this post was submitted on 26 Aug 2024
204 points (99.5% liked)

Open Source

31717 readers
86 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
 

Greetings everyone. It is with much regret that I am writing this post. A plugin, ss-otr, was added to the third party plugins list on July 6th. On August 16th we received a report from 0xFFFC0000 that the plugin contained a key logger and shared screen shots with unwanted parties.

We quietly pulled the plugin from the list immediately and started investigating. On August 22nd Johnny Xmas was able to confirm that a keylogger was present.

you are viewing a single comment's thread
view the rest of the comments
[–] Churbleyimyam@lemm.ee 19 points 3 months ago* (last edited 3 months ago) (1 children)

Was the plugin open source?

Edit: looks like it wasn't and the incident has prompted more more transparency. Good stuff.

[–] sugartits@lemmy.world 6 points 3 months ago (1 children)

Unless the pidgin team are compiling the binaries themselves, this doesn't really fix much.

Ideally we need reproducible builds.

[–] delirious_owl@discuss.online 1 points 3 months ago

Its really not hard for them to compile themselves. This is what most package managers do