> Of course you need to know what you're doing

No one knows what they are doing. Unless you are decompiling and reverse engineering the whole thing you are mostly just blindly trusting its safe. Even on trusted sites people share stuff from other sites not knowing its infected.

There's something to be said for the sites that only shared scene releases from groups with a reputation to protect. Maybe in the future, trusted groups can cryptographically sign their releases to avoid tampering and minimize the amount of trust necessary.

They have been for decades! Most scene releases that are packed will include an SFV file that contains the checksums of each of the package files so that you can check the file integrity.

Obviously those can be repacked and faked so you'd have to check multiple sources to ensure you get a genuine release, but yeah the scene groups are as usual way ahead of everyone else.

I meant signatures, not checksums. A signature chain would avoid the repackaging problem if the signer's public key was distributed out-of-band. Groups and distributors alike could add their own signatures to create multiple possible trust boundaries.

I think the scene groups are a traditional bunch that in some respects are years behind because of it. I remember in maybe 2005 I'd still download releases that were split into floppy sized RAR files. Possibly, this tradition carried on for so long because the scene was so keen to shame groups that didn't package like everyone else. I don't know how it is now but I'm hoping they got over splitting releases.

My guess is that the OP means knowing where you download from. In a way it's like the fabled "web of trust". Reputable warez groups didn't distribute software with viruses.

Like the OP, back in the day I used to have plenty of pirated software (mostly games) and never had a problem with viruses (at least, not that I knew or had any noticeable effects). The threat complexity is probably way worse these days and I wouldn't risk it. Plus, of course, I support games by paying for them :)

I mean, the RuTracker thread identified it as malicious long before this report ever came out. A few people running sandbox tools, firewalls and host based IDS tools will catch pretty much all malware quickly based on behavior alone.

I used to swear by Outpost Firewall as it was able to do things like detect applications adding to startup, injecting into other processes, gaining raw disk access, reading your browser profile for passwords, communicating with any unexpected hosts, etc. This is enough to rapidly identify most malware packaged with pirated software immediately. This isn't some advanced targeted attack, it's a script kiddie packing ransomware, password dumpers like iStealer, RATs like DarkComet, etc. The kind of thing these tools are designed to detect.

I skimmed the blog post. It seems disingenuous to not say the original thread already people saying it is [shitty] malware.

I’m on my phone so can’t search better, but couldn’t find it at rutracker from a quick search. Not sure if it will be available via some archive.

It’s important to realize that’s true also when you’ve paid for the software and got it directly from the source:

Sony has a root kit included, Zoom had a web server that could be exploited (at least) to then on your camera.

That’s just off the top of my head.

It's also true most of the time when using open source software.

“Most” Depends if you weight by installs, sources, or packages.

I don’t remember malware on Debian, Ubuntu, Fedora or Arch’s repository (put there by maintainers like the examples I gave above, or by a hack). And definitely not Gentoo.

But you are right. The bottom line is, you shouldn’t trust that which you cannot verify; but with open source, you have much more ability to verify (but it’s not a panacea - you run to many lines of code to verify yourself, it’s not clear anyone trustworthy verified it all, and there also the “reflections on trusting trust” argument)

Sure. All I meant is you cannot just download and install anything and everything without using your judgement.

My judgement says not to execute programs I can't read the source to or hold the publisher legally accountable for.

But you don’t read the source to most things, no? Nor do most people.

Isn’t that why things like heartbleed took two years before being found out? I presume some people using the vulnerable OpenSSL versions felt similar to you.

Being open source does not ensure software is bug free but its highly highly likely to not be malicious. Usually malware authors don't actually write software, they tack it on to other peoples software or write stuff that doesn't do anything useful at all. Not once have I ever heard of malware making its way in to the debian repos.

The worst I have seen is xscreensaver embedding a message in the code to complain about the old version a year after release.

How old are you? Malware is much worse nowadays thanks to Bitcoin monetization and more networked sensitive data.

The world has changed pretty substantially from my teenage days when I'd happily run pirated software. Back in the day viruses and malware would either screw with your computer in amusing and reversible ways (so long as you had a good backup), or spam you with popup ads. Maybe they'd relay spam mail for a while until you noticed your internet connection was useless and run a virus scan.

The damage malware can do now is so much deeper - encrypting all your files, which then gets synchronised out through the tool you were using for backups automatically, before holding them to ransom. Then it turns your light bulbs into DDoS nodes to spread that to people across the internet, and probably you won't notice because you're on a fast enough connection for that to fly under the radar.

I don't know when you went through your youthful piracy phase, but I know that when I did, malware was still mostly a shits'n'giggles affair. Worst case you'd get nudged a little closer to that long overdue clean slate reinstall. That landscape has changed dramatically, it's an industry now.