11 ms·

Filezilla at SourceForge is malware

283 points by Sami_Lehtinen 12y ago

Sami_Lehtinen 12y ago
https://www.virustotal.com/fi/file/d0d418efb07df4378b24bccaced697bf34745de33ad1521beffa18565d9f2e1c/analysis/1420630836/ https://www.virustotal.com/fi/file/d0d418efb07df4378b24bccac... If you download the package, it will be unique malware packet for you. So if you check it with virus total, it's not the same file.
- loosescrews 12y ago
  As usual, Avira is right on the money with "Adware/InstallC.buzg." ESET is pretty good too with "a variant of Win32/InstallCore.UQ." None of the other providers clearly identified it.
RubyPinch 12y ago
isn't this more, the SourceForge wrapper is acting unsafely? regardless, this has been happening for the entire last year with the consent of the developers: https://forum.filezilla-project.org/viewforum.php?f=1&sid=13d72227c55b2204476060d348e64d37 https://forum.filezilla-project.org/viewforum.php?f=1&sid=13... I would be very doubtful they will listen to their users any further about the harm it does. I'll probably avoid FZ from now on, I don't exactly enjoy using software that is openly hostile towards me
- necrobrit 12y ago
  Wow, yeah, this thread: https://forum.filezilla-project.org/viewtopic.php?f=1&t=32945 https://forum.filezilla-project.org/viewtopic.php?f=1&t=3294... I think it is best to avoid these guys.
  - cyphax 12y ago
    While I initially thought this as well, at some point the site admin (botg) posts this: ""MalSign.Generic.F84". Looks like a typical false-positive generated by a heuristic. There is no malware in the SourceForge Downloader, you can safely use it to install FileZilla. While the SourceForge Installer may present third-party offers, they are clearly labeled as such. All third-party offers can easily be declined. Nothing unwanted is being installed without your consent. Declining offers does not prevent nor otherwise disturb the installation of FileZilla. If you do not wish to use the SourceForge installer, have a look at the additional download options listed on the FileZilla website." His stance seems to be that it's not malware, rather a false positive (I have no proof to claim he's wrong and if he is, it could be a honest mistake; he's trusting SF, which I understand), and he mentions that you can also download Filezilla from their own website, without the SF installer. That seems pretty reasonable to me, but again: at first I got the impression they (FileZilla's owners) simply didn't care. I hate what SF has been doing, and I refuse to use their installers (although I'm primarily a Linux-user so I don't have to worry about these installers, thankfully), but I don't really feel like the FileZilla owners should be avoided as it looks like they're simply trusting SourceForge, nothing more. I hope I'm right. ;)
    - RubyPinch 12y ago
      my main issue is that, the offers only exist to either affect the people who don't know any better (and would probably chose the opposite if they were more educated about such practices), or those that mis-click. Most people, when presented with a) a logo (of a group they trust), and b) accept or decline, they are going to make assumptions and not read the middle. Which ends up affecting a lot of users: every bad review relating to the installer and every complaint in the forums (once again, in relation to the installer), is a person who has been deceived and had a negative experience, because of a decision of the FZ developers (and the installer is choose-able by the project developer, last I inquired)
- grimmfang 12y ago
  Filezilla's community is toxic and the projects creator can be aptly described as tyrannical. If you use Mac check out Transmit by Panic. It's the best FTP client I've ever used.
  - ceejayoz 12y ago
    I'll second the Transmit recommendation. As a bonus, it nicely supports AWS S3 and S3-compatible object stores.
  - slenk 12y ago
    Filezilla is free and cross-platform. That was a lot of the appeal to me.
    - tonyedgecombe 12y ago
      I don't think you can count it as free if it comes loaded with malware.
      - c0wb0yc0d3r 12y ago
        To be clear though, it's the SF installer not FZ itself. You can most certainly go and compile it yourself.
      - slenk 12y ago
        Filezilla isn't malware. The SF installer is malware
    - makzan 12y ago
      I use CyberDuck which has free edition and is open source too. It doesn’t support Linux although.
  - 0942v8653 12y ago
    How does Transmit compare to Cyberduck?
  - rogual 12y ago
- davb 12y ago
  I've heard similar things about FileZilla and it's creator. Do you have any recommendations for an open source, GUI-based, Linux FTP client? Most of the time I simply scp or rsync files as neccessary, however I use FileZilla to manage files on my phone and tablets via FTP. I've never found the FTP/SFTP/SMB support in Thunar to be all that reliable...
  - RubyPinch 12y ago
