This is the same sort of behavior that malicious applications are increasingly using to avoid detection and analysis.
Very interesting! I'd be interested to hear the corporate-speak rationale for this. Kind of interested, anyway.
I'm not affiliated with Sourceforge in any way, shape, or form--thank the fucking gods--but I suspect it would be something along the lines of "our downloader and associated offers are optimized to automatically use fewer resources in an environment, such as a VM, where computing resources are scarce."
On a technical level - how come you can detect VM's? with something like BOCHS and if you lie about wall time inside your OS, can't it emulate a PC perfectly? How does crapware know whether it's in a VM or not?
Even if we reached the point where VMs never technically revealed they were VMs, I think the human element might still play a part. When I spin up a VM for a quick test, I might leave it on 512MB or 1GB RAM - but this could be a giveaway that it's a VM (not 100% of the time, granted) given how unlikely a fresh installation of Windows is to have that small amount of memory.
As the hypervisor gets low on RAM, it tells its driver in the VM OS to use more RAM, which steals some away from that system. Then the hypervisor swaps that RAM or puts it out of play in another way, and gets to reclaim the underlying physical RAM. At least, this is the VMWare way of doing it, not too sure about MS or Citrix or RH or others.
For example, for best performance you want to run the instructions in the VM directly on the hardware CPU so that they run as fast as they would outside the VM. But not all instructions can be run safely this way, so the VM will trap some and emulate them. This is necessarily slower, so a program can detect the presence of a VM by noticing that some instructions are much slower than they ought to be. You can lie about the time, but the bookkeeping needed to do so accurately imposes a lot of overhead.
Just a guess, but probably plausible deniability reasons for when they're inevitably brought to court.
Also available from https://ninite.com/
I am not familiar with chocolatey but the powershell script on https://chocolatey.org/packages/filezilla (click show files) contains the following
$url = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win32-setup.exe/download"
$url64bit = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win64-setup.exe/download"
Is there any reason to believe ninite does anything different?
I hadn't thought of choco, but good call on that.
I know, this isn't very helpful, but if you don't like how software is distributed for your system there's still the option to use a system that solved this during the '90s.
~ Ned Stark, A Game of Thrones.
I think that pathetic blog post where they tried to justify their actions made one thing clear - SourceForge knows how dead they are. No amount of internet outrage is going to help, they don't think they've got anything to lose at this point.
The best thing to do at this point would be to speed up their demise. If you're a developer that still hosts with them, delete your project and move to Github or Bitbucket.
Also, start reporting these malicious pages to Google so they don't show up in search results. https://www.google.com/safebrowsing/report_badware/
This is an error on Google's part. For everyone's sake, they need to apply some serious ranking penalties to malware distributing sites like SourceForge, as well as click-through warnings that you are going to a site other than the original authors'.
1) to form or make by concentrated effort
2) to imitate fraudulently; fabricate a forgery
They're certainly living up to definition #2..
Advice. Unix Linux - separate user. low privilege. configure, make, but make install with ROOT PRIVILEGE. check files.
all source code should have search engine keywords for vulnerabilies, updates, etc. for even BSD is somewhat broken, IMHO.
make it easier for the NOT C expert and ASM expert to install reasonably clean software, PLEASE.
Thank U. Thank U. Thank U. ... 1000 times
Thank you. Thank you. the attack on code repo and the infiltration of the clean database continues, perhaps.