Filezilla installer is suspicious again • Hacker News Board

Re: Filezilla installer is suspicious again

#131

Post by whoopdedo » Sat, Jun 23, 2018, 11:12 PM UTC

michaelmrose wrote: post #92

NiveaGeForce wrote: post #73

Earlier quoted context omitted.

> Its truly amazing to me that installing windows software is still like this It doesn't have to be that way, since there is a Windows/Microsoft Store since plenty of years now. But then you have gamers and game devs spreading FUD about UWP and the the MS Store, while they praise 3rd party platforms like Steam and GoG that actively refuse UWP apps in their store, while allowing Spyware like this. https://www.reddit.c…

The long term solution CAN'T be the MS store. It requires asking Microsoft for permission to compete with them. It gives MS permission to bar entire categories of software globally or in your particular market. Giving the party running the store 30% of all revenue is a hard sale to start with. More importantly it gives MS the position to impose whatever dictates it or even more likely every government in existence th…

> It requires asking Microsoft for permission to compete with them

On that note, Apple now distributes iTunes for Windows through the Microsoft Store.

Re: Filezilla installer is suspicious again

#132

Post by pktgen » Sat, Jun 23, 2018, 11:19 PM UTC

belorn wrote: post #71

michaelmrose wrote: post #18

Botg site admin "The hash doesn't match because the filename doesn't match." A fully descriptive answer is that they don't have a checksum for the bundled package but botg doesn't want to say this. " Dangerously ignorant user. Not matching filename = the checksum is NOT for that file. Checksums can only be provided for the non-bundled packages, because they're static. Bundled installers are not." Dangerously ignorant…

Getting off platforms is usually quite hard with most trying to be as sticky as possible. The common reason why people tend to stick to Windows is games, even if the situation has gotten better. Personally I have come to the conclusion that the best solution is virtual machines with a linux base system. Put every game that is sticky to windows into its own little container and just have hardware passed through. That…

> Personally I have come to the conclusion that the best solution is virtual machines with a linux base system. Put every game that is sticky to windows into its own little container and just have hardware passed through.

Is there a Windows license available to consumers that allows simultaneous installation on multiple VMs under a non-Windows-based hypervisor?

Re: Filezilla installer is suspicious again

#133

Post by mcbits » Sat, Jun 23, 2018, 11:22 PM UTC

ksk wrote: post #14

mkane848 wrote: post #2

I can't believe those are real admin responses. TigheW was far more patient than they needed to be, that was painful.

What factual information do you dispute from their responses?

I dispute "The hash doesn't match because the filename doesn't match." He did backpedal and say he really meant they don't match because the files are different. (Well, duh.)

I also dispute "It's a tautological false-positive, by the very definition of the term, _everything_ is potentially unwanted."

That's not the definition. Here is a definition in line with what just about everyone means by the term:

"A potentially unwanted program (PUP) is a piece of software that is also downloaded when a user downloads a specific program or application. PUP is similar to malware in that it will cause problems when it is downloaded and installed."[0]

Or my own shorter definition: "Software that nobody would want on their computer if they knew what it is and does."

It sounds like that's exactly what was detected.

I don't dispute, but I'm curious about his claim that AV vendors maliciously flag their competitors' legitimate software. I wouldn't be the least bit surprised if that's true, but it's the first time I've heard of it.

[0] https://www.techopedia.com/definition/4061/potentially-unwan...

Re: Filezilla installer is suspicious again

#134

Post by code_duck » Sat, Jun 23, 2018, 11:30 PM UTC

whoopdedo wrote: post #131

michaelmrose wrote: post #92

Earlier quoted context omitted.

The long term solution CAN'T be the MS store. It requires asking Microsoft for permission to compete with them. It gives MS permission to bar entire categories of software globally or in your particular market. Giving the party running the store 30% of all revenue is a hard sale to start with. More importantly it gives MS the position to impose whatever dictates it or even more likely every government in existence th…

> It requires asking Microsoft for permission to compete with them On that note, Apple now distributes iTunes for Windows through the Microsoft Store.

I wonder if MS would have been on board with that around the time they were launching the Zune.

Re: Filezilla installer is suspicious again

#135

Post by code_duck » Sat, Jun 23, 2018, 11:32 PM UTC

ksk wrote: post #49

michaelmrose wrote: post #36

Earlier quoted context omitted.

I would rather they go out of business if they can't figure out another way to make money. You CAN install binaries on other platforms but on for example linux distros their is a curated platform of packages where you can get most/all software. The fact that this is the default way to install software and regular users don't need to look beyond the official repos is why installing software on linux isn't this kind of…

Well, I do think there is some hypocrisy on the part of people (including myself) enjoying free software and services, when the revenue of those is generated by unaware people clicking on ads or accidentally installing crapware. >You CAN install binaries on other platforms but on for example linux distros their is a curated platform of packages where you can get most/all software. Sure, but things often work better w…

"things often work better when you pay people upfront rather than get something for free and let them fend for themselves"...

