the comparatively small userbase is actually an underappreciated security feature of linux ;)
i'm sure that if installcore supported linux, then the linux binaries would also be bundlers.
Hopefull it will be blocked by the browsers using the safe browsing list.
https://i0.wp.com/keepass.fr/wp-content/uploads/2018/05/keep...
So maybe we can report it here too:
https://en.wordpress.com/abuse/
Only works if you put this as URL though:
Look like it's a copy paste of the .com one, with same download links.
I've had discussions with coworkers on why they shouldn't look up "free online json beautifier" and dump thousands of lines of crown jewels into them (http too). Meanwhile we're doing web dev and JSON responses are autoformatted in Firefox dev tools so there's an amazingly convenient and perfectly safe alternative right there...
How do we impart urgency with this kind of stuff?
From their FAQ:
> No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find (just type ‘putty’ into google.com and we're the first link returned), and we don't believe the administrative hassle of moving the site would be worth the benefit.
https://keepass.fr/ https://7zip.fr https://audacity.fr https://gparted.fr https://keepass.fr https://nc3354.nexylan.net https://paintnet.fr
Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.
https://sourceforge.net/blog/brief-history-sourceforge-look-...
I think 7zip has a way for you to check the hash signature with just a right click on the file so thats dandy
Not implying you are but there is plenty of software where that is how they expect users to verify the integrity of the download. Useful for checking bit errors, but in the event that someone has replaced the binary then they could probably also replace the checksum...
Anyway, this wouldn't be the first time an open source software is packaged with some adware. Unsavory, but I think within the limits of the license.
Source : am french
One time I downloaded the wrong google chrome which was ironic because I was on google searching it.
Other examples that come to mind with different sites are popcorn.sh vs popcorn-time.to. There not the same repository.
Normally I just do a sanity check by checking the domain URL and checking if it has authority.
If its on sourceforge... I just assume its malware or has bundled PUPware on it, run it through antivirus and SHA/MD5 checks.
Ninite.com is pretty convenient I hope they don't get comprimised one of these days and get sold to a shady vendor
