FastStone Image Viewer is a mystery -- who is the developer behind this?

[Beetuna]

Hi all,

I was recently exploring some various image software offerings, and quite a few folks showed interest in the FastStone Image Viewer program.

The program has been around for quite some time, and had a recent update in August to version 7.7. There are some companion programs, as well, from the same place like FastStone Capture.

On the website, you can find "FastStone Corporation" as the entity behind it. On Wikipedia, it instead shows "FastStone Soft."

I wanted to learn a little bit more about this application, but despite my best Google-fu, I didn't have much luck. Apart from a generic email address for support that gets published on the site, I can't really find anything. I saw several reports of folks getting no response from the email.

There is no engagement from a developer or company that I can find at all. Not even a country of origin for this software. Even though it has been around a long time, in this day and age especially, it's very odd.

Normally, you would have some sort of audit trail back to a developer or company or something. But... nothing.

I really liked the feature list for this, but it's just a bit shady for my tastes. I thought I would check in here to see if anyone else has happened to determine more about this application and what's behind the curtain.

 

[migla9]

A whois domain lookup for faststone.org only yielded Alberta, Canada:

Registrant:

• Organization: FastStone Corporation
• Mailing Address: AB, CA

 

[p900learner]

My $.02 fwiw - no software expert.

Happily used FSIV for 8-9 years as an editor and organizer. Currently I use it as a viewer and organizer because I've transitioned to paid software. Periodically I send small donations to support the work - I always get a thank you note promptly. It's a pleasure to support the ongoing efforts - I admire this sort of work.

A question or two over the years has been responded to, but seems like it took awhile.

AFAIK - it is developed and supported by an individual. No corporate backing.

It has always just worked - along with nice improvements and fixes being provided. I've always just viewed the developer's work as a labor of love with no particular profit motives. Not once did it ever cross my mind - any shadiness, or ulterior behind the scenes motives. I am careful about software I download.

Good luck. Ev

 

[Beetuna]

Very glad you have used it for many years with success. That seems to be quite common--it's been around a while. But, your story and that of many others doesn't really apply to the topic at hand. Declaring being careful is great, but I might suggest others would disagree, especially in today's world filled with software available via FOSS, independent audit, platform publishing, or even simple hash verification. FastStone has none of these. Longevity of use really changes nothing.

Most software published by individuals today receives some form of engagement from the developer. Whether that's via online community engagement, or review response, it isn't complete radio-silence.

So, could it be completely fine? Just a guy that stays behind the curtain and writes image software in free time for the world to use? Absolutely, yes.
Could it also be a nefarious group hiding a payload in an obscure program just under the radar enough to linger? Absolutely, yes.

I guess my only point is that we don't really have evidence to conclusively substantiate either position, and I wish we did!

 

[Digital Nigel]

Very glad you have used it for many years with success. That seems to be quite common--it's been around a while. But, your story and that of many others doesn't really apply to the topic at hand. Declaring being careful is great, but I might suggest others would disagree, especially in today's world filled with software available via FOSS, independent audit, platform publishing, or even simple hash verification. FastStone has none of these. Longevity of use really changes nothing.

Most software published by individuals today receives some form of engagement from the developer. Whether that's via online community engagement, or review response, it isn't complete radio-silence.

So, could it be completely fine? Just a guy that stays behind the curtain and writes image software in free time for the world to use? Absolutely, yes.
Could it also be a nefarious group hiding a payload in an obscure program just under the radar enough to linger? Absolutely, yes.

I guess my only point is that we don't really have evidence to conclusively substantiate either position, and I wish we did!

Obviously, if you have any doubts, don't download it. Meanwhile, the rest of us will enjoy using it.

 

[SecondTimeAround]

FastStone Corporation

https://www.whois.com/whois/faststone.org

https://albertacorporations.com/faststone-corporation

 

[IanYorke]

My $.02 fwiw - no software expert.

Happily used FSIV for 8-9 years as an editor and organizer. Currently I use it as a viewer and organizer because I've transitioned to paid software. Periodically I send small donations to support the work - I always get a thank you note promptly. It's a pleasure to support the ongoing efforts - I admire this sort of work.

A question or two over the years has been responded to, but seems like it took awhile.

AFAIK - it is developed and supported by an individual. No corporate backing.

It has always just worked - along with nice improvements and fixes being provided. I've always just viewed the developer's work as a labor of love with no particular profit motives. Not once did it ever cross my mind - any shadiness, or ulterior behind the scenes motives. I am careful about software I download.

Good luck. Ev

I am with you and also send donations every couple of years.

