4 ms·

Outside the filehash thing there isn't anything wrong with his responses. The project chose to get third party products from sources outside their control. Th

Outside the filehash thing there isn't anything wrong with his responses. The project chose to get third party products from sources outside their control. There is nothing "technically" wrong with it. The thread is littered with poor security practices, but I see TightW's response as more painful. The admin is already clearly aware of the concern and is stating why it is setup that way. I would much rather see somebody state the practices are wrong rather than just calling this guy out since it is really counter-productive.

verroq 8y ago
If your software installer bundles crapware for any reason then you've completely lost the plot and nobody should trust your software ever again.
- code_duck 8y ago
  Personally, I abandoned FileZilla after the prior incidents and would never consider installing it again.
- DmenshunlAnlsis 8y ago
  Admin of FileZilla, Your reactions to this post deeply concern me. I do believe this is a serious problem you should at least entertain investigating whomever you have an agreement with in regards to bundling their stuff into your installer. Those domains its communicating with have several hits on known malware/RATs reports. For instance, https://www.maltiverse.com/sample/a98b1 https://www.maltiverse.com/sample/a98b1 ... 38233c50b7. Here is another that spawns the same type of .exe which turns out to be NJRAT malware -> https://www.hybrid-analysis.com/sample/ https://www.hybrid-analysis.com/sample/ ... mentId=120 Your defensive attitude is what alarms me the most. Almost as if you might care more about your bundle agreement profits than your users security/safety. Hole in one. I wouldn’t trust those admins to make me a cup of tea, and I agree that their attitude reeks of deception for selfish reasons. Nobody should ever trust their software again, full stop.
  - ksk 8y ago
    I don't support crapware but I'm not going to tell someone how they should make their living. That post looks like rabble rousing to me. I have yet to see any factual information except a whole lot of "it seems" "it appears" "I believe". I'd rather reserve judgement till the facts emerge.
    - dahdum 8y ago
      If it were the first instance of this with Filezilla, and the admin response wasn't dismissive, I'd agree with you. They earned their reputation as untrustworthy.
      - ksk 8y ago
        Which facts did they dismiss? I just saw a lot of rabble rousing..
        gmueckl 8y ago
        The admin's replies are clever smokescreens: they stay neatly of the periphery of the matter and avoid giving actual answers to the questions being posed. Whoever wrote these replies would probably do well in politics.
    - michaelmrose 8y ago
      If I see someone being immoral I'm going to tell them "how to make their living" not because I hope they are going to be so inspired as to change for the better because you and I both know that's not going to work. I do so because I hope other people will listen and stop doing business with them leading to a decrease in profit and THEN changed behaviour from the culprit. There is lots of factual information. They are factually doing a lot of malware like behaviour in their installer and bundling software from questionable sources they have no control over. At best they are putting their customers at risk. The only facts that can possible emerge is that its actually worse and customers are getting their identities stolen or some such. Rabble rousing is literally the only way anything gets fixed.
- ksk 8y ago
  There is pretty much no freeware download site that doesn't bundle crapware. I guess all freeware is untrustworthy by your logic. https://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving-crapware-heres-the-proof/ https://www.howtogeek.com/207692/yes-every-freeware-download...
  - rspeer 8y ago
    Oh my god. You're talking to competent computer users on Hacker News, not people who use crapware download sites and need to be warned away from them by "HowToGeek". Of course there is trustworthy freeware. You can get it using Apt, Yum, Ninite, Chocolatey, Homebrew, or just by going to the actual site of a trustworthy software product. The fact that the people who run most download sites are scum isn't a problem with the software. It's a problem with those sites.
    - ksk 8y ago
      Um, the download section on the vendors website contains the text "This installer may include bundled offers. Check below for more options." https://imgur.com/a/Xrc1jMy https://imgur.com/a/Xrc1jMy You can download FileZilla without the bundled "offers". If the average hacker news reader is capable of doing that, then whats left is just a criticism of ALL bundled installers, in which case, pick a number and join the queue.
      - rspeer 8y ago
        HN readers are capable of not using FileZilla, because its admin is actively trying to mislead its users into running malware. Are you associated with FileZilla? Why are you here bringing out the "everyone is doing it" defense?
        ksk 8y ago
        >HN readers are capable of not using FileZilla, because its admin is actively trying to mislead its users into running malware. Then your prior comment makes no sense to me. >Of course there is trustworthy freeware. You can get it using Apt, Yum, Ninite, Chocolatey, Homebrew, or just by going to the actual site of a trustworthy software product. If you don't use the crapware downloader, then the vendor doesn't get any money. I noted that pretty much all freeware is bundled like so, including your "trustworthy" software, on various other download sites. Then the only way the vendor can stay in business is if enough people download the crapware version. >Are you associated with FileZilla? Huh? Why are you asking, and why would it matter? >Why are you here bringing out the "everyone is doing it" defense? I am not. Its your interpretation that's flawed.
jlgaddis 8y ago
It's threads like these that remind me, quite clearly, that not everyone shares the same ethics that I do.

