7 ms·
Tell HN: "Default" FileZilla download bundled with adware
- Alifatisk 3y agoFileZilla took the same route has uTorrent and destroyed their reputation I guess.
- eastbound 3y agoAnd Oracle’s Java, when they bundled the Askbar with the JRE.
- jonathanlydall 3y agoIf you click the "quick download link" on the home page it will lead you to downloading a "sponsored" version of the application, e.g. "FileZilla_3.66.5_win64_sponsored2-setup.exe" for me on Windows. Clicking "show additional download options" takes you to https://filezilla-project.org/download.php?show_all=1 https://filezilla-project.org/download.php?show_all=1 which has links to "clean" versions of the client. Sidenote: It was Windows Defender which pointed out to me that I had downloaded "unwanted" software, otherwise I might have missed this before running the installer since I had downloaded FileZilla many times in the past without having to worry about it being bundled with unwanted stuff.
- Dalewyn 3y agoI hate bundled adware as much as the next man here, but we also need to be fair and acknowledge that FileZilla plainly informs the user: "This installer may include bundled offers. Check below for more options." The download page[1] that is referred to by "check below" then gives a list of both installers (without the adware) and ZIP archives, and notably does not list the adware'd installer. [1]: https://filezilla-project.org/download.php?show_all=1 https://filezilla-project.org/download.php?show_all=1
- mellutussa 3y ago"may include bundled offers" is not the same thing as "this will install adware on your computer." This is incredibly deceptive for FileZilla and excuses like this just add to the embarrassment.
- maccard 3y agoIt's exactly the same thing.
- pacifika 3y agoIncluded discounts versus mining your pc for advertising purposes, ok
- tyingq 3y agoUsing "may" when you know full well it's "will" isn't honest. And I imagine the UI to install the "offers" makes them not really an offering, but a default.
- maccard 3y agoI agree with you, but it being dishonest doesn't make it mean anything different.
- StefanBatory 3y agoMay include bundled offers has different emotional implications to me.
- mellutussa 3y agoAh, I see you're on our team. Well played!
- phone8675309 3y agoNo it's not. If I say I 'may' give you a million dollars it's much different from _actually_ giving you a million dollars.
- frankjr 3y agoFileZilla has a long history with bundling spyware/adware with their primary installers. If you are looking for alternatives, check out Cyberduck. https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issues https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issue... https://cyberduck.io https://cyberduck.io
- elaus 3y agoNote: cyberduck GUI applications seems to be available only for MacOS and Windows and it shows donations prompts unless you purchase a license. I'm interested in finding a replacement for FileZilla that works on Linux as well, ideally with data import (having tens of connections saved).
- rob74 3y agoOn Linux you should be safe if you install FileZilla using your package manager, I have always done it this way and actually today is the first time I'm hearing of this adware issue...
- p4bl0 3y agoOn Linux the main file managers (Dolphin, Nautilus) can be used as very good (s)ftp clients, on par with FileZilla. No need for additional software.
- wodenokoto 3y agoFileZilla is one of those examples that makes me want overly stringent trademark laws. To me the name implies it’s part of the Mozilla family and it is neither in ownership nor in spirit and it makes me irrationally angry
- Ekaros 3y agoOn other hand is there other than Bugzilla and Chatzilla(dead) that follow that scheme?
- dspillett 3y agoBugzilla actually came out of Mozilla so that would be safe.
- Nursie 3y agoOn the one had yes, it would be nice to avoid that sort of association-blurring. But on the other, if we're calling ownership over the '-zilla' suffix then a certain giant monster might take precedent.
- bjoli 3y agoAs long as it is not confuseable it is not trademark infringement. You are free to start a Pharmacy named McDonalds, but not Walmart's Pharma.
- Kuinox 3y agozilla isn't a word reserved to Mozilla, there are other thing using this word, like godzilla, where mozilla name came from.
- Kuinox 3y agoThat's why nobody should use FileZilla anymore, but WinSCP.
- papichulo2023 3y agoSadly no for linux. Wonder how well it works on wine.
- bouncycastle 3y agofor linux, try the scp command. It works wonders! Also, rsync is very useful https://phoenixnap.com/kb/how-to-rsync-over-ssh https://phoenixnap.com/kb/how-to-rsync-over-ssh
- p4bl0 3y agoOr just your file manager. Both Dolphin and Nautilus have very good support for (S)FTP. At least Dolphin can have bookmarks, dual pane, transfer resume, etc. Also thanks to KIO, the remote storage can be transparently used from any applications not just to transfer files directly inside Dolphin.
- pquki4 3y ago...as if command line is the most intuitive way of doing things, provides all the workflows and solves all the problems, while GUI has no additional benefit. Maybe for you, but not for many (if not most) people.
- SAI_Peregrinus 3y agoSpecifically, GUIs & TUIs have vastly superior discoverability compared to CLIs.
- LinuxBender 3y agoAlso lftp [1] for those connecting with Chroot SFTP-Only accounts. It's mirror subsystem can mimic the behavior of rsync and can also spin up many threads for a batch of files or a single large file. Only downside is being chroot there isn't a corresponding daemon on the other side beyond sshd doing directory enumeration so that part is slower. LFTP is great for automating data synchronization across different vendor clouds or sharing data between different orgs in a company without providing shell access thus simplifying some audits. [1] - https://linux.die.net/man/1/lftp https://linux.die.net/man/1/lftp
- latexr 3y agoIt’s still good to alert people, but do note this has been going on for a decade. FileZilla has irreparably tarnished its reputation. https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issues https://en.wikipedia.org/wiki/FileZilla#Bundled_adware_issue...
- iLoveOncall 3y agoAs far as I remember this had nothing to do with FileZilla in particular and was instead SourceForge repackaging all the popular software hosted on its platform with adware.
