Hacker News Reader

Comment by pests | Hacker News Reader

There was a single mention of Paint.NET in the article with no other comment. Is that the company involved in this? It was not clear to me nor do I recognize the name of the author.

There are two technical holes in how this was achieved, disregarding the initial drive-by update install:

* Unprotected browser cookie storage

* Android web-based App Install requires no user interaction past a request to a web endpoint

Are these holes still open?

View on HN

I'll put this comment here as a response to sibling and child comments about Paint.NET and to defend the author (Rick Brewster) regarding misleading installers.

Rick has had numerous problems over time with scammers wrapping Paint.NET with scumbag installers and with "backspaceware" distributions. He's documented these issues in his blog:

http://blog.getpaint.net/2009/11/06/a-new-license-for-paintn...

http://blog.getpaint.net/2007/12/04/freeware-authors-beware-...

http://blog.getpaint.net/2011/10/03/paint-net-v3-5-9-and-dow...

http://blog.getpaint.net/2010/12/22/photoshop-filters-and-mo...

For as long as I've used Paint.NET (since v1) his home page and download page have never obfuscated or tried to lure users into downloading and installing crapware.

EDIT: Just turned off my adblocker and see I'm sadly very wrong about the crapware download ads. My other points still stand though.

you're probably using adblock then.

homepage: right below his link (paint.net 4.0...) is a "GET IT HERE" picture add which installs crapware

download page: pig green banner "START DOWNLOAD" above his text link for the download.

Oh, I see your point. about the ads (just turned off uBlock), makes me sad to see that :( It used to be much cleaner than that. I'd be interested to know how much control he has over those.

He has total control. Its his website, he has made the choice to work with scummy advertisers for a larger cut. Make no mistake: He could choose to run adverts that are not immoral and are not pushing malware, and in return he would earn slightly less money.

I have no sympathy whatsoever for him - he's directly benefiting from the same scummy industry he's complaining about.

Wow. I really admired that product, back when I used Windows. That's pretty sad, Paint.NET was doubtlessly a lot of hard work to create, and it's name now besmirched with this bad decision.

I've also been using Paint.NET since v1. It's always had the crapware links.

It would not be Paint.NET itself - lots of Windows freeware apps are approached by advertising companies. The advertising company pays the freeware company a lot of money to add a checkbox during install. It's this kind of checkbox that the author is talking about. They probably gave Paint.NET (and Java, winzip, winrar, etc etc) a ton of money to put that there.

Paint.net has ads on their pages, right next to the download page... Their own download link is non-obvious, and the advertisers create full-size ads with a big green button saying "download" ... what the user gets isn't the installer from paint.net proper. I think the fact that the paint.net guys are resorting to allowing ad networks on their main page instead of an inline donate option (like ubuntu) is pretty bad.

Another example, as recently as 3 months ago a search on google for "chrome" would result in a few ads that were for malware like this.

The ones that are in the actual installers upset me a lot... more so in open-source, and one of the reasons people are starting to avoid source-forge like the plague.

I thought SF rescinded their new policies? Regardless, I still won't be using them unless I must.

I guess this might be one benefit of the Windows Store, as long as that hasn't been taken over. I haven't checked it in awhile nor know their guidelines.

They're trying to sell SF right now (and slashdot), so who knows what's going to happen next.

I don't know if either have the funding, but Github or Atlassian would be better stewards of sourceforge, at least in terms of migrating the whole thing into the fold of Github or Bitbucket.

As it stands, I get a little sad when I see a project still on or using SF.

Based on the text of the article:

> Over time, those notification and opt-in screens were “optimized” away as much as possible. They already “agreed” to our 23 page EULA when they were trying to install Paint.NET but accidentally clicked the wrong download button anyway, right?

I'd say that what he's talking about is those sites that offer software for download, and the download button is displayed under an advertisement which also shows an image of a download button. If you click on the ad (showing an image of a download button), you get the malware, instead of the Paint.NET installer that you were trying to download.

There's also a lot of sites that package adware without the developer's consent. See for example the semi-recent Sourceforge controversy: SF approached devs asking if they'd be interested in using their new download manager that would automatically install third-party 'offers' (unless the user declined the EULA the first 2 times and accepted on the third try). The GIMP team not only declined, but abandoned SF altogether - so now SF's version of GIMP includes adware, and the devs don't see a single dime from it.

Okay, thank you. I must have skimmed the intro the first time. Still he only mentions once that he works at the advertising agency and not Paint.NET, in his second sentence. I was thoroughly confused about what type of company Paint.NET had become.

There was a single mention of Paint.NET in the article with no other comment.

I suspect this was an example of one of the bait-apps that shonky download sites (download.com and now sourceforge.com etc) repackage with toolbar installers.

The replies are correct--I mentioned Paint.NET mainly becaues that was/is a highly effective site to get people to click the misleading "Download" button ads.

As for browser cookie storage, there's not much the browsers can do. Even if they were encrypted or obfuscated somehow, the browsers themselves would still need access so people would always be able to reverse-engineer the process.

The only way I could see them preventing the web-based install exploit would be to always require a password first (and not just rely on session cookies to identify the user). I'm not sure if Google is doing that now or not.

Yes, they're still open.

Reply on news.ycombinator.com