[TC 11.58rc3] Leaking encrypted names via logfile

[white]

Sorry but these complaints make no sense at all. It's very eye catching, so if it shows for the whole 3 seconds, there is no way to miss it. And it's repeated over and over again for each header-encrypted file.

I wasn't complaining. I shared arguments showing that there is a security flaw.

I never suggested the user wouldn't notice that there is something being displayed on screen. I argued that 3 seconds is insufficient time to comprehend the message. You didn't address the points I made about this.

If you do feel you addressed the comprehension time, please clarify what you mean. Are you calling me a liar when I say that it takes me longer than 3 seconds? Or are you saying that you know me better than I know myself, and that according to you 3 seconds is more than enough time for me to process the message if I don't already know what it says? BTW, I tested myself before writing about my processing time.

I find your last argument, "And it's repeated over and over again for each header-encrypted file", particularly remarkable. When it concerns writing encrypted names to the log file in plaintext, Total Commander is circumventing the protection via password and encryption and shows a warning instead. You previously repeatedly expressed that the user has to be warned. But now you seem to suggest that it is enough if the user eventually finds out that his data was leaked via the log file. Additionally, it is not certain that a second warning and consequent warnings will ever occur, or that they will occur within a short time period.

[ghisler(Author)]

Sorry but you are way too paranoid. If a user doesn't get it in 3 seconds, he will not get it in a 1000 years. Really, I don't know why I spend so much time on this bullshit. If an attacker has physical access to your device, they can do anything, install a keylogger, replace Total Commander with something else, etc. etc. etc.

[JOUBE]

Really, I don't know why I spend so much time on this bullshit.

That's it.

And it wouldn't bother me at all if a user decided now to stop using TC and end his activity on the forum,because I am interested in further development, not stagnation. 2ghisler(author) There are so many new, small and important proposals (suggestions); please get to work on them now.

[ghisler(Author)]

I will get to work when this beta test ends, but some people have a talent to make me drag the beta test forever.

[JOUBE]

I will get to work when this beta test ends

Have you read my proposal regarding the handling of suggestions (viewtopic.php?p=486359#p486359) ? Here are two key points from it: 1. There are no longer any "bugs"; everything is classified as a suggestion. 2. Voting on these suggestions takes place in a new, version-specific sub-forum (though you make the final decision, and users must have posted a certain number of times to be eligible to vote).

I myself have also a few concrete suggestions for new versions, but it’s pointless to post them in the suggestions forum, where they just vanish into thin air. Others feel the same way, which is why they (rather brazenly) simply label them as bug - apparently to get them addressed faster (e.g., this post: viewtopic.php?p=486245#p486245 [TC 11.57rc4]Multi-renaming in Search results does not show until I leave the Search result).

See also: viewtopic.php?p=485889#p485889: "It’s not the case that those who constantly write up are automatically right"

[ghisler(Author)]

1. No, bugs always take precedence. Adding something which would be nice to have is not the same as fixing something which is supposed to work, but doesn't work.
2. There are probably too few forum users left to justify voting in the forum.

[JOUBE]

1. No, bugs always take precedence. Adding something which would be nice to have is not the same as fixing something which is supposed to work, but doesn't work.

How then? Things essentially grind to a halt because a vast number of trivial bug reports are addressed in detail, blocking further development. Meanwhile, many suggestions are simply reported as bugs - presumably to get them processed faster - and far too many suggestions are overlooked because they simply get lost in the sheer volume and the passage of time.

2. There are probably too few forum users left to justify voting in the forum.

But the saying is, that the more discussion a suggestion generates, the more likely it is to be implemented - yet it is always the same people doing the siskussion, while those who don't write have no voice. Unfortunately, that is an inadequate concept for checking the importance of suggestions.

After all, a key aspect of these proposals is having a list of "current", "active" suggestions. That, above all, is what needs to be resolved somehow.

[ghisler(Author)]

You are right, the main problem is the forum. Public bug reports more or less force me to fix them immediately, and can delay a beta test forever. I'm seriously considering to close the forum forever and let users report bugs only via Web form or e-mail. It can't go on the way it's going now. Unfortunately it would mean a big loss of knowledge.

[JOUBE]

You are right, the main problem is the forum. Public bug reports more or less force me to fix them immediately, and can delay a beta test forever. I'm seriously considering to close the forum forever and let users report bugs only via Web form or e-mail. It can't go on the way it's going now.

That’s exactly how to handle it: bugs via web form from now on. If bugs start getting reported frequently in other forums (German, English, Suggestions), you can set up a standard response ("Please submit bugs via the web form") and close the thread.

But the second point concerns suggestions: these are far more important than the many banal bug reports. A version-based system needs to be set up so that there is - so to speak - a fresh start every now and then; otherwise, far too many suggestions simply get lost due to the passage of time since they were created. This way, only active suggestions would be taken into account. Or however to handle the suggestions.

Unfortunately it would mean a big loss of knowledge.

?

In any case, please return to further development based on suggestions.

[Dalai]

Though we're getting off topic now, I'd like to chime in about this point. The advantage of public bug reports is that users can check if an issue has been reported already. If they're not publicly visible anymore, you'll probably get MORE reports, especially about the same issues. Furthermore, bugs can't be discussed, if something is considered a bug or how far the bug reaches. Please don't underestimate that.

