Transmission BitTorrent app contained malware - <AUTHOR> https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834 <comment><USER2> The fact that the binary was infected, I can somewhat understand. However, the way communication happened/is happening on this issue is very disconcerning and basically makes it impossible to know whether it's safe to currently download 2.92 from their site.

Questions like

\- how did the compromised binary get there? Was the source code hijacked or was the binary altered after it had been built?

\- Were the SHA256 hashes on the site also compromised (btw: Having hashes on the site is good enough for making sure you're not installing a corrupted binary. It doesn't do anything against intentional alterations of the binary though. These hashes need to be stored on an external site)?

\- How did the compromise happen?

\- what steps were taken to ensure that the same compromise doesn't happen to new binaries posted?

\- Did the attacker leave any foothold on the compromised system(s)?

\- How were such footholds removed?

All questions that need to be answered before it's safe to upgrade transmission either from the website or with the AutoUpdate feature. A red warning telling me that one binary was infected and that I have to download another binary isn't good enough.

I know the transmission people are volunteer developers and no PR people and I can totally accept that, but there's some things that just need to be made clear before we can safely update to later versions (and thankfully, 2.8 keeps running just fine)

<comment><USER3> It will probably take time to get all of the answers, but in this case, automatic updates are safe.

Although I'm not a Transmission developer, I develop software that uses the same automatic update mechanism. It appears that the hacker did not update the MD5 present in the automatic update mechanism. (Sparkle) Thus, when the automatic update mechanism downloaded the hacked version of Transmission, it reported it as a corrupted download.

You can see the comment here: [https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834#p...](https://forum.transmissionbt.com/viewtopic.php?f=4&t=17834#p73036)

<comment><USER2> > It appears that the hacker did not update the MD5 present in the automatic > update mechanism. (Sparkle) Thus, when the automatic update mechanism > downloaded the hacked version of Transmission, it reported it as a corrupted > download

yeah. But not knowing how the attacker got access, we have no idea whether they have changed the current 2.92 binary again, this time remembering to update the hash in the appcast or whether this time around the binary is actually pristine.

The fact that the site was never down between this happening and the red warning text appearing makes me suspect that only a hasty cleanup was performed and that the actual security flaw might still exist.

<comment><USER4> An attacker would need the private key to update the signature in the app cast. It's possible the devs store their private key on the server, although that would be silly.

Although that doesn't discount the recent MITM vulnerability Sparkle had and if transmission is still using an old version of the framework.

</comment></comment></comment></comment><comment><USER5> VirusTotal has some more info, including the files it writes:

[https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc...](https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1/analysis/)

(Look under the "Behavioural information" tab)

Written Files and Created Processes are interesting:

[Transmission] /Users/user1/Library/kernel_service (successful)

[unknown] /Users/user1/Library/.kernel_pid (successful)

[unknown] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/window_1.data (successful)

[Transmission] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/data.data (successful)

[Transmission] /Users/user1/Library/Saved Application State/org.m0k.transmission.savedState/windows.plist (successful)

[kernel_service] /Users/user1/Library/.kernel_time (successful)

Created processes

/Volumes/Transmission/Transmission.app/Contents/MacOS/Transmission (successful)

/Users/user1/Library/kernel_service (successful)

kernel_service (successful)

 __Edited to add: __If anyone has a copy of the DMG, sha1 5f8ae46ae82e346000f366c3eabdafbec76e99e9, please link me a copy via email (email@example.com) or twitter DM (@moyix).

<comment><USER6> Here's an analysis of the malware - [http://researchcenter.paloaltonetworks.com/2016/03/new- os-x-...](http://researchcenter.paloaltonetworks.com/2016/03/new-os-x- ransomware-keranger-infected-transmission-bittorrent-client-installer/)

<comment><USER7> Copy/pasting the helpful parts of that article:

How to Protect Yourself

Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now.

We suggest users take the following steps to identify and remove KeRanger holds their files for ransom:

1\. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission.

2\. Using "Activity Monitor" preinstalled in OS X, check whether any process named "kernel_service" is running. If so, double check the process, choose the "Open Files and Ports" and check whether there is a file name like "/Users/<username>/Library/kernel_service" (Figure 12). If so, the process is KeRanger's main process. We suggest terminating it with "Quit -> Force Quit".

3\. After these steps, we also recommend users check whether the files ".kernel_pid", ".kernel_time", ".kernel_complete" or "kernel_service" existing in ~/Library directory. If so, you should delete them.

<comment> why-el You have a typo: "Applicaions". Usually not a problem but in this case it will say "No file/folder found" when it's just a typo.

<comment><USER7> Thanks. Fixed it. I only copy/pasted originally though :)

</comment></comment></comment></comment></comment><comment><USER8> Do the developers have an explanation anywhere as to how this happened? The homepage ( [https://transmissionbt.com/](https://transmissionbt.com/) ) has a big red warning to upgrade to 2.91, but I can't find any info about how someone went about putting malware in the download.

<comment><USER9> Yep, this deserves a more detailed explanation (or maybe they still don't know what happened). I updated from the previous version to 2.90 through the app built-in update, and I don't seem to have any "kernel_service" process running. Can someone that has that process in their system tell us where they downloaded the program?

<comment><USER10> > I updated from the previous version to 2.90 through the app built-in > update...

Same, and I also don't see any `kernel_service` process running.

Fingers crossed for the in-app update not being affected by the hack.

<comment><USER11> I'd definitely run a virus scan to be sure... If you don't have one just install a Trial version and remove it again after a week.

<comment><USER10> Noted: I've gone with BitDefender from the Map App Store. Will report back results.

EDIT: welp, BitDefender found nothing, all clear.

<comment><USER10> (reply to noondip): if anyones got a better suggestion I'd love to hear it :)

<comment><USER12> Back when Apple still made Mac OS X Server as a separate operating system, they included ClamAV¹ to scan for malware in mail. They don't include it anymore, but ClamXav² (been around since 2004³) is a nice GUI for ClamAV that I've been using for a while now.

――――――

¹ — [https://en.wikipedia.org/wiki/Clam_AntiVirus#Mac_OS_X](https://en.wikipedia.org/wiki/Clam_AntiVirus#Mac_OS_X)

² — [http://clamxav.com/index.html](http://clamxav.com/index.html)

³ — [http://clamxav.com/birthday.html](http://clamxav.com/birthday.html)

<comment><USER13> I run a private mail server and swear by ClamAV to help reduce noise and pollution that accumulates and spreads through my server, but I don't think I've ever had any luck with it being a good front line defense against up-and- coming malware, whether it targets Windows or Mac. I don't think I would recommend it as a primary malware scanner for a Mac, or Windows.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it.

When you can't (be bothered to) vet the source code, stick it in a vm. On a sensible machine with an ssd it's only 10 seconds away. Why risk it. Especially if the software you want/need to run only works under windows.

<comment><USER15> Beware that VMs are not necessarily secure. They can be escaped!

<comment><USER16> This argument is similar to "a condom can always break". Technically you are correct, but I'd still use one.

<comment><USER17> This argument is only similar if the condom is known to have huge design flaws

VMs have tons of well documented issues. If you want a smaller attack surface, try OS virtualization technologies (zones/jails)

<comment><USER18> This makes no sense. VMs are by far the most secure form of isolation. No one is going to get infected with malware that escapes VMs - it is far too valuable.

<comment><USER17> How can you honestly think VMs are the most secure form of isolation?

</comment></comment></comment></comment></comment></comment><comment><USER19> CNBC isn't a website I'd expect to read anything tech-related on, but there are actually a few details in this article:

[http://www.cnbc.com/2016/03/06/reuters-america-apple- users-t...](http://www.cnbc.com/2016/03/06/reuters-america-apple-users- targeted-in-first-known-mac-ransomware-campaign.html)

\- It's Ransomware.

\- Seems to be a 3 day grace-period (chance to remove it, possibly).

\- The Transmission developer certificate [Gatekeeper] has been revoked.

</comment><comment><USER20> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it.

On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

<comment><USER21> > Along with the recent Linux Mint hijack, this really illustrates the need > for people to verify programs they download. Though I think most people > can't be bothered to verify the checksum on a file every time they download > it.

Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware into the download and not have the ability to make the checksum match. Posting checksums is actually pretty useless, and was something that used to be used to deal with the possibility of malicious _mirrors_ , but doesn't provide any security against mitm attacks (unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway), the site getting hacked, etc.

Digital signatures are a little bit better if the key is kept safe, since hacking the site and replacing the binary won't allow a random person to produce a valid signature, although ability to modify the source code would still allow someone to introduce backdoors into the next version, but there's still a huge problem where you need some way to determine what key was supposed to be used to sign the binary in the first place, so just posting a signature on a website is also basically useless.

Digital signatures can work if there's some sort of centralized distribution method, or for safely updating software that's already installed.

