Hacker News Reader

Isn't it quite popular on Debian and derivates too? It's Pre-installed with GNOME there as far as I know. Fair enough, it's extremly interesteing. Never saw such an infection in the "free World", outside the laboratory. I hope they can find the source.

View on HN

It's quite popular everywhere. Interesting that 2.90 just showed up in Fedora updates.

At least Linux distributions usually compile from source. I wonder if the source was also modified, or only the binaries.

EDIT: I downloaded the Transmission 0.90 and 0.91 source code and took a look. The diff between them is quite small, with nothing suspicious being removed, and the 0.90 .tar.xz MD5 matches what Fedora used (according to http://pkgs.fedoraproject.org/cgit/rpms/transmission.git/com...). So, unless there was also a malicious source code change the developer didn't catch, Fedora's package should be clean.

> I wonder if the source was also modified, or only the binaries.

Personally, pending further information, I've removed Transmission from my machine.

It seems the most recent version is 2.84 on ubuntu 15.10. The last update to the package was on July 2015.

There's a fairly popular PPA which is currently on 2.90[1]. However, it seems like only OS X binaries included malware (... hopefully).

[1]: https://launchpad.net/~transmissionbt/+archive/ubuntu/ppa

Reply on news.ycombinator.com