Whoah, for a second I thought this was 1999.

Re: Filezilla installer is suspicious again

#136

Post by code_duck » Sat, Jun 23, 2018, 11:34 PM UTC

kodablah wrote: post #110

michaelmrose wrote: post #18

Botg site admin "The hash doesn't match because the filename doesn't match." A fully descriptive answer is that they don't have a checksum for the bundled package but botg doesn't want to say this. " Dangerously ignorant user. Not matching filename = the checksum is NOT for that file. Checksums can only be provided for the non-bundled packages, because they're static. Bundled installers are not." Dangerously ignorant…

> The long term solution is to get off the platform. Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platform, people keep putting the onus on these OS's, distros, etc to build walls around carefully curated gardens. Gotta take the good with the bad. Either you accept that people can run untrusted executables or you give up the flexibility to build/use/distribute u…

It sounds like you have a lot more experience with windows than other platforms.

Many who have mainly used windows haven't experienced what typical software installation is like on systems like Linux. One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites. That is just not how Linux software is distributed. It doesn't abridge freedom, either - if you want to run I trusted executables, nothing is trying to stop you, either.

Then, if you do have an executable to install from, the installation process is more likely to be one command run in a terminal then a GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks, and tries to convince/trick you to install a bunch of other software.

Re: Filezilla installer is suspicious again

#137

Post by abiox » Sat, Jun 23, 2018, 11:42 PM UTC

guessmyname wrote: post #56

zeth___ wrote: post #43

Earlier quoted context omitted.

This is a really toxic attitude in the open source community where when asked a question the answer is: "you're doing it wrong, just do it right". If I had a choice I would, but unless you have a few million dollars to give us to refactor 30 years of technical debt, please answer the question.

> you're doing it wrong, just do it right That's not how I wrote my comment above, I gave you alternatives. > If I had a choice I would You have choices, many. > unless you have a few million dollars to give us to refactor 30 years of technical debt How is using FileZilla a technical debt? What are you requiring from FileZilla that you need a few million of dollars to refactor code? What kind of code depends on an ex…

> I did, you asked for alternatives, I gave you Rsync and SCP.

afaict, they asked about the impact to the linux build of filezilla (not about alternatives).

are rsync and scp strict supersets of filezilla's features?

Re: Filezilla installer is suspicious again

#138

Post by loganabbott » Sat, Jun 23, 2018, 11:42 PM UTC

mintplant wrote: post #106

loganabbott wrote: post #78

Earlier quoted context omitted.

This blog post is not accurate at all.

So what's your side of the story, then?

We lost a few hours of commits and notified everyone affected. That's it.

Re: Filezilla installer is suspicious again

#139

Post by zeth___ » Sat, Jun 23, 2018, 11:48 PM UTC

guessmyname wrote: post #56

zeth___ wrote: post #43

Earlier quoted context omitted.

This is a really toxic attitude in the open source community where when asked a question the answer is: "you're doing it wrong, just do it right". If I had a choice I would, but unless you have a few million dollars to give us to refactor 30 years of technical debt, please answer the question.

> you're doing it wrong, just do it right That's not how I wrote my comment above, I gave you alternatives. > If I had a choice I would You have choices, many. > unless you have a few million dollars to give us to refactor 30 years of technical debt How is using FileZilla a technical debt? What are you requiring from FileZilla that you need a few million of dollars to refactor code? What kind of code depends on an ex…

>You have choices, many.

Would you like the email of my cto to explain to them why I have those choices?

>What kind of code depends on an external FTP client to work?

The type that invests your 401k's. Filezilla called from Excel macros.

>I did, you asked for alternatives, I gave you Rsync and SCP.

I didn't. You just told me I was doing it wrong and need to change it to do it right.

Re: Filezilla installer is suspicious again

#140

Post by Fnoord » Sat, Jun 23, 2018, 11:54 PM UTC

loganabbott wrote: post #29

FYI the SourceForge version of FileZilla is clean, and has been since 2016. The official FileZilla installer has been doing this for some time now though. In case people don’t know, a lot has changed at SourceForge since my company acquired them in 2016. All projects are scanned for malware. We covered the improvements again here https://sourceforge.net/blog/brief-history-sourceforge-look-...

Regardless of that we can no longer trust the developers of FileZilla.

If they need money, they should ask for donations instead. Patreon was suggested elsewhere in this thread.