Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Filezilla installer is suspicious again

forum.filezilla-project.org

Post reply on HN
Print view View original

51–60 of 258 posts

Re: Filezilla installer is suspicious again

#51

Post by ourmandave »

michaelmrose wrote: post #18

Botg site admin "The hash doesn't match because the filename doesn't match." A fully descriptive answer is that they don't have a checksum for the bundled package but botg doesn't want to say this. " Dangerously ignorant user. Not matching filename = the checksum is NOT for that file. Checksums can only be provided for the non-bundled packages, because they're static. Bundled installers are not." Dangerously ignorant…

Its truly amazing to me that installing windows software is still like this.

You think this is bad, you should try the Windows 10 auto updater.

Disclaimer: It's broken on my brand new PC and no helpful on-line fix has worked so far. So I might hold hate in my heart.

Re: Filezilla installer is suspicious again

#52

Post by ksk »

rspeer wrote: post #38
ksk wrote: post #30

Earlier quoted context omitted.

Um, the download section on the vendors website contains the text "This installer may include bundled offers. Check below for more options." https://imgur.com/a/Xrc1jMy You can download FileZilla without the bundled "offers". If the average hacker news reader is capable of doing that, then whats left is just a criticism of ALL bundled installers, in which case, pick a number and join the queue.

HN readers are capable of not using FileZilla, because its admin is actively trying to mislead its users into running malware. Are you associated with FileZilla? Why are you here bringing out the "everyone is doing it" defense?

>HN readers are capable of not using FileZilla, because its admin is actively trying to mislead its users into running malware.

Then your prior comment makes no sense to me.

>Of course there is trustworthy freeware. You can get it using Apt, Yum, Ninite, Chocolatey, Homebrew, or just by going to the actual site of a trustworthy software product.

If you don't use the crapware downloader, then the vendor doesn't get any money. I noted that pretty much all freeware is bundled like so, including your "trustworthy" software, on various other download sites.

Then the only way the vendor can stay in business is if enough people download the crapware version.

>Are you associated with FileZilla?

Huh? Why are you asking, and why would it matter?

>Why are you here bringing out the "everyone is doing it" defense?

I am not. Its your interpretation that's flawed.

Re: Filezilla installer is suspicious again

#53

Post by gmueckl »

ksk wrote: post #33
dahdum wrote: post #25

Earlier quoted context omitted.

If it were the first instance of this with Filezilla, and the admin response wasn't dismissive, I'd agree with you. They earned their reputation as untrustworthy.

Which facts did they dismiss? I just saw a lot of rabble rousing..

The admin's replies are clever smokescreens: they stay neatly of the periphery of the matter and avoid giving actual answers to the questions being posed.

Whoever wrote these replies would probably do well in politics.

Re: Filezilla installer is suspicious again

#54

Post by guessmyname »

skolemtotem wrote: post #45
guessmyname wrote: post #41

Earlier quoted context omitted.

I don't see why, being on Linux, you would prefer to use FileZilla to transfer files to a remote machine over an insecure protocol when there are plenty of alternatives with better security. Rsync, for example, allows you to specify an SSH key. Or SCP, which also offers the same functionality.

Familiarity and consistency across platforms are two obvious reasons that come to mind. Another is that it's easier for those unfamiliar with a terminal.

Most, if not all, Linux distributions allow you to FTP into a remote machine using the file manager.

Nautilus, Gnome's file manager, have offered this functionality for several years.

> Another is that it's easier for those unfamiliar with a terminal

That's a weird thought considering that the parent comment is using Linux.

Re: Filezilla installer is suspicious again

#56

Post by guessmyname »

zeth___ wrote: post #43
guessmyname wrote: post #41

Earlier quoted context omitted.

I don't see why, being on Linux, you would prefer to use FileZilla to transfer files to a remote machine over an insecure protocol when there are plenty of alternatives with better security. Rsync, for example, allows you to specify an SSH key. Or SCP, which also offers the same functionality.

