16 ms·

FileZilla now contains adware if you download from the official homepage

542 points by URfejk 6y ago

ToFab123 6y ago
It has been like that for a long time. Many years I believe. There is an option to download clean versions on their website. "Download > Show Additional download options" is the page you are after. https://filezilla-project.org/download.php?show_all=1 https://filezilla-project.org/download.php?show_all=1 If you check the filename of the windows installer you download from the frontpage the name is FileZilla_Version_Sponsored-setup.exe The installer available from the link above does not contain the word "Sponsored" and the installer is 2.5 MB smaller. Additional. Windows Defender tries it best to prevent you from installing the version found on the frontpage due to the adware. It has no issues with the other installer.
- deskamess 6y ago
  Does this impact the Filezilla server or just the client?
- buffet_overflow 6y ago
  We've had to ban the application entirely from our work machines. At least when we went through review, even the "clean" versions packaged things that tripped our antivirus software, and at that point, we as an organization decided to stop trusting the author entirely. There's quite a lot of forum posts where the author defends this practice, so we don't see this reversing any time soon.
  - tgsovlerkhgsel 6y ago
    I'm surprised nobody made a forked commercial version yet. Remove the adware, replace the logo, sell commercial licenses.
    - m-p-3 6y ago
      There's FileZilla Pro. https://filezillapro.com/ https://filezillapro.com/
      - randerson 6y ago
        As someone who is happy to pay for good software, I can't ever see myself buying a paid version of something (no matter how good it might be) if the author has a history of using dark patterns and showing their apparent contempt for their users with the "free" edition. I'd be constantly wondering what other traps might be lurking in there.
        Brian_K_White 6y ago
        Right. The fact that you can get around something, or that someone failed to do something to you is not the important thing. What matters far more is the fact that they tried and wanted to.
  - m-p-3 6y ago
    We packaged it ourselves and made it available as an SCCM bundle, since users don't have admin rights on their systems anyway.
- grawprog 6y ago
  >If you check the filename of the windows installer you download from the frontpage the name is FileZilla_Version_Sponsored-setup.exe Damn...that reminds me of the old days of sneaky checkboxes hidden in installers, usually actually hidden, that would be pre-checked confirming your consent to whatever ad/spyware to be installed alongside whatever you wanted to install. I remember that shit being everywhere for a few years. Got tricked by them once or twice and had a hell of a time cleaning things up after.
  - jasonwatkinspdx 6y ago
    Yeah, the one I remember was RealPlayer, which during the install wizard had a list of check boxes. The ones initially visible were unchecked, but if you scrolled you'd find the spam consent ones were checked.
    - hnrodey 6y ago
      RealPlayer... RealAudio... immediately jettisoned back to the 90's :)
  - oth001 6y ago
    Adobe Reader comes to mind
    - Fnoord 6y ago
      Java...
- userbinator 6y ago
  Windows Defender tries it best to prevent you from installing the version found on the frontpage due to the adware. ...as if Windows (10) itself didn't contain any. More than 2.5MB of it, no doubt! How ironic to see the pot calling the kettle black. Edit: if you don't believe me, search around here and elsewhere for "Windows 10 adware". I'm surprised that this is even a controversial comment.
  - deleted 6y ago
    [deleted]
  - WolfRazu 6y ago
    There are no relevant search results for "windows 10 adware". Can you be more specific?
    - viraptor 6y ago
      In the start menu you automatically get stubs for apps like Candy crush, Adobe CC, and others. You never requested them but they'll install on first use.
  - monsieurbanana 6y ago
    Is it really a controversial comment? Or are people just tired of hearing the same "but Microsoft does this this and this" everytime something positive comes up? Are you saying we all should switch away from Microsoft right this instant? If you aren't, then what? Let's boycott windows defender? Make our windows experience even worse? That will show them.
- Underphil 6y ago
  Came here to say this. There's been adware in the official download for what feels like 7-10 years now.
- johnmaguire 6y ago
  You could also download it with Ninite. Nothing downloaded with Ninite will install the sponsored versions of software.
- stjohnswarts 6y ago
  If you're using filezilla on windows only (not cross platform) then winscp is a great replacement. No worries about ads or repackaging.
  - thefz 6y ago
    WinSCP is great and I find myself using it more and more over FileZilla. I wish there was a WinSCP equivalent for Linux too.
    - Fnoord 6y ago
      Really depends what you use it for (dual pane SSH file manager/FTP file manager/file manager). You can do this with Nautilus or Fman plus GNOME if you want to, since gvfs abstracts protocols such as FTP, SSH, SMB, ... On Windows you go such as well, including Fuse/Dokan, and on macOS you got MacFuse. Hence on macOS I use (by default CLI but if that does not cut it) Finder/Fman, and if that doesn't work, Cyberduck. Fman and Cyberduck also work on Windows, on Linux Cyberduck does not work but Fman does. CrossFTP might also work for you, as might Wine. I'm not sure about all features, such as FXP (which is insecure anyway, and only used in scene).
code_duck 6y ago
While the phrasing implies this is new, here's an discussion about the issue from 2018. https://news.ycombinator.com/item?id=17381184 https://news.ycombinator.com/item?id=17381184 An article from 2018... https://www.bleepingcomputer.com/news/security/filezillas-use-of-bundled-offers-sparks-outrage-from-users/ https://www.bleepingcomputer.com/news/security/filezillas-us... A question about it on their forum from over 4 years ago https://forum.filezilla-project.org/viewtopic.php?t=42791 https://forum.filezilla-project.org/viewtopic.php?t=42791
- lioeters 6y ago
  From the last link, the exchange went like this.. User: Just downloaded filezilla from the "official site". This one and was infected by adware which trashed my browser. WTF. I have trusted filezilla for years this is MOST Disappointing. Admin: The offer-enabled installer may display third-party offers during installation. Nothing is installed without your prior consent. In case you have accidentally agreed to an offer, you can completely uninstall it from Windows' Add/Remove Programs dialog. If you do not wish to use the offer enabled installer, have a look at the additional download options page.
  - EMM_386 6y ago
    > The offer-enabled installer may display third-party offers during installation. Nothing is installed without your prior consent. In case you have accidentally agreed to an offer, you can completely uninstall it from Windows' Add/Remove Programs dialog. Except in looking into it further, there was a particular sketchy offer that was being sent called "Search Bundle" that was completely opaque, put what is essentially an APT on the machine, and was not listed in Add/Remove programs. The other applications (Firefox, Opera, etc) seemed to allow for normal uninstallation, but not that one.
  - Brian_K_White 6y ago
    It's even a bit worse than that. You already probably imagine that the installer has default-selected checkbox that will install something extra if you don't catch it and deselect it. But what surprised me was, it actively reacts and tries again if you do catch it. If you don't stop it, it installs something extra. Straightforward. But if you DO stop it, it then tries to install a 2nd, different extra unwanted crap. There are 2 things in the installer from the get-go, but it only hits you with the 2nd one if you managed to catch and decline the 1st one. That's a whole special extra level of actively attempting to trick and decieve. That is crossing a line from at least plausible deniability that it's just a passive annoyance, into activly adversarial behavior against your own users.
willis936 6y ago
In case anyone out there hasn’t moved on: WinSCP is better than FileZilla ever was.
- sunsipples 6y ago
