I've been getting exe's and such since I've been using the tech for a decade or more, though it does seem to be more common lately. I only wish sonarr would have an option to automatically blacklist and search. But at least now it does have an option to fail the download before even attempting to import it.
Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
Shit like this is why I’m done with public trackers.
This shit is why I never used the arr stack. Never automate incoming data. It fetches what I intend it to fetch.
What do you use instead?
Bittorrent
I was also flabbergasted when I observed this. No idea why this is not default, but you can configure "Fail downloads" = "Executables", "Potentially dangerous" in the Sonarr Indexer options to prevent these downloads. Enable advanced settings first.
Good find, thanks! Kind of annoyed I can't set those values in Prowlarr to automatically propagate to all the *arrs, but still good to have the option once Prowlarr indexers are sync'd to other apps.
I actually saw this last night while I was looking for another setting. Why would I ever want sonarr to download an executable, and why would they think I'd want it that way by default? It made me wonder if I was missing something.
“Why do I need to download 7zip? That’s too hard. Everything should be a self-extracting exe!”
A few moments later…
I think this isnt a thing with prowlarr, is it?
It is, I've seen it. People upload .exe files pretending to be an episode day before it's release. Prowlarr will find those and start downloading.
Also frustrating that sonarr won't allow you to NOT auto search for an episode before it's released. It auto downloads WAY more garbage than early releases in my experience. In fact I'm not sure I've seen it actually download something successfully before it's official release.
But searches online show sonarr devs pushing back against it for some unknown reason.
I believe the v5 sonarr beta has this feature. So it’ll be on the main branch soon enough.
Are people running the arr stack in windows?
I did have mine up and running in windows some years ago before I switched my daily driver, yes.
I use Prowlarr, but had to configure it in Sonarr. I don't see any option for it in Prowlarr
The author getting pissed every step of the way is really funny, great write-up!
I blacklist just about anything executable from downloading in Qbit but it stills feels a little clunky, I wish the ARRs would inspect the torrents and immediately ignore the .exe ones before they even hit Qbit, I feel like it should be a default option to help the Newbies out.
Next Sonarr release will have this.
Settings -> Indexers -> Pick one -> Fail Downloads -> Select "Executables" and "Potentially dangerous"
You still have to remove the malware from your torrent client, but at least sonarr will give up importing it and try a different torrent.
Wait, wtf, this isn't on by default??
Dealing with the executableshas been such a pain in the ass, thank you so much for pointing this out.
I remember spotting this when the Mario Galaxy film came out. The top seed was a 2GB exe.
I hope we come full circle and we get "Avril Lavine - Girlfriend.mp3.exe"
There was a GTA6.exe that appeared on the torrent sites around the time of the first gameplay video leaks, I'm sure it got a few people.
I don't know why you are annoyed by this.
You use an automatic tool. It's bound to fail or make a mistake once in a while.
The "uploader" likely knew this, so they had some fun. It's not like what you are doing is legal or anything. "Le me go complain on my blog about someone messing with how I do my illegal activites".
It's reasonable to be annoyed by this.
I've built automatic tools within client software that handle file types and basic security better than this, < 5 years into my career as an inexperienced dev.
It's crazy that not only is executable downloading not blocked by default for a media downloader, but as fast as I can tell it's not even doing magic bytes based format detection...?
I don't know why you are annoyed by this.
I don't read it as annoyance. It's a rundown of them tracking down who is doing it and what it actually is. They're just flagging for it.
As annoying as this is, I agree. It's a case of automate better or add a confirmation layer to the download decision.
The reason I don't auto-DL anything yet is cos I'm too lazy to spend hours making sure it's setup correctly.
This seems like a one off for them, but for me whenever tracking ongoing TV series I would regularly get malicious files as they appear before the real ones, and get found and downloaded by sonarr.
These days I only automate from private trackers, and enable a public tracker for an interactive search only if something can't be found on the private trackers.
The problem is your roommate, your parent, or 3am you double clicking it in the downloads folder. (do NOT execute execute the skid malware)>
Yeah, like any of those scrubs has access to any folders of any importance.
Cool to see someone pull this kind of malware apart. Interesting read.
I know that qBit has an "excluded file name" option so just add *.exe to it.
.bat, .vbs, .ps1: "it's showtime"
Add .js, .url, .com, and .lnk to that list too.
And .scr
Yeah they had this enabled without knowing it
qBittorrent marked it "finished" two seconds after adding it with total_downloaded: 0, so nothing actually landed on disk. No idea why. Don't care. Thanks qBit.
Think .exe is the default value but you can add more
When this happened to me it always seemed to be episodes that hadn't actually aired yet. I ended up installing swurapp (automatically unmonitors episodes until they've aired, to stop them being grabbed) and haven't had it happen since.
I have been using cleanuparr to automate this. I have exes blocked in the download client and then cleanuparr sees they aren't being downloaded and removes them and triggers another search.
I've been hit by this a few times recently too. No ill effects other than needing to clear it from the queue thankfully.