<comment><USER22> I thought only apps signed by "identified developers" are run by default on Macs with Gatekeeper now. Shouldn't code-signing have prevented this? Unless they inserted the malware before the signing process.

<comment><USER23> The malware version was signed with the Transmission developer key.

<comment><USER12> No, it wasn't:

" _The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer ID in this certificate is "POLISAN BOYA SANAYI VE TICARET ANONIM SIRKETI (Z7276PX673)", which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signed on the morning of March 4._ "

From: [http://researchcenter.paloaltonetworks.com/2016/03/new- os-x-...](http://researchcenter.paloaltonetworks.com/2016/03/new-os-x- ransomware-keranger-infected-transmission-bittorrent-client-installer/)

<comment><USER24> > which was different from the developer ID used to sign previous versions of > the Transmission installer

and that didn't ring any alarm bells?

<comment><USER12> For the end user? No, it wouldn't. As _thesimon_ and _jakobegger_ , respectively, said:

" _And according to the analysis, this is exactly what they did. They used a different cert to sign their malware. I have to admit that Windows ' UAC is better in that regard, as it shows the signees name. But of course this is only useful if you know the "right" name._"

" _Yeah, I think this is a major issue on OS X. For the average user it is impossible to tell who signed an app, if it is sandboxed, and what permissions it has. Hell, using the codesign command to extract entitlements from all binaries in a package is hard even for advanced users... (There is third party tool named RB App Checker which does make these tasks a bit easier, though)_ "

…in this comment thread: [https://news.ycombinator.com/item?id=11234966](https://news.ycombinator.com/item?id=11234966)

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> I've become increasingly paranoid lately, given that things like these happen and major bugs are uncovered in software that I use almost every day.

It's good that the Transmission developer reacted quickly and made waves so that people can at least be aware that they might have been exposed..

But I wonder how many more applications from the hundreds that I have installed on my machines contain weird stuff - either intentional (for money) or unintentionally (result of a hack).

Open source software is especially vulnerable to this kind of stuff.

If a hacker gets access to a server holding the binaries for an open source app (which most people download), the hacker can just compile the program from sources and add his own code in there and place the installer online.

Given that many big governments are now involved in the information wars, this scenario is quite likely.

<comment><USER26> _" Open source software is especially vulnerable to this kind of stuff."_

I'm not sure I follow on this front. Proprietary software could be compromised (whether intentionally by the vendor or unintentionally by some outsider working on the software) effectively forever with no one noticing. At least with OSS, the number of eyes on the source makes it less likely that an exploit will exist for long (though the definition of "long" could vary wildly dependent on popularity and the skill level of the software's normal users).

 _" Given that many big governments are now involved in the information wars, this scenario is quite likely."_

Again, this one seems to point more to proprietary software then OSS. A government only needs to compromise a single company to make an exploit happen in commercial software. OSS exploits can be caught by the Linux distribution vendors that package the software, the users, the developers themselves (who are often working at different companies and in different nations), etc.

So, it may seem easier to compromise an OSS project, by attacking the distribution server and uploading a compromised binary built from source with patches...but, there are many good ways to guard against that (though any single mitigation, like signing with developer keys, can be compromised, the more eyes the less likely it is to succeed for long). But, if a government compromises a company, or someone within that company, all bets are off, and the problem literally may never be found.

<comment><USER25> I was thinking more about the users on Macs and Windows who use open source software..

The risk is not in the sources, but in the server which hosts the installers. A hacker could just build the software from sources (adding his backdoor) and replace the original installers with his own.

<comment><USER27> ..and the same is true for closed source software. Replacing installers and patching binaries isn't difficult.

</comment></comment></comment></comment><comment><USER28> Hm. [https://trac.transmissionbt.com/wiki/Changes#version-2.91](https://trac.transmissionbt.com/wiki/Changes#version-2.91) lists the following under Mac changes for 2.90

>Allow downloading files from http servers (not https) on OS X 10.11+

Mac version affected in OP was 10.10, though.

Maybe it had something to do with

>Change Sparkle Update URL to use HTTPS instead of HTTP (addresses Sparkle vulnerability) ?

Edit: it appears the infection was downloaded from a website, in which case this doesn't help. But one did say the in-app update failed on incorrect signature first.

<comment><USER29> >Allow downloading files from http servers (not https) on OS X 10.11+

This reads like they disabled Apple's "App Transport Security", which only allows HTTPS connections unless a program explicitly makes an exception. Introduced in iOS 9 and OS 10.11 (El Capitan). I bet the failing HTTP connections caused a bug in Transmission, and it was an easier fix to disable ATS than to transition whatever connection to HTTPS.

[https://developer.apple.com/library/prerelease/ios/documenta...](https://developer.apple.com/library/prerelease/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW33)

<comment><USER30> > and it was an easier fix to disable ATS than to transition whatever > connection to HTTPS.

Pretty sure this is for arbitrary downloads. Unless you want to prevent transmission to download from http based sources out of principle it makes no sense to do anything other than opting out of this behavior.

<comment><USER29> Right, being a web connected app based on a distributed community of other clients, it's very possible that the encryption isn't possible to implement on their end. IIRC it's only blocking HTTP connections, so the torrent transfers themselves aren't affected (unless it's masking that as HTTP traffic to avoid easy inspection?), but there may be other things that require HTTP. Connections to trackers maybe?

On the other hand, El Capitan came out last September. If this just changed in 2.9.0, the restricted HTTP connections can't have been _that_ big of a problem.

</comment></comment></comment></comment><comment><USER31> If the file /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist contains:

            <dict>
                    <key>Description</key>
                    <string>OSX.KeRanger.A</string>
                    <key>LaunchServices</key>
                    <dict>
                            <key>LSItemContentType</key>
                            <string>com.apple.application-bundle</string>
                    </dict>
                    <key>Matches</key>
                    <array>
                            <dict>
                                    <key>MatchFile</key>
                                    <dict>
                                            <key>NSURLTypeIdentifierKey</key>
                                            <string>public.unix-executable</string>
                                    </dict>
                                    <key>MatchType</key>
                                    <string>Match</string>
                                    <key>Pattern</key>
                                    <string>488DBDD0EFFFFFBE00000000BA0004000031C04989D8*31F64C89E7*83F8FF7457C785C4EBFFFF00000000</string>
                            </dict>
                    </array>
            </dict>

Does that mean I am infected?

<comment><USER32> What does the <string> match pattern mean exactly, how is it used to identify the executable?

<comment><USER33> The match type is saying that to match a file it must be fingerprint (hash) match using the Key provided below it.

</comment></comment></comment><comment><USER34> Looking more at this issue, it seems like the problem _may_ have been (hard to tell, not a lot of information) a compromise of a third-party mirror to which [https://www.transmissionbt.com/](https://www.transmissionbt.com/) redirected users; the checksum on the HTTPS site was unaltered, and was used to identify the altered download.

Perhaps a defense against this kind of attack would be an altered version of HSTS - one that protected the content of download links, and not just of sub- resources included on the page.

</comment><comment><USER35> 2.90 was released a couple of days ago[1], so if you haven't used Transmission in a couple of weeks this doesn't affect you.

[1]: [https://en.wikipedia.org/wiki/Transmission_%28BitTorrent_cli...](https://en.wikipedia.org/wiki/Transmission_%28BitTorrent_client%29)

</comment><comment><USER36> It seems that is a ransomware campaign [http://www.reuters.com/article/us- apple-ransomware-idUSKCN0W...](http://www.reuters.com/article/us-apple- ransomware-idUSKCN0W80VX) Next monday, tomorrow could pave terror on the office.

</comment><comment><USER37> It might be worth updating the title to specify the vulnerable version (2.90) and the platform (OS X - from what I can tell, this is not a vulnerability on Linux or Windows).

</comment><comment><USER38> Isn't it quite popular on Debian and derivates too? It's Pre-installed with GNOME there as far as I know. Fair enough, it's extremly interesteing. Never saw such an infection in the "free World", outside the laboratory. I hope they can find the source.

<comment><USER39> It's quite popular everywhere. Interesting that 2.90 just showed up in Fedora updates.

<comment><USER40> At least Linux distributions usually compile from source. I wonder if the source was also modified, or only the binaries.

EDIT: I downloaded the Transmission 0.90 and 0.91 source code and took a look. The diff between them is quite small, with nothing suspicious being removed, and the 0.90 .tar.xz MD5 matches what Fedora used (according to [http://pkgs.fedoraproject.org/cgit/rpms/transmission.git/com...](http://pkgs.fedoraproject.org/cgit/rpms/transmission.git/commit/?h=f23&id=640c669434ea7f7b92449a50aba118f4b7335354)). So, unless there was also a malicious source code change the developer didn't catch, Fedora's package should be clean.

<comment><USER39> > I wonder if the source was also modified, or only the binaries.

