Trojan found in Filezilla downloaded from SourceForge • Hacker News Board

Re: Trojan found in Filezilla downloaded from SourceForge

#81

Post by krylon » Thu, Dec 03, 2015, 12:21 PM UTC

jmnicolas wrote: post #10

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

I use WinSCP. I cannot say much about technical differences, but it has worked well for me.

Also, PuTTY comes with a SFTP/SCP client, and unless there are strong reasons you cannot use SFTP, it is a lot better than FTP, security-wise (does not transmit passwords in plain text and allows using cryptographic keys rather than passwords; in fact, on OpenSSH you can configure the server to deny password authentication completely; and the entire connection is encrypted, of course).

Re: Trojan found in Filezilla downloaded from SourceForge

#82

Post by tokenizerrr » Thu, Dec 03, 2015, 12:25 PM UTC

dagw wrote: post #53

agildehaus wrote: post #24

SourceForge and Filezilla are both on their way out, hence their owners desire to monetize their remaining users while they still can. WinSCP is a decent alternative. As is Swish: http://www.swish-sftp.org/ https://github.com/alamaison/swish

I've found WinSCP's performance lagging quite a bit behind FileZilla, especially when it comes to up/downloading 1000s of files at a time.

Same, it's much slower.

Re: Trojan found in Filezilla downloaded from SourceForge

#83

Post by yitchelle » Thu, Dec 03, 2015, 12:25 PM UTC

IshKebab wrote: post #79

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

Looks nice!

The source code running it - https://github.com/CyberShadow/DFeed

Re: Trojan found in Filezilla downloaded from SourceForge

#84

Post by manveru » Thu, Dec 03, 2015, 12:26 PM UTC

acd wrote: post #42

There is a safer way install FileZilla through ninite installer or chocolately https://ninite.com/filezilla Chocolatey nuget is similar to Linux package managers but for Windows programs https://chocolatey.org choco install filezilla

Please don't recommend chocolatey for this reason. While it's excellent, you should probably check the install file first: https://chocolatey.org/packages/filezilla (and click "show" on "tools\chocolateyInstall.ps1")

You don't see the installer UI, but it still downloads from sourceforge because that's where the executables are stored.

Re: Trojan found in Filezilla downloaded from SourceForge

#85

Post by level3 » Thu, Dec 03, 2015, 12:27 PM UTC

huuu wrote: post #16

Jonnerz wrote: post #7

It's done intentionally to make the owners a bit of money. They have direct download links on their website (click show all on download page), avoid the green Sourceforge link.

Nope, all links direct to Sourceforge.

Yes, all the downloads are hosted on Sourceforge, but Jonnerz is pointing out that the additional links come without the Sourceforge wrapper (the links will have "?nowrap" at the end).

We all wish FileZilla would just drop Sourceforge completely, but at least the non-wrapped versions are still available.

Re: Trojan found in Filezilla downloaded from SourceForge

#86

Post by JupiterMoon » Thu, Dec 03, 2015, 12:31 PM UTC

DanBC wrote: post #36

> If someone really wanted to download FileZilla and skip the malware do just that. > Then after installation is complete install Malware bytes and Avira. Scan with both and restart the computer. > Then run with ADWcleaner and and remove the infections and restart. should be good from there and enjoy FileZilla. Do people really think this works? I mean, there's no-one on HN who thinks this works, right?

A depressing number of my friends and family have an absolute trust in their security software and will rely on it to do exactly this.

Re: Trojan found in Filezilla downloaded from SourceForge

#87

Post by daurnimator » Thu, Dec 03, 2015, 12:39 PM UTC

IshKebab wrote: post #79

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

D has the best mailing list interface in the world by an enormous margin . http://forum.dlang.org/ (The forum is a front-end to the mailing lists / newsgroups.)

FWIW, I find the information density of this site quite low. When I visit these archives I'll generally read with via the gmane frame interface.

Re: Trojan found in Filezilla downloaded from SourceForge

#88

Post by tomaac » Thu, Dec 03, 2015, 12:40 PM UTC

jmnicolas wrote: post #10

No way I'm supporting this kind of behavior. Can you suggest an alternative to FileZilla ?

https://cyberduck.io/

They have some issues with SSL certificate, though.

Re: Trojan found in Filezilla downloaded from SourceForge

#89

Post by teh_klev » Thu, Dec 03, 2015, 12:41 PM UTC

manveru wrote: post #84

acd wrote: post #42

There is a safer way install FileZilla through ninite installer or chocolately https://ninite.com/filezilla Chocolatey nuget is similar to Linux package managers but for Windows programs https://chocolatey.org choco install filezilla

Please don't recommend chocolatey for this reason. While it's excellent, you should probably check the install file first: https://chocolatey.org/packages/filezilla (and click "show" on "tools\chocolateyInstall.ps1") You don't see the installer UI, but it still downloads from sourceforge because that's where the executables are stored.

Unless ninite is building everything from source where do you think it's getting the installer binaries?

Re: Trojan found in Filezilla downloaded from SourceForge

#90

Post by daurnimator » Thu, Dec 03, 2015, 12:42 PM UTC

aldanor wrote: post #21

scrollaway wrote: post #8

Something came up last time Sourceforge was discussed here, namely "why are projects still using it?"... I'm the project lead for LXQt ( http://lxqt.org ). We inherited some infrastructure legacy from LXDE, which was hosted on sourceforge. Today, we have moved most of the legacy to Github but we're still using Sourceforge's mailing list system. We're moving to a self-hosted mailman3 instance but it's been excruciatin…

Why mailing lists are still quite massively popular in 2015?..

Why shouldn't they be?

If I want long-form messages delivered asynchronously, what other choices do I have (forums?) and why are they better than mailing lists? (everyone already has an email client.)