Re: hacked package on server

2007-07-30 Thread Steve Holden
Louis Kruger wrote: [...] I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before thinking about it, the package went ahead and

Re: hacked package on server

2007-07-30 Thread Brian Mathis
On 7/30/07, Steve Holden [EMAIL PROTECTED] wrote: Louis Kruger wrote: [...] I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no button. I read it quickly and pressed

RE: hacked package on server

2007-07-27 Thread Dave Korn
On 26 July 2007 21:27, Markus E.L. wrote: 3) Calm down, breath deeply, and try not to be so hysterical. Good advice, Dave. Did you try it once? - M Snappy reply dude, you've obviously been working hard on that one. No wonder it took you a fortnight to come up with it. Now would you

Re: hacked package on server

2007-07-26 Thread Markus E . L .
3) Calm down, breath deeply, and try not to be so hysterical. Good advice, Dave. Did you try it once? - M -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ:

hacked package on server

2007-07-16 Thread Louis Kruger
I performed a cygwin update today, and was confronted with an MD5 failure on one of the packages. The package was vim-7.1-1.tar.bz2 downloaded from mirrors.dotsrc.org As the package installed, I saw some strange behavior, I'm worried it might have been some kind of trojan. I saved the

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before thinking

Re: hacked package on server

2007-07-16 Thread Brian Kelly
@cygwin.com Subject: Re: hacked package on server On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no button. I read

Re: hacked package on server

2007-07-16 Thread Louis Kruger
On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before

Re: hacked package on server

2007-07-16 Thread Thorsten Kampe
* Louis Kruger (Mon, 16 Jul 2007 11:17:43 -0500) On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no

Re: hacked package on server

2007-07-16 Thread William Sutton
I remember an extensive discussion about the purpose MD5 sums serve for the cygwin installer[1] some time ago. My understanding (synopsis) of the thread (before I gave up reading it in disgust somewhere around Christopher Faylor's suggestion that the subject be dropped :} ) was that md5sum is

Re: hacked package on server

2007-07-16 Thread Louis Kruger
I do think that instead of simply aborting the install with a message that the server was compromised (was it? or is something else going on?), that a more useful option would be to allow the user to select a different mirror and continue the process. Sure. I just wanted to make the

RE: hacked package on server

2007-07-16 Thread Dave Korn
DANGER: Extreme sarcasm ahead. May also be withering. No warranty, no refunds. On 16 July 2007 16:31, Chicken Licken ^W^W Louis Kruger wrote: As the package installed, I saw some strange behavior, I'm worried it might have been some kind of trojan. Are you able to actually describe

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 11:59:12AM -0400, Brian Kelly wrote: This would be more helpful: Do you want to not skip the package (No/Yes/Maybe)? The Maybe can then consult a random number routine to decide whether or not to do the operation. Good point. I obviously stick at this UI stuff. cgf

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Mon, Jul 16, 2007 at 02:38:17PM -0400, Christopher Faylor wrote: On Mon, Jul 16, 2007 at 11:59:12AM -0400, Brian Kelly wrote: This would be more helpful: Do you want to not skip the package (No/Yes/Maybe)? The Maybe can then consult a random number routine to decide whether or not to do the

Re: hacked package on server

2007-07-16 Thread Igor Peshansky
Ugh, top-posting... Reformatted. On Mon, 16 Jul 2007, Brian Kelly wrote: -Original Message- From: Christopher Faylor [EMAIL PROTECTED] Sent: Jul 16, 2007 11:52 AM To: [EMAIL PROTECTED] http://cygwin.com/acronyms/#PCYMTNQREAIYR. Thanks. Subject: Re: hacked package on server

Re: hacked package on server

2007-07-16 Thread Igor Peshansky
On Mon, 16 Jul 2007, Louis Kruger wrote: As the package installed, I saw some strange behavior, I'm worried it might have been some kind of trojan. Are you able to actually describe strange behaviour It crashed the setup program, which seemed to indicate it was installing strangely

Re: hacked package on server

2007-07-16 Thread Brian Mathis
. Thanks. Subject: Re: hacked package on server On Mon, Jul 16, 2007 at 10:30:52AM -0500, Louis Kruger wrote: I also have a complaint: the dialog that notifies the user of the failed MD5 is not well designed. The dialog asks Do you want to skip the package? and has a yes and no button