  any chance you know of something comparable for linux? I have tried a half dozen or so in last few months and keep coming back to filezilla, maybe it's because it's familiar, but always like options.
  - blfr 6y ago
    I use lftp. The website design tells you exactly how the tool works. https://lftp.yar.ru/ https://lftp.yar.ru/ One of the most valuable features is its ability to download a single file over multiple connections pget -n 4 your.file.tar.gz because many ISPs limit speed per flow and opening multiple of them, even to the same target, allows you to max out your connection.
    - sunsipples 6y ago
      appreciated, thank you
    - lathiat 6y ago
      I use this all the time not due to ISP limits but in Australia the 200-400ms latency limits you instead especially as you go over 50Mbit. Mirror command is also great :)
    - dmoo 6y ago
      +1 for lftp. On windows I use it via Cygwin for scheduled tasks etc. FileZilla has a speed advantage over winscp but nothing like the flexibility.
  - Macha 6y ago
    Your file manager probably does FTP. Try enter a [s]FTP[s]:// URL into your location field. Depending on your distro, for gnome or derivatives you might have to install a gvfs plugin package first.
gspr 6y ago
I occasionally use this software through Debian's package for it, which of course doesn't contain the adware. But the strategy employed here does leave me with a bit of a sour taste and a desire to stop using the software altogether.
- swiley 6y ago
  Most graphical DE shells on Linux will just mount sftp (scp/ssh) graphically, no need for stuff like this. People still say Linux DEs aren't user friendly but IMO they're much more so than other OSes largely because other OSes have a moat to protect.
  - sgc 6y ago
    I use FileZilla on Linux because the file manager integrated ftp clients were not very good, and did not save connections etc. Just less of a PITA. I see I should try gftp or another alternative though.
    - swiley 6y ago
      I'd imagine it's wrapping ssh which will reuse connections if you tell it to in your ssh config. I use that heavily on my mobile computers.
- deskamess 6y ago
  I wonder if the Chocolatey version has the adware.
- arbitrage 6y ago
  don't hate the player, hate the game. this is the result of parasitic capitalism. i have no doubts that a dev who contributed so strongly to the opensource ecosystem for such a long time specifically wants to be in this situation. you wouldn't, i don't, they probably don't. how else are we supposed to support our families and the community? there's no other source of revenue or support for a freelance programmer in caretaker mode for a mature and stable codebase. donations don't cut it, obviously.
DpdC 6y ago
As has already been said, this is not news, nor is it a change, it is not news. It is not even something, that can be reprehensible to the people who maintain the Filezilla project. Funny to see people who have been using the software for half their lives, criticizing this. This can only surprise someone who installed filezilla for the first time, or had not installed it for half a lifetime.. So crazy.
- Macha 6y ago
  Some of the software the adware installer requires an opt out to not install can be harmful or hard to remove, like the "Search Offer powered by Bing" in the article linked elsewhere in this site. Even the free AVs will often start you as a trial for the paid version or have incredibly easy ways to convert your install to such a trial and nag the user to pay up once the trial expires, arguably reducing their computer security. I know HN has a strong libertarian bent, and uou could argue this is a free market, buyer beware situation, but in that case, wouldn't the criticism posted be part of that and how buyers know that they should beware?
  - noxer 6y ago
    So the people who dont know better pay for stuff they dont need? Sounds like literally everything else. Most people who buys cars dont know anything about cars and thus they likely overpay. This sucks but its in fact a "free market" thing.
    - yjftsjthsd-h 6y ago
      A free market, according to my econ prof at least, has: 1. easy entrance/exit to the market, 2. many buyers and sellers, and 3. perfect information availability. If the players don't have good information, it is at best a severely degraded free market.
      - noxer 6y ago
        All the infos about cars are easily available. It chances nothing, most buyers of car simply dont care enough to get fundamental knowledge about cars. If you would value the time it takes for an average car buyer to get fundamental knowledge it would cost way more than what they overpay so unless you already have above average knowledge it makes no sense to dig into it. You are better off asking someone who has the knowledge and no incentive to fool you aka a friend not the sale person.
rubyist5eva 6y ago
Wow, I just switched to Transmit a few weeks ago from years of using Filezilla...looks like I dodged a bullet.
- notsuoh 6y ago
  Filezilla has been like this for years assuming you downloaded the regular version. There's a no-adware version, but it's kinda hidden.
  - rubyist5eva 6y ago
    I usually got it from brew cask, not sure which "version" it downloaded - never saw any ads in it, myself but either way - I'd rather just not deal with a scummy project anymore.
    - kergonath 6y ago
      Only the version downloaded from the developer’s website included malware. Versions in various repositories are fine.
superkuh 6y ago
Wow. I recall when this first happened because of SourceForge being sold to shady people who decided to put ad/malware loaders around the installers of all the exes hosted there (like FileZilla). But that was the early/mid-2000s. It's hard to believe it is being allowed to happen again in modern times.
- robinj6 6y ago
  SourceForge is to software as maggots are to meat. Don’t know how the people behind it have an ounce of self respect.
  - wincy 6y ago
    I’d imagine that it’s easy to drown out the sound of your conscience when you’re driving a brand new Model X and live in a big house.
  - dehrmann 6y ago
    SourceForge was a huge blunder. They were so close to being Github, but they opted to to squeeze out every last dollar, instead. ExpertsExchanges and AIM are similar--products that could have been medium-large opportunities today, but business and product choices that left an opening for a competitor. That said, I'm not convinced SourceForce could have actually been Github because it didn't have the culture, the brand was mispositioned, and it's hard to to be Github without lots of VC.
    - MrGilbert 6y ago
      Ah yes, Expert-Exchange - the site where you could simply google your way around their paywall. Never took this page too serious, tbh.
  - kergonath 6y ago
    AFAIK the new SourceForge, after they’ve been bought, is much better. Also, much less relevant now that everything is on GitHub.
varispeed 6y ago
Interestingly the applications are free to collect any personal data as they are not included in GDPR. When I requested from one company to let me export my data from the application in a human readable format or to at least send documentation of their file format, so that I can port my data to another application, they refused saying that GDPR only applies to online apps. It's possible that companies will be moving their online apps to electron or native phone apps to bypass GDPR.
- dasil003 6y ago
  IANAL but I have worked on GDPR compliance and I’m not sure how that will fly if they are phoning home. Of course the EU regulators probably won’t have bandwidth to chase these minnows but worth reporting in any case.
  - w3ll_w3ll_w3ll 6y ago
    I think in OP case the app is not phoning home. The data are still in his pc, but he would like to export it in another format. I don't think GDPR applies here, but I am not an expert.
    - dasil003 6y ago
      It's a little tricky to infer the specifics, but adware that collects personal data would be non-sensical if it doesn't phone home. In fact the whole idea of "collecting data" implies it is being sent to storage under control of the collecting entity. I think this is pretty clear cut under GDPR and there's no bypassing it based on the technicality of web app vs native app—I believe regulators learned their lesson about tight coupling to specific technical implementions with the earlier cookie laws. On the other hand, you could be write that OP is just talking about data portability in which case there is "data collection", just lack of an export feature.
