7

I am sort of reviving this, but sort of not as well.

@BrunoPereira was aware of this, as I poked him about it. I did not flag it as I was being overly cautious, i just wanted moderator input at the time.

But now that I think about it, these "anonymous hosting" sites (including Rapidshare among others) pose somewhat of a security risk, as these "download links" can contain almost anything.

PPAs and official torrents are one thing, anonymous download links are another.

I think we should not allow them, but I'm biased towards listening to the IT Security aspect of using random links that dont provide details and are from "non official" sources (like stuff on mediafire).

Thoughts on this? Moderator input is welcome too :)

12
  • Discussion on Superuser about the same thing: meta.superuser.com/questions/4716/… May 29, 2012 at 20:28
  • 3
    Sounds the same except here (correct me if wrong please) we are mostly talking about anonymous file sharing sites, not (for ie:) github and similar. May 29, 2012 at 20:35
  • @Bruno indeed, but even moreso is the anonymity factor of certain sites. Launchpad, github, sourceforge, etc. all require an identifier for you to use to host any data. Mediafire and rapidshare (free accounts on rapidshare used for spam uploads and stuff), though, don't necessarily need those identifiers.
    – Thomas Ward Mod
    May 30, 2012 at 12:39
  • Well, I think it is only fair to assume people should be taking caution when opening / downloading / or installing anything provided from an unknown or untrusted source. We cannot babysit these users any more than posting something in the FAQ. I don't think we should block these any more than we should block bitly (obfuscated) links.
    – rlemon
    May 30, 2012 at 15:39
  • If the source is bad, flag the answer for moderator attention... a few bad apples might sneak through but that will happen anyway.
    – rlemon
    May 30, 2012 at 15:40
  • Unlike "anonymously" hosted sites, where you know what website you are going to, with a shortened link (to bit.ly, tinyurl.com, or a similar site), you don't know what website you're going to. Files offered for download can be downloaded and examined. Examining them is low-risk. In contrast, a bit.ly link can redirect to a web page that itself exploits a security vulnerability in the user's web browser. Even if we allow links to "anonymous" download sites (and you all know I think we should ;-)), I still don't think that means we should allow URL's obfuscated by shortening. Jun 5, 2012 at 0:32
  • To illustrate the difference, in case it's not clear: Yes, any link could be to a web page that tries to exploit a security vulnerability in your browser. But with a link obfuscated by shortening, you don't even have the URL of the page, to use to judge whether or not it's safe to go there. You don't even have a domain name to look up. Furthermore, while every once in a very long while there is a security vulnerability discovered making it possible for non-executable files (e.g., archives, graphical images) to run code, bugs letting websites run code with elevated abilities are very common. Jun 5, 2012 at 0:36
  • 1
    I think there is little difference in this case because the link was for example something like (www.mediafire.com/random8numbers13andletters) If we use a set of common download tools, where users know what the primary link is going to do (aka take them to a link without alot of adds and Click Yes and Download Here) To a certain extent I know what type of content will come from pastebin ( yes I will still be careful and check the content), for custom programs we have ppa's, we can see if the user is active as a developer. The sites should not be used, there are better places for the content.
    – Mateo
    Jun 5, 2012 at 13:08
  • ... and mediafire doesn't just "automatcally" put up random adds? I will still avoid clicking on the link.
    – Mateo
    Jun 5, 2012 at 17:32
  • 2
    While I understand both of your points of view, it seems this is turning into a sort of an argument. Please note that for each comment you make I get a notification. Also, arguing is counter-intuitive here :P
    – Thomas Ward Mod
    Jun 5, 2012 at 17:34
  • 2
    Maybe StackExchange in general needs a small file-hosting system for users with enough(like 100) rep.
    – nanofarad
    Jun 5, 2012 at 20:46
  • That would be insane storage requirements, I doubt that'll happen. Might pose that at Meta SO though
    – Thomas Ward Mod
    Jun 5, 2012 at 21:39

3 Answers 3

6

I actually opened the file with the extreme secure method of clicking on the link and checking it out.

Normally I would kill anything that moves and has random links that have nothing to do about anything the site but from the 2 secs it took to read the file I saw that the user that posted it was simply confused about what was asked and the kind of solution he proposed.

In simple words, the post is harmless (imho, correct me if wrong).

I say no, no links in anonymous file sharing sites should be considered a good thing:

  • If they are files for your system, you need to be crazy to actually download them and use them from a file sharing site like that;
  • If its documentation (not extensive pages ofc) it belongs in our site as an answer instead of a lost PDF file in the internet.

There is almost no reason to use file sharing sites like those to share anything useful in AU, they can be flagged and discussed with a moderator, or if you don't have the patience or time you can simply flag and forget about it. Your flag will return useful (because it is useful in these cases) and a moderator will take care of it.

