BlockTheSpot compromised or false positive? (github.com)

submitted 2 days ago by DoctorButts@kbin.melroy.org to c/piracy@lemmy.dbzer0.com

16 comments fedilink hide all child comments

Seems strange that the dev seems to be keeping quiet on this, no? I'm not telling you to read every comment of every post, you can just skim the post titles. Then you'll see multiple open issues and a few closed issues too going back 5 days to the latest BtS update.

Though I haven't followed this project long enough to tell if this is just the way they normally behave.

Edit:

I'm back at my computer, so it's easier to edit and add info now.

Some key points that have stuck out to me:

Previous version released in July only triggers 2 detections on Windows defender versus 29 for the most recent version: https://i.imgur.com/GIoH7eG.png
Users getting constantly pestered to update to the latest version: https://i.imgur.com/Oege3kU.png
Yeah, naturally, the dev is going to say it's a false positive. Obviously. I've only mentioned that the dev has previously responded because some people barely skimmed through the issues and thought the dev simply hadn't seen the latest open issue from only a few hours ago, when that is not the case.

you are viewing a single comment's thread
view the rest of the comments

[-] lol@discuss.tchncs.de 15 points 2 days ago* (last edited 2 days ago)

Seems strange that the dev seems to be keeping quiet on this, no?

No, it doesn't seem strange. It's only been a few hours since the issue (I assume you're referring to) was opened. The developer could be in a different time zone or on a vacation and not respond for a few weeks. People are not entitled to a (quick) response.

Though I haven’t followed this project long enough to tell if this is just the way they normally behave.

Looks completely normal to me. The tool works by pretending to be some DLL loaded by Spotify, providing the same functionality as the original library, but also modifying Spotify's behavior to block ads. It's easy to see why anti virus software would flag a modified DLL, injecting unknown code as suspicious, especially if the same DLL might have previously been used by some malware to inject malicious code.