Ian

 

[ppage]

I guess my only point is that we don't really have evidence to conclusively substantiate either position, and I wish we did!

There is no evidence to suggest the software is anything other than what it appears to be, but we can't prove that it isn't something else. However, we don't have to remain stuck in a state of uncertainty.

We know that logically we can't prove a negative, but does that mean we can't dismiss an idea such as we are being governed by an alien race that has its base on the far side of the moon, for example? In situations in which there is no evidence to support one proposition over another the preferred approach is to apply Occam's Razor: ignore the proposition that makes the topic more complex than the other proposition.

FS has been used by photographers for almost 20 years now. So at this point, and in the absence of evidence to suggest that the software is anything other than what it appears to be, it is perfectly reasonable to assume that it is absolutely safe.

 

[sybersitizen]

... your story and that of many others doesn't really apply to the topic at hand. Declaring being careful is great, but I might suggest others would disagree, especially in today's world filled with software available via FOSS, independent audit, platform publishing, or even simple hash verification. FastStone has none of these. Longevity of use really changes nothing.

Most software published by individuals today receives some form of engagement from the developer. Whether that's via online community engagement, or review response, it isn't complete radio-silence.

So, could it be completely fine? Just a guy that stays behind the curtain and writes image software in free time for the world to use? Absolutely, yes.

Two of the FastStone programs are free. Two others require payment for a license, so there's also an income stream.

Could it also be a nefarious group hiding a payload in an obscure program just under the radar enough to linger? Absolutely, yes.

I guess my only point is that we don't really have evidence to conclusively substantiate either position, and I wish we did!

That's all true. There are in fact a number of useful Windows programs that are produced by one individual or a small team with limited documentation, no forum, and just the barest ability to make contact. Many are perfectly benign, but others are not.

If the goal of the FastStone developer is to secretly embed malware of some kind, he has been putting an extraordinary effort into it, having offered four different products on his site for many years and keeping them updated. Certainly it could be done far more easily by offering one free utility and calling it a day ... so why would he work so much harder than necessary?

Anyway, as with all software (even so-called trusted software), the best line of defense is conscientious use of malware detection tools.

 

[Night Pixel]

Apparently, they do not have open records laws in Canada and third party agents charge to get information. I was able to find this:







--
**** REDACTED ****

 

[SecondTimeAround]

Apparently, they do not have open records laws in Canada and third party agents charge to get information. I was able to find this:

That's one of the two pages I linked earlier, the other being a whois result:

https://www.dpreview.com/forums/post/66588057

 

[Night Pixel]

Apparently, they do not have open records laws in Canada and third party agents charge to get information. I was able to find this:

That's one of the two pages I linked earlier, the other being a whois result:

https://www.dpreview.com/forums/post/66588057

Odd that the incorporation was in 2021 since the product has been around for 20 years.

 

[JustGeorge]

I've been a FastStone user for at least 15 years. I was still using a Win 95 machine at that time. Never had a cause for concern. My wife is a total non-techie, I call her a "Ludd-Lite": one-half analog, one-half tech. She's been using FS on her Win 7 Notebook for the past 9 years, currently v.7.7, her machine is still clean.

I've been a fan of Freeware since the BBS days of the late 1980s. I made several submissions which were added to the Freeware Hall of Fame listing back then. I don't know if that list is still maintained, if it was, I'd definitely see if FS was on it, and if not then submit it.

I currently have dozens of small freeware programs on my computer. I download almost all of them from MajorGeeks.com (MG). (Won't link to it, you can find it easily enough if you're interested.) They provide either direct downloads from their own servers, or links to the author's site, or sometimes both. The direct downloads are always checked thoroughly for nasties. I d/l the installer from MG, and the portable version from the author's site. Downloading from a trusted site is a no-brainer for me.

I'm probably wrong, but for some reason I thought FS was headquartered years ago somewhere in the southern U.S. Maybe he recently re-located?

Anyway, of all the freeware programs I run, FS is easily one of the most trustworthy, at least for now and the foreseeable future.

 

[Beetuna]

Interesting still that no one really knows anything about where it comes from.

Lots of folks pointing to longevity of use, but that can't be a sole indicator that something is safe. There are plenty of examples out there of software that was seemingly innocuous, only to be found years later that it was tampered with or malicious.

To be frank, my opinion is that it is probably completely fine. It's probably a guy out there that's a bit oldschool and doesn't really want to engage at a community level, stay behind the scenes, and just maintain his software. But I do think it raises an interesting question in a scenario that isn't that common these days.

 

[ppage]

Interesting still that no one really knows anything about where it comes from.