Personally, pending further information, I've removed Transmission from my machine.

</comment></comment></comment></comment><comment><USER41> Transmission put up a new version - 2.92 that supposedly checks for and removes the malware.

<comment><USER42> Threw away Transmission as soon as I read this (even though I was running a old version), my trust is pretty much gone now, never installing it again. Shame because it really was a nice app.

<comment><USER43> flying the day after 9/11 was the safest time, I really doubt this sort of thing will happen again to the same software

<comment><USER44> This would be true if they knew how it was compromised, they've been silent on that issue so far.

The current version could be being compromised this minute for all we know.

<comment><USER45> Not an official comment, but from other parts of the hacker news thread it sounds like one of the mirrors the main site redirects to was hacked, not the main site itself. The SHA sums on the main site where apparently unaltered. So it sounds like the only fault on the developers is trusting that mirror.

</comment></comment></comment></comment></comment><comment><USER46> This is a good illustration of why you should not install apps as administrator. Specifically, you should not install Mac OS packages, which allow for arbitrary pre- and post- install scripts to be executed as root.

Same is true for Windows and Linux.

There are privilege escalation bugs in any OS, but it is usually not a given. Throw the application into ~/Applications as a Mac bundle, worst that will happen is your account will be compromised. Much easier to detect and clean. Most trojans won't even succeed.

We are going to have these problems until the developer community realizes that executing a randomly downloaded package installer as a privileged user is giving away the keys to the kingdom.

Application stores is one solution, but really is not an open one. I'd rather see the apps distributed in a form similar to Apple app bundles, where a non- privileged user can just install the app into their home.

<comment><USER47> I think it's a poor illustration. You could install and run this app as a regular user (and never escalate to administrator) and the app's bundled malware would still absolutely destroy anything of value on your computer.

It's the stuff inside $HOME (and $HOME/Documents) that's valuable. Not system binaries in {/bin,/sbin,/Applications} that can be re-downloaded in a second.

The problem is that any non-sandboxed app runs with the same uid and full read/write permissions to all of $HOME as well as all the other running processes, even if it only needs read/write access to $HOME/Documents/Appname/ and none of the other pids.

<comment><USER46> First, obviously you can make an account for running the untrusted software, like Bittorrent clients (which are known to carry malware frequently).

Second, most malware requires and counts on having admin privileges on target machine. The task of auditing, cleaning and finding out that malware is present is significantly easier if malware is limited to a non-privileged account. With malware running as a non-privileged user you still have to clean up and recover, but you can easily switch an account, compare, audit and trace. The anti-malware tools also still have a chance when OS is not compromised, otherwise it's all lost the moment you ran a malicious post- install script.

The more common problem, however, is a regular app install. The goal of the application packager is to make their application work first, and preserve your environment second. So, in many cases even not malware does bad things to your OS. The scripts are usually written by devs that are fairly clueless, which leads to some pretty awful stuff in them. Almost 100% of the time the install/uninstall action is not idempotent, although it should be.

What really needs to happen is a shift in a mentality that accepts the idea that apps need to be installed as an administrator (unless the apps are a part of the main OS distro).

<comment><USER48> His comment went right past you. What you care about the most on your computer is your personal data, and all of it sits under $HOME. Any script running as $USER can steal sensitive data, wipe out personal and work files, maybe even cloud storage services. None of that requires admin rights.

The only solution is sandboxing everything.

<comment><USER46> For things that are likely to carry malware, use a separate account. Probably a good idea for a Bittorent client in any case.

In practice, however, it is much easier to deal with malware if there's no admin rights. It matters even for a clueless user, since the OS mechanisms of detection can't be altered and more much so for a power user.

This specific malware installs a kernel module, as far I can tell. I am guessing it would be harder to encrypt data and not be noticed and removed quickly.

Of course, there are even more obvious reasons, like sharing a computer with... kids that tend to bring malware at every turn.

We really need to educate the devs and change the culture. There's no reason for something like a word processor and file sharing app to require full access to the system. That's why we have access controls in the first place.

</comment></comment></comment></comment></comment><comment><USER10> While we're here, can anyone recommend a good antivirus for OSX?

I've just been looking at BitDefender, which looks promising, but would rather get this right than faff around with potentially crappy AV tools.

<comment><USER6> > can anyone recommend a good antivirus for OSX?

Common Sense 2016, see [https://github.com/drduh/OS-X-Security-and-Privacy- Guide](https://github.com/drduh/OS-X-Security-and-Privacy-Guide)

<comment><USER49> Common Sense 2016 would not have prevented a malicious Transmission update though

<comment><USER6> Agreed - it would not defend against this presumed watering-hole attack. However, neither would have AV: [https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc...](https://www.virustotal.com/en/file/d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1/analysis/)

Nevertheless, I still believe Common Sense to be a better alternative to bloated, vulnerable anti-virus programs.

</comment></comment></comment></comment><comment><USER50> The strength of a chain is the strength of its weakest link, and the more "apps" are provided as _the system_ the longer and more vulnerable is the chain.

When it comes to checksums with have the chicken egg problem plus the collision attack of md5.

MD5 has been the standard for too long (and is deprecated since 10 years for crypto checksum). And for next generation of softwares to install that don't do modern checksum how can they trust the download of the package required to check for whatever the new format? Plus the new format is less likely to be checked without errors. A off by one character could easily be discarded in checking given the number of packages that are now required to be installed and the human limitation in focus.

Human are the limiting factors, and security is modeling the user in a kind of grotesque caricature of a robot that can check thousands of informations perfectly and remember 20 characters passwords for tens of appliances.

There is a tyranny of computer engineers regarding what is safe for people having a life not concerned about geeky technology that is a tad annoying.

People have the right to be human and to fail is human. The burden put on human to make the system safe in order to avoid costly for the bosses human interactions is way to high.

And since computer security always blame failure on human behaviour I begin to positively dislike it.

<comment><USER51> > There is a tyranny of computer engineers regarding what is safe for people > having a life not concerned about geeky technology that is a tad annoying.

You know you can make that complaint about _any_ tool or technology, right?

"Gosh why do I have to follow all these rules and observe traffic lights to drive a car?" (something that actually intimidates me, in fact, because I've never driven a car.)

"Why do I have to worry about cutting or burning myself or someone else while trying to cook a meal?"

"Why are all these procedures and protocols, like schools and banks and taxes, required to function at all in contemporary society?"

Until computers advance to the point of being artificially intelligent familiars that can figure out exactly what we want from a simple vocal command and do something even better, we're gonna have to put in a little effort from our end to make them work the way we want them to.

<comment><USER50> You know all engineers do not always blame users?

There are fields of engineering where an accident even due to human causes is systematically seen as an engineering problem.

And that may be the reason why traveling by plane and train are safer than by car.

But US engineers made a great job at convincing legal department that poorly engineered goods where not the causes of accidents.

<comment><USER51> > You know all engineers do not always blame users? > There are fields of > engineering where an accident even due to human causes is systematically > seen as an engineering problem.

In those other fields, such as automobiles, an accident by a person may cause death of another.

On a computers your careless may not cause someone else to outright die (which tends to cause a lax attitude on the part of users) but they can still cause someone else harm, like inadvertently leaking someone's financial information or causing malware on your device to participate in a DDOS attack on someone. Time and again it's been proven that users are often the weakest link in this field no matter how tight the security is. It's only understandable for the engineers to be annoyed.

</comment></comment></comment></comment><comment><USER52> Does installing 2.9.1 remove it completely or just from the Transmission app? I'm concerned the malware is still there.

<comment><USER29> Additionally, what does the malware do? "OSX.KeRanger.A" appears to be a name that Apple assigned it in their malware definitions, but Google doesn't know anything except the pages about Transmission.

I'm curious what sort of malware we're looking at. Botnet? General remote access/control? Harvesting keychains?

<comment><USER19> According to this article it's ransomware.

[http://www.cnbc.com/2016/03/06/reuters-america-apple- users-t...](http://www.cnbc.com/2016/03/06/reuters-america-apple-users- targeted-in-first-known-mac-ransomware-campaign.html)

<comment><USER29> Thanks! Guess my search was too specific. The important bit:

> The malware is programmed to encrypt files on an infected personal computer > three days after the original infection, according to Olson.

Anyone who may have been hit, update your backups _NOW_ so you can restore the files.

<comment><USER53> Careful not to backup the malware infection though...

<comment><USER29> Of course, and if you only have the one backup drive, be wary of connecting it to an infected computer with read/write access. Link posted in another comment suggests that this malware has encryption of Time Machine backups in development (should be safe this time around?).

Safer option would be to create a write-only network share on another computer and copy files to that.

</comment></comment></comment></comment></comment></comment><comment><USER54> I'm on 2.90 and can't find any weird processes running. I'll hold off on 2.91 until they've explained what happened.