19
  • 1
    Define "anonymous" please - does that include launchpad, github, sourceforge etc?
    – jrg
    May 29, 2012 at 20:38
  • 1
    No, I think we are referring to sites where there is no need to have an account associated like rapidshare, mediafire or similar ones. May 29, 2012 at 20:42
  • Does DropBox count? May 30, 2012 at 2:29
  • 2
    When I mean anonymous i mean sites with no account or identifier connected to them, such as filedump.net, mediafire, rapidshare (although it needs free accounts for uploading), and a few others. Any site that has a reliable identification method (github, sourceforge, launchpad, upstream developer sites, etc) should not be considered "Anonymous"
    – Thomas Ward Mod
    May 30, 2012 at 12:38
  • @LordofTime Because bad guys can't make an account, and claim some identity? May 30, 2012 at 15:24
  • 1
    @EliahKagan you dont seem to be getting the point of the "scope" or the reason for bringing this up. If you wish to discuss this further about my scope of this question, I created discussion room and sent you an invite. If you don't want to discuss, then do me a favor and post your opinion as an answer to here.
    – Thomas Ward Mod
    May 30, 2012 at 15:33
  • 1
    @EliahKagan sorry, i didnt see it was your answer. Assume the scope of my post here is to refer specifically to the use of mediafire links that are just thrown into posts such as the one linked earlier in this question. Such "random links" in the universe of users are assumed to be valid. In the ITSec community, its the biggest vulnerability hole in corporate systems. Similarly, its the leading cause of residential vulnerabilities in 95.86% of the clients i've worked with. ...
    – Thomas Ward Mod
    May 30, 2012 at 15:49
  • 1
    @EliahKagan While I agree the scope of "Anomymous Hosting" can be extremely vague, I am attempting to argue against the use of random links without greater explanation and verification of those files, as well as potentially not allowing mediafire specifically, given that they have ZERO requirement for identifiers, and almost no restriction of what can/can't be uploaded (I've seen ITSec baddies uploaded there, so...) ...
    – Thomas Ward Mod
    May 30, 2012 at 15:50
  • 1
    @Eliahkagan And while current policies suggest that any download link being used be explained so people assume what it is, the case I am trying to make is that unless such links as the one referenced earlier are vetted, or explained in far greater detail than "This download has [something] to do what you need. [link]", those posts should be removed, or at least the links be removed.
    – Thomas Ward Mod
    May 30, 2012 at 15:51
  • @LordofTime "One-click" download sites are very useful for hosting files to a lot of people without worrying about download quotas. These sites are valuable to bad guys for the same reason that they are valuable to good guys. The "anonymity" of the sites has nothing to do with it. If you find that blocking them decreases exploits, it's probably because you are blocking some percentage of all downloads. (Decreased activity means less of everything including exploits.) I agree that download links that don't explain precisely what they're for should be removed, but that's for any download at all! May 31, 2012 at 22:38
  • 1
    @mateo_salta Requiring that someone fill in a "name" field and an "email address" field and check a checkbox labeled "I agree" doesn't make a service harder to abuse. I certainly hope we don't consider a website more reputable based on this, either. (And what does the reputability of a "middleman" file hosting site have to do with safety? The most reputable sites that host arbitrary user-posted files still disclaim all responsibility for what those files are and what they do.) In any case, the red car comparison was intended to illustrate a statistical fallacy, not to be an exact analogy. Jun 5, 2012 at 0:22
  • 1
    @mateo_salta You've apparently misunderstood my position. I don't "believe in" sites like mediafire; I don't think they're particularly good for AskUbuntu. Rather, I think links to them are no worse than any other download links whose safety are not easily verified, like links to DropBox. So far, I've avoided having to post any hard-to-verify download links on AskUbuntu. If/when the day comes when I do post such a link, I'll use a site like mediafire or a site like dropbox or some other site based on what works best in that situation. I won't do it to make a point. Jun 5, 2012 at 16:18
  • One example of when posting such a link might be the best available option is if I had a virtual machine/appliance that performed some task well that was nontrivial to do otherwise (for example, a 10.04 LTS based GUI-less VM for running a single important KDE3 app and making it accessible to the host via ssh -X). In that situation, I would choose a download site based on which seemed like the best solution. I would consider how many people would likely download, bandwidth limits, and how long the file would remain available. Jun 5, 2012 at 16:22
  • Exactly, Normal users don't find it helpful to use downloads from the sites, and for experienced users there are simply much better alternatives. Not to mention that the links expire quickly.
    – Mateo
    Jun 5, 2012 at 16:24
  • Another example where it might be the best available option is when a project, lacking resources, uses such a site to make content available. Ideally (as for any download link external to a project's site) the link would be accompanied in my AU post by a link to the project's page. However, if the project page was down (temporarily or permanently), I wouldn't hesitate to post the download link if I had it. You seem to have said that we should, officially or unofficially, insist on using download sites that make people feel safer whether or not they actually are safer. Am I misunderstanding? Jun 5, 2012 at 16:26
5

It does raise some concern for me, but I definitely don't think PPA and github should be forbidden. There's also pastebin for source/file/document type of posts.

