Free Windows Desktop Software Security List - discussion thread

[MrBrian]

Section "All Items" has been added to the home page. It contains a link allowing you to view the entire list on a single page.

[MrBrian]

I've done some reorganization of Firewalls page. The sections "Third-party firewalls with alert-based non-network behavior containment/detection" and "Third-party firewalls without alert-based non-network behavior containment/detection" are new, so I'd appreciate any feedback on wrongly filed items.

[MrBrian]

New keys have been introduced. For an example of their use, see item ThreatFire at http://www.techsupportalert.com/cont...-list-hips.htm.

I don't plan on checking each item for applicability of new key "Discontinued or inactive" in the near future, so please let us know of any items that you believe this key applied to.

[MrBrian]

Work is underway on reviewing and revising every page at mostly section-level granularity. When that is finished (which is expected to be 4-12 weeks from now), the list will be reorganized at the section-level.

[MrBrian]

Does anyone have any non-obvious tips on discovering how old a downloaded file is? One is to look at "First submission" date at VirusTotal.

[Remah]

Originally Posted by MrBrian

Does anyone have any non-obvious tips on discovering how old a downloaded file is? One is to look at "First submission" date at VirusTotal.

You will have to tell us what you think is obvious because it is not obvious to me.

Do you mean the date created or the date modified? They are often very different and can be handled differently by some programs.

Whichever you mean, there are differences in how web sites and web browsers handle those dates. The most common difference has traditionally been that some browsers, e.g. Internet Explorer, maintain the dates from the downloaded file on the website whereas others, e.g. Firefox, have traditionally supplied the current date for both values. I use Firefox and it is annoying so I often use download managers that provide the dates from the downloaded file.

Is that one of the obvious tips?

[Remah]

Originally Posted by MrBrian

Does anyone have any non-obvious tips on discovering how old a downloaded file is? One is to look at "First submission" date at VirusTotal.

Are you wanting tips that can apply to all files rather than those that apply to some like those that are digitally signed which then have a timestamp?

[MrBrian]

@Remah: The reason I asked is because of the new key "Discontinued or not updated recently (for at least three years)." As for whether I meant use of creation date or last modified date, I guess it would be the newer of the two.

As I a longtime Firefox user, I hadn't realized or remembered that some browsers handle that issue differently, so that is a great tip, thanks! Maybe I'll look for a Firefox extension to change that behavior.

I'm looking for tips that would apply to those file formats that are typically used for Windows programs, so digital signature date is relevant to me.

Here are some other tips (obvious or not obvious):
1. Look at date text supplied on developer's website (if present).
2. Google search of program name.
3. Use website archive to download file from years past, for comparison purposes (if available)
4. If in an archive, look at newest file dates within the archive.

[MrBrian]

Some info that I found regarding Firefox and last modified date:
1. Bug 178506 - save original last-modified date on file downloads; summary: this issue was fixed for awhile, but the fix caused other issues, so the fix was removed, and won't be fixed in the future
2. Preserve Download Modification Timestamp (doesn't work on newer Firefox versions)
3. Extension DownThemAll has setting "Set files time to last modified time (server) or time of queuing."

[Remah]

Originally Posted by MrBrian

Here are some other tips (obvious or not obvious):
1. Look at date text supplied on developer's website (if present).
2. Google search of program name.
3. Use website archive to download file from years past, for comparison purposes (if available)
4. If in an archive, look at newest file dates within the archive.

I had a look at those options because I was intrigued by the fact that the VirusTotal option works so well in one step because it ignored the file metadata. It confirms that the file contents are unchanged by using the SHA checksum. That also means that any user changes, like renaming the file, don't confuse the situation.

Most of the other options require us to work the other way around. You find the file name or file date but to be certain you have the same file then a second step involves some way to confirm that the file contents are in fact the same.

I had a try at 3. archive.org but I could only search the snapshot metadata and not the webpage contents so I had to know where to look for the file. Then I found that many downloads weren't uploaded, e.g. sourceforge.net use their robot.txt to exclude themselves from archiving.

The good thing about it all is that all these checks could be automated by a program so the checking of the list could also be by setting rules.