Can't we just fork and fix?
let's do it.
Filezilla installer is suspicious again
141–150 of 258 posts
Re: Filezilla installer is suspicious again
#142Earlier quoted context omitted.
"And let’s not forget that so much Linux software installs these days via curl|sh... " Actually virtually everything is packaged for at least the major linux platforms an exhortation on a web site saying you can install foo via curl |sh can in fact normally be reasonably followed by apt install foo or insert gui/cli package manager of your choice.
When I use apt-get I am downloading from debian.org, where at least there will be a record of what was executed. Further, I trust debian.org more than some random github repo. When I use curl|sh, I could execute hidden text, e.g. through a Javascript command, which automatically executes the code and then deletes it from my history. At a future date, there is no way for me to know whether something malicious was exec…
You're agreeing.
Re: Filezilla installer is suspicious again
#143Earlier quoted context omitted.
> The long term solution is to get off the platform. Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platform, people keep putting the onus on these OS's, distros, etc to build walls around carefully curated gardens. Gotta take the good with the bad. Either you accept that people can run untrusted executables or you give up the flexibility to build/use/distribute u…
It sounds like you have a lot more experience with windows than other platforms. Many who have mainly used windows haven't experienced what typical software installation is like on systems like Linux. One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites. That is just not how Linux software is distributed. It…
My experience ranges across platforms which is why I call out this ridiculous bias when I see it, especially when it uses dumb examples like Filezilla to represent the whole. Look at the other options for Filezilla downloads. The default Mac one is the same bundled crap from the same source. The Linux one is from the same source too. Of course I would be unreasonable to criticize the other platforms if the forum post was about those instead.
> One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites
That's just not true if you want up to date software. I can list a ton of software to the contrary and lots of installing that includes just extracting tarballs, or installing their deb/rpm you download, or if they use the distro package manager, they just have you add their server and cert.
> GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks
Well if you're just gonna give false impressions with hyperbole, a rational discussion can't be had.
Regardless, the issues with installation are primarily the choice of the devs, not the OS. These days they more look like the installation of Nodejs, Go, PgAdmin, VSCode, etc (i.e. minimal MSI's or just zip extracts) than complicated adware of yore. That this is not clear and you think 10 minute wizards with 20 clicks is normal makes it seem like you are not familiar with the platforms you talk about.
Re: Filezilla installer is suspicious again
#144« The connections are for fetching offers and, if the user accepts the offer, the offered file. What the file is for is written in the offer text. The network requests to fetch offers are done only after the user has agreed to it by accepting the privacy policy. »
Translation:
« Our installer fetches random crapware once you click past the giant wall of text. »
Re: Filezilla installer is suspicious again
#145« The connections are for fetching offers and, if the user accepts the offer, the offered file. What the file is for is written in the offer text. The network requests to fetch offers are done only after the user has agreed to it by accepting the privacy policy. » Translation: « Our installer fetches random crapware once you click past the giant wall of text. »
yup, its been going on for years.
its 2018. f* filezilla.
winscp is a decent alternative
Re: Filezilla installer is suspicious again
#146Botg site admin "The hash doesn't match because the filename doesn't match." A fully descriptive answer is that they don't have a checksum for the bundled package but botg doesn't want to say this. " Dangerously ignorant user. Not matching filename = the checksum is NOT for that file. Checksums can only be provided for the non-bundled packages, because they're static. Bundled installers are not." Dangerously ignorant…
> The long term solution is to get off the platform. Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platform, people keep putting the onus on these OS's, distros, etc to build walls around carefully curated gardens. Gotta take the good with the bad. Either you accept that people can run untrusted executables or you give up the flexibility to build/use/distribute u…
macOS has a good solution to this, where attempting to open an unsigned binary will fail and warn the user, but can be overridden in the file's context menu.
Re: Filezilla installer is suspicious again
#147« The connections are for fetching offers and, if the user accepts the offer, the offered file. What the file is for is written in the offer text. The network requests to fetch offers are done only after the user has agreed to it by accepting the privacy policy. » Translation: « Our installer fetches random crapware once you click past the giant wall of text. »
This is allowed under GDPR? Doesn't this constitute breaking into computers?
Re: Filezilla installer is suspicious again
#148Earlier quoted context omitted.
It sounds like you have a lot more experience with windows than other platforms. Many who have mainly used windows haven't experienced what typical software installation is like on systems like Linux. One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites. That is just not how Linux software is distributed. It…
My experience ranges across platforms which is why I call out this ridiculous bias when I see it, especially when it uses dumb examples like Filezilla to represent the whole. Look at the other options for Filezilla downloads. The default Mac one is the same bundled crap from the same source. The Linux one is from the same source too. Of course I would be unreasonable to criticize the other platforms if the forum post…
> The Linux one is from the same source too.
Not in practise. The Linux version of Filezilla will usually be sourced from a package manager:
$ apt show filezilla
Package: filezilla
Version: 3.28.0-1
…
Description: Full-featured graphical FTP/FTPS/SFTP client
A huge portion of the software a typical user requires is available in the standard repository of a Linux distribution. I have one extra Apt repository configured that would be reasonable for a normal user to install: Skype.
Re: Filezilla installer is suspicious again
#149Earlier quoted context omitted.
My experience ranges across platforms which is why I call out this ridiculous bias when I see it, especially when it uses dumb examples like Filezilla to represent the whole. Look at the other options for Filezilla downloads. The default Mac one is the same bundled crap from the same source. The Linux one is from the same source too. Of course I would be unreasonable to criticize the other platforms if the forum post…
> The Linux one is from the same source too. Not in practise. The Linux version of Filezilla will usually be sourced from a package manager: $ apt show filezilla Package: filezilla Version: 3.28.0-1 … Description: Full-featured graphical FTP/FTPS/SFTP client Even Filezilla's own website says "It is highly recommended to use the package management system of your distribution". A huge portion of the software a typical…
Meh, they don't keep versions up to date. That version in the apt repo is several versions behind (not to mention how far behind they are on 16.04 repos), not something you usually want to do with network software like Filezilla. My comment listed just 4 pieces of software off the top of my head I installed on a fresh desktop recently, and I wouldn't get any of them from default apt install.
Re: Filezilla installer is suspicious again
#150Earlier quoted context omitted.
> The long term solution is to get off the platform. Ug. Running untrusted executables on any platform can be trouble. The problem is that by blaming the platform, people keep putting the onus on these OS's, distros, etc to build walls around carefully curated gardens. Gotta take the good with the bad. Either you accept that people can run untrusted executables or you give up the flexibility to build/use/distribute u…
macOS has a good solution to this, where attempting to open an unsigned binary will fail and warn the user, but can be overridden in the file's context menu.
Windows has the same thing (well, unsigned downloaded binaries that aren't otherwise vetted/popular).