Lots of folks pointing to longevity of use, but that can't be a sole indicator that something is safe. There are plenty of examples out there of software that was seemingly innocuous, only to be found years later that it was tampered with or malicious.

To be frank, my opinion is that it is probably completely fine. It's probably a guy out there that's a bit oldschool and doesn't really want to engage at a community level, stay behind the scenes, and just maintain his software. But I do think it raises an interesting question in a scenario that isn't that common these days.

Let's be honest, we can't really be sure about very much in life. But to continue to speculate about something without any evidence to support that speculation is how conspiracy theories start and misinformation spreads. Unless someone can show some reason for concern about FS, I think we should put this story to bed.

 

[Beetuna]

Interesting still that no one really knows anything about where it comes from.

Lots of folks pointing to longevity of use, but that can't be a sole indicator that something is safe. There are plenty of examples out there of software that was seemingly innocuous, only to be found years later that it was tampered with or malicious.

To be frank, my opinion is that it is probably completely fine. It's probably a guy out there that's a bit oldschool and doesn't really want to engage at a community level, stay behind the scenes, and just maintain his software. But I do think it raises an interesting question in a scenario that isn't that common these days.

Let's be honest, we can't really be sure about very much in life. But to continue to speculate about something without any evidence to support that speculation is how conspiracy theories start and misinformation spreads. Unless someone can show some reason for concern about FS, I think we should put this story to bed.

I would argue that the lack of any real information or clarity, in today's software landscape filled with community engagement, social media, github and FOSS, is evidence enough to have the concern or conversation on a forum built for conversations. Building consumer trust and confidence is not a new paradigm.

That's a straw man. No one has raised any conspiracies.

That said, I'm not sure there's much else more to say. Maybe someone with some more of the inside scoop will chime in here some day.

 

[mangurian]

When looking to download a freebee, I always look here first:

https://www.oldergeeks.com/downloads/index.php

 

[JustGeorge]

Interesting still that no one really knows anything about where it comes from.

Lots of folks pointing to longevity of use, but that can't be a sole indicator that something is safe. There are plenty of examples out there of software that was seemingly innocuous, only to be found years later that it was tampered with or malicious.

To be frank, my opinion is that it is probably completely fine. It's probably a guy out there that's a bit oldschool and doesn't really want to engage at a community level, stay behind the scenes, and just maintain his software. But I do think it raises an interesting question in a scenario that isn't that common these days.

Let's be honest, we can't really be sure about very much in life. But to continue to speculate about something without any evidence to support that speculation is how conspiracy theories start and misinformation spreads. Unless someone can show some reason for concern about FS, I think we should put this story to bed.

I would argue that the lack of any real information or clarity, in today's software landscape filled with community engagement, social media, github and FOSS, is evidence enough to have the concern or conversation on a forum built for conversations. Building consumer trust and confidence is not a new paradigm.

That's a straw man. No one has raised any conspiracies.

That said, I'm not sure there's much else more to say. Maybe someone with some more of the inside scoop will chime in here some day.

Long before I ever heard of dpreview, I was using FS after reading about it on other trusted sites. And it's been discussed for years on this forum as well as other fora here on DPR, and I've never read anything remotely resembling any distrust of the program, or even questioning its safety. So this is a first.

The ONLY time to be concerned would be if one was to download from a website that "bundled" it with other software, such as PUPs (Potentially Unwanted Programs), or similar.

I don't stick my neck out often, but I have no problem recommending FastStone to anyone wanting a simple image viewer with some basic file management and image tweaking capabilities.

In all the years I have used FS, I have never seen an immediate fix issued, after any update, as few and far between as they are. Rather remarkable.

Okay, I'm done, sorry to go on about this.

 

[ppage]

Building consumer trust and confidence is not a new paradigm.

Everyone using FS has expressed trust and confidence. This wasn't an issue with this software for anyone until you questioned it, thus possibly lowering consumer trust and confidence. Throwing what is known into doubt without offering any reason to do so does seem to be a new paradigm.

 

[Billiam29]

Some people may have differing opinions on how much importance they place in this, but Faststone Image Viewer is digitally signed with a code signing certificate issued in the parent company’s name from a major certification authority. See the screenshot below.

Digital certificates can…and have…been forged. Personally, I think that’s more of a concern about whether or not the individual copy of the software you’ve downloaded is legitimate. The important thing germane to the discussion here is that the parent company of the software has successfully had a code signing certificate issued to them from DigiCert and have paid the not small fee to do so. Those are the items that reinforce the overall legitimacy of the application and its developer/parent company IMO.