Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

Post reply on HN
Print view View original

61–70 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#61

Post by creshal »

enimodas wrote: post #46
pmlnr wrote: post #30

Earlier quoted context omitted.

How would you replace them? ( Please don't say Slack. That is just _not_ a good replacement, especially for projects that needs publicly searchable archives. ) IMHO a publicly/semi-publicly logged irc channel would do just as well, but that's even more oldschool.

I have never used mailing list so I'm probably naive, but what about github issues?

Mailing lists are not just about issue tracking (and really shouldn't be about it). There's general discussion on them, release announcements, etc. pp.

Re: Trojan found in Filezilla downloaded from SourceForge

#62

Post by cuonic »

pmlnr wrote: post #30
aldanor wrote: post #21

Earlier quoted context omitted.

Why mailing lists are still quite massively popular in 2015?..

How would you replace them? ( Please don't say Slack. That is just _not_ a good replacement, especially for projects that needs publicly searchable archives. ) IMHO a publicly/semi-publicly logged irc channel would do just as well, but that's even more oldschool.

Mattermost is a free and open-source alternative to Slack, giving users publicly searchable archives, great for sending images, files and code in chat. http://www.mattermost.org/

Re: Trojan found in Filezilla downloaded from SourceForge

#64

Post by StavrosK »

scrollaway wrote: post #55
StavrosK wrote: post #54

Earlier quoted context omitted.

Why can the passwords not be hashed?

The client needs them in plain text to be able to connect. "Remember password" is a feature, there. Like I said, correct solution is to use the keyring, but the dev team is incompetent, so ...

Oh, I thought we were talking about the server. Never mind, thanks.

Re: Trojan found in Filezilla downloaded from SourceForge

#65

Post by halviti »

teddyh wrote: post #12
jmnicolas wrote: post #10

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

The problem is not FileZilla, but SourceForge. They do this to all their files.

I had contacted FileZilla's developer about this back in 2014.

He let me know that bundling crapware was "intentional"

http://i.imgur.com/AvfDuOA.png

His statement about alternate download links was also incorrect, because I was asking about Filezilla server, which I could not find anywhere but sourceforge.

Re: Trojan found in Filezilla downloaded from SourceForge

#66

Post by akerro »

aldanor wrote: post #21
scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Why mailing lists are still quite massively popular in 2015?..

There's no alternative that's even close to that. For me email and IRC work for years and everything is going well.

Re: Trojan found in Filezilla downloaded from SourceForge

#67

Post by morganvachon »

I stopped using Filezilla on Windows a while back, due to this and other issues (passwords stored in plaintext, etc.) and switched to PSFTP and PSCP, which are MIT licensed and offered directly from the developer's page[1]. However, reading this article reminded me that Filezilla was actually still installed on that box, just not in use, so I decided to uninstall it while it was on my mind. Immediately after uninstalling it, it tried to force a shutdown on my computer. The only reason I was able to stop it was because I had a process running in the background that wouldn't terminate and I was given the choice by Windows to force shutdown or cancel.

Now, I've only ever installed it from ninite.com[2], so I know it didn't initially have the Sourceforge trojan/adware junk. However, I've since allowed it to download its own updates instead of doing it manually through the Ninite downloader. I've never, ever seen a program I've uninstalled via the Windows Control Panel with the ability to force a shutdown or restart without first notifying me or giving me the option to postpone. I'm starting to think there's something nefarious in Filezilla itself, perhaps in one of those "direct from the developer" updates, not just the Sourceforge wrapper.

Another interesting thing is that the built in Filezilla updater will first uninstall the app before reinstalling the updated version, and it never tried to restart or shutdown the computer during those updates, only during uninstallation from the Control Panel.

[1] http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h...

[2] Ninite strips out any malware or other crap from the installer and only installs the pure program with default settings, in the background, and sources the app directly from the developer's site when possible. It's my go-to tool for essential Windows utilities.

Re: Trojan found in Filezilla downloaded from SourceForge

#70

Post by bigbugbag »

agildehaus wrote: post #24

SourceForge and Filezilla are both on their way out, hence their owners desire to monetize their remaining users while they still can. WinSCP is a decent alternative. As is Swish: http://www.swish-sftp.org/ https://github.com/alamaison/swish

A decent alternative to filezilla would have to be cross-platform, neither swish nor winscp are (they're win only).

An alternative to sourceforge implies not using sourceforge but swish does.

Post reply on HN