Re: [Update] Text Grab 4.14.1

On 10/06/2026 15:01, Shadow wrote:
> On Wed, 10 Jun 2026 12:31:00 +0000, "p-0 0-h the cat (coder)
> <[email protected]>" wrote:
> 
>> I had a thought about your JavaScript issue. I can’t bear to think of
>> you sitting there in fear, unable to download the few files left not
>> signed by Satan
> 
> 	Yes, about that. Satan declared he no longer signs anything
> for XP.... its users are not likely to follow him. Never invest when
> people are not interested in your product.
> 
> 	But he does still sign a lot of stuff:

I'm beginning to think you have a degree in BS and clickbait

> <https://www.techspot.com/news/102113-more-than-100000-github-repositories-discovered-spreading-malicious.html>


Let me tell you how this really worked because reading is one thing, 
understanding is another.

"Several" malicious packages were uploaded to PyPl not to GitHub

A script was used to fork a number of projects on GitHub

Those forks were named something similar to the original project

A file or 2 on the forked project were changed, one line I'm told

Crucially, and this links in with signing, if the original release was 
signed by the original developer the verified status is broken on the 
fork when the changes were made.

The dodgy release gets released but unless the new 'developer' signs it 
with another key it's not verified and even then not verified and signed 
by the original developer.


So, GitHub was guilty of allowing forks to be made a bit too easily from 
the sound of it but the PyPl, Oh boy.

Of course you didn't understand any of this otherwise you wouldn't have 
posted it.

The bottom line is at no point did this affect the original project.

If people had been a bit more careful and gone to the original project 
all would have been good, and on the original project most likely the 
release would be verified a.k.a signed.

You however probably have no idea how to check if the release is 
verified because I would guess that because you live in the dark ages 
and run a ham stringed browser you won't see any of the little buttons, 
ticks and popups I am about to describe for the elucidation of the great 
unwashed here at the arsehole of the Internet.

1) Go to project using non nobbled browser
2) Click Releases on right hand side
3) Developers avatar on left 2 rows down there's a string like e45rf4 or 
whatever and next to that if verified there's a green circle with a 
green tick in it. Click on that and tada! Magic

Now, say thank you Pooh, I'm a fricken dinosaur and your idea about 
running a fully working up to date browser in a VM was a stroke of genius.

I'm not going to research anymore BS btw, so have at it.

See ya!


> 	An OP( SpamBlk) suggested I download from several sources, and
> compare to github's offering. I already do that. The checksums usually
> match, but not always...
> 	Possibly because the offerings made "on demand" have different
> internal dates, hence different checksums.
> 	[]'s
> 
> 	PS It's Devuan, not Mint. Mint is Ubuntu(arrrggghh)
> --
> Don't be evil - Google 2004
> We have a new policy  - Google 2012
> Google Fuchsia - 2021

Cat's lives matter!

p-0.0-h the cat, the number one influencer on the Usenet Social!
Live everyday like you're a really cool cat!
Sent from my iFurryUnderbelly.

-- 
p-0.0-h the cat
Internet Terrorist, Mass sock puppeteer, Agent provocateur, Gutter rat,
Devil incarnate, Linux user#666, BaStarD hacker, Resident evil,
Monkey Boy, Certifiable criminal, Spineless cowardly scum,
textbook Psychopath, the SCOURGE, l33t p00h d3 tr0ll, p00h == lam3r,
p00h == tr0ll, troll infâme, the OVERCAT [The BEARPAIR are dead, and
we are its murderers], lowlife troll, shyster [pending approval by
STATE_TERROR], cripple, sociopath, kook, smug prick, smartarse,
arsehole, moron, idiot, imbecile, snittish scumbag, liar, total *******
retard, shill, pooh-seur, Pooh Dendum, scouringerer, jumped up chav,
punk ass dole whore troll, no nothing innumerate religious
maniac, lycanthropic schizotypal lesbian, professional bully and
stalker, the most complete ignoid, joker, and furball.

NewsGroups Numbrer One Terrorist

Honorary SHYSTER and FRAUD awarded for services to Haberdashery.
By Appointment to God Frank-Lin.

Signature integrity check
md5 Checksum: be0b2a8c486d83ce7db9a459b26c4896

I mark any messages from trolls »Q« and 'Arlene' Holder as stinky