  - dehrmann 6y ago
    If they don't have an EU office, I assume they can ignore GDPR because the EU has no jurisdiction.
KyleSanderson 6y ago
It has indeed been like this for nearly half a decade. To clarify, it's sourceforge that did this wrapping.
user3939382 6y ago
Tangentially related, but I had a Windows FTP client back in the day called LeechFTP that I loved and I miss it.
- WalterSobchak 6y ago
  Yep, LeechFTP was a good client for its time. I also remember running Serv-U FTP Server 2.5 on a dial-up modem back in the AOL/NetZero days. Good times.
butz 6y ago
Looking at download filenames only versions for Windows have "sponsored" variants. Can I presume that version for macOS is clean?
hakube 6y ago
You've got SFTP and rsync. There's no need for these kind of stuff if you're on Linux. Some DEs file manager are giving you the option to mount SFTP servers
- fbnlsr 6y ago
  As someone who's using Linux but not that much at ease with this, it's nice sometimes to have a GUI.
  - rocky1138 6y ago
    In KDE you can access this sort of thing with the built-in GUI file manager right out of the box. You don't need a third-party app. 1. Open Dolphin (file manager) 2. Right click in the Places section on the left to add entry 3. Type `fish://<the-address>` 4. Click OK https://www.dedoimedo.com/computers/plasma-dolphin-fish-ssh.html https://www.dedoimedo.com/computers/plasma-dolphin-fish-ssh....
  - chungy 6y ago
    As someone that's spent multiple decades living on the command line for almost all my file management... sometimes I still open the GNOME file manager because a GUI makes a select few tasks simpler. It's all about the right tool for the job. Some people are more comfortable with a GUI for the majority of file management tasks, some people are more comfortable with the CLI for the majority of file management tasks. It's just a bit silly to be a zealot and put yourself through a lot of pain if one of these isn't optimal for whatever you're trying to do.
- greggturkington 6y ago
  I was disappointed I had to scroll this far down on an HN thread to find "just use rsync!"
superted 6y ago
Any idea what kind of revenue this potentially brings in, assuming this is the rationale begins this decision? In contrast to tarnishing the Filezilla name (albeit this could mostly be controversial in the hn crowd)
- david_allison 6y ago
  Around $0.01 per active user per year from open source donations. Many factors: depends on the type of open source (infra vs user-facing) and the technical ability and geographic location of your users. PPI malware seems to go for around $0.40/install [0] [0] https://medium.com/csis-techblog/installcapital-when-adware-becomes-pay-per-install-cyber-crime-15516249a451 https://medium.com/csis-techblog/installcapital-when-adware-...
JohnTHaller 6y ago
For clarification, FileZilla itself does not appear contain adware nor has it switched to ads within the app from my analysis. The main download page for Windows installers contains a bundleware offer within the installer as you install (this offer may currently be offline). The installer filename contains the string _sponsored_. If you click through to the show additional download options, you can get all the installers without bundleware for all OSes.
- Nexxxeh 6y ago
  Also, no malware when installed by Ninite, which I imagine is how many of us get it on our systems.
  - JohnTHaller 6y ago
    No malware or bundleware in the portable package I maintain either. PortableApps.com and PortableApps.com Format prohibit it.
neogodless 6y ago
Can someone explain this to me in layman's terms? The link from a Twitter reply[0] shows about 14 malware items contained in the installer. Do these get invisibly installed onto your computer? Is there some way to detect them after the fact and remove them? Since I was worried, I checked my most recent FileZilla FTP Client installation file, and it seems clear[1]. [0] https://www.virustotal.com/gui/file/ec4c01ab48df9095b602323cb6beca2fef7bf8bd763a01debafadc176cafe941/detection https://www.virustotal.com/gui/file/ec4c01ab48df9095b602323c... [1] https://www.virustotal.com/gui/file/4c9e0e07eaafabfe7be191d1e7c94487fe915d149d19b2dcfc86e40269b4ab5d/detection https://www.virustotal.com/gui/file/4c9e0e07eaafabfe7be191d1...
- zenexer 6y ago
  As others have pointed out, FileZilla has been caught doing shady stuff for a while now. Antivirus doesn’t pick up on everything; furthermore, just because it’s clean today doesn’t mean it will be tomorrow, and FileZilla’s actions have demonstrated that they’re not above shipping malware. There are better, free tools out there that don’t have this issue. FileZilla fell behind the competition well over a decade ago; you should look into finding a new tool that meets your needs. WinSCP is a popular option.
  - neogodless 6y ago
    Yes - this doesn't really answer my question. Another comment mentions the dark patterns trying to get you to install things you don't want in the process. That kind of thing is annoying but manageable. Quietly installing malware is a whole different animal, so I'm trying to get an explanation of if that's what's happening with the bad installation file above. (And yes given this thread, I've already downloaded WinSCP to use going forward, though I haven't installed it / used it yet.)
    - zenexer 6y ago
      As of writing, it looks like the answer is probably “no.”
anotheryou 6y ago
Cyberduck is similar and nice. Don't use it much though, can't promise it's ad free.
geocrasher 6y ago
In 2015 I wrote this blog post about Filezilla having a networking error: https://www.tidbitsfortechs.com/2015/08/how-to-solve-enetunreach-network-unreachable/ https://www.tidbitsfortechs.com/2015/08/how-to-solve-enetunr... The solution? WinSCP. Filezilla has been rubbish for years!
lnl 6y ago
I find it interesting that ads are considered acceptable and commonplace in Android and to a slightly lesser extent iOS apps; but on desktop they are seen as almost malware. To be clear, I also avoid it when I can, and most of the time ad-free or open-source alternatives are available (in this case I have been using WinSCP). I dislike the mobile app ecosystem with its plethora of garbage, privacy invading apps; and I am glad that desktop apps usually aren't like that. But if a program is much better than its alternatives and the ads are not too annoying, I guess I don't mind supporting its development via ads. Being a poor person from a poor country, I couldn't afford purchasing the program or donating to it, so ads sound like one way of supporting a program I like so much (though my ad views are probably worthless for the same reason). The only adware program I actually have is PotPlayer (the only thing that comes close is KMPlayer, which I used before; but it's originally built by the same developer and added ads even earlier). I think a few other programs I use had adware-bundled installers (e.g. JDownloader, CDisplayEx,...) but I had found adware-free installers. Even in the case of PotPlayer, it doesn't show ads, just an empty window (maybe again because I am in a poor country?) so I blocked the empty "ads" via hosts file. What's the point of annoying myself if that's not even supporting the developer? But if PotPlayer actually showed ads to me; assuming it didn't upload my private data and no comparable open-source/ad-free program emerged, I feel like I should be fine with it rarely showing some ads in the corner.
- cptskippy 6y ago
  > I find it interesting that ads are considered acceptable and commonplace in Android and to a slightly lesser extent iOS apps; but on desktop they are seen as almost malware. Totally different beast. The Android and iOS variety are embedded in the App. On Windows they are almost always a third party application installed separately with it's own uninstaller and granted near admin rights to the machine. It's the difference between inviting your friend over to your home and him showing up wearing a Nike shirt, or showing up with a dude you've never met who is spinning a sign. He can roam about your house without your knowledge and doesn't leave when your friend does.
- roywiggins 6y ago