RE: hacked package on server

2007-07-16 Thread Bengt-Arne Fjellner
Christopher Faylor wrote: On Mon, Jul 16, 2007 at 03:44:51PM -0400, Brian Mathis wrote: Yes, everyone now has been quite hilarious on this part of the matter, but I think it's time to get past the arrogance and, god forbid, consider that a user's reported problem, oh my god, might actually be

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Tue, Jul 17, 2007 at 12:47:50AM +0200, Bengt-Arne Fjellner wrote: Or something like that. Then its two clicks or several keystrokes before one can continue. If you want to help, then dig up multiple googled cases of previous confusion. Then we can quibble about wording. cgf -- Unsubscribe

Re: hacked package on server

2007-07-16 Thread Pedro Alves
Bengt-Arne Fjellner wrote: Well in my opinion It could even be better to have an unchecked checkbox like: Wrong MD5 sum detected. This package look broken. Try another mirror. ( ) Yes I Really want to install this even if it looks broken. OK Or something like that. Then its two clicks or

Re: hacked package on server

2007-07-16 Thread Christopher Faylor
On Tue, Jul 17, 2007 at 12:20:19AM +0100, Pedro Alves wrote: The second best, and quickest, would be for a patch to show up implementing Thorsten's suggestion that cfg pointed out. Until someone steps up to do the work, this discussion is just going to fade out and die. Urp. How could I have

Re: hacked package on server

2007-07-16 Thread Igor Peshansky
On Tue, 17 Jul 2007, Pedro Alves wrote: Bengt-Arne Fjellner wrote: Well in my opinion It could even be better to have an unchecked checkbox like: Wrong MD5 sum detected. This package look broken. Try another mirror. ( ) Yes I Really want to install this even if it looks broken.

RE: hacked package on server

2007-07-16 Thread Gary R. Van Sickle
From: Brian Mathis [snip] Yes, everyone now has been quite hilarious on this part of the matter, but I think it's time to get past the arrogance and, god forbid, consider that a user's reported problem, oh my god, might actually be a problem! snort! Heheheh! He thinks he's on

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Brian Mathis wrote: In this case, a user running an installer is in the frame of mind of *installing* things, not *skipping* things. Perhaps this is in your case, certainly not everyone in this mailing list. So when they are asked a question, they should be asked questions about

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Louis Kruger wrote: As the package installed, I saw some strange behavior, I'm worried it might have been some kind of trojan. Are you able to actually describe strange behaviour It crashed the setup program, which seemed to indicate it was installing strangely named files. It also

Re: hacked package on server

2007-07-16 Thread Erich Dollansky
Hi, Carlo Florendo wrote: Brian Mathis wrote: The OP said: Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before thinking about it ^^ So you see, it's a problem of thought. The UI message *is*

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Erich Dollansky wrote: Hi, Carlo Florendo wrote: Brian Mathis wrote: The OP said: Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before thinking about it ^^ So you see, it's a problem of

Re: hacked package on server

2007-07-16 Thread Pedro Alves
Erich Dollansky wrote: Carlo Florendo wrote: Brian Mathis wrote: The OP said: Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before thinking about it ^^ So you see, it's a problem of thought.

Re: hacked package on server

2007-07-16 Thread Carlo Florendo
Pedro Alves wrote: Perhaps the screen should flash, and a loud beep should sound every time a MessageBox not related to install to package wants to show up. Then wait 3 seconds, show a warning, going out of install mode MessageBox, sleep a bit more, and only then show the skip message box.

Re: hacked package on server

2007-07-16 Thread Erich Dollansky
Hi, Pedro Alves wrote: Erich Dollansky wrote: Carlo Florendo wrote: Brian Mathis wrote: The OP said: Do you want to skip the package? and has a yes and no button. I read it quickly and pressed no before thinking about it ^^ So you see,

Re: hacked package on server

2007-07-16 Thread Matthew Woehlke
Pedro Alves wrote: The switch from: do you want to format your drive?: +-+ +-+ + yes + + no + +-+ +-+ to: do you want to format your drive?: ++ +-+ + format + + cancel + ++ +-+ ... Makes it much easier to understand what the

Re: hacked package on server

2007-07-16 Thread Pedro Alves
Carlo Florendo wrote: The switch from: do you want to format your drive?: +-+ +-+ + yes + + no + +-+ +-+ to: do you want to format your drive?: ++ +-+ + format + + cancel + ++ +-+ ... Makes it much easier to understand what the