<comment><USER55> that feels like a pretty week standard for knowing if your machine is infected. I will look for a virus scanner myself, and seriously think about reinstalling if it finds anything

<comment><USER54> Yeah I know, it is the lowest effort. But I'm not running it on my main system. Worst case I'll have to reinstall (unless it messes with the hardware, firmware changes for example).

</comment></comment></comment><comment><USER56> If you installed/updated via Homebrew-Cask [1], you should not be affected. 2.90 was not always compromised, and looking at Caskroom history, the checksum was only updated for the 2.84 -> 2.90 bump once [2].

It is updated and at 2.92 now, also [3].

(I'm one of the maintainers of Homebrew Cask)

[1] [https://github.com/caskroom/homebrew- cask](https://github.com/caskroom/homebrew-cask)

[2] [https://github.com/caskroom/homebrew- cask/issues/19504#issue...](https://github.com/caskroom/homebrew- cask/issues/19504#issuecomment-192992223)

[3] [https://github.com/caskroom/homebrew- cask/pull/19508](https://github.com/caskroom/homebrew-cask/pull/19508)

<comment><USER57> Homebrew Cask is awesome, but I still think security is an issue here because you still have to trust the upstream binaries are safe, each built and hosted by totally different people. Verifying checksums is certainly better than not checking them, but you still haven't escaped from the trust-whatever-binary- you-downloaded-from-the-internet-style of doing things. I really wish package managers like Homebrew Cask offer some level of trust by building applications from source and signing them, like Debian.

<comment><USER56> You are absolutely correct. Homebrew-Cask favors convenience and availability of as many applications as possible, though we make reasonable efforts to avoid malicious actors by verifying checksums, download links, and (soon) GPG verification where possible.

You may be interested in [https://www.macports.org](https://www.macports.org) for a build-from-source solution for OSS projects.

</comment></comment></comment><comment><USER58> Can someone explain me what Xprotect.plist contains? Are those malware's that are recognized by Apple and are blocked and dealt with?

I saw some post on forum where dude said how his Xprotect now contains at the top OSX.KeRanger.A entry, and said how it means he got infected. It didn't made much sense to me, but I checked mine this morning and found the same entry? Does it mean I am infected too?

But I didn't download anything from their website like 3 months back, I just did the update to 2.90 in Thursday or Friday can't remember, and yesterday as soon as I saw the news I update everything and checked for malicious files and processes which weren't present on my machine.

<comment><USER59> If I recall correctly, they are file signatures that OS X uses to identify and remove malware. Not sure when and how the files on your drive are checked (potentially right before they are opened?), but the XProtect.plist file is automatically updated by Apple, and that's what you're seeing.

The entry doesn't exactly mean you're infected, but just that your copy of the file was updated.

I have the entry for instance, but I was never infected. You can check your copy of XProtect with this command (I have 2076):

defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version

Edit: Looks like you do get a message before launching an app, if it's identified by XProtect/File Quarantine.

<comment><USER58> Yeah, I have 2076 too. Now after the update of Xprotect you get the message, but what if you ran the app for example on Friday (4th) and got infected then?

Checked on IRC, it seems that sparkles prevented infection for those who updated their app, like I did. Screw all this, as I read in one of the comments here, I will run transmission through Docker container on RPi running FreeBSD.

<comment><USER59> If you ran the app before the XProtect definitions were updated, then it would've ran with no problem and you would've been infected.

<comment><USER58> Now it bugs me cause i can't find info on when the file was edited... Stats and defaults read display 20th January. wierd thing is that I ran the app during problematic time interval but havent found any single process or file that was mentioned in Palo Alto Security page, no kernel_services process or any other misbehaving. Anyway I did Time Capsule backup 10 days ago, and haven't plugged the drive into my computer since, so if anything happens I will roll it back. We shall see, but it is kinda uncomfortable to keep using "maybe infected" machine. Who knows what else may be left, supposedly nothing... Thanks anyway for the help! Cheers

</comment></comment></comment></comment></comment><comment><USER60> It looks like they've since changed the upgrade to 2.92 (it was previously 2.91 this morning), wonder why that happened?

<comment><USER61> The update dialog says:

"Everyone running 2.90 on OS X should immediately upgrade to and run 2.92, as they may have downloaded a malware-infected file. This new version will make sure that the "OSX.KeRanger.A" ransomware (more information available here) is correctly removed from you're computer.

Users of 2.91 should also immediately upgrade to and run 2.92. Even though 2.91 was never infected, it did not automatically remove the malware-infected file. "

<comment><USER60> Thanks, I dug out the diff and found that too :)

[https://trac.transmissionbt.com/changeset?old_path=%2F&old=1...](https://trac.transmissionbt.com/changeset?old_path=%2F&old=14711&new_path=%2F&new=14713&sfp_email=&sfph_mail=)

</comment></comment></comment><comment><USER62> Can anyone tell me if this also applies to brew's cask's builds? I needed to download CentOS the other day and wanted to go with a torrent. I got pretty pissed after I realized that BitTorrent installed some adware called Spigot. I tried to remove it as good as possible (I mainly killed the process, removed `Library/Application Support/Spigot` and ran a `sudo find / | grep -i Spigot`).

Ironically I decided to use the good, ol', trusted open source alternative transmission because I just read on HN that Transmission gets updated again...

<comment><USER63> My build from cask didn't start the process but force removed it anyways and am waiting for cask room to point towards 2.91.

<comment><USER64> homebrew-cask updated with version 2.92 and https

</comment></comment></comment><comment><USER65> Just an anecdatum: I got infected by this yesterday when I installed Transmission to download a Debian install CD. When I read about this at MacRumors I checked and had the kernel_service process running and the two hidden files hiding in Library.

I've unplugged and archived the TimeMachine backup disk and done the prescribed cleanup actions to remove he malware. I guess time will tell if it had any other tricks up its sleeve.

<comment><USER66> Do a search for any files in /Users and connected volumes which are suffixed with __.encrypted __. Apparently that 's the interim filename suffix used by the malware.

<comment><USER65> Thanks, I appear to be clear of _.encrypted_ files.

The good of this mess is that I realized I only had one Time Machine backup going on that machine. I had turned off the remote backup a month ago while shoving backups around on the remote server to make more room and hadn't restored it. One backup is too few.

The weakness exposed is that if the remote were mounted, this malware would have nailed it too. I'll have to look at having the remote make filesystem snapshots on its end so malware can't corrupt my older backups.

</comment></comment></comment><comment><USER4> This is really bad but there are two good security defenses that came out of that forum thread (which is better than not having them at all).

1\. Apple revoked the certificate already. Thus people that have gatekeeper on are safer.

2\. Sparkle (for auto updater) denied the malware infected update. Thus downloading from the main website is not necessarily safer, even with the recent mitm sparkle vulnerability.

</comment><comment><USER67> I used to Transmission in Linux but switched to qBitTorrent instead when I switched to Windows 10. It has an OSX version if you don't trust Transmission anymore.

[http://www.qbittorrent.org/](http://www.qbittorrent.org/)

[http://www.qbittorrent.org/download.php](http://www.qbittorrent.org/download.php)

</comment><comment><USER68> Popular Mac rumour/news site 9to5mac (that is rapidly decreasing in quality) actually posted about this malicious update few days ago.

Somehow I found it out of place, especially as they have never posted about TransmissionBT before. They sure did get lots of people to update after putting in on front page.

<comment><USER69> Good for them.

</comment></comment><comment><USER70> The headline should probably say "at least Mac". I hope we soon learn the source of the compromise, but nothing so far indicates that Linux distributions' packages would be affected by a Mac malware.

<comment><USER71> The headline should definitely say "at least Mac". It so annoying to hear about "computer viruses"... (protip: it's Windows, Osx, well, maybe even Linux virus).

</comment></comment><comment><USER72> Can someone please confirm that the in-app update is not affected by the hack?

<comment><USER73> I performed the in-app update to 2.90 last night. Just found about this. Doesn't appear that I am infected, amazingly enough.

</comment></comment><comment><USER74> I checked my version of Transmission and i'm still on 2.84. I guess I dodged a big bullet, but tonight i'll go through the diagnostics to see if any versions prior to 2.90 were infected. I may do it sooner if I get a quiet moment at work.

I'm also running the usual litany of tools to check for activity (Wireshark on my WAN Tap, Anti-virus, etc)

My Synology NAS uses transmissiond for its BT Client, so I will be contacting them to see if they are affected by this issue.

</comment><comment><USER31> Something that is not entirely clear. Does updating to 2.9.2 attempt to clean KeRanger up automatically? Or is some manual cleanup still needed after updating?

<comment><USER59> The newest update removes it automatically.

</comment></comment><comment><USER75> Posted by one of the researchers that discovered the malware...

"#Transmission just pushed 2.92 update that includes code to > detect and to remove the #KeRanger ransomware. Update it before Monday 11:00am."