  Usually Android ads are embedded in the apps. Close the app and the ad goes away. Uninstall the app and you won't see its ads again. Just including ads in an application doesn't make it adware. Adware infects the whole system, displaying popups and installing unwanted extensions in your web browser that follow you around. If FileZilla wants to include ads in the actual app that's one thing, but that's not what people are taking issue with.
tgsovlerkhgsel 6y ago
This is unfortunately nothing new. Ironically, Sourceforge (which many years ago had their own adware-adding program, i.e. otherwise-clean software would be infected if downloaded from SF) has cleaned up their act, started enforcing against adware, and as a result the SF version of FileZilla is clean (or at least was when I last checked).
- jorl17 6y ago
  I was still actively lurking around slashdot when the new guys came in and bought slashdot and sourceforge. I don't know if any of them are reading, but I think you've done a remarkable job. It saddens me that I don't get to experience your improvements because...ultimately...slashdot and sourceforge just don't turn up on my radar anymore. Nevertheless, I'd like to thank you guys!
  - shasheene 6y ago
    The new Sourceforge team has generally done a great job. Here is a review that might help some people. Pros: For general project discussion, Sourceforge's traditional discussion forum is far superior to Github/GitLab issues (though I haven't tried Github Discussions beta yet). The forum can be configured for users to be able to post without creating an account (though only as a specific user named "Anonymous", not arbitrary names) which is as important feature when creating software for users who aren't likely to have Github or Sourceforge accounts. Sourceforge download statistics tracking of releases (including graphing per country and with arbitrary timestamps) is far superior to Github, which doesn't offer even private tracking of download numbers without directly using their API. This is actually a really ridiculous situation. Cons: Sourceforge recently added the ability for the project administrator to mark any review as spam, which automatically hides it. This single change has completely ruined the trustworthiness of Sourceforge's reviews, as unscrupulous application authors are able to mark all poor reviews as spam so users only see good reviews. Because of this, I recommend AlternativeTo (http://alternativeto.net/ http://alternativeto.net/), as they have better review non-interference policy. Sourceforge's entire website seems to go into maintenance mode for a few minutes every 24 hours, which is frustrating for those in less favorable timezones. Even after using it for a long time, Sourceforge user-interface and settings/permissions is overly complex, confusing and non-intuitive. I find Github's well designed settings page much easier. Though admittedly Github has its share of UI quirks. New Github users are understandably initially confused by the concept of Pull Requests (which should have been called Merge Requests) and the fork user-interface. As a developer familiar with both tools (and git, PRs etc) I find Github easier to use than Sourceforge, which is saying something. Many Sourceforge projects tend to have their source code mirrored on a rarely updated Github project, which then gets forked and developed without changes being upstreamed, which causes fragmentation. Many third-party tools (like CircleCI) tend to target only Github (and to a lesser degree GitLab/Bitbucket) and ignore Sourceforge entirely. It's too easy for newbie users to download older releases (Github has the same issue unless you create a Github Pages site to highlight the most recent release). Conclusion: Sourceforge is actually a reasonable tool to develop open-source software in 2021. For new projects I would generally suggest sticking with Github and GitLab, but for existing projects on Sourceforge changing hosting to Github may not be required. The real killer is lack of integration of third-party tools like CircleCI. That's enough to switch to Github. But you will likely miss the excellent download statistics, anonymous support forum and user review system.
joshgoldman 6y ago
Check crystalftp out
S_A_P 6y ago
Towards the end of the shareware era this became more and more common. I have to wonder how much money this must be bringing in for the Filezilla project for them to just be so blasé about it. I
darkwater 6y ago
It really amazes me that people keeps using FileZilla or dedicated ftp graphical clients in general. Linux and Windows has built-in graphical clients in file managers, and I don't recall if MacOS Finder has the same.
- divingdragon 6y ago
  Last time I used the built-in FTP client in Windows Explorer it was an awful experience (think it was Windows XP). It also does not support SFTP or SCP.
- jerieljan 6y ago
  It sure does, Finder can easily connect to FTP and other network shares with Finder -> Go -> Connect to Server. Reasons I can think for dedicated graphical clients is the transfer log and the additional controls when connecting to servers. I agree that it's not really necessary unless you have very specific requirements, I guess.
  - divbzero 6y ago
    I think macOS Finder is limited to read-only FTP access [1] though there are alternatives [2] that mount drives through a variety of protocols. [1]: https://support.apple.com/guide/mac-help/network-address-formats-and-protocols-on-mac-mchlp1654/mac https://support.apple.com/guide/mac-help/network-address-for... [2]: https://mountainduck.io/ https://mountainduck.io/
- laurent123456 6y ago
  You can keep a list of different FTP connections in FileZilla and easily connect to one or the other. That's why I keep using it (although less and less these past few years as FTP isn't really a thing anymore).
  - Macha 6y ago
    Dolphin supports this, too. For any type of supported network location (FTP, SFTP, SMB, NFS, etc)
unicornporn 6y ago
So, don't touch it. WinSCP for Windows and Cyberduck for macOS.
caycep 6y ago
A few thoughts: -I've noticed the overall experience of downloading and installing on a lot of "classic" windows apps making installing a little dicier- ads are served on the download page, and look like official install links, and installers themselves have issues like the above. -App store is one way I supposed - it's a way to cryptographically sign things but with an element of control delegated to the central computer vendor; which is unpalatable to a lot of the open source/free computing crowd -The one thought that came to me - is blockchain tech - i.e. Blockchain Chicken Farm, NFTs, etc a parallel development to address this sort of thing? The parallel seems to mirror Jennifer 8. Lee's book on the rise of General Tso's Chicken (open source) vs. McDonald's Chicken McNuggets (corporate), vs. the old ESR essay re "The Cathedral vs. the Bazaar" model of Microsoft vs. Linux development?
- caspar 6y ago
  As I remember it, ads/malware trying to look like install (or download) links have been common for the last 10 years - to the point of training me to ignore any image that has the word "Download" in it. Choco helps work around much of that. It's more concerning to have official installers contain adware/malware though.
superasn 6y ago
That's why I still use http://ninite.com/ http://ninite.com/ for most downloads. They have saved me so much headache not dealing with such bundled adware / malware.
mastazi 6y ago
I stopped using it long ago because of this (still open) issue which is now 16 years old https://trac.filezilla-project.org/ticket/2191 https://trac.filezilla-project.org/ticket/2191
gsodk 6y ago
Freeware also Need to make money to live
villgax 6y ago
Switched to CyberDuck for everything, FileZilla couldn't even connect reliably to multiple SFTP accounts on AWS servers have the time
viktoracoric 6y ago
While I liked and used FileZilla just several months ago, I discovered that most Linux distributions come with ftp and sftp programs, and it's very easy to use them, easy as navigating your system through command line. With sftp you connect with "sftp -P [port] [ip address]", and navigation is very intuitive. cd changes directory on server, lcd changes directory on local machine Same with ls/lls (first lists directory on server, latter on local machine). get downloads files, put uploads them, add -r option for folders, and that's pretty much it. exit for exit of course lol
- stjohnswarts 6y ago
  lftp is -far- superior to sftp, you should check it out if you do a lot of scp/sftp/ftp.

