184
FBI warnings are true—fake file converters do push malware
(www.bleepingcomputer.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 25 Mar 2025
184 points (99.5% liked)
Technology
71356 readers
2653 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
That's why I always prefer an offline converter. Also if your upload a file somewhere the website can save it for their own purpose alhough they say they won't do it.
Precisely, and this is why I've never trusted online "free" converters since day one. Who the fuck knows what they're actually doing with your file, and I always assumed that most of them were fronts to steal data and IP from users who are stupid enough to upload corporate and business stuff to them.
Anyway, there's vanishingly little I haven't been able to do over the years with ffmpeg or Imagemagick, their byzantine command line structures notwithstanding.
Which is why I've been happy to trust them for files nobody cares about, like a random audio file that I got off the Internet. And it's very unlikely they'd be able to exploit my media player.
I tend to just whip up a script of some sort that employs widely used libraries for the conversion. I know that’s more technical than most people would have the tolerance or aptitude for, but for me, it’s the least ambiguous and most secure way to do stuff like that. And then I can squirrel it away in a utility scripts directory and use it later if I need it again.
The website mentions that there are fake offline converters that push malware as well.
Yes this can also happen. I should have written open source offline converter
What you recommend in terms of offline open-source converters?
Pandoc for documents, ffmpeg for video , imagemagick for images
What are you looking to convert?
Usually what i do is look for any converter and look for open source alternatives to it on alternativeto.net and hopefully one of the top 3 alternatives fits your use case
Psst the URL is: https://alternativeto.net/ I always stop here first to research what software options there are available and also learning what other people are using. Extremely useful and trustworthy site!
Thanks i dropped the "to"
Which offline converter? I find myself often trying to convert:
etc. I have no idea how to do that but if I type it into a search engine there's usually tools there.
FFmpeg and handbrake do the latter two quite handily. The latter even has a nice program interface, rather than needing commands.
ImageMagick is capable of the first. I've had it go the other way before, and I should be most surprised if it couldn't convert a PDF to a jpg.
I don't have the knowledge or the time to learn to use these tools.
Then I suppose you're up shit creek.
Thanks for that deep analysis.
Let me tell you a little bit about all those various file converter tools, be it ffmpeg, pandoc, imagemagick, whatever.
The majority of them can be used like this:
magick inputfile.bmp outputfile.jpg.If all you need is this file in that format, that's how you do it. They're ridicluously capable, you can do editing and compositing and such with them and whatever. If you have a use case where you do that a lot, like you just always put a watermark on images or you always desaturate them or whatever, you can write a script, then just run that script.They're basically all like that. Fairly simple to use for basic format translation, shockingly capable if you want to write a script.
magick inputfile.bmp outputfile.jpg.
I don't think it worked.
They're command line tools. If you want to get something done you have to put in a little effort.
Strange, those online tools don't require any "effort".
This is learned helplessness. Especially for someone who took the time to go waste time on Lemmy in stead of Reddit, you could have learned it in the time it took to complain about it taking effort.
Handbrake has a GUI, and it's relatively straightforward to use. VLC also works well. You can also use ffmpeg on the CLI like so:
imagemagick isn't really that hard, in most cases it's:
For example:
If that doesn't work, try
pdftoppm:I don't know of a good GUI for it, I recommend just learning to use either imagemagick or pdftoppm.
I downloaded it and it immediately did not work so I'm gonna have to disagree with you there, champ.
I've lost far too many hours to the CLI. I don't fall for that trick anymore.
You do you, I guess. Those are incredibly simple commands I provided, and you can intuit pretty easily how to tweak them for other formats.
I guess it's up to you. You can gamble with random services online, or you can spend a few minutes and learn to use a tool that's all but guaranteed to not have malware.
This is just a fucking lie and I'm tired of hearing it. What did I just say?
I've tried to learn this shit. It's a fucking rabbit hole. I type these commands, letter for letter, the terminal returns some completely useless error that provides me with no diagnostic information whatsoever, I spend hours searching and trying to understand why and come up empty-handed. I don't have time for that anymore. I already have multiple jobs. It's not how I prefer to spend my free time. And frankly, I don't believe it anymore when software engineers feed me this bullshit.
You know what those web services do? I just click a button and it does what the button says. Why is that so hard?
There's also a pretty big chance that they'll do more than what the button says, like inject malware. That's the whole point of the article.
I understand that but that's beside the point. It does what they advertise. It's incredibly simple and easy to use. Why can no one make something comparable that's FOSS?
They did, it's often a CLI interface because it's incredibly flexible. ffmpeg and imagemagick are quite easy for basic things.
Building a cross-platform GUI is a pain, and hosting a website costs money. Building a cross-platform CLI is incredibly easy, which is why it's so popular.
Some of these tools have GUI frontends or alternatives, some don't. The more niche you go, the harder it'll be to find a reasonable GUI, and I consider PDF to JPEG pretty niche.
No. This does not compute.
You don't have to host a website. Just make software that works like the website and runs locally.
But not niche enough that these websites don't exist.
Making a GUI is more work than making a CLI tool. GUIs are not cross-platform, a pure CLI is more portable. You can code a CLI with any programming language you like, while there are many restrictions on what kind of GUI is available on what programming languages and platforms.
The GUI code is tedious and boring to write. That code can become outdated and broken and might need fixing to run on newer platforms. The CLI has essentially no extra dependencies and the interface hasn't changed much since like the 70s.
The sort of person who develops free software usually knows and likely prefers to use the CLI. They're not doing it for users like you, first and foremost. They're doing it themselves, or because they need it for their job. The CLI tool might be exactly what they want, because the file conversion is part of some backend stuff, something that's run from a script, so you can automatically run it on all the files.
Anybody with basic web dev skills can then take these tools, slap together web fronted and try and make some quick bucks. They're basically incentivized to not care about security, privacy or anything like that. Of course that space attracts scammers.
The incentives just aren't there for it to be any other way. You can either learn the CLI commands, written by people who care about their reputations and professional pride and want to share their tools. Or you can trust anonymous internet randos wanting to make a quick buck. And while I sympathize not wanting to have to learn new shit, I swear using a shell isn't actually more complicated than using a web browser, you're just not used to it.
I can’t comment on the others, but PDF to JPEG should be easy enough. ImageMagick, which another commenter suggested, is possible but not user friendly. However you can just open the PDF in many applications and export it as an image. Adobe Acrobat and Photoshop can do it. GIMP probably too.
I’m a last ditch effort you can even just open the file and screenshot it.
Open/Libreoffice can do that too