[https://twitter.com/claud_xiao/status/706579264036950016](https://twitter.com/claud_xiao/status/706579264036950016)

<comment><USER76> I'm not sure how I feel about that. How long will that code live in Transmission? It's not really Transmission's job to remove malware.

</comment></comment><comment><USER77> Checked my install of 2.9.0 from auto-update, it's clean (none of the suspect files are in Contents/Resources). According to a post on the Transmission forums, when a person was (probably) delivered an infected binary, there was a checksum failure as you'd expect. So it seems as though you won't be infected if you used the auto-updater.

</comment><comment><USER78> On a related note, Windows Defender detects malware when downloading the windows putty installer. Trojan: Win32/Varpes.J!plock [http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h...](http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html) Not sure how to report.

<comment><USER79> try uploading the file to virustotal, avira etc. Windows Defender should in the alert have a button to report to microsoft.

<comment><USER80> Looks clean. Maybe false positive from Windows Defender...

[https://www.virustotal.com/en/url/73d82ff580cd445b907c6334c7...](https://www.virustotal.com/en/url/73d82ff580cd445b907c6334c7d7bd0b14107a6fc2a821cada334944edc7e25f/analysis/)

</comment></comment></comment><comment><USER58> Oh dear god. Used 2.90 past week, when I saw the news I updated immediately, checked for all the files, found nothing. I hope my MacBook will stay fine tomorrow. I got it backed up on Time Machine anyway. Where do we go from here, since I lost the trust, what are the alternatives? And from now one, I'll go with Brew Cask for everything possible.

F __* GUI /s

<comment><USER81> Would brew cask have helped you here? It doesn't build from source, it just downloads a precompiled binary.

<comment><USER56> In this case, yes, as it verifies the download against a (best-effort) known- good checksum. It's not a perfect system, but did work out in this case.

GPG verification where available and refusing to install Casks without a checksum is also in the pipeline.

(I'm one of the maintainers of Homebrew Cask)

</comment></comment></comment><comment><USER82> If they indeed used a legit code signing certificate, what is the fix? It seems very difficult to just blindly trust signed binaries anymore. Short of setting up a registry of vetted code signing certificates, it seems that signed code is just as easily manipulated as unsigned code. And even then, the keys to the certificate could be mishandled.

</comment><comment><USER83> Wondering if brew cask can be solution for this.

<comment><USER64> Inded, see my comment here: [https://github.com/caskroom/homebrew- cask/pull/19508](https://github.com/caskroom/homebrew-cask/pull/19508) Installation via brew cask was never at risk thanks to checksum verification, and at anyrate is now updated.

<comment><USER83> That's really nice. I was in doubt, because it downloads Transmission DMG from their site, but checksums solves it. We should use it more. :-)

</comment></comment></comment><comment><USER84> I uninstalled the app, but is there a way I can check if i've been affected?

<comment><USER85> This article[1] says Transmission is doing to offer a way to check, but I'm not sure it's on the site yet. Apparently tomorrow is the ransomware activation date for people who installed the infected version on Friday.

[1] - [http://www.reuters.com/article/us-apple-ransomware- idUSKCN0W...](http://www.reuters.com/article/us-apple-ransomware- idUSKCN0W80VX)

</comment></comment><comment><USER86> Sorry, but how did this happen? Was the website breached?

</comment><comment><USER87> Yet another reason why you should have a (offline) backup of all your important files.

</comment><comment><USER88> any reason why it's correlated with dht.transmissionbt.com loosing its AAAA record? it's the only IPv6 DHT bootstrap node on the Internet

</comment><comment><USER89> It's not. Condoms aren't used against a hostile opponent. If your partner is intent on exposing you, a condom won't provide any protection.

<comment><USER16> I can't think of a more hostile opponent than an HIV virus. And we're still not sure if Transmission was spreading the virii intentionally, making the condom analogy even more fitting.

<comment><USER15> HIV is not a threat crafted by an active adversary, it's a product of evolution.

<comment><USER90> I think the point is that viruses can exploit properties of their hosts regardless of how they came to do so.

<comment><USER91> But humans and viruses aren't competing in the same game. A better metaphor for the adversary in that situation is the person you're having sex with poking a hole in your condom.

<comment><USER13> These metaphors are hard to follow. Does anyone have a car analogy to phrase this better? Seems like that's all we're missing in this thread.

<comment><USER92> It's like not putting a condom on your car. Sure, HIV might stick a hole in it, but I'd still use one.

</comment></comment></comment></comment></comment></comment></comment><comment> Dorian-Gray Am I the only one who saw the app and thought "Why the heck is TPB releasing an app?" Makes them more of a target, less stable platform, more easily interfered with , ect.</comment>


Google vs. Death - <AUTHOR> http://techland.time.com/2013/09/18/google-vs-death/ <comment><USER2> So this article was presumably written beforehand and embargoed to coincide with the official announcement of Calico. While I guess there's nothing wrong with that, it does make me wonder what kind of pre-approved message is supposed to be imparted by a premeditated PR campaign.

Perhaps it is just to avoid scaring investors, going by Larry's concern assuaging in the second paragraph of his post.

One of the Google founders was also behind funding the first purely lab-grown burger eaten in London a few months ago. That also had an obviously professional PR campaign attached to it, although little of this was explicit in the press. A professionally edited HD recording of the event appeared on the BBC web site only a few minutes after publication, so obviously some PR mechanism was at play.

But that event wasn't to promote Google or anything else, it was absent of any commercial labels attached to the copy or the video itself, and no mention was made of who organized or funded it. I have no idea what the message, or the point of that campaign was either.

What are these campaigns trying to tell us?

<comment><USER3> Google does everything in a very orchestrated campaign. Bash Adwords or Search here and you will see "them" show up to defend it.

But unless Google already transferred $x billions to Calico's bank account, I have to laugh at the 20-30+ year investment agenda and that somehow Google will be in for the long run--unlike other companies. This will be shut down the minute Adwords growth slows down...and they're running out of places to put them due to over-saturation and "free" traffic to sites is disappearing at an alarming rate already.

Google, Page, Brin should've put $500 mil each and then pledged regular contributions.

Or maybe this is Brin's divorce package: Calico will buy 123andMe for a lot of money ;-)

<comment><USER4> You don't have any information on how much money they have invested.

All you do is speculate and inform us about your aversion towards Google.

And the enlightening insight that Google would probably drop this project if their profits started going down isn't really informative unless you think that we all here have problems with understanding fundamental logic.

<comment><USER3> _> >"You don't have any information on how much money they have invested."_

I never said I had the info. The people that know this chose not to say it. I speculated, which is all we can do.

 _> >"And the enlightening insight that Google would probably drop this project if their profits started going down isn't really informative unless you think that we all here have problems with understanding fundamental logic."_

It's not that informative, I give you that; it's Wall Street 101 and most know by now.

 _> >"about your aversion towards Google._"

Not sure blind love and gullibility is any better, assuming that I have an aversion to everything Google.

</comment></comment></comment></comment><comment><USER5> When Google sponsors an awesome project like this, I see the tech company equivalent of Nike sponsoring LeBron James for $105 million. Even if the R&D angle doesn't work out, Google gets real value (i.e. indirectly interchangeable for money) in terms of PR and recruiting. Consumer products companies pay huge amounts of money for PR. Google is just doing the same thing in a typically Googlish way. I don't think it's as cynical as just that: Google, and Larry Page in particular have been talking about making the world a better place for 15 years in a way that makes me pretty inclined to believe them, but the side benefits must counterbalance the longshot-ness quite a bit.

<comment><USER6> It's a bit more risky than sponsoring a popular athlete I think. Few peope think we shouldn't play sports, but there is a surprisingly large group of people who believe we shouldn't be engaging on research like this. Reasons include religious, environmental, and social concerns.

<comment><USER7> When I first read about Aubrey de Grey, I instinctively knew that he had the right approach to the problem of aging and immortality but I also suspected that he would run afoul of the religious, environmental, and social criticism that you're suggesting.

However, I no longer think that is the case, and I think if Calico takes the same tack they will mostly avoid it as well.

Here's why: a gross simplification of de Grey's entire research program is "aging and death happen because things start breaking faster than we can fix them, and because things start breaking that we have no idea how to fix." One of the greatest things about tackling the fountain of youth from this perspective is that it will _continue to look like normal medicine and cosmetic procedures_.

I predict that effective "eternal youth and immortality" will be achieved, but by the time the mass population notices enough to care, the majority of the population will be composed of people who grew up with the idea of accelerating progress on human health (in the same way that today's kids simply do not know an era without exponential advances in information technology). Thus, they will probably experience this threshold as completely normal, if they experience it at all.

In other words, there won't be a "magic moment". That moment will only appear retroactively, similar to today's magazine articles that say "hey look, here we are in the future with our video phones and what not! Isn't that nice?"

