Re: hacked package on server

2007-07-30 Thread Brian Mathis
On 7/30/07, Steve Holden <[EMAIL PROTECTED]> wrote: > Louis Kruger wrote: > [...] > > > > I also have a complaint: the dialog that notifies the user of the > > failed MD5 is not well designed. The dialog asks "Do you want to skip > > the package?" and has a yes and no button. I read it quickly a

Re: hacked package on server

2007-07-30 Thread Steve Holden
Louis Kruger wrote: [...] I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks "Do you want to skip the package?" and has a yes and no button. I read it quickly and pressed no before thinking about it, the package went ahead and

RE: hacked package on server

2007-07-27 Thread Dave Korn
On 26 July 2007 21:27, Markus E.L. wrote: >> 3) Calm down, breath deeply, and try not to be so hysterical. > > Good advice, Dave. Did you try it once? > > - M Snappy reply dude, you've obviously been working hard on that one. No wonder it took you a fortnight to come up with it. Now woul

Re: hacked package on server

2007-07-26 Thread Markus E . L .
> 3) Calm down, breath deeply, and try not to be so hysterical. Good advice, Dave. Did you try it once? - M -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ:

Re: hacked package on server

2007-07-16 Thread Pedro Alves
Carlo Florendo wrote: The switch from: "do you want to format your drive?: +-+ +-+ + yes + + no + +-+ +-+ to: "do you want to format your drive?: ++ +-+ + format + + cancel + ++ +-+ ... Makes it much easier to understand what the soft

Re: hacked package on server

2007-07-16 Thread Matthew Woehlke
Pedro Alves wrote: The switch from: "do you want to format your drive?: +-+ +-+ + yes + + no + +-+ +-+ to: "do you want to format your drive?: ++ +-+ + format + + cancel + ++ +-+ ... Makes it much easier to understand what the software

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Erich Dollansky wrote: Hi, Pedro Alves wrote: Erich Dollansky wrote: "do you want to format your drive?: ++ +-+ + format + + cancel + ++ +-+ ... Makes it much easier to understand what the software's up to. when I start a disk formating program, I und

Re: hacked package on server

2007-07-16 Thread Erich Dollansky
Hi, Pedro Alves wrote: Erich Dollansky wrote: Carlo Florendo wrote: Brian Mathis wrote: The OP said: > "Do you want to skip the package?" and has a yes and no button. > I read it quickly and pressed no before thinking about it" ^^ So you see

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Pedro Alves wrote: Perhaps the screen should flash, and a loud beep should sound every time a MessageBox not related to "install to package" wants to show up. Then wait 3 seconds, show a "warning, going out of install mode" MessageBox, sleep a bit more, and only then show the skip message box.

Re: hacked package on server

2007-07-16 Thread Pedro Alves
Erich Dollansky wrote: Carlo Florendo wrote: Brian Mathis wrote: The OP said: > "Do you want to skip the package?" and has a yes and no button. > I read it quickly and pressed no before thinking about it" ^^ So you see, it's a problem of thoug

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Erich Dollansky wrote: Hi, Carlo Florendo wrote: Brian Mathis wrote: The OP said: > "Do you want to skip the package?" and has a yes and no button. > I read it quickly and pressed no before thinking about it" ^^ So you see, it's a problem of t

Re: hacked package on server

2007-07-16 Thread Erich Dollansky
Hi, Carlo Florendo wrote: Brian Mathis wrote: The OP said: > "Do you want to skip the package?" and has a yes and no button. > I read it quickly and pressed no before thinking about it" ^^ So you see, it's a problem of thought. The UI message

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Louis Kruger wrote: > As the package installed, I saw some strange behavior, I'm worried it > might have been some kind of trojan. Are you able to actually describe "strange behaviour" It crashed the setup program, which seemed to indicate it was installing strangely named files. It also

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Brian Mathis wrote: In this case, a user running an installer is in the frame of mind of *installing* things, not *skipping* things. Perhaps this is in your case, certainly not everyone in this mailing list. So when they are asked a question, they should be asked questions about *installing

RE: hacked package on server

2007-07-16 Thread Gary R. Van Sickle
> From: Brian Mathis [snip] > > Yes, everyone now has been quite hilarious on this part of > the matter, but I think it's time to get past the arrogance > and, god forbid, consider that a user's reported problem, oh > my god, might actually be a problem! > Heheheh! He thinks he's on th

Re: hacked package on server

2007-07-16 Thread Igor Peshansky
On Tue, 17 Jul 2007, Pedro Alves wrote: > Bengt-Arne Fjellner wrote: > > > Well in my opinion It could even be better to have an unchecked checkbox > > like: > > > > Wrong MD5 sum detected. > > This package look broken. Try another mirror. > > ( ) Yes I Really want to install this even if it looks

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Tue, Jul 17, 2007 at 12:20:19AM +0100, Pedro Alves wrote: >The second best, and quickest, would be for a patch to show up >implementing Thorsten's suggestion that cfg pointed out. Until someone >steps up to do the work, this discussion is just going to fade out and >die. Urp. How could I have

Re: hacked package on server

2007-07-16 Thread Pedro Alves
Bengt-Arne Fjellner wrote: Well in my opinion It could even be better to have an unchecked checkbox like: Wrong MD5 sum detected. This package look broken. Try another mirror. ( ) Yes I Really want to install this even if it looks broken. OK Or something like that. Then its two clicks or seve

