Someone on Torrent Sites Kept Fucking with My Sonarr
thereallo.dev
thereallo.dev
We can thank Microsoft for their willful support of criminals by having file extensions be hidden by default in Windows.
(please don't feel the need to point out how you can use more words to say more, that's always true, our goal here is to use less words, no need for extensions to that)
Am I DBA, accountant, or data engineer?
But I do personally agree, that better extensions (e.g. for exec files) in Linux would be a really good thing. I have the same gripe with Linux's case sensitivity of files and dirs. Fine if you want to make the file name more legible by using CamelCase or something, and this needs to be displayed as such. But it's madness that one directory can have the files with the same exact name (case written notwithstanding).
Heck, I fondly remember my DOS days when directories and files were easily distinguishable, since the former ones were always written in CAPS. Not saying that we should bring it back or anything.
Windows does. The file extension determines everything (and the icons can be easily faked) and not showing it is criminal.
This is like MS brings a real pistol to a kindergarten and don't want to put it in a holster. You are the one, who tries to shift the blame and is asking why others are not holsting their weapons. They are not doing it because they don't bring weapons at all, or if they bring, they are orange toy weapons.
That must have been the conventions of some third-party file manager (Norton Commander?), because DOS stored and showed everything as uppercase, both directories and files.
But I did mostly use Dos Navigator.
As someone who remembers Napster being new, I am happy to see the kids rediscovering the real joys of Piracy!
Of course, once it had collected your data, you had to post it back.
In practice, it's just adding an API key, setting a rule in the app to remove after x and then you can go back to ignoring it.
TBF this isn’t a revival of some arch 90s thing, this is just how private trackers have been. What was the same in the aughts, for instance.
That's why they called private? Nice thing about private trackers is that you can just download without VPN (with DHT off...). Downside of private trackers, you get banned for weirdest thing, like my seed box was offline while I was out of country on vacation, I didn't download or seed anything for two weeks and got banned. Newsgroups are much better.
If you are too old for trackers, then just sign up for usenet. You will have to pay for it though.
flaresolverr even had an open issue or similar that acknowledges it's basically dead last I checked?
And thus, it's not completely unmoderated, nor full of malware.
This can get stupid sometimes like when they're expecting everybody to keep over 1.0 when there are people with 10.0; but usually when they're doing that it's because it's a scammy tracker (all private trackers that you have to pay to join are scammy no exceptions) and they're trying to extort people who fall below 1.0 to give them money.
But expecting people to upload is part of the deal. That's not about being old, that's about being selfish. Non-scammy private trackers make it very easy, and some just concentrate on gatekeeping and don't worry about ratios at all.
Your basic point is very true, though. The way many private trackers have lasted is to stop letting people in almost entirely. To get into a non-scammy tracker you have to know somebody irl who is on and active, and they still might not be able to get you in. Or they will pretend like they can't - inviters sometimes get punished for the quality of the people they invite, and you think sharing back is something children do.
Why lol? Still better value than paying the IP holder what they want. And maintaining well curated torrent platforms costs money.
There are zero good private trackers that you can pay for to enter. Buying invites will get you banned, and paying the site directly is only possible on scummy trackers.
There is a lot of good information here [0]. Most notably RED is open via interviews conducted on IRC, and has a big invite forum to join other trackers. But yes, they do force you to contribute through maintaining your ratio.
But isn't this sort of structure just completely transparent to [Nation|Narco]/State Actors? Feel free to widen the set of economically interested actors.
How do you scale video interviews?
I think I am missing something about this scene. I really want to dive in tho.
the point is, some trackers don't even take these one-time payments for themselves and still provide service on the level as if you pay tenfold of that, monthly, to them.
My setup is optimised for being quiet and low power, and part of that means bulk HDD storage that is mostly spun down. Seeding a large long tail of data would probably mean a lot more disk activity.
Meanwhile, I joined my first private tracker 3 years ago, and now I am in all of them (ptp, btn, etc). I do not have to worry about the ratios (cross-seed is set and forget), and after awhile you have more "upload" and "ratio" then you need for a lifetime. I barely have to seed anymore. I log in once in a while, but otherwise do not have to participate in the communities, and the selection is awesome (they basically have everything, even Mexican B movies from the 1940s, whatever floats your boat). They saturate my fiber when I download too.
But do keep complaining and arguing, you will feel better.
Just get into a decent general tracker and you'll literally never have this issue again (along with getting torrents with more seeders and better tagged content so your "4k" download will never be 480p again)
You're left with just paying for upload credits. Makes no sense.
I miss demonoid from the 2005 era something fierce. It was private but also super chill, the way it's supposed to be.
I'm a member of two fairly private trackers but haven't downloaded anything from them in a long time. It's not really worth the hassle. :( the only thing I would still say it's worth it if you find super niche private trackers with stuff nobody else has, like cinemageddon
I wouldn't consider a requirement that people to upload as much as they download a "bad habit" it's called not being a leech.
Since bittorrent prioritizes peers with better bandwidth and so many people use servers with 10G connections, you won't get much upload off your home network. On some trackers I've been seeding 24/7 since I joined and uploaded only a few gigabytes. Fortunately many of them are generous with other ways to get credit for uploading so I've never had a problem.
Yet a few stick with all the existing, stringent rules they have, as if they are irreplaceable. I haven't touched them for a while. Let them die.
For a while all torrents downloaded from that site where replaced by a torrent of simple exe, it disguised itself by using a directory icon, plus having 800M of padding to simulate a real torrent.
The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way
Cleanuparr uses the built-in Sonarr/Radarr blacklist feature, so if you encounter something where there's nothing to import, it will backlist the torrent. You can set it to cover stuck torrents too if you want, so it blacklists the "dead" torrents and will make Sonarr/Radarr move on and search again.