Let's say in the next 20 years the following things happen:

1\. A therapeutic AIDS vaccine performs the equivalent of Polio eradication

2\. Highly targeted and effective cancer therapies are developed at an increasingly alarming rate

3\. An actual cure for baldness is found

4\. A preventative therapeutic regimen for treating obesity at a genetic level is discovered

5\. A "nano-cream" that restores collagen in the skin becomes available first by prescription, then over the counter

6\. Alzheimer's and Parkinson's can be detected and prevented early and completely managed in those that are in advanced stages

Each one of those 6 things will likely face some opposition, but the opposition's voices will most probably not reach any kind of "critical mass"; people will (for example with the AIDS vaccine) simply regard as cruel the idea that people should die of AIDS because you don't want them having sex (a silly protest that I can still predict happening).

Each of these advances will happen individually, and to the average person they won't look anything alike.

But if you stack enough of these together long enough, you eventually get your fountain of youth. It's just that by the time it arrives there won't be riots in the streets, just 90% of the population saying "oh cool" and the other 10% viewed as harmless luddites with an interesting perspective on life.

<comment><USER8> _I instinctively knew_

Why?

<comment><USER9> death is bad

<comment><USER10> That doesn't imply anything about the most effective way to increase longevity.

<comment><USER11> I think you're reading too much into the words "right approach." In this case, "right approach" (I think) means something like "understanding that death is bad and trying to fight it."

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> There is something very weird about people routinely speaking of immortality as something that is actually a thing. For all we know, stars die eventually, the sun will burn out eventually, the universe as we know most likely comes to an end and so forth, you can not cheat basic physics. To me this is the same kind of refusal that makes some people believe in god, and that shows how hopelessly biased we get on topics we are emotionally involved in. On any other topic with the information available everyone sane would asses the likelihood of success as maybe less than 0.001%, but if you ask about this specific thing, it's more like 50%...

(Speaking in advance: I understand this is in fact about life extension)

<comment><USER13> Due to these circumstances, I suspect that this having possible applications into life extension is a really good way to get funding for your research, because death is 100% certain, and a .0001% chance of evading it sounds so good to some people that you can just about write your own check. Agreed though, death can be terrifying, but the idea of immortality is flawed in more ways than one. Are you really the same person you were 10 years ago? 10 Months? Weeks? Days? Minutes? Seconds? What is it, other than one's own fragile ego, that people are trying to perpetuate into eternity? A few extra years is one thing, immortality sounds like a fool's paradise to me.

<comment><USER14> > A few extra years is one thing, immortality sounds like a fool's paradise to > me.

Feel free to pass on it then, assuming you'd actually make that decision if you really had the choice. That problem will naturally solve itself: the set of people still alive will trend towards 100% rejection of having a limited lifespan.

"Everyone who had serious philosophical conundra on that subject just, you know, _died_, a generation before. [...] didn't need to convert its detractors, just outlive them." \-- Cory Doctorow, "Down and Out in the Magic Kingdom".

<comment><USER12> And what is your solution to not getting hit by a truck over an infinite period of time?

<comment> loup-vaillant That's a technical problem, not a moral one.

More seriously, we could scan backups. Or we could live in the Matrix, not as meatbags plugged through the neck, but as _programs_ –which could be backed up as well. (Don't ask me who gets to be root.)

<comment><USER13> It's funny, because Eli was making a moral argument, but I was not, yet that seems to be the default argument against immortality. I think you last question is actually close to what I was striking at - who is it that's immortal? What does it mean to be a consciousness freed from its humanity? I honestly am not sure that many people would end up being happy in such an arrangement, or necessarily actually survive in any sense as "themselves" for very long, despite the persistence of a body or simulant or whatever.

</comment></comment></comment></comment></comment></comment><comment><USER15> If this random stat I found on Gizmodo (yeah, I Googled and couldn't find anything better) your chances of dying of an accident in a year are 1 in 1656.

So "immortality" is really a couple thousand years.

Don't get me started on "brain uploading". Unless you can guarantee me that I'll still be me (which is really a religious question) I'm sticking with a couple thousand years tops.

Impressive life extension. Not immortality. Not even talking about the "heat death of the universe" here - you're getting nowhere near that.

You can live your life through robotic surrogates, and that could extend your life further, but wherever you warehouse your body becomes a single point of failure so it had better be secure.

<comment> loup-vaillant > _Don 't get me started on "brain uploading". Unless you can guarantee me > that I'll still be me (which is really a religious question) […]_

Luckily, religions are false. The supernatural is unlikely, and immaterial souls even more so. But we have quantum mechanics.

Current quantum mechanics say that copy&paste transportation doesn't kill you. (Yep. The question was philosophical, and the answer came from physics.) The reason is, you're not a heap of atom, you're an _arrangement_ of atoms. Mind uploading goes a bit further, but should work just as well. Imagine a "temporary" uploading, where your memories from the Matrix are downloaded back into your brain (by rewiring your neurons accordingly). It's still you, only older. Anyway, a deeper understanding of our brains' inner workings may resolve the question of mind uploading more definitely. We'll see then.

<comment><USER16> _Current quantum mechanics say that copy &paste transportation doesn't kill you. (Yep. The question was philosophical, and the answer came from physics.)_

[citation needed]

As far as i'm aware, there's no evidence that the mind is anything more than a physical construct. As such, the idea of 'uploading' it makes no sense. You can create a copy, sure, and perhaps even a running simulation might be self- aware and identify as you, but you still only last as long as does the hemisphere of jelly in your head.

I agree though that it is a question of philosophy, but a different philosophy altogether. We will have to redefine what a 'mind' is to take into account the persistent pattern of the brain in whatever form it takes as software, but that's not actually going to solve the problem of mortality any more than religion does.

<comment> loup-vaillant > _[citation needed]_

[http://lesswrong.com/lw/r9/quantum_mechanics_and_personal_id...](http://lesswrong.com/lw/r9/quantum_mechanics_and_personal_identity/)

It's long, but it's worth it. I personally enjoyed reading all this.

<comment><USER16> Thank you, that was enjoyable. But...

[http://en.wikipedia.org/wiki/No- cloning_theorem](http://en.wikipedia.org/wiki/No-cloning_theorem) and the uncertainty principle suggest to be that while it might be possible to create a model which appears indistinguishable from an existing person, and could be considered "similar enough" philosophically or legally, by definition it would have to be considered a 'different' object because perfect copies are impossible.

<comment> loup-vaillant > _perfect copies are impossible._

Sure. But from one nanosecond to another, we're perturbed by thermal noise, without any qualms about what that noise does to ourselves.

I think we can safely assume that a copy whose imperfections are on the same order as thermal noise is a second original. That, or we admit that room temperature is enough to change us.

<comment><USER16> _That, or we admit that room temperature is enough to change us._

It might be, at some level, I don't know.

Am I the same person I was when I was born? Am I the same person when I wake up as when I dream? Was Phineas Gage a different person after taking an iron shaft in the brain as before?

Maybe it's more accurate to describe people as processes rather than objects. Which could support your premise while not necessarily invalidating mine, since the whole concept of a singular, coherent self would itself be an illusion.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Can anyone find meaningful detail in here about how Google hopes to solve the problem of death? Beyond the name of the company and the guy running it, this seems like a stock profile of Google X.

</comment><comment><USER18> Succeed or not in their stated goal, it could end up throwing off a lot of interesting science, assuming actual bio/neuro/genetic science is backed by the venture. Presumably all this enhanced by vast amounts of computational prowess, as well.

That said, there are a lot of questions about what the philosophical, cultural, sociological and political underpinnings and implications might be. Creating a friendly environment for discussing those could be a worthwhile exercise as well. For example, what is the interaction between individual wellbeing and longevity, and the quality of world in which you live? Perhaps it's a two-way street, a wholistic set of factors that includes social wellbeing in addition to medical health, taking for example the case of that Greek island with famously long-living people (Ikaria).

As someone said, it's not the years in your life, it's the life in your years.

</comment><comment><USER19> What's with the fake, trollish headline on HN?

It should say "Google vs. Death".

<comment><USER20> It does say that, now.

What was the original headline?

</comment></comment><comment><USER21> Last week, my fiancée telling about me a novel she was reading "Google Démocratie" by David Angevin and Laurent Alexandre (2011, French language). This article sure makes the premise of the novel (genetically modified trans- humans vs the good old fashioned kind) seem a little less far-fetched.

</comment><comment><USER22> after money, fame, what else? the google founders desire to live forever

<comment><USER23> Desire _everyone_ to live forever.

What kind of monster are you that you don't think thats a laudable goal?

<comment><USER24> > _What kind of monster are you that you don 't think thats a laudable goal?_

I think there are many compelling ethical and philosophical arguments one can make against wanting everyone to live forever.

