Live data from Hacker News

Filezilla installer is suspicious again

forum.filezilla-project.org

251–258 of 258 posts

Re: Filezilla installer is suspicious again

#251
Does anyone have suggestions for alternatives to FileZilla, both for Windows and for Mac, that I can recommend to non-technical friends. In other words, something with a GUI.

Basically, when pointing out security problems, I find that people are much more likely to actually listen if you present an alternative action. I will probably just use sftp from the command-line, but that won't fly for some.

Re: Filezilla installer is suspicious again

#253
post #166
post #103

Earlier quoted context omitted.

Hey, mine too! I actually had that, reformatted, it was fixed for a while, and it's back to doing it again. The worst part is when windows will start ignoring my request to delay updates to the weekend, and will begin restarting my computer during the week whenever I walk away from it for too long.

One of the most frustrating parts of Win10 is the update scheduling. You can request that an update be delayed, but the OS does not always honor the request as specified (settings - update & security - windows update - active hours). In Win10 Pro, you can postpone an update for max 35 days (windows update - advanced options - pause updates), but never indefinitely. If a pending update will break your machine (and you…

Best advice for your situation: Assign the Windows Update service to an account (which doesn't have to exist in your Windows install [like ".\FFFFFFFFF"] ) and it will never succeed with updates again. You can remove the account and let it run as System if you want to restore Windows Updates functionality.

Re: Filezilla installer is suspicious again

#254
post #237

Earlier quoted context omitted.

I didn't say you work for Microsoft. I have no way of knowing that, and it doesn't seem likely. But you can't use HN exclusively to promote one company over others. The reasons ought to be obvious.

Here is more proof that I'm not promoting for MS https://www.google.com/search?q=niveageforge+pen+issue+site:... I'm the most vocal about this pen issue, that could potentially cost MS billions of dollars if they need to recall those devices. I once posted a pen issue thread that got banned from /r/Microsoft once. https://www.reddit.com/r/microsoft/comments/82ilso/the_worka...

I don't disbelieve you but from our point of view it is beside the point. The point is that you've used HN primarily to argue for one company, and that's a serious abuse of this site. And we don't allow agenda-driven accounts or single-purpose accounts in general.

Re: Filezilla installer is suspicious again

#255
post #178
post #71

Earlier quoted context omitted.

Getting off platforms is usually quite hard with most trying to be as sticky as possible. The common reason why people tend to stick to Windows is games, even if the situation has gotten better. Personally I have come to the conclusion that the best solution is virtual machines with a linux base system. Put every game that is sticky to windows into its own little container and just have hardware passed through. That…

The opposite is true for my purposes... I run linux and then use virtualbox to run windows 10 for the only app i'm using windows for, which is QuickBooks. I gave up on closed source software decades ago. With Windows, every six months you have to reinstall your machine because of malware and of course the hour(s) of lost productivity per day compared to linux. Good luck with that.

> With Windows, every six months you have to reinstall your machine because of malware

This is only true if you're careless or technically inept.

> of course the hour(s) of lost productivity per day compared to linux

I don't lose any productivity by using Windows. Not sure where you're getting this from.

Re: Filezilla installer is suspicious again

#256
post #254

Earlier quoted context omitted.

Here is more proof that I'm not promoting for MS https://www.google.com/search?q=niveageforge+pen+issue+site:... I'm the most vocal about this pen issue, that could potentially cost MS billions of dollars if they need to recall those devices. I once posted a pen issue thread that got banned from /r/Microsoft once. https://www.reddit.com/r/microsoft/comments/82ilso/the_worka...

I don't disbelieve you but from our point of view it is beside the point. The point is that you've used HN primarily to argue for one company, and that's a serious abuse of this site. And we don't allow agenda-driven accounts or single-purpose accounts in general.

I just happen to be very enthusiastic about hybrid 2-in-1s and pen computing (which most of my comments are actually about), which happens to be best supported on Windows, my primary OS.

I also support forward looking OS architectures, such as ChromeOS and especially Fuschia.

https://news.ycombinator.com/item?id=17053858

And the web as an OS platform.

https://news.ycombinator.com/item?id=17071867

And here I praised Safari on iOS.

https://news.ycombinator.com/item?id=15412075

Also, there are plenty of things I don't like about Microsoft, such as not educating devs what WSL is really about.

https://news.ycombinator.com/item?id=17073777

As you can see, I support forward looking stuff, regardless of which company it's from.

Re: Filezilla installer is suspicious again

#257
post #227
post #141

Earlier quoted context omitted.

let's do it.

https://github.com/rain-1/filezilla-ng

Is this doing assembly in the installer and getting window handles directly, then calling old school offsets into Win32 structs with DLL'd functions I don't see the source to?

Am I reading this right? It sets off my "malicious stuff" alarm but I'm not a security wonk.

https://github.com/rain-1/filezilla-ng/blob/master/data/offe...

We need to cut all that trash out.

Re: Filezilla installer is suspicious again

#258

I install filezilla (amongst other things) from ninite.com. In general ninite.com installation is equivalent to normal installation without having to carefully uncheck obviously horrid and unwanted optional "extras".

I wasn't sure which version Ninite were using or if they were aware of the suspicious installer, so I wrote them a mail referencing this thread. They wrote back a couple hours later (and I'm not even a Pro user!):

> Apparently FileZilla has more than one installer package. The discussion in the [HN] forum link is about their "bundled" installer. We use the one without the junk-ware bundled. Below are links to the virustotal results for the packages we use.

https://www.virustotal.com/#/file/92aa946d4127eeef30b428e86b...

https://www.virustotal.com/#/file/a86a836888e9894215e15da49e...

Post reply on HN