verroq 8y ago

If your software installer bundles crapware for any reason then you've completely lost the plot and nobody should trust your software ever again.

code_duck 8y ago
Personally, I abandoned FileZilla after the prior incidents and would never consider installing it again.
DmenshunlAnlsis 8y ago
Admin of FileZilla, Your reactions to this post deeply concern me. I do believe this is a serious problem you should at least entertain investigating whomever you have an agreement with in regards to bundling their stuff into your installer. Those domains its communicating with have several hits on known malware/RATs reports. For instance, https://www.maltiverse.com/sample/a98b1 https://www.maltiverse.com/sample/a98b1 ... 38233c50b7. Here is another that spawns the same type of .exe which turns out to be NJRAT malware -> https://www.hybrid-analysis.com/sample/ https://www.hybrid-analysis.com/sample/ ... mentId=120 Your defensive attitude is what alarms me the most. Almost as if you might care more about your bundle agreement profits than your users security/safety. Hole in one. I wouldn’t trust those admins to make me a cup of tea, and I agree that their attitude reeks of deception for selfish reasons. Nobody should ever trust their software again, full stop.
- ksk 8y ago
  I don't support crapware but I'm not going to tell someone how they should make their living. That post looks like rabble rousing to me. I have yet to see any factual information except a whole lot of "it seems" "it appears" "I believe". I'd rather reserve judgement till the facts emerge.
  - dahdum 8y ago
    If it were the first instance of this with Filezilla, and the admin response wasn't dismissive, I'd agree with you. They earned their reputation as untrustworthy.
    - ksk 8y ago
      Which facts did they dismiss? I just saw a lot of rabble rousing..
      - gmueckl 8y ago
        The admin's replies are clever smokescreens: they stay neatly of the periphery of the matter and avoid giving actual answers to the questions being posed. Whoever wrote these replies would probably do well in politics.
  - michaelmrose 8y ago
    If I see someone being immoral I'm going to tell them "how to make their living" not because I hope they are going to be so inspired as to change for the better because you and I both know that's not going to work. I do so because I hope other people will listen and stop doing business with them leading to a decrease in profit and THEN changed behaviour from the culprit. There is lots of factual information. They are factually doing a lot of malware like behaviour in their installer and bundling software from questionable sources they have no control over. At best they are putting their customers at risk. The only facts that can possible emerge is that its actually worse and customers are getting their identities stolen or some such. Rabble rousing is literally the only way anything gets fixed.
ksk 8y ago
There is pretty much no freeware download site that doesn't bundle crapware. I guess all freeware is untrustworthy by your logic. https://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving-crapware-heres-the-proof/ https://www.howtogeek.com/207692/yes-every-freeware-download...
- rspeer 8y ago
  Oh my god. You're talking to competent computer users on Hacker News, not people who use crapware download sites and need to be warned away from them by "HowToGeek". Of course there is trustworthy freeware. You can get it using Apt, Yum, Ninite, Chocolatey, Homebrew, or just by going to the actual site of a trustworthy software product. The fact that the people who run most download sites are scum isn't a problem with the software. It's a problem with those sites.
  - ksk 8y ago
    Um, the download section on the vendors website contains the text "This installer may include bundled offers. Check below for more options." https://imgur.com/a/Xrc1jMy https://imgur.com/a/Xrc1jMy You can download FileZilla without the bundled "offers". If the average hacker news reader is capable of doing that, then whats left is just a criticism of ALL bundled installers, in which case, pick a number and join the queue.
    - rspeer 8y ago
      HN readers are capable of not using FileZilla, because its admin is actively trying to mislead its users into running malware. Are you associated with FileZilla? Why are you here bringing out the "everyone is doing it" defense?
      - ksk 8y ago
        >HN readers are capable of not using FileZilla, because its admin is actively trying to mislead its users into running malware. Then your prior comment makes no sense to me. >Of course there is trustworthy freeware. You can get it using Apt, Yum, Ninite, Chocolatey, Homebrew, or just by going to the actual site of a trustworthy software product. If you don't use the crapware downloader, then the vendor doesn't get any money. I noted that pretty much all freeware is bundled like so, including your "trustworthy" software, on various other download sites. Then the only way the vendor can stay in business is if enough people download the crapware version. >Are you associated with FileZilla? Huh? Why are you asking, and why would it matter? >Why are you here bringing out the "everyone is doing it" defense? I am not. Its your interpretation that's flawed.

jlgaddis 8y ago

It's threads like these that remind me, quite clearly, that not everyone shares the same ethics that I do.