We shouldn't confuse live _extension_ with living _forever_. Oddly enough, David Attenborough is in the news today for suggesting population control is a huge and growing problem[1]. You could argue that research into extending human life when we are looking at significant problems with population overcrowding and competition for resources in the near future is putting the horse before the cart.

I am not sure which side of the fence I fall on. Medical research can allow people with previously incurable conditions to live full lives. This is a laudable goal. But that's not what you said - you're talking about living _forever_. Is that so laudable? I would certainly not call someone who thought that was a truly awful idea 'a monster'. Indeed, there's lots of speculative fiction based around how awful it would actually be to live forever (or even a very long time).

[1] [http://www.telegraph.co.uk/culture/tvandradio/10316271/Sir-D...](http://www.telegraph.co.uk/culture/tvandradio/10316271/Sir- David-Attenborough-If-we-do-not-control-population-the-natural-world- will.html)

<comment><USER25> Admittedly, you do have to laugh at the sheer irony. Research into life- extension is taking place in advanced countries that can't even maintain their current population levels without net immigration.

And also, at the same time, cannot be bothered to raise labor wages.

What the fuck?

<comment><USER26> > Research into life-extension is taking place in advanced countries that > can't even maintain their current population levels without net immigration.

Sounds perfectly consistent to me.

> And also, at the same time, cannot be bothered to raise labor wages.

As long as the immigrants keep coming, why bother raising wages?

<comment><USER25> Right, the inconsistency is: the First World goes tsk tsk at the Third World for its overpopulation and poverty; meanwhile, it critically relies on the Third World to breed a neverending supply of cheap immigrant labor to exploit.

<comment><USER26> You could just as well say it offers people suffering from those circumstances the chance of a better life.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> A couple of years ago, after it was revealed that Sergey had some genetic disorder I wrote this sci-fi short story inspired by the fact that Larry/Sergey would be doing exactly this:

\----

In the year 2010, scientists perfected suspended animation through the use of cryogenics for the purpose of surgery. After more than a decade of study and refinement, long term suspended animation became a reality, yet a privilege reserved for only the most wealthy and influential.

The thinking at the time was that only those who showed a global and fundamental contribution to society (while still viewed through the ridiculously tinted lenses of the global elite of the era) were worthy of entering into such state.

The process was both incredibly complex and costly. As each Transport, as they were known, required their own stand alone facility to be built around them. Significant resources were put into the development of each facility as they required complete autonomous support systems to accommodate whatever duration was selected by the Transport.

Standalone, yet fully redundant, power, security and life support systems were essential to the longevity of each facility.

Additionally, it was recognized that monetary resources would be subject to change over time, especially fiat-currency based resources. Thus there was a need to place physical holders of value that would be perceived to not deplete/dilute over time into the facilities for use by the Transport when they resuscitate.

These resources are the most sought after treasure of the new world.

After hundreds of years of human progress, civilization could no longer sustain itself in an organized self-supporting system. Through utter corruption of what some call the human soul, the world has fallen dark. There are very few outposts of safety in the current Trial of Life, as its now known.

Many Transporters have been found, resuscitated and exploited already. There are believed to be many many more, but their locations are both secret and secure. Akin to your life relying on the discovery of an undisturbed Tomb of a Pharaoh - even though every consciousness on the planet is also seeking the same tomb.

They are the last bastion of hope for they alone have the reserves of precious materials needed to sustain life for the current generation.

Metals, technology (however outdated), medicines, seeds, weapons and minerals are all a part of each Transport 'Crop'.

One find can support a group or community for years alone based on the barter and renewable resource potentials in each Crop.

One transport, found in 2465, that of a long dead nanotech pioneer - who was purportedly responsible for much of the cybernetic medical capabilities of the 21st century, which he sought to cure his genetic predisposition for a certain disease, was so vast that the still powerful city-state in the western province of North America was able to be founded.

The resources of this individual were extraordinary, but his resuscitation, as they all are, was rather gruesome and cold.

The security systems in each Transport Facility are biometric and very complex. They can only be accessed by a living, calm and (relatively) healthy Transport.

If the system, and its control mechanism AI, detect signs of duress, stress or serious injury to the Transport - they go into fail-safe. Which is to say they self detonate. Taking with them all resources, the Transport and the Seekers as well.

There have been many instances of this, such that the art of successful Resuscitation has become an extremely profitable business.

The most active and successful Resuscitation Team (RT) have been the ironically named, Live Well Group.

The most conniving, well practiced and profitable con in the history of mankind.

LWG alone has been responsible for the resuscitation of more than 370 Transports. Their group is currently the most powerful in the world. With their own city-state, established after the Brin case mentioned, they have a cast of thousands of cons all working to ensure the Transport believes they have been Awakened to a new, advanced, safe world and that they would be allowed to stake part in a significant way now that they have been Transported.

They are fooled into releasing their resources, then brutally tortured for information about any other Transports or any other knowledge they may possess, which invariably is less than nothing.

It is a hard world out there now, and the LWGs ruthless strive to locate the thousands of other Transport Facilities is both the worst aspect of our modern struggle - yet ironically will serve to be the basis of the ongoing endeavor of the species.

There is rumor of a vast facility of resources and Transports in an underground 'CITY' of the most elite Transports ever. A facility supposedly comprised of the 13 most powerful and rich bloodlines of people to have ever existed.

It is not known which continent this facility is on, but I believe it is in Antarctica - fully automated and with the ability to auto-resuscitate at a given time.

This is my mission, this is my life's work. To find and own this facility and crush any and all other groups that oppose me.

<comment> loup-vaillant I like the background, though from a narrative standpoint, it is better presented piecemeal, as the hero progresses.

Just one quibble: cryonics (not "cryogenics") _today_ is much less expensive than that. Okay, you don't live back (yet). But if we get working suspended animation, with resuscitation and all, it will probably be much cheaper, much more dependent on the survival of our current civilization, and much less protected.

<comment><USER27> I wrote it in 2010 after the wired article about Sergey's gene issue came out... it was a stream of conscious post, and I hadn't edited it since...

I predicted that given his resources and being found to have a genetic predisposition to a disease with later-in-life onset, he would focus on health/longevity.

With the article that came out at the same time about cryonic (thanks) surgery, I was thinking that he would be more likely to be able to freeze himself later in life than to cure his genetic disorder.

</comment></comment></comment><comment><USER28> You'd think with everything Google already knows about most people they could just solve for x.

</comment><comment><USER29> The date publish on the article is wrong? Its also cuts off and trys to get me to pay money?

</comment><comment><USER30> Funny. No mention of Kurzweil.

<comment><USER31> Kurzweil is a joker. His entire hypothesis rests on the assumption that computational power is the only obstacle to general AI, which is manifestly not the case.

<comment><USER32> Kurzweil works for Google.

</comment></comment></comment><comment><USER33> Damn, I thought Pratchet wrote another book...

</comment><comment><USER34> I think I'll go with death, then.

<comment><USER10> That's fine, as long as you _choose_ it rather than having it thrust upon you. Currently, we lose this choice after less than a century.

<comment> qu4z-2 I worry that it will not be a choice (or at least taboo, like suicide is these days -- given that's basically what it will be).

EDIT: I wonder if the possibility of living nearly forever will make society even more risk-averse?

<comment><USER26> Improved healthcare, reduced war and so on have already made society much more risk-averse. This would just be another bit of improved healthcare.

</comment></comment></comment></comment><comment><USER35> Love that it has a cat name... they're the ones with seven lives, right?

<comment><USER36> I thought it was 9.

<comment><USER35> Depends what country you're from.

</comment></comment></comment><comment><USER37> Google can't extend human life but maybe it can pick the right people who can.

This is similar to iPhone. Steve Jobs didn't make the iPhone possible. What he did was recognize something that many engineers had recognized for a long time and he permitted the resources to flow to the right people. Sure, he introduced some of his own artistic flair. But the combination of radio, UNIX, with a nice API was an idea whose time had come. We just needed a CEO with the balls to let his engineers go for it.

There are many brilliant scientists and engineers that can nearly do magic, and not enough people who know how to discern what visions to fund. Every so often we get blessed with a Steve Jobs or Elon Musk who can send the resources the right way, but for the most part we get Carly Fiorina.</comment>


Android 3.0 Platform Preview and Updated SDK Tools  - <AUTHOR> http://android-developers.blogspot.com/2011/01/android-30-platform-preview-and-updated.html

<comment><USER3> From the article -

 _High-performance 2D and 3D graphics: A new property-based animation framework lets developers add great visual effects to their apps. A built-in GL renderer lets developers request hardware-acceleration of common 2D rendering operations in their apps, across the entire app or only in specific activities or views. For adding rich 3D scenes, developers take advantage of a new 3D graphics engine called Renderscript._

This ought to do a lot of good for smoothness and sleek animations. The selection ability is also great - looks like Apps can selectively enable hardware acceleration based on their needs and underlying hardware capabilities.

