What is Trojan-QT5? How to check home brew history? - security

Just concerned after brew deleted this casks trojan-qt5 when installing angular CLI brew install nginx.
I use OSX and I try to be very careful when download stuff. How can I check further information on it?
How to check how it was installed in the first place?

You can find more information about what this project used to do, and review its code, from its original GitHub page: https://github.com/charlieethan/Trojan-Qt5
Trojan-QT5 was based off of Shadowsocks QT, which seems to be about encrypting traffic. A white paper on that can be viewed here: https://shadowsocks.org/assets/whitepaper.pdf
Shadowsocks was a VPN alternative primarily used in China to get past the firewall.

Related

Why does Chromium for Windows need API keys, while with Linux it works without?

my problem involves Google Chromium. Where on Windows I would download it from the Chromium Project Website and on a debian Linux distro I'd simply type "apt install chromium".
On Windows systems I use, Chromium provides a 404 when I attempt to sign in. However a fresh install of Linux, Chromium signs in without any error. This has been chalked up to API keys according to other Stack posts and Google Forums posts. What is different about Linux coded Chromium, why doesn't Windows Chromium have default keys for signing in?
Thanks for any clarity you can provide and if possible a solution to make Windows Chromium sign in properly without having to create some weird developer account through Google for the keys.
I came here with the same question you have, and later discovered this Python script for injecting the API keys securely under macOS:
https://github.com/ezeeyahoo/ChromiumSyncEnabler
In the readme, the author says that as an alternative to generating your own keys:
You can also use keys used in chromium for linux platform:-
export GOOGLE_API_KEY="AIzaSyCkfPOPZXDKNn8hhgu3JrA62wIgC93d44k"
export GOOGLE_DEFAULT_CLIENT_ID="811574891467.apps.googleusercontent.com"
export GOOGLE_DEFAULT_CLIENT_SECRET="kdloedMFGdGla2P1zacGjAQh"
So, according to this, the Linux version simply comes with these ready-to-use keys.
Though I have no insight as to why this isn't done for Windows and macOS, I hope it's useful information.

How would I host deb packages?

I'm currently working on a github project mainly focused on windows users, written in Java. Install4j allows for easy .deb/.rpm etc. package conversion...
We could just ditribute the .deb on the download side, but when looking at gitlab a while ago, I saw, that Gitlab is using packagecloud.io as a hosting service for their packages (usingtheir own domain), so they can be updated using apt-get.
My question is, if there is a free service working just like packagecloud.io (not launchpad or similar with baazar and that advanced stuff) which can either be hosted on our own server or a public server. Or if there even is a downloadable version of packagecloud.io which we could use on our own server.
You can configure Travis CI to run extra commands when the build succeeds. You can put in some conditions, so that the deploy stage will only be run if commit happens to have a tag name. See the deployment documentation to get going.
A number of providers are officially supported, among which PackageCloud.io.
You might find the dpl utility useful, as it assists with writing and testing deployment settings.
Check out OpenRepo: https://github.com/openkilt/openrepo
I think this is what you're asking for. This is a package hosting server that can make packages available for both Debian (APT) and Red Hat (RPM) files.

What are the way programmers are using to deploy its node.js app in ubuntu?

What is the recommended way to deploy Node.js on Ubuntu 12.04 in a production environment?
I saw this ppa but I don't know if is well maintained or if it will and if is a source in witch one can trust.
I know that is easy install Node.js manually, but seem to me that install it using the Ubuntu packages manager will allow me safe some management time and will be more integrated with the way the underlying server is being currently management. So, what are your recommendations? Thanks in advanced.
we are using Chef with the existing node.js cookbook
Well, after read lot of posts and pages that talk about Node.js deployment-installation, I must said that Chris PPA is mentioned in tons of them as an official source. Beside one can see her PPA linked at the Github Node.js wiki.
So, seem to me that is trust enough to be used in production, what made it the choice if you want keep your system updated using standards Ubuntu tools.

Complete Cygwin packages download

I am fond of Unix/Linux tools,So I install the Cygwin.My problem is each time I need a tool I has to download it separately,besides the download rate is pretty low.
Is there anyone knows a good resource of a complete packages of all the tools ?
Having the complete packages we can just download it once and install it using Cygwin's 'install from local directory' option.
This is an FAQ on the Cygwin site. If the link doesn't work for you, look for "How do I just get everything" in the FAQ. Note, however that it's rather rare to actually install all of Cygwin. I've been using Cygwin for many years, and I'm sure I have far less than half of it installed.
You can check the tools you want in setup, and it will retain your settings.
Initially you will add tools, but as your workflow becomes complete, you will add tools much less frequently. Downloading everything always is a less effective approach.

Keeping an apt-based distro, running as a web server, up to date

I am in the process of configuring a production web server running Debian 5.0. How do you keep an apt-based distro up to date. Is there any best practice or magical ways of doing it? Logging in via ssh and running apt-get upgrade manually seems unrational.
EDIT:
After some discussion in the comments I am now deciding to upgrade the server manually but would like to know how to keep up to date with what packages to apply.
Automatically updating your server could be problematic; the installation could fail, the new package could have slightly different behavior (debian is pretty good at avoiding this), or a condition might have changed which only becomes evident when package installation forces a service restart, etc. So I would advise against unattended package installs.
That being said, you could look into cron-apt, which you can configure to do just that, or to download the packages in advance, and alert you about the available updates so that all you have to do is log in and install them.
Additionally/alternatively, you could subscribe to debian-security-announce, which sends out notices of new security updates.

Resources