  • is the user generally established on the site?
  • does the user intentionally link several accounts together?
  • does the user have a substantial amount of data on github or PPA?

Here's an example where I link to one of my PPAs.

I don't think there's a lot of concern on that one because I took the old package from universe and bumped the distribution to precise. It's pretty clear from the change-log and patches.

I didn't, however, link to some compiled binary for which you couldn't get the deb-src.

Another example where I linked to a PPA or github.

I made it for an earlier question, and it's just a simple python script and some packaging.

I think disallowing mediafire or rapidshare is completely a good idea.

I think users should just discriminate a little about the anticipated content and how much a given user has done to try and help out before making a determination on what to install/run and what not to install/run.

After all, what's the point of PPAs if you can't share them.

2
  • Couldn't have explained my idea/proposal any better than this
    – Thomas Ward Mod
    Jun 2, 2012 at 14:59
  • Awesome, This is great because the link comes up as "launchpad.net/~aking1012-com/+archive/aircrack-precise" we know its from you right from the start, and that it is going to launchpad where we can get more information about the package.
    – Mateo
    Jun 5, 2012 at 13:53
2

I think we should allow these links, because I don't think links to file-sharing sites that don't require account creation actually pose a risk greater than other kinds of download links.

There is no reason to think that links to sites that require creating an account (like Dropbox) are safer. There's nothing stopping a bad guy from creating a free account. This applies not just to Dropbox-style sites, but also to SourceForge, GitHub, Launchpad, and the like. Anyone can make a Launchpad account with a fake identity, sign the code of conduct under false pretenses, and roll out a PPA to infect users with malware. The PPA could even be named similarly to an existing PPA, to fool users. (To the best of my knowledge, we haven't seen this yet, but that's only because Ubuntu still occupies a pretty small market share--there probably aren't enough users yet--that is, potential victims--to make it worth the time, effort, and risk.)

Such a miscreant could even create and use a paid account on an online service. Rather than going into deeply instructional detail about different ways to do this, I'll just point out the simplest: A criminal can con someone into trusting them, give this initial victim (real) money, and get the victim to create the account in the victim's name, for the criminal to use.

If practically speaking there are specific websites that are shown to be used on AskUbuntu, other Ubuntu support resources, or other StackExchange sites to fool people into downloading dangerous files, then that would probably warrant an automatic warning message cautioning users, and maybe warrant a policy of forbidding links to those sites. But fundamentally, anonymous file sharing sites are only needed by those of us who aren't criminals taking over people's computers. If you can take over people's computers, you can run your own download servers. You can even register (free or not) DNS for them. And you can always enjoy anonymity online with a fake identity.

With that said, providing any kind of direct download link for software (except apt: links for installing packages from the official repositories) should be strongly discouraged except in the rare cases where it is demonstrably necessary, and in those cases, users should always be cautioned about the risks.

I think we should start continue disclosing the potential risks of PPA's, too (in every post that suggests installing from a PPA, or automatically for posts containing PPA syntax). [EDIT: Jorge Castro has reminded me that we're essentially already supposed to be doing this.] This would not be to keep people from using them. Rather, assuming Ubuntu continues growing in user base, eventually PPA's and other non-official software sources are going to start being exploited to fool users into installing malware. It would be good for Ubuntu users to be prepared for this, before it starts happening.

In conclusion, making a distinction between safe and unsafe downloads is only a good thing if the safe downloads are substantially safer than the unsafe ones. What it means for a site to allow anonymity is that it lets rule-abiding users go without disclosing their identity, because rule-breaking users can and will always be willing to break the rules and create a fake identity that looks real. Singling out and prohibiting linking to download sites allowing anonymity would only give us false comfort, and make us all the less prepared to deal with threats effectively.

5
  • 2
    We're supposed to be linking this question when we mention PPAs already: askubuntu.com/questions/35629/… May 30, 2012 at 2:50
  • 1
    I think at the least we should have moderators remove the link(s) until its been checked out, its a known tactic for someone to say "Use this to fix your system: [random download link]" and the general public assumes they know what you're talking about unless moderators or "god users" intervene.
    – Thomas Ward Mod
    May 30, 2012 at 12:40
  • @EliahKagan read the comments I posted to another answer here.
    – Thomas Ward Mod
    May 30, 2012 at 15:27
  • 1
    I agree with the top statement... past that ... tl;dr ... in a nutshell: do not block these links.. the flag/moderation system works well for people posting malicious content. If a user is randomly clicking links and installing content... well then, you cannot stop them from doing so. Blocking their ignorance here will not save them anywhere else.
    – rlemon
    May 30, 2012 at 15:45
  • rlemon at his best. Could not agree more. Flags and users + mods are here and we all work to try to keep the site safe, we can't protect everyone all the time. If in doubt, flag it and move on. Jun 1, 2012 at 6:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .