. Some are reasonable, and others are just wild accusations. But just to give you an answer that you will be happy with, No, they didn't.

What factual information do you dispute from their responses?

by ksk 8y ago

What factual information do you dispute from their responses?

I'd dispute the whole "we are shipping this extra software, we don't really know what it does, but they are paying us so I don't see what the problem is ¯\_(ツ)_/¯" (paraphrasing)

mcbits 8y ago

I dispute "The hash doesn't match because the filename doesn't match." He did backpedal and say he really meant they don't match because the files are different. (Well, duh.) I also dispute "It's a tautological false-positive, by the very definition of the term, _everything_ is potentially unwanted." That's not the definition. Here is a definition in line with what just about everyone means by the term: "A potentially unwanted program (PUP) is a piece of software that is also downloaded when a user downloads a specific program or application. PUP is similar to malware in that it will cause problems when it is downloaded and installed."[0] Or my own shorter definition: "Software that nobody would want on their computer if they knew what it is and does." It sounds like that's exactly what was detected. I don't dispute, but I'm curious about his claim that AV vendors maliciously flag their competitors' legitimate software. I wouldn't be the least bit surprised if that's true, but it's the first time I've heard of it. [0] https://www.techopedia.com/definition/4061/potentially-unwanted-program-pup https://www.techopedia.com/definition/4061/potentially-unwan...

ksk 8y ago
Well, the central question in my mind anyway, is whether FileZilla distributes malware. I don't see any data on that yet.. maybe it will come. Meanwhile I'm not going to join other HN members in calling people I don't know "scum".
- justinclift 8y ago
  FileZilla doing this has been known for at least a few years: https://web.archive.org/web/20140816230250/http://blog.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/ https://web.archive.org/web/20140816230250/http://blog.glust... Back then, they were doing it as part of the (previous incarnation of) SourceForge's "DevShare" offering. eg malware authors got SourceForge to bundle crapware with popular Win installers, and gave the developers a cut of the take. It seems like the FileZilla people didn't like that revenue stream being cut off, and went to the source directly afterwards. :(

9935c101ab17a66 8y ago

A) The hash/filename comments, that's ridiculous and obviously meant to mislead (yes, the BOTG person tries to walk it back, but it was still bullshit) 2) The lack of actual rebuttal — a tonne of valid points were made about the bundled binary, the dats, the phoning home, the unsigned executables, etc. None of them were addressed. 3) the nonsense about digital signatures Do you really truly think they did an adequate job responding to the complaints/criticisms/questions? Seriously?

ksk 8y ago
OK I just re-read the thread. What did they walk back? Someone posted hashes of different files and asked why they don't match. >The lack of actual rebuttal — a tonne of valid points were made about the bundled binary, the dats, the phoning home, the unsigned executables, etc. None of them were addressed. https://forum.filezilla-project.org/viewtopic.php?p=161493#p161493 https://forum.filezilla-project.org/viewtopic.php?p=161493#p... Maybe the dude didn't go into excruciating detail but I understood the reply. Which part of the reply was factually incorrect? >3) the nonsense about digital signatures Could you link to the comment ? >Do you really truly think they did an adequate job responding to the complaints/criticisms/questions? Seriously? I don't know which complaints you're referring to. Some are reasonable, and others are just wild accusations. But just to give you an answer that you will be happy with, No, they didn't.