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Tue, Jul 17, 2007 at 12:47:50AM +0200, Bengt-Arne Fjellner wrote: >Or something like that. Then its two clicks or several keystrokes before >one can continue. If you want to help, then dig up multiple googled cases of previous confusion. Then we can quibble about wording. cgf -- Unsubscribe

RE: hacked package on server

2007-07-16 Thread Bengt-Arne Fjellner
Christopher Faylor wrote: > On Mon, Jul 16, 2007 at 03:44:51PM -0400, Brian Mathis wrote: >> Yes, everyone now has been quite hilarious on this part of the >> matter, but I think it's time to get past the arrogance and, god >> forbid, consider that a user's reported problem, oh my god, might >> act

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 03:44:51PM -0400, Brian Mathis wrote: >Yes, everyone now has been quite hilarious on this part of the matter, >but I think it's time to get past the arrogance and, god forbid, >consider that a user's reported problem, oh my god, might actually be a >problem! You did receive

Re: hacked package on server

2007-07-16 Thread Brian Mathis
TED] <http://cygwin.com/acronyms/#PCYMTNQREAIYR>. Thanks. > >Subject: Re: hacked package on server > > > >On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: > >> I also have a complaint: the dialog that notifies the user of the > >> failed MD5 i

Re: hacked package on server

2007-07-16 Thread Igor Peshansky
On Mon, 16 Jul 2007, Louis Kruger wrote: > > > As the package installed, I saw some strange behavior, I'm worried > > > it might have been some kind of trojan. > > > > Are you able to actually describe "strange behaviour" > > It crashed the setup program, which seemed to indicate it was installi

Re: hacked package on server

2007-07-16 Thread Louis Kruger
> As the package installed, I saw some strange behavior, I'm worried it > might have been some kind of trojan. Are you able to actually describe "strange behaviour" It crashed the setup program, which seemed to indicate it was installing strangely named files. It also corrupted the cygwin

Re: hacked package on server

2007-07-16 Thread Igor Peshansky
Ugh, top-posting... Reformatted. On Mon, 16 Jul 2007, Brian Kelly wrote: > -Original Message- > >From: Christopher Faylor <[EMAIL PROTECTED]> > >Sent: Jul 16, 2007 11:52 AM > >To: [EMAIL PROTECTED] <http://cygwin.com/acronyms/#PCYMTNQREAIYR>. Thanks.

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 02:38:17PM -0400, Christopher Faylor wrote: >On Mon, Jul 16, 2007 at 11:59:12AM -0400, Brian Kelly wrote: >>This would be "more" helpful: >> >>Do you want to not skip the package (No/Yes/Maybe)? >> >>The "Maybe" can then consult a random number routine to decide whether >>or

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 11:59:12AM -0400, Brian Kelly wrote: >This would be "more" helpful: > >Do you want to not skip the package (No/Yes/Maybe)? > >The "Maybe" can then consult a random number routine to decide whether or not >to do the operation. Good point. I obviously stick at this UI stuff

RE: hacked package on server

2007-07-16 Thread Dave Korn
DANGER: Extreme sarcasm ahead. May also be withering. No warranty, no refunds. On 16 July 2007 16:31, Chicken Licken ^W^W Louis Kruger wrote: > As the package installed, I saw some strange behavior, I'm worried it > might have been some kind of trojan. Are you able to actually describe "s

Re: hacked package on server

2007-07-16 Thread Louis Kruger
I do think that instead of simply aborting the install with a message that the server was compromised (was it? or is something else going on?), that a more useful option would be to allow the user to select a different mirror and continue the process. Sure. I just wanted to make the p

Re: hacked package on server

2007-07-16 Thread William Sutton
I remember an extensive discussion about the purpose MD5 sums serve for the cygwin installer[1] some time ago. My understanding (synopsis) of the thread (before I gave up reading it in disgust somewhere around Christopher Faylor's suggestion that the subject be dropped :} ) was that md5sum is o

Re: hacked package on server

2007-07-16 Thread Thorsten Kampe
* Louis Kruger (Mon, 16 Jul 2007 11:17:43 -0500) > > On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: > > > I also have a complaint: the dialog that notifies the user of the failed > > > MD5 is not well designed. The dialog asks "Do you want to skip the > > > package?" and has a ye

Re: hacked package on server

2007-07-16 Thread Louis Kruger
On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: > I also have a complaint: the dialog that notifies the user of the failed > MD5 is not well designed. The dialog asks "Do you want to skip the > package?" and has a yes and no button. I read it quickly and pressed no > before th

Re: hacked package on server

2007-07-16 Thread Brian Kelly
ul 16, 2007 11:52 AM >To: cygwin@cygwin.com >Subject: Re: hacked package on server > >On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: >> I also have a complaint: the dialog that notifies the user of the failed >> MD5 is not well designed. The dialog asks &qu

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: > I also have a complaint: the dialog that notifies the user of the failed > MD5 is not well designed. The dialog asks "Do you want to skip the > package?" and has a yes and no button. I read it quickly and pressed no > before thin

hacked package on server

2007-07-16 Thread Louis Kruger
I performed a cygwin update today, and was confronted with an MD5 failure on one of the packages. The package was vim-7.1-1.tar.bz2 downloaded from mirrors.dotsrc.org As the package installed, I saw some strange behavior, I'm worried it might have been some kind of trojan. I saved the hacked