542 points by URfejk 6y ago

It has been like that for a long time. Many years I believe. There is an option to download clean versions on their website. "Download > Show Additional download options" is the page you are after. https://filezilla-project.org/download.php?show_all=1 https://filezilla-project.org/download.php?show_all=1 If you check the filename of the windows installer you download from the frontpage the name is FileZilla_Version_Sponsored-setup.exe The installer available from the link above does not contain the word "Sponsored" and the installer is 2.5 MB smaller. Additional. Windows Defender tries it best to prevent you from installing the version found on the frontpage due to the adware. It has no issues with the other installer.

deskamess 6y ago
Does this impact the Filezilla server or just the client?
buffet_overflow 6y ago
We've had to ban the application entirely from our work machines. At least when we went through review, even the "clean" versions packaged things that tripped our antivirus software, and at that point, we as an organization decided to stop trusting the author entirely. There's quite a lot of forum posts where the author defends this practice, so we don't see this reversing any time soon.
- tgsovlerkhgsel 6y ago
  I'm surprised nobody made a forked commercial version yet. Remove the adware, replace the logo, sell commercial licenses.
  - m-p-3 6y ago
    There's FileZilla Pro. https://filezillapro.com/ https://filezillapro.com/
    - randerson 6y ago
      As someone who is happy to pay for good software, I can't ever see myself buying a paid version of something (no matter how good it might be) if the author has a history of using dark patterns and showing their apparent contempt for their users with the "free" edition. I'd be constantly wondering what other traps might be lurking in there.
      - Brian_K_White 6y ago
        Right. The fact that you can get around something, or that someone failed to do something to you is not the important thing. What matters far more is the fact that they tried and wanted to.
- m-p-3 6y ago
  We packaged it ourselves and made it available as an SCCM bundle, since users don't have admin rights on their systems anyway.
grawprog 6y ago
>If you check the filename of the windows installer you download from the frontpage the name is FileZilla_Version_Sponsored-setup.exe Damn...that reminds me of the old days of sneaky checkboxes hidden in installers, usually actually hidden, that would be pre-checked confirming your consent to whatever ad/spyware to be installed alongside whatever you wanted to install. I remember that shit being everywhere for a few years. Got tricked by them once or twice and had a hell of a time cleaning things up after.
- jasonwatkinspdx 6y ago
  Yeah, the one I remember was RealPlayer, which during the install wizard had a list of check boxes. The ones initially visible were unchecked, but if you scrolled you'd find the spam consent ones were checked.
  - hnrodey 6y ago
    RealPlayer... RealAudio... immediately jettisoned back to the 90's :)
- oth001 6y ago
  Adobe Reader comes to mind
  - Fnoord 6y ago
    Java...
userbinator 6y ago
Windows Defender tries it best to prevent you from installing the version found on the frontpage due to the adware. ...as if Windows (10) itself didn't contain any. More than 2.5MB of it, no doubt! How ironic to see the pot calling the kettle black. Edit: if you don't believe me, search around here and elsewhere for "Windows 10 adware". I'm surprised that this is even a controversial comment.
- deleted 6y ago
  [deleted]
- WolfRazu 6y ago
  There are no relevant search results for "windows 10 adware". Can you be more specific?
  - viraptor 6y ago
    In the start menu you automatically get stubs for apps like Candy crush, Adobe CC, and others. You never requested them but they'll install on first use.
- monsieurbanana 6y ago
  Is it really a controversial comment? Or are people just tired of hearing the same "but Microsoft does this this and this" everytime something positive comes up? Are you saying we all should switch away from Microsoft right this instant? If you aren't, then what? Let's boycott windows defender? Make our windows experience even worse? That will show them.
Underphil 6y ago
Came here to say this. There's been adware in the official download for what feels like 7-10 years now.
johnmaguire 6y ago
You could also download it with Ninite. Nothing downloaded with Ninite will install the sponsored versions of software.
stjohnswarts 6y ago
If you're using filezilla on windows only (not cross platform) then winscp is a great replacement. No worries about ads or repackaging.
- thefz 6y ago
  WinSCP is great and I find myself using it more and more over FileZilla. I wish there was a WinSCP equivalent for Linux too.
  - Fnoord 6y ago
    Really depends what you use it for (dual pane SSH file manager/FTP file manager/file manager). You can do this with Nautilus or Fman plus GNOME if you want to, since gvfs abstracts protocols such as FTP, SSH, SMB, ... On Windows you go such as well, including Fuse/Dokan, and on macOS you got MacFuse. Hence on macOS I use (by default CLI but if that does not cut it) Finder/Fman, and if that doesn't work, Cyberduck. Fman and Cyberduck also work on Windows, on Linux Cyberduck does not work but Fman does. CrossFTP might also work for you, as might Wine. I'm not sure about all features, such as FXP (which is insecure anyway, and only used in scene).

code_duck 6y ago

While the phrasing implies this is new, here's an discussion about the issue from 2018. https://news.ycombinator.com/item?id=17381184 https://news.ycombinator.com/item?id=17381184 An article from 2018... https://www.bleepingcomputer.com/news/security/filezillas-use-of-bundled-offers-sparks-outrage-from-users/ https://www.bleepingcomputer.com/news/security/filezillas-us... A question about it on their forum from over 4 years ago https://forum.filezilla-project.org/viewtopic.php?t=42791 https://forum.filezilla-project.org/viewtopic.php?t=42791

lioeters 6y ago
From the last link, the exchange went like this.. User: Just downloaded filezilla from the "official site". This one and was infected by adware which trashed my browser. WTF. I have trusted filezilla for years this is MOST Disappointing. Admin: The offer-enabled installer may display third-party offers during installation. Nothing is installed without your prior consent. In case you have accidentally agreed to an offer, you can completely uninstall it from Windows' Add/Remove Programs dialog. If you do not wish to use the offer enabled installer, have a look at the additional download options page.
- EMM_386 6y ago
  > The offer-enabled installer may display third-party offers during installation. Nothing is installed without your prior consent. In case you have accidentally agreed to an offer, you can completely uninstall it from Windows' Add/Remove Programs dialog. Except in looking into it further, there was a particular sketchy offer that was being sent called "Search Bundle" that was completely opaque, put what is essentially an APT on the machine, and was not listed in Add/Remove programs. The other applications (Firefox, Opera, etc) seemed to allow for normal uninstallation, but not that one.
- Brian_K_White 6y ago
  It's even a bit worse than that. You already probably imagine that the installer has default-selected checkbox that will install something extra if you don't catch it and deselect it. But what surprised me was, it actively reacts and tries again if you do catch it. If you don't stop it, it installs something extra. Straightforward. But if you DO stop it, it then tries to install a 2nd, different extra unwanted crap. There are 2 things in the installer from the get-go, but it only hits you with the 2nd one if you managed to catch and decline the 1st one. That's a whole special extra level of actively attempting to trick and decieve. That is crossing a line from at least plausible deniability that it's just a passive annoyance, into activly adversarial behavior against your own users.