BTW, nobody says that bugs must be fixed immediately just because they've been publicly reported. Sure, it's true for security issues (I don't count the "leaked" encrypted names from archives in log files as such). But I don't see why other bugs, especially cosmetic ones, should be fixed immediately.

[JOUBE]

Though we're getting off topic now, I'd like to chime in about this point. The advantage of public bug reports is that users can check if an issue has been reported already. If they're not publicly visible anymore, you'll probably get MORE reports, especially about the same issues. Furthermore, bugs can't be discussed, if something is considered a bug or how far the bug reaches. Please don't underestimate that.

Well-considered words that are worth pondering (as ever), thanks. But since things cannot go on as they are at the moment, my proposal is to treat everything as suggestions (with a single post - plus requests for clarification if needed) and then hold a vote on them (with the final decision resting by ghisler(author). That way, numerous trivial bugs would immediately fall by the wayside. Because that...

BTW, nobody says that bugs must be fixed immediately just because they've been publicly reported. Sure, it's true for security issues (I don't count the "leaked" encrypted names from archives in log files as such). But I don't see why other bugs, especially cosmetic ones, should be fixed immediately.

... doesn't seem acceptable to ghisler(author) as long as they are called "bugs". When someone goes off on the wrong track again, as we are currently witnessing - things stall with TC, the great tool. However, I also don't quite understand why it took so long for ghisler(author) to use the word "bullshit" and play along?

But ultimately, it is not so important *how* it is resolved, but only *that* it is, so that we can finally move on to the many, many suggestions.

[white]

Moderator message

Sorry but you are way too paranoid. If a user doesn't get it in 3 seconds, he will not get it in a 1000 years. Really, I don't know why I spend so much time on this bullshit.

The words "paranoid" and "bullshit" are characterizations that violate forum rule 4:

4.) Be nice to each other and respect the moderator. Profanity and insults will not be tolerated. If you have a problem with another member turn to the respective moderator and if the moderator can't help you send a private message to Admin.

Comments about users are off-topic for this bug report thread and for this forum, and violate forum rule 3:

3.) Keep the focus: Questions outside the scope of a certain forum will either be moved, locked or simply be deleted.

And it wouldn't bother me at all if a user decided now to stop using TC and end his activity on the forum,because I am interested in further development, not stagnation.

This also violates above rules.

I will get to work when this beta test ends, but some people have a talent to make me drag the beta test forever.

As the owner of the forum, I feel you are effectively encouraging the violation of the rules here, and contributing to it.

Because you are the owner of the forum, your behavior sets the example and lets forum users know that it is acceptable to respond to others in this way. Your behavior has already caused people to go off-topic and to resort to ad hominem attacks. I therefor ask you to clarify if you no longer want people to follow forum rules, but that you want an environment where people respond to others using strong dismissive words, name calling and statements indicating that they are not welcome on the forum.

Since you shared your grievance against me here on the forum, I will address it here.

In the past you have complained that I reported issues after a final release and asked me to report issues during the beta stage. And now you complain that I am letting the beta testing phase drag on endlessly.

You continuously asked to report any issues, but when the reports keep coming, you start calling reports complaints and you complain about the reports.

Let me remind you that:

• User contributions represent a significant amount of unpaid QA labor that directly benefits your commercial software.
• You are the one that is responsible for creating the bugs in Total Commander.
• You are responsible for the way testing is organized.
• You are responsible for managing and prioritizing bug reports.
• And you alone, make all decisions about whether or not to change anything in Total Commander.

Beta testing is taking longer than you want because of your own doing, not because people are following your request to report issues.

Since this bug report thread has gone off-topic, I have now locked this thread.

[ghisler(Author)]

OK, then I leave this as it is now, and move this thread to "will not be changed".

Sorry if you feel offended, but this thread was going completely over board. Your requests became more and more extreme - if I implemented them, the program would become completely unusable. I simply could not go on with it like this.

Moderator message from: ghisler(Author) » 2026-07-05, 09:18 UTC

Moved to will not be changed

[white]

Moderator message from: white » 2026-07-08, 11:57 UTC

Sorry if you feel offended, but this thread was going completely over board.

Your comment about my possible emotional state is irrelevant, off-topic, and constitutes another subtle ad hominem attack.

Your requests became more and more extreme - if I implemented them, the program would become completely unusable.

I did not make any requests. I simply pointed out issues. These issues are not extreme, and designing Total Commander in a way that respects protection by password and encryption does not make Total Commander completely unusable.

What is extreme here is your response to my assertion that it takes me more than three seconds to process a warning displayed in a tooltip if I didn't already know what it said:

Sorry but you are way too paranoid. If a user doesn't get it in 3 seconds, he will not get it in a 1000 years. Really, I don't know why I spend so much time on this bullshit.

What is also extreme is a user expressing the wish for another user to leave the forum:

And it wouldn't bother me at all if a user decided now to stop using TC and end his activity on the forum,because I am interested in further development, not stagnation.

What is furthermore extreme is that you encourage this behavior, contribute to it, and are now doubling down on it. These actions clearly violate the forum rules.

I simply could not go on with it like this.

That's hardly an excuse to violate forum rules. Even if extreme requests are being made, there are many ways to respond without misbehaving. For example, you could say, "Thanks for your request, I will take it under consideration," or "Thanks for your request, but I have decided not to change it." And if you are holding a grievance, you could have discussed it via email and in a civil manner.