Comment

Comment on Someone purchased the old domain of a FOSS app, then it's using it to deceive users to download adware

It seems it’s not so much they stole the domain, it’s that they are using the same name with a different top-level domain. This is a common shady practice in malware. Most people can’t afford to purchase every TLD or their domain and so just pick one or two. Problem is that search engines will find the bad TLDs and suggest them over the real TLD if the malware providers do proper SEO manipulation. A FOSS author is unlikely to be able to or afford the time and effort it takes to manipulate search results and most popular search engines are not doing much to fix the problem, and instead relying on “AI” to reduce the costs of maintaining their search results, which does a pretty bad job, IMHO.

source

Sort:hotnew top

Moonrise2473@feddit.it ⁨1⁩ ⁨month⁩ ago
originally it was hosted in the .org domain, then somehow it changed hands and it was changed to .io

source
- irotsoma@lemmy.world ⁨1⁩ ⁨month⁩ ago
  Ah, thanks for clarifying. I didn’t see that mentioned anywhere and the git repo is showing .io
  
  source
trolololol@lemmy.world ⁨1⁩ ⁨month⁩ ago
Would fdroid be safe from this kind of practice? Of course there’s no web domains involved but the exploit there is potentially the same

source
- ammonium@lemmy.world ⁨1⁩ ⁨month⁩ ago
  Yes, Android apps are signed and Android refuses updates with a different signature.
  
  source
  - trolololol@lemmy.world ⁨1⁩ ⁨month⁩ ago
    What I mean is fake apps with slightly different names, does fdroid have the potential to approve them? Even if it’s open source, if someone intentionally adds malicious code it can take a couple months to spot, while the scan is going on.
    
    source