Live data from Hacker News

Trojan found in Filezilla downloaded from SourceForge

forum.filezilla-project.org

111–120 of 217 posts

Re: Trojan found in Filezilla downloaded from SourceForge

#111
post #3

AFAIK this practice (and not on the FileZilla project alone) is why uBlock Origin is blocking SourceForge.

Though ublock origin can use it, it's the ublock badware risks filter list which is blocking sourceforge : https://github.com/gorhill/uBlock/wiki/Badware-risks

That's the github project for uBlock Origin.

Re: Trojan found in Filezilla downloaded from SourceForge

#112

Earlier quoted context omitted.

Isn't this what Google Groups is used for? (what's different / lacking there? I'm of the age where I remember SourceForge as somewhere I would sometimes download things from as a young teenager but nothing more than that)

Yes, Google Groups is very close to what's needed - unfortunately, it's proprietary and Google doesn't really maintain it, it's only a matter of time it goes the way of Reader.

Don't forget than when they do maintain it they make the UX worse. Every damn time. Over the years it's gone from mediocre to downright horrible.

Re: Trojan found in Filezilla downloaded from SourceForge

#113

Earlier quoted context omitted.

Isn't this what Google Groups is used for? (what's different / lacking there? I'm of the age where I remember SourceForge as somewhere I would sometimes download things from as a young teenager but nothing more than that)

Yes, Google Groups is very close to what's needed - unfortunately, it's proprietary and Google doesn't really maintain it, it's only a matter of time it goes the way of Reader.

Also, Groups doesn't have the ability to import archives from my previous list. (I'm in exactly the same position of wanting to migrate away from SourceForge, and the mailing list is the last thing remaining.)

Re: Trojan found in Filezilla downloaded from SourceForge

#114

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

The cool thing about D's forums/feed is how amazingly fast they are. I wish more web apps were designed like this, with a fast backend framework.

Instead, it's all either slow, slow backend frameworks like Ruby, or even worse, these SPA applications that require extensive client-side JS processing before they show you the goods.

Node is a step in the right direction for both problems: for the first, Node-based backend applications are faster than Ruby and Python, and for the client-side rendering problem, because Node can pre-render these SPA apps (which everyone should do for a serious production app that uses a framework/library like AngularJS or React for major client-side rendering).

But a server application based on D or Rust, or even Go, is an even better solution to the slow backend framework issue. Unfortunately, no one has yet created a full-service framework like Rails or Django for any of those languages.

Re: Trojan found in Filezilla downloaded from SourceForge

#115

Earlier quoted context omitted.

It's usually hidden in the EULA. Very hidden. It's not just Filezilla or sourceforge doing this. Lenovo do this routinely. They used to bundle something called BrowserGuard, which contains a PUP by Conduit. Conduit have since been partially acquired by another company Perion. I followed that rabbit hole last year, Lenovo point blank refuse to acknowledge it is spyware. And it IS spyware. I created a Perion account to…

Good to know - I was almost ready to consider Lenovo again after Superfish, but no...

You should generally not trust preinstalled OSs, regardless of vendor. Most (all?) of them shovel crap in there, often because they get paid to do it. It's sad, but it's just the world we live in.

The really scary thing is when vendors put in backdoors or trojans like this at a level below the OS (in UEFI, for example).

Re: Trojan found in Filezilla downloaded from SourceForge

#116
post #42

There is a safer way install FileZilla through ninite installer or chocolately https://ninite.com/filezilla Chocolatey nuget is similar to Linux package managers but for Windows programs https://chocolatey.org choco install filezilla

It's much easier to simply download the portable version (without malware) from FossHub.

http://www.fosshub.com/FileZilla.html

Re: Trojan found in Filezilla downloaded from SourceForge

#117
post #43
post #32

Earlier quoted context omitted.

Or you type 'ftp' in the command line.

It doesn't come standard, not on all Windows flavours. It's a part of "Core networking utilities" package that used to have some really odd dependencies.

You're mis-remembering or something... There's no such thing as a "Core Networking Utilities" package on Windows (never has been) and ftp has been a command line tool since at least Windows 95.

I don't particularly like the built in FTP command line utility (even with scripts). But it has existed a very long time indeed.

Re: Trojan found in Filezilla downloaded from SourceForge

#118
post #21

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Why mailing lists are still quite massively popular in 2015?..

> Why mailing lists are still quite massively popular in 2015?..

IRC is still an underused tool in my opinion. The ability to just talk about one issue in a Mail List and keep track of the communication is great. I can't think of another tool that manages communication as well as a mail list (Forums are just not as good in communication notifications like a mail list.)

P.S. I still hate Mail List and don't use them anymore but nothing does it as well right now.

Re: Trojan found in Filezilla downloaded from SourceForge

#119
The linked thread is from 2015-04-20. SourceForge has been bundling adware with Filezilla since then and continues to do so. Here's a VirusTotal analysis of the current installer: https://www.virustotal.com/en/file/16e0ecda06ed98f835e449e1e...

If you want clean software you must not install directly from Sourceforge.

Re: Trojan found in Filezilla downloaded from SourceForge

#120

This has been known about for some time. The Filezilla guys know about it. http://sourceforge.net/blog/devshare-relaunch-power-to-end-u...

Shouldn't this be a criminal offense?

Meanwhile, 8th grader charged with felony hacking for changing teacher's digital wallpaper:

http://www.computerworld.com/article/2909321/8th-grader-char...

Post reply on HN