willis936 6y ago

In case anyone out there hasn’t moved on: WinSCP is better than FileZilla ever was.

sunsipples 6y ago
any chance you know of something comparable for linux? I have tried a half dozen or so in last few months and keep coming back to filezilla, maybe it's because it's familiar, but always like options.
- blfr 6y ago
  I use lftp. The website design tells you exactly how the tool works. https://lftp.yar.ru/ https://lftp.yar.ru/ One of the most valuable features is its ability to download a single file over multiple connections pget -n 4 your.file.tar.gz because many ISPs limit speed per flow and opening multiple of them, even to the same target, allows you to max out your connection.
  - sunsipples 6y ago
    appreciated, thank you
  - lathiat 6y ago
    I use this all the time not due to ISP limits but in Australia the 200-400ms latency limits you instead especially as you go over 50Mbit. Mirror command is also great :)
  - dmoo 6y ago
    +1 for lftp. On windows I use it via Cygwin for scheduled tasks etc. FileZilla has a speed advantage over winscp but nothing like the flexibility.
- Macha 6y ago
  Your file manager probably does FTP. Try enter a [s]FTP[s]:// URL into your location field. Depending on your distro, for gnome or derivatives you might have to install a gvfs plugin package first.

gspr 6y ago

I occasionally use this software through Debian's package for it, which of course doesn't contain the adware. But the strategy employed here does leave me with a bit of a sour taste and a desire to stop using the software altogether.

swiley 6y ago
Most graphical DE shells on Linux will just mount sftp (scp/ssh) graphically, no need for stuff like this. People still say Linux DEs aren't user friendly but IMO they're much more so than other OSes largely because other OSes have a moat to protect.
- sgc 6y ago
  I use FileZilla on Linux because the file manager integrated ftp clients were not very good, and did not save connections etc. Just less of a PITA. I see I should try gftp or another alternative though.
  - swiley 6y ago
    I'd imagine it's wrapping ssh which will reuse connections if you tell it to in your ssh config. I use that heavily on my mobile computers.
deskamess 6y ago
I wonder if the Chocolatey version has the adware.
arbitrage 6y ago
don't hate the player, hate the game. this is the result of parasitic capitalism. i have no doubts that a dev who contributed so strongly to the opensource ecosystem for such a long time specifically wants to be in this situation. you wouldn't, i don't, they probably don't. how else are we supposed to support our families and the community? there's no other source of revenue or support for a freelance programmer in caretaker mode for a mature and stable codebase. donations don't cut it, obviously.

DpdC 6y ago

As has already been said, this is not news, nor is it a change, it is not news. It is not even something, that can be reprehensible to the people who maintain the Filezilla project. Funny to see people who have been using the software for half their lives, criticizing this. This can only surprise someone who installed filezilla for the first time, or had not installed it for half a lifetime.. So crazy.

Macha 6y ago
Some of the software the adware installer requires an opt out to not install can be harmful or hard to remove, like the "Search Offer powered by Bing" in the article linked elsewhere in this site. Even the free AVs will often start you as a trial for the paid version or have incredibly easy ways to convert your install to such a trial and nag the user to pay up once the trial expires, arguably reducing their computer security. I know HN has a strong libertarian bent, and uou could argue this is a free market, buyer beware situation, but in that case, wouldn't the criticism posted be part of that and how buyers know that they should beware?
- noxer 6y ago
  So the people who dont know better pay for stuff they dont need? Sounds like literally everything else. Most people who buys cars dont know anything about cars and thus they likely overpay. This sucks but its in fact a "free market" thing.
  - yjftsjthsd-h 6y ago
    A free market, according to my econ prof at least, has: 1. easy entrance/exit to the market, 2. many buyers and sellers, and 3. perfect information availability. If the players don't have good information, it is at best a severely degraded free market.
    - noxer 6y ago
      All the infos about cars are easily available. It chances nothing, most buyers of car simply dont care enough to get fundamental knowledge about cars. If you would value the time it takes for an average car buyer to get fundamental knowledge it would cost way more than what they overpay so unless you already have above average knowledge it makes no sense to dig into it. You are better off asking someone who has the knowledge and no incentive to fool you aka a friend not the sale person.

rubyist5eva 6y ago

Wow, I just switched to Transmit a few weeks ago from years of using Filezilla...looks like I dodged a bullet.

notsuoh 6y ago
Filezilla has been like this for years assuming you downloaded the regular version. There's a no-adware version, but it's kinda hidden.
- rubyist5eva 6y ago
  I usually got it from brew cask, not sure which "version" it downloaded - never saw any ads in it, myself but either way - I'd rather just not deal with a scummy project anymore.
  - kergonath 6y ago
    Only the version downloaded from the developer’s website included malware. Versions in various repositories are fine.

superkuh 6y ago

Wow. I recall when this first happened because of SourceForge being sold to shady people who decided to put ad/malware loaders around the installers of all the exes hosted there (like FileZilla). But that was the early/mid-2000s. It's hard to believe it is being allowed to happen again in modern times.

robinj6 6y ago
SourceForge is to software as maggots are to meat. Don’t know how the people behind it have an ounce of self respect.
- wincy 6y ago
  I’d imagine that it’s easy to drown out the sound of your conscience when you’re driving a brand new Model X and live in a big house.
- dehrmann 6y ago
  SourceForge was a huge blunder. They were so close to being Github, but they opted to to squeeze out every last dollar, instead. ExpertsExchanges and AIM are similar--products that could have been medium-large opportunities today, but business and product choices that left an opening for a competitor. That said, I'm not convinced SourceForce could have actually been Github because it didn't have the culture, the brand was mispositioned, and it's hard to to be Github without lots of VC.
  - MrGilbert 6y ago
    Ah yes, Expert-Exchange - the site where you could simply google your way around their paywall. Never took this page too serious, tbh.
- kergonath 6y ago
  AFAIK the new SourceForge, after they’ve been bought, is much better. Also, much less relevant now that everything is on GitHub.

varispeed 6y ago

Interestingly the applications are free to collect any personal data as they are not included in GDPR. When I requested from one company to let me export my data from the application in a human readable format or to at least send documentation of their file format, so that I can port my data to another application, they refused saying that GDPR only applies to online apps. It's possible that companies will be moving their online apps to electron or native phone apps to bypass GDPR.

dasil003 6y ago
IANAL but I have worked on GDPR compliance and I’m not sure how that will fly if they are phoning home. Of course the EU regulators probably won’t have bandwidth to chase these minnows but worth reporting in any case.
- w3ll_w3ll_w3ll 6y ago
  I think in OP case the app is not phoning home. The data are still in his pc, but he would like to export it in another format. I don't think GDPR applies here, but I am not an expert.
  - dasil003 6y ago
    It's a little tricky to infer the specifics, but adware that collects personal data would be non-sensical if it doesn't phone home. In fact the whole idea of "collecting data" implies it is being sent to storage under control of the collecting entity. I think this is pretty clear cut under GDPR and there's no bypassing it based on the technicality of web app vs native app—I believe regulators learned their lesson about tight coupling to specific technical implementions with the earlier cookie laws. On the other hand, you could be write that OP is just talking about data portability in which case there is "data collection", just lack of an export feature.
- dehrmann 6y ago
  If they don't have an EU office, I assume they can ignore GDPR because the EU has no jurisdiction.