The blacklist feature of Sonarr/Radarr can be hooked into Prowlarr pretty easily so that the torrents get blacklisted all the way back there.
You should definitely add wildcard blocks to your torrent client too though for *.exe and similar so you don't even download them in the first place rather than throwing them away only after downloading.
You might want to combine this with something like Packarr too, unless you just want to blanket blacklist all archives (zip, rar, etc). Packarr will try to (semi-securely) unpack archives after download. If they fail to unpack (e.g. requires a password you haven't supplied, badly formatted, etc), the Cleanuparr will end up marking them as failed import and they'll get blacklisted and removed from disk.
Also, you should generally manually blacklist things in Sonarr/Radarr if you discover it's bad, rather than just deleting it from disk. That will also prevent the same thing from re-downloading.
I found the "ignore and blacklist executables" setting easily enough and moved on with my life.
But props to the OP for taking it this far!
But usually I'm downloading TV on Linux not windows
Very cool Microsoft.
I find it funny that great minds think alike because I was just thinking of analysing these EXE files this week and doing a quick writeup at medium:
https://lazherrera.medium.com/analyzing-that-exe-file-youre-...
How long until someone uses AI to find an exploit in IDA and starts putting that in their malware, so that if you try to disassemble it you get pwned?
The ability to change it, dude. Have you never written a malware before?
Often a primary concern is the security response, so you want redundancy for the ability to work around enforcement action, such as website takedowns.
Hardcoding a scapegoat into the malware itself also buys you time, so that the first enforcement action is less likely to spend your backups right away.
> And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.
People have been making infostealers that support hundreds or thousands of different apps and corners of your computer for decades. Plenty of vendors pride themselves on it.
Meanwhile you used LLM to write a bunch of your article, and seemingly to do the RE too...
Just thought "does anyone actually fall for that?", but I guess a few must.
Now you need 9 different pieces of software that end in *arr, all of which implement parts of the solution that you want and parts that you don't, and none of them is even a torrent client!
And they don't even work with torrent sites reliably, so people then spend money on a Usenet subscription like it's 1990 again.
Any all-in-one solution is going to be considered illegal at face value if it is obviously designed to circumvent copyright.
But if you split all the pieces of the solution up into separate pieces of software that can't do much illegal by themselves, you can always claim plausible deniability as the maintainer.
After all, you aren't going to be downloading torrents with Sonarr, you aren't going to be looking up information about shows with Jackett, and you aren't going to be automating your downloads with qBittorrent. If you link them all together with APIs, though, they do everything automatically.
As for the issue demonstrated here, it's just a long-standing problem in Sonarr and Radarr that even when it detects that a torrent is bad, it just sits there holding onto a virus until you override it with a working torrent, instead of just dumping the bad data and trying again.
You can also automate 99% of it with the *arr stack and completely forget about it.
What is the issue? There is more choice now?
Not that your old stack doesn't still work exactly how you'd expect it to, nothing's changed there.
Or, I don't know, make some application that combines all of them like https://github.com/rivenmedia/riven-ts
Maybe if I made a VM dedicated just to this behind a VPN gateway, then let Codex go wild in that VM with no guardrails it could eventually get something working.
Or you could put in the work and end up with a system that will let a non-technical family member type the name of a show that comes out next week and it will automatically search, download, tag, and add every episode on release to a Jellyfin instance for them to watch.
- as a guy whose s too broke to afford claude pro or gpt pro, i ask you
- what llm models have you tried to reverse engineer exe files or decompile or disassemble or whatever the term of the month is?
People unironically put users and passwords in those.
No idea. But any software that autodownloads from untrusted sources should NOT be run in an environment with information available.
My *arr runs in a Linux container on a VM, suggest you do the same.
some 13 year old on his dad's Dell
I was 11 at the time.
No, that's to exhaust sandboxing without being able to trust sleep() or time API calls by the only way you can: generating heat.
Mainly with new Mobland episodes.
Because people very VERY often will stash passwords/account numbers/other commonly needed secrets in Stickies
He meant the physical kind.
Yeah, when she forgot her password the only hint was stored on the computer.
I am forbidden to laugh in her face every time I see her. He insists.
Are you using The Pirate Bay, which is unmoderated? Otherwise why wouldn't your tracker have quickly deleted this?
Scammers always have a new trick up their sleeve.
I’m as upset as OP, get a job skid.
let's all join a private tracker!
that'll fix the problem, the bad actors won't chase the crowd, and it definitely wont end in a burning of the library of alexandria loss-of-history what.cd style event again and again if the public can't archive it.
/s
how about we just create an exe/bat/com exclusion on our dumb-as-dick media downloaders like sensible people have been doing for 30+ years?
And i also truly cannot understand what your point is. Trackers are not really legal, they come and go. I don't think a few hundred or even a few thousand HN users joining across the ecosystem is going to suddenly cause them all to get raided
I don’t agree with that framing.
All metadata has been preserved and published, and the sucessor sites to what.CD have long outgrown it; and their successors will again. Anything you find missing, you can request and typically it will be filled within less than 24 hours.
Using settings on the indexer isn't great since with Prowlarr the user doesn't actually interact with the indexer portion of Sonarr.
Doing it in release profiles by bumping down their score is a cute workaround but then the torrents will just stop saying ".exe" in their title.
Really it's a thing Sonarr have to do, as evidenced by the multiple PRs they have to try and finally do it.
This is literally one of the advice points at the end of the article. Did you get that far?
Alternatively, if there's a way to have qbit itself mark the download as "Failed" when it detects and refuses to download an executable, that would work too. I don't use qbit personally so I don't know if that's a thing it can be configured to do.
Are many of them highly specialized? Just lots of redundancy?