- dagurp 3y agoThey must have been aware of it
- latexr 3y agoRead beyond the first paragraph. This wasn’t a one off and they didn’t stop.
- iLoveOncall 3y agoOk but it has been going on at worst since 2018, not for a decade.
- latexr 3y agoNo, it has been going on for a decade because they knew about it and defended the practice. You only need to look on this very thread to find more information. https://news.ycombinator.com/item?id=39614226 https://news.ycombinator.com/item?id=39614226
- odux 3y agoThe download from filezilla-project.org even now has “bundled offers” at least for the Windows version (the Windows download page even has this disclaimer “This installer may include bundled offers. Check below for more options.”).
- jamesy0ung 3y agoFilezilla is nasty. I have been satisfied with WinSCP and Cyberduck.
- bachmeier 3y agoOldest HN thread I could find on the topic: https://news.ycombinator.com/item?id=8849950 https://news.ycombinator.com/item?id=8849950
- pavinjoseph 3y agoGood that I don't have to worry about things like this when downloading from official OpenSuse repos. Are they allowed to bundle adware into flatpaks and AppImages?
- taspeotis 3y agoUnchecky helps with shit like this https://unchecky.com/ https://unchecky.com/
- creshal 3y agoAgain?
- tapper 3y agowinSCP for the win! WinScp is all so grate with screen readers. For anyone that needs to use one. I find it to be grate with NVDA even the file viewer.
- pixelpoet 3y agoFileZilla raged me out so hard for years, I should have switched to WinSCP long ago. It does this thing where it automatically downloads the latest update and prompts to install it on every launch, and you can't disable it! When you google the issue, you see devs saying basically "screw the users, we are right and they are wrong"... two middle fingers to that.
- benterix 3y agoYeah, this and another thing that annoys me basically itch me to start a fork (I connect once a month to a known server, so I'm in the target group of people who would complain about update nags and the security argument is moot in my case). There is another warning about an expired security certificate I can do nothing about - a few years ago I could just add it to exceptions but not anymore, I need to click a few times more. These are just little annoyances but at some point someone will get upset and actually start the fork - the software is very mature so basically I don't care about any new features, I want to use it as I did 10 years ago :)
- rightbyte 3y agoSemiauto-updates is a potential way for them to bundle spyware or sell to some even worse spyware vendor and infect the users' computers. I always assume autoupdates (or nagging to update without options to turn the nagging off) is hostile code.
- Dalewyn 3y agoUpdate checks can be disabled. Either this was so long ago that nobody remembers, or you're lying. I'm going to give you the benefit of the doubt and presume you aren't the latter.
- pixelpoet 3y agoThanks, gracious of you.
- Dalewyn 3y agoI can smell that sarcasm, so to further prove my point: https://imgur.com/mN3REpq https://imgur.com/mN3REpq So unless what you're saying is that the setting is not obeyed or doesn't work as it implies, you're either working off ancient memory or lying and I don't necessarily have reason to believe you are the latter.
- for_i_in_range 3y agoIt's probably added $30k/day in revenue. Meanwhile Cyberduck gets $30/day via donations.
- tycho-newman 3y agoWinSCP
- dgellow 3y agoIs it also the case if installed from brew and winget?
- geokon 3y agoWhat's a good alternative on Ubuntu/Linux? I haven't found anything that works as smoothly and consistently with flaky connections. It also seems to handle edge cases better than Linux filemanagers. For instance I never managed to get Dolphin to work with usernames/passwords that had an `@` symbol in them (don't blame me.. NASA FTP servers auto-assign your email address as a username)
- npteljes 3y agoI don't think that you need an alternative for Ubuntu or other linuxes. The FileZilla project is open source, and as such, is present in the major package managers. And surely the sponsor stuff is not there in these builds.
- hprotagonist 3y agorsync
- progx 3y ago90s are back.
- ngcc_hk 3y agoIs that ok with the macOS (non-pdf and non-apple store version)? I used that all the time and seems ok. (The other version is costly and hence not opt-in.)
- Kim_Bruning 3y agoThis is why it's a good idea to use ninite for installing The Usual Suspects on windows. Among other things, they make sure to avoid any adware. https://ninite.com/ https://ninite.com/
- kotaKat 3y agoDoes Filezilla still have the weird, arbitrary "10 connection limit" with FTP connections? Ah, yes. https://trac.filezilla-project.org/ticket/5062 https://trac.filezilla-project.org/ticket/5062 "If you feel you need more than 10 connections, there's something wrong with your internet connection." --Tim Kosse, FileZilla creator
- rchaud 3y agoFilezilla's UX is stunningly bad for an SFTP client. I used it for years to update my personal website. I ended up installing Cloudron on my droplet and just manage my files through there.
- m-p-3 3y agoWe deploy the version without the bundled stuff at work and we disable the auto-update since we push it ourselves internally. I don't see any other way to keep ourselves safe. We also add the SHA256 checksums of the versions with spywares to our EDR (aka antivirus) platform to automatically quarantine them if someone attempts to download those. For my personal use I use Mountain Duck, and I can mount those as drives which is nice (I'm not affiliated with them).
- ementally 3y agoSame with Cheat engine https://github.com/cheat-engine/cheat-engine/issues/2105 https://github.com/cheat-engine/cheat-engine/issues/2105
- endofreach 3y agoThis is no news. I forgot the other programs but i remember that this practice was more or less common 1-2 decades ago. But today, who would still need something like filezilla anyway?
- ementally 3y agoAlso Cheat engine https://github.com/cheat-engine/cheat-engine/issues/2105 https://github.com/cheat-engine/cheat-engine/issues/2105