KyleSanderson 6y ago

It has indeed been like this for nearly half a decade. To clarify, it's sourceforge that did this wrapping.

user3939382 6y ago

Tangentially related, but I had a Windows FTP client back in the day called LeechFTP that I loved and I miss it.

WalterSobchak 6y ago
Yep, LeechFTP was a good client for its time. I also remember running Serv-U FTP Server 2.5 on a dial-up modem back in the AOL/NetZero days. Good times.

butz 6y ago

Looking at download filenames only versions for Windows have "sponsored" variants. Can I presume that version for macOS is clean?

hakube 6y ago

You've got SFTP and rsync. There's no need for these kind of stuff if you're on Linux. Some DEs file manager are giving you the option to mount SFTP servers

fbnlsr 6y ago
As someone who's using Linux but not that much at ease with this, it's nice sometimes to have a GUI.
- rocky1138 6y ago
  In KDE you can access this sort of thing with the built-in GUI file manager right out of the box. You don't need a third-party app. 1. Open Dolphin (file manager) 2. Right click in the Places section on the left to add entry 3. Type `fish://<the-address>` 4. Click OK https://www.dedoimedo.com/computers/plasma-dolphin-fish-ssh.html https://www.dedoimedo.com/computers/plasma-dolphin-fish-ssh....
- chungy 6y ago
  As someone that's spent multiple decades living on the command line for almost all my file management... sometimes I still open the GNOME file manager because a GUI makes a select few tasks simpler. It's all about the right tool for the job. Some people are more comfortable with a GUI for the majority of file management tasks, some people are more comfortable with the CLI for the majority of file management tasks. It's just a bit silly to be a zealot and put yourself through a lot of pain if one of these isn't optimal for whatever you're trying to do.
greggturkington 6y ago
I was disappointed I had to scroll this far down on an HN thread to find "just use rsync!"

superted 6y ago

Any idea what kind of revenue this potentially brings in, assuming this is the rationale begins this decision? In contrast to tarnishing the Filezilla name (albeit this could mostly be controversial in the hn crowd)

david_allison 6y ago
Around $0.01 per active user per year from open source donations. Many factors: depends on the type of open source (infra vs user-facing) and the technical ability and geographic location of your users. PPI malware seems to go for around $0.40/install [0] [0] https://medium.com/csis-techblog/installcapital-when-adware-becomes-pay-per-install-cyber-crime-15516249a451 https://medium.com/csis-techblog/installcapital-when-adware-...

JohnTHaller 6y ago

For clarification, FileZilla itself does not appear contain adware nor has it switched to ads within the app from my analysis. The main download page for Windows installers contains a bundleware offer within the installer as you install (this offer may currently be offline). The installer filename contains the string _sponsored_. If you click through to the show additional download options, you can get all the installers without bundleware for all OSes.

Nexxxeh 6y ago
Also, no malware when installed by Ninite, which I imagine is how many of us get it on our systems.
- JohnTHaller 6y ago
  No malware or bundleware in the portable package I maintain either. PortableApps.com and PortableApps.com Format prohibit it.

neogodless 6y ago

Can someone explain this to me in layman's terms? The link from a Twitter reply[0] shows about 14 malware items contained in the installer. Do these get invisibly installed onto your computer? Is there some way to detect them after the fact and remove them? Since I was worried, I checked my most recent FileZilla FTP Client installation file, and it seems clear[1]. [0] https://www.virustotal.com/gui/file/ec4c01ab48df9095b602323cb6beca2fef7bf8bd763a01debafadc176cafe941/detection https://www.virustotal.com/gui/file/ec4c01ab48df9095b602323c... [1] https://www.virustotal.com/gui/file/4c9e0e07eaafabfe7be191d1e7c94487fe915d149d19b2dcfc86e40269b4ab5d/detection https://www.virustotal.com/gui/file/4c9e0e07eaafabfe7be191d1...

zenexer 6y ago
As others have pointed out, FileZilla has been caught doing shady stuff for a while now. Antivirus doesn’t pick up on everything; furthermore, just because it’s clean today doesn’t mean it will be tomorrow, and FileZilla’s actions have demonstrated that they’re not above shipping malware. There are better, free tools out there that don’t have this issue. FileZilla fell behind the competition well over a decade ago; you should look into finding a new tool that meets your needs. WinSCP is a popular option.
- neogodless 6y ago
  Yes - this doesn't really answer my question. Another comment mentions the dark patterns trying to get you to install things you don't want in the process. That kind of thing is annoying but manageable. Quietly installing malware is a whole different animal, so I'm trying to get an explanation of if that's what's happening with the bad installation file above. (And yes given this thread, I've already downloaded WinSCP to use going forward, though I haven't installed it / used it yet.)
  - zenexer 6y ago
    As of writing, it looks like the answer is probably “no.”

anotheryou 6y ago

Cyberduck is similar and nice. Don't use it much though, can't promise it's ad free.

geocrasher 6y ago

In 2015 I wrote this blog post about Filezilla having a networking error: https://www.tidbitsfortechs.com/2015/08/how-to-solve-enetunreach-network-unreachable/ https://www.tidbitsfortechs.com/2015/08/how-to-solve-enetunr... The solution? WinSCP. Filezilla has been rubbish for years!

lnl 6y ago

I find it interesting that ads are considered acceptable and commonplace in Android and to a slightly lesser extent iOS apps; but on desktop they are seen as almost malware. To be clear, I also avoid it when I can, and most of the time ad-free or open-source alternatives are available (in this case I have been using WinSCP). I dislike the mobile app ecosystem with its plethora of garbage, privacy invading apps; and I am glad that desktop apps usually aren't like that. But if a program is much better than its alternatives and the ads are not too annoying, I guess I don't mind supporting its development via ads. Being a poor person from a poor country, I couldn't afford purchasing the program or donating to it, so ads sound like one way of supporting a program I like so much (though my ad views are probably worthless for the same reason). The only adware program I actually have is PotPlayer (the only thing that comes close is KMPlayer, which I used before; but it's originally built by the same developer and added ads even earlier). I think a few other programs I use had adware-bundled installers (e.g. JDownloader, CDisplayEx,...) but I had found adware-free installers. Even in the case of PotPlayer, it doesn't show ads, just an empty window (maybe again because I am in a poor country?) so I blocked the empty "ads" via hosts file. What's the point of annoying myself if that's not even supporting the developer? But if PotPlayer actually showed ads to me; assuming it didn't upload my private data and no comparable open-source/ad-free program emerged, I feel like I should be fine with it rarely showing some ads in the corner.

cptskippy 6y ago
> I find it interesting that ads are considered acceptable and commonplace in Android and to a slightly lesser extent iOS apps; but on desktop they are seen as almost malware. Totally different beast. The Android and iOS variety are embedded in the App. On Windows they are almost always a third party application installed separately with it's own uninstaller and granted near admin rights to the machine. It's the difference between inviting your friend over to your home and him showing up wearing a Nike shirt, or showing up with a dude you've never met who is spinning a sign. He can roam about your house without your knowledge and doesn't leave when your friend does.
roywiggins 6y ago
Usually Android ads are embedded in the apps. Close the app and the ad goes away. Uninstall the app and you won't see its ads again. Just including ads in an application doesn't make it adware. Adware infects the whole system, displaying popups and installing unwanted extensions in your web browser that follow you around. If FileZilla wants to include ads in the actual app that's one thing, but that's not what people are taking issue with.

