Filezilla installer is suspicious again

Post by mirimir » Sun, Jun 24, 2018, 1:28 AM UTC

michaelmrose wrote: post #18

Botg site admin "The hash doesn't match because the filename doesn't match." A fully descriptive answer is that they don't have a checksum for the bundled package but botg doesn't want to say this. " Dangerously ignorant user. Not matching filename = the checksum is NOT for that file. Checksums can only be provided for the non-bundled packages, because they're static. Bundled installers are not." Dangerously ignorant…

    #9 Post by botg » 2018-01-05 09:11
    The connections are for fetching offers and, if the user
    accepts the offer, the offered file. What the file is
    for is written in the offer text. The network requests
    to fetch offers are done only after the user has agreed
    to it by accepting the privacy policy.

    #10 Post by TigheW » 2018-01-05 16:55
    Sorry man, this isn't "bundled software that people
    want" and no amount of repeating it will make it true.
    This is a malware downloader bundled with your software
    and hosted on your page and you're intentionally
    misleading the users who are here directly asking you
    if it's safe to run this bundle on their machines. ...

Post by mirimir » Sun, Jun 24, 2018, 1:32 AM UTC

kodablah wrote: post #149

Symbiote wrote: post #148

Earlier quoted context omitted.

> The Linux one is from the same source too. Not in practise. The Linux version of Filezilla will usually be sourced from a package manager: $ apt show filezilla Package: filezilla Version: 3.28.0-1 … Description: Full-featured graphical FTP/FTPS/SFTP client Even Filezilla's own website says "It is highly recommended to use the package management system of your distribution". A huge portion of the software a typical…

Meh, they don't keep versions up to date. That version in the apt repo is several versions behind (not to mention how far behind they are on 16.04 repos), not something you usually want to do with network software like Filezilla. My comment listed just 4 pieces of software off the top of my head I installed on a fresh desktop recently, and I wouldn't get any of them from default apt install.

Post by jensv » Sun, Jun 24, 2018, 1:45 AM UTC

codedokode wrote: post #88

zaroth wrote: post #39

Sophisticated users will know to download the unbundled installer, and maybe even go so far as to verify the hash. But that sideskirts the question of whether to continue using software where the authors are willing to put their users at risk by monetizing with what is apparently malware bundles. FileZilla is by all accounts a fantastic piece of software. I’ve used it for years, both the client and the server, and it…

I don't really see the problem. If the developers want to get paid for they work they can just sell their software. The problem is when someone tries to monetize their product by deceiving users. This is the case: they prevent user from knowing what is happening on their computer, download and run suspicious binaries and use EULA as an excuse. And I suspect, they themselves don't even know for sure what is bundled in…

Post by anyfoo » Sun, Jun 24, 2018, 1:50 AM UTC

dogma1138 wrote: post #154

jakelazaroff wrote: post #146

Earlier quoted context omitted.

macOS has a good solution to this, where attempting to open an unsigned binary will fail and warn the user, but can be overridden in the file's context menu.

https://en.m.wikipedia.org/wiki/Microsoft_SmartScreen And this is considerably better than the “this app was downloaded from the internet do you want to open it” message that OSX provides which Windows provides by default also to all files downloaded from the internet.

Post by smsm42 » Sun, Jun 24, 2018, 2:16 AM UTC