This is the 2nd time Transmission has been compromised this year.

Previously: https://news.ycombinator.com/item?id=11234589

And, possibly, still the first time their website was compromised.

If so, chances are we will see this happen again. Adding a payload to an open source project and signing it with a new key is not rocket science.

At this point they can't be trusted as developers. This is completely ridiculous.

I love Transmission, although nowadays I rarely use it. But this is really disconcerting to have happened twice this year, which means the developers aren't really doing well on the security front. Since it's open source, why don't they just move to Github Pages for hosting and Github for development? (Gitlab is great too!) Self hosting Trac and website, plus self hosted Jenkins from my understanding, leaves so many attack vectors.

The Windows version of Transmission-qt does not allow one to completely disable seeding. Little bellwethers go a long way in identifying poor applications.