tgsovlerkhgsel 6y ago

This is unfortunately nothing new. Ironically, Sourceforge (which many years ago had their own adware-adding program, i.e. otherwise-clean software would be infected if downloaded from SF) has cleaned up their act, started enforcing against adware, and as a result the SF version of FileZilla is clean (or at least was when I last checked).

jorl17 6y ago
I was still actively lurking around slashdot when the new guys came in and bought slashdot and sourceforge. I don't know if any of them are reading, but I think you've done a remarkable job. It saddens me that I don't get to experience your improvements because...ultimately...slashdot and sourceforge just don't turn up on my radar anymore. Nevertheless, I'd like to thank you guys!
- shasheene 6y ago
  The new Sourceforge team has generally done a great job. Here is a review that might help some people. Pros: For general project discussion, Sourceforge's traditional discussion forum is far superior to Github/GitLab issues (though I haven't tried Github Discussions beta yet). The forum can be configured for users to be able to post without creating an account (though only as a specific user named "Anonymous", not arbitrary names) which is as important feature when creating software for users who aren't likely to have Github or Sourceforge accounts. Sourceforge download statistics tracking of releases (including graphing per country and with arbitrary timestamps) is far superior to Github, which doesn't offer even private tracking of download numbers without directly using their API. This is actually a really ridiculous situation. Cons: Sourceforge recently added the ability for the project administrator to mark any review as spam, which automatically hides it. This single change has completely ruined the trustworthiness of Sourceforge's reviews, as unscrupulous application authors are able to mark all poor reviews as spam so users only see good reviews. Because of this, I recommend AlternativeTo (http://alternativeto.net/ http://alternativeto.net/), as they have better review non-interference policy. Sourceforge's entire website seems to go into maintenance mode for a few minutes every 24 hours, which is frustrating for those in less favorable timezones. Even after using it for a long time, Sourceforge user-interface and settings/permissions is overly complex, confusing and non-intuitive. I find Github's well designed settings page much easier. Though admittedly Github has its share of UI quirks. New Github users are understandably initially confused by the concept of Pull Requests (which should have been called Merge Requests) and the fork user-interface. As a developer familiar with both tools (and git, PRs etc) I find Github easier to use than Sourceforge, which is saying something. Many Sourceforge projects tend to have their source code mirrored on a rarely updated Github project, which then gets forked and developed without changes being upstreamed, which causes fragmentation. Many third-party tools (like CircleCI) tend to target only Github (and to a lesser degree GitLab/Bitbucket) and ignore Sourceforge entirely. It's too easy for newbie users to download older releases (Github has the same issue unless you create a Github Pages site to highlight the most recent release). Conclusion: Sourceforge is actually a reasonable tool to develop open-source software in 2021. For new projects I would generally suggest sticking with Github and GitLab, but for existing projects on Sourceforge changing hosting to Github may not be required. The real killer is lack of integration of third-party tools like CircleCI. That's enough to switch to Github. But you will likely miss the excellent download statistics, anonymous support forum and user review system.

joshgoldman 6y ago

Check crystalftp out

S_A_P 6y ago

Towards the end of the shareware era this became more and more common. I have to wonder how much money this must be bringing in for the Filezilla project for them to just be so blasé about it. I

darkwater 6y ago

It really amazes me that people keeps using FileZilla or dedicated ftp graphical clients in general. Linux and Windows has built-in graphical clients in file managers, and I don't recall if MacOS Finder has the same.

divingdragon 6y ago
Last time I used the built-in FTP client in Windows Explorer it was an awful experience (think it was Windows XP). It also does not support SFTP or SCP.
jerieljan 6y ago
It sure does, Finder can easily connect to FTP and other network shares with Finder -> Go -> Connect to Server. Reasons I can think for dedicated graphical clients is the transfer log and the additional controls when connecting to servers. I agree that it's not really necessary unless you have very specific requirements, I guess.
- divbzero 6y ago
  I think macOS Finder is limited to read-only FTP access [1] though there are alternatives [2] that mount drives through a variety of protocols. [1]: https://support.apple.com/guide/mac-help/network-address-formats-and-protocols-on-mac-mchlp1654/mac https://support.apple.com/guide/mac-help/network-address-for... [2]: https://mountainduck.io/ https://mountainduck.io/
laurent123456 6y ago
You can keep a list of different FTP connections in FileZilla and easily connect to one or the other. That's why I keep using it (although less and less these past few years as FTP isn't really a thing anymore).
- Macha 6y ago
  Dolphin supports this, too. For any type of supported network location (FTP, SFTP, SMB, NFS, etc)

unicornporn 6y ago

So, don't touch it. WinSCP for Windows and Cyberduck for macOS.

caycep 6y ago

A few thoughts: -I've noticed the overall experience of downloading and installing on a lot of "classic" windows apps making installing a little dicier- ads are served on the download page, and look like official install links, and installers themselves have issues like the above. -App store is one way I supposed - it's a way to cryptographically sign things but with an element of control delegated to the central computer vendor; which is unpalatable to a lot of the open source/free computing crowd -The one thought that came to me - is blockchain tech - i.e. Blockchain Chicken Farm, NFTs, etc a parallel development to address this sort of thing? The parallel seems to mirror Jennifer 8. Lee's book on the rise of General Tso's Chicken (open source) vs. McDonald's Chicken McNuggets (corporate), vs. the old ESR essay re "The Cathedral vs. the Bazaar" model of Microsoft vs. Linux development?

caspar 6y ago
As I remember it, ads/malware trying to look like install (or download) links have been common for the last 10 years - to the point of training me to ignore any image that has the word "Download" in it. Choco helps work around much of that. It's more concerning to have official installers contain adware/malware though.

superasn 6y ago

That's why I still use http://ninite.com/ http://ninite.com/ for most downloads. They have saved me so much headache not dealing with such bundled adware / malware.

mastazi 6y ago

I stopped using it long ago because of this (still open) issue which is now 16 years old https://trac.filezilla-project.org/ticket/2191 https://trac.filezilla-project.org/ticket/2191

gsodk 6y ago

Freeware also Need to make money to live

villgax 6y ago

Switched to CyberDuck for everything, FileZilla couldn't even connect reliably to multiple SFTP accounts on AWS servers have the time

viktoracoric 6y ago

While I liked and used FileZilla just several months ago, I discovered that most Linux distributions come with ftp and sftp programs, and it's very easy to use them, easy as navigating your system through command line. With sftp you connect with "sftp -P [port] [ip address]", and navigation is very intuitive. cd changes directory on server, lcd changes directory on local machine Same with ls/lls (first lists directory on server, latter on local machine). get downloads files, put uploads them, add -r option for folders, and that's pretty much it. exit for exit of course lol

stjohnswarts 6y ago
lftp is -far- superior to sftp, you should check it out if you do a lot of scp/sftp/ftp.