This is a really toxic attitude in the open source community where when asked a question the answer is: "you're doing it wrong, just do it right". If I had a choice I would, but unless you have a few million dollars to give us to refactor 30 years of technical debt, please answer the question.

> you're doing it wrong, just do it right

That's not how I wrote my comment above, I gave you alternatives.

> If I had a choice I would

You have choices, many.

> unless you have a few million dollars to give us to refactor 30 years of technical debt

How is using FileZilla a technical debt? What are you requiring from FileZilla that you need a few million of dollars to refactor code? What kind of code depends on an external FTP client to work? If you give more details about why your company has such a weird technical debt, maybe I or other can give you more options to switch.

> please answer the question

I did, you asked for alternatives, I gave you Rsync and SCP.

Re: Filezilla installer is suspicious again

#57

Post by mintplant »

loganabbott wrote: post #29

FYI the SourceForge version of FileZilla is clean, and has been since 2016. The official FileZilla installer has been doing this for some time now though. In case people don’t know, a lot has changed at SourceForge since my company acquired them in 2016. All projects are scanned for malware. We covered the improvements again here https://sourceforge.net/blog/brief-history-sourceforge-look-...

Yet this happened with your company at the helm:

https://medium.com/@jonykatz/sourceforge-hiding-fact-that-th...

Re: Filezilla installer is suspicious again

#58

Post by ksk »

Joeri wrote: post #40
ksk wrote: post #26

Earlier quoted context omitted.

Vendors who have partaken in the "bundled crapware" model of distribution - Google, Amazon, Yahoo, Microsoft, Adobe, Oracle, etc, etc. >They have decided that tricking people into downloading malware is a reasonable alternative to charging money for their software or soliciting donations. If you would be so kind enough as to show them how to make money perhaps they'll stop doing it. >Its truly amazing to me that inst…

I got tricked into installing adware as part of a java install, and took me many hours to get it back off my system. I don’t get why microsoft isn’t pushing all these vendors really hard to distribute through the windows store. The windows store is a graveyard compared to the mac app store, despite having a head start and a bigger target audience, and it’s basically impossible to use windows without sideloading apps.…

Because nobody really wants to give the AppStore 30% of their revenue. Having it be a percentage of the revenue instead of just a flat fee means its just a money-grab IMHO. Ironically Apple is arguing in court that Qualcomm is doing the same thing to them (charging a percentage based on retail pricing) and that the price is unfair.

Re: Filezilla installer is suspicious again

#59

Post by michaelmrose »

skolemtotem wrote: post #42
michaelmrose wrote: post #36

Earlier quoted context omitted.

I would rather they go out of business if they can't figure out another way to make money. You CAN install binaries on other platforms but on for example linux distros their is a curated platform of packages where you can get most/all software. The fact that this is the default way to install software and regular users don't need to look beyond the official repos is why installing software on linux isn't this kind of…

> I would rather they go out of business if they can't figure out another way to make money. Only for some other unscrupulous company to replace them? Ideally, the most profitable method should be ethical by nature, unlike the current situation in software (and games, of course) where the most profitable methods are among the least ethical.

Ideally we can support good software by donating to it but this is challenging to. Perhaps a software store for various platforms that defaults to charging money for open source software you haven't already paid for. Let the user set a multiplier that effects the price so it is reasonable for that user and let the user also change the price if they desire. They CAN pay zero for insert filezilla competitor here but the default is 3.99. This is probably already more than for example filezilla makes for selling out their users.

Re: Filezilla installer is suspicious again

#60

Post by giancarlostoro »

e2e8 wrote: post #22

It is still possible to get non bundled versions of filezilla by clicking "Show additional download options" rather than clicking the big download button. Whether or not to continue to use filezilla or to trust that that software is really clean is another matter.

Let's be honest a lot of people wont suspect the main recommended download to be sketchy until it's too late in some cases.
Post reply on HN