 _Support for multicore processor architectures: Android 3.0 is optimized to run on either single- or dual-core processors, so that applications run with the best possible performance._

Would be great to know what they did to optimize it for dual core - may be some parallel GC tweaks, and some API additions for task bindings etc.

 _Rich multimedia: New multimedia features such as HTTP Live streaming support, a pluggable DRM framework, and easy media file transfer through MTP/PTP, give developers new ways to bring rich content to users._

DRM - NetFlix can finally shut up! I am not unhappy as it is pluggable - if I don't want it I won't install the plug.

 _Enhancements for enterprise: New administrative policies, such as for encrypted storage and password expiration, help enterprise administrators manage devices more effectively._

Encrypted storage is too little too late unless I am misunderstanding it - this looks like it's limited to storing Exchange data only, and not system wide encryption. But they are going somewhere with it which is good.

<comment><USER4> > I am not unhappy as it is pluggable - if I don't want it I won't install the > plug.

Pluggable does not mean "as a plugin". As a user, you won't be given any choice in the matter (short of not installing the application at all of course).

<comment><USER3> Right - I meant if I don't need/install Netflix for example, the DRM plug won't be on my phone. So yeah - I might get Netflix bundled on VZW phone but I have a choice to go with another one that doesn't ship with it.

<comment><USER4> > Right - I meant if I don't need/install Netflix for example, the DRM plug > won't be on my phone.

There is no "DRM plug". "Pluggable DRM framework" means Google just provides an architecture to implement their actual DRM, instead of forcing developers to use Google's own DRMs. Nothing more, nothing less. Your declarations hardly make sense.

<comment><USER3> I don't understand what you are arguing here. Quoting from the docs - <USER2> 3.0 includes an extensible DRM framework that lets applications manage protected content according to a variety of DRM mechanisms that _may_ be available...

All I am saying is it would still be possible for me to buy a Android device whose maker doesn't implement any DRM at all. Or do you happen to know something that I don't and Google is planning to provide a default mandatory DRM for Android that everyone must carry?

<comment><USER5> _> All I am saying is it would still be possible for me to buy a Android device whose maker doesn't implement any DRM at all._

Assuming you can find one that satisfies your requirement. Wanna bet? Hint: DRM is part of newer ARM designs.

<comment><USER3> DRM in ARM designs - It has long been there, nothing new. That hasn't changed anything. [http://www.arm.com/products/processors/technologies/trustzon...](http://www.arm.com/products/processors/technologies/trustzone.php) says all Cortex-A class CPUs support it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> _Android 3.0 (Honeycomb) is a new version of the Android platform that is designed from the ground up for devices with larger screen sizes, particularly tablets._

Does this mean that 3.0 is not going to ship on phones? I haven't seen it demoed on phones at all.

<comment><USER7> The UI for Honeycomb, as displayed, would not work on phones.

I get the impression that Honeycomb isn't going to be coming to phones. Why Google is doing this is anyone's guess. Things that are deeply important, like graphics acceleration, needs to filter down very quickly, but it looks like Google are solely focused on tablets.

It's a really schizophrenic strategy, and I'm beginning to get the impression no-one is really in charge there. Why does the Nexus One still not have 2.3? Why are features that were slated for 2.3 now in 3.0, which doesn't even look like it's coming to phones?

Google certainly aren't doing well at pleasing their current customers, and they've certainly scared me away. I don't see why I should trust anything about their upgrade path. The argument that you buy a handset for what it does, rather than what it promises, is flimsy, but when you sell phones like the Nexus One, and specifically promise upgrades, you're just lying.

EDIT: To those commenting about iOS 3.2, the difference is that iOS 3.2 didn't really deliver any large features that meant iPhone didn't maintain parity. Honeycomb, with graphics acceleration, overhauled UI etc. etc. will. Apple's strategy was always a unified one, with a little detour to get it going on tablets. Google appear to have completely switched tack.

<comment><USER8> _It's a really schizophrenic strategy_

It's the same strategy that virtually every maker is following now. It's building out a platform, and its what you have to do to compete now.

 _I get the impression that Honeycomb isn't going to be coming to phones._

Their introductory video specifically says "built entirely for tablets". I don't know what the credibility of it is, but there was the rumor that the next iteration will be 2.4 and will be for handsets. Such a versioning strategy makes sense.

Obviously they would share considerable amounts of code. The "shell" is just a replaceable process.

 _Google certainly aren't doing well at pleasing their current customers_

It's clear that Google and its open handset partnership is perilously understaffed right now, and they need to cut the umbilical going to whoever is screwing up this opportunity.

Android, I think, succeeded far beyond Google's dreams (originally tablets and PMPs were a no-go, but they've become a primary focus), but it seems to be moving _far_ too slowly. A bunch of stuff they promised for 2.2 still isn't there in 2.3, and is only rumored for 3.0. They need to seriously pick up the pace.

<comment><USER9> _there was the rumor that the next iteration will be 2.4 and will be for handsets. Such a versioning strategy makes sense._

Except for the part where 2.4 comes after 3.0...

<comment><USER8> ...where 3.0 is the new tablet line and 2.4 is the next handset version of 2.3. There's nothing particularly confusing about that, and there's a logic.

And at 4.0 they would likely merge.

</comment></comment></comment></comment></comment><comment><USER10> A video of Honeycomb's new "Holographic" UI: <http://www.youtube.com/watch?v=hPUGNCIozp0>

Not sure yet how well that theme will go over. When the Sense UI came out it was certainly more flashy and pretty than the stock UI, but at a major cost to battery life. Hopefully holographic has mitigated some of this.

It'll be interesting to see their UI builder in action once they finalize it. One of the larger gripes I've heard from iOS developers turned android is the lack of decent/fast UI construction tools.

<comment><USER11> I've used my current phone with both SenseUI and without, and did not notice any difference in battery life, FWIW.

</comment></comment><comment><USER12> This is great, but the phone market can't seem to keep up with these new versions.

I was just at a wireless store last night and their one in-store device would only run 1.6.

Their sold out device was only 2.1

The next device was still 2.1, "hopefully" 2.2

I asked if I could update, they said it wasn't possible and they didn't know for sure when it would be.

As a developer, what am I supposed to do here? Develop for 2.2 and 3.0 and just wait it out? Nope. I still have to make my games compatible with 1.6 if I want to reach the majority of the market.

<comment><USER13> Not really. Targeting 2.1+ gets you 87% of the market [1], a clear majority. Beyond that, does every Android thread have to talk about this? It is a well covered topic, everyone knows the deal. Android has a problem with updates. It isn't ideal, but things are what they are. We all know this. How about we focus on what this post is about, a 3.0 preview.

1\. [http://developer.android.com/resources/dashboard/platform- ve...](http://developer.android.com/resources/dashboard/platform- versions.html)

<comment><USER14> Plus the smartphone market (and Android's share of the same) are growing briskly so it makes sense to forge ahead, for both developers and Google. I don't know if Google planned for this, or they just got lucky but even with all the moaning and groaning about it they've got over 50% on 2.2 in 6 months.

</comment></comment></comment><comment><USER15> The emulator is unusably slow on my Core2Duo. Launching the browser spikes 100% cpu then timesout. Anybody have better luck on a modern i7?

<comment><USER3> On my i7 Win7 laptop with 8G RAM it isn't exactly fast - but it is borderline acceptable. Core2 should not be drastically different - have you tried increasing the default RAMSIZE from 96Mb to say 256Mb?

<comment><USER15> Yes I did 1024 to simulate the tablets. I'm going to try switching from openjdk-6 to sun.

EDIT: still no better. sun-java6-jdk is in the Ubuntu partner repo for maverick now though

<comment><USER16> Slow is being charitable. It's molasses.

This is what the docs say:

About emulator performance

Because the Android emulator must simulate the ARM instruction set architecture on your computer and the WXGA screen is significantly larger than what the emulator normally handles, emulator performance is much slower than usual.

In particular, initializing the emulator can be slow and can take several minutes, depending on your hardware. When the emulator is booting there is limited user feedback, so please be patient and continue waiting until you see the home screen appear.

We're working hard to resolve the performance issues in the emulator and it will improve in future releases. In the meantime, we wanted to give developers access to new APIs and an basic test environment as early as possible.

Keeping in mind that performance on the emulator does not reflect the speed or performance of apps on actual devices running Android 3.0, developing and testing on the emulator is still an important tool in evaluating your application's appearance and functionality on the new platform.

</comment></comment></comment></comment><comment><USER17> I'm stuck in 90° rotated mode :(</comment>


Canopy Financial Accused Of Serious Financial Fraud, Investors Burned - <AUTHOR> http://www.techcrunch.com/2009/11/24/canopy-financial-accused-of-serious-financial-fraud-investors-burned/ <comment><USER2> Amazing. Can't wait to find out who did what.</comment>