    unfortunately I haven't. For the most part, I'm a Windows user, so I've been using Explorer for plain FTP to my phone (which, while not great, does do the job more-than-well-enough for my uses)
  - TazeTSchnitzel 12y ago
    IIRC GNOME has FTP and SFTP support, so you should be able to just use Nautilus.
    - davb 12y ago
      I'm not using GNOME. I'm using XFCE, and unfortunately in my experience Thunar (the XFCE file manager) doesn't handle those sorts of connections too well. I think it's more to do with the FUSE layer beneath it (possibly the same driver that's used by GNOME).
  - cyphax 12y ago
    Maybe Midnight Commander? It can open FTP-connections (and shell connections, too, allowing secure copying of files over SSH rather than FTP), has that well-known dual pane layout, and, while not a GUI application, can be controlled the same way a GUI application can without even needing X. :)
  - okasaki 12y ago
    For sftp, you can just mount it locally with sshfs and then use $FILE_MANAGER
    - davb 12y ago
leni536 12y ago
Open source software really should abandon SourceForge. You can't even download any binaries through HTTPS from them. Even if you log in the download links redirect to plain HTTP.
jmuguy 12y ago
We've been sending Windows clients to https://ninite.com/filezilla/ https://ninite.com/filezilla/ to download it but perhaps we ought to start avoiding it completely. I don't particularly like any other FTP client I've used in Windows, but its been a while since I looked.
- thrillgore 12y ago
  I've been a fan of Cyberduck for quite some time now.
  - glomph 12y ago
    hmm I did not know there was a windows version.
  - micro-ram 12y ago
    I like Cyberduck for quickly creating expiring S3 download links.
- whoisthemachine 12y ago
  That's a neat website and product. I've often wanted a quasi-package manager for Windows. Now I use Linux almost exclusively however :/.
  - aswerty 12y ago
    For something a bit less "quasi" there is https://chocolatey.org/ https://chocolatey.org/.
  - panzi 12y ago
    A friend of mine uses this: http://portableapps.com/ http://portableapps.com/ (I use Linux.)
  - slantyyz 12y ago
    If you're on Windows, it's a great site. I just had to provision a new laptop, and it saved me a ton of time, since I was able to install about a third of my checklist with a single download.
jpmonette 12y ago
It sounds more like a SourceForge issue than FileZilla. SourceForge used to provide clean binaries, but I guess they changed that process in the past year or two to bundle apps in the installer wrapper. You need to be extremely careful during the installation process to make sure that you do not accidentally install some extra software. The same happen to uTorrent - they also added tricky question during the install process to include advertisement, change default browser and such. That's a sad way to earn money - the end-users will definitely move on because of that.
- pc86 12y ago
  Unfortunately it must work because people keep doing it. If it didn't increase revenue companies would stop doing it. It's the same with those timed modal windows on blogs. They piss a lot of people off. But they also increase email capture rates, and sites with large audiences usually see revenue increase as a result.
  - geekamongus 12y ago
    > Unfortunately it must work because people keep doing it. If it didn't increase revenue companies would stop doing it. Unless it's a desperate attempt at saving a sinking ship.
    - TazeTSchnitzel 12y ago
      If SourceForge want to stay afloat, they should reinvent themselves as a decent GitHub alternative or pivot. Bundling malware for kickbacks and keeping the old site design won't take them anywhere good.
- Cthulhu_ 12y ago
  FileZilla could choose to move away from SourceForge, to be honest - any party staying with SF after stunts like this (and this isn't the first one) are as corrupt as SF themselves are IMO
  - 12y ago
_cpancake 12y ago
There's really no reason to use SourceForge anymore. GitHub can do almost everything SourceForge can do, aside from app reviews I guess. GitHub also doesn't make you feel like you're in 2004.
- longlivegnu 12y ago
  some people want that 2004 feel. Also some people don't like github, __even the creator of git doesn't like github__
  - TazeTSchnitzel 12y ago
    Linus's problems with GitHub are mostly with how it handles pull requests, IIRC.
    - longlivegnu 12y ago
      As well as commit messages, he said it's fine as a mirror
      - lomnakkus 12y ago
        Indeed, but how is any of this relevant to the OP?
  - estefan 12y ago
    > __even the creator of git doesn't like github__ That's like saying "even the creator of baked beans doesn't like Tesco". So what?
    - longlivegnu 12y ago
      If the creator of a software critiques your SaaS that uses his software maybe you should pay more attention to it? I am sure Linus knows git a lot better than most of us.
zuck9 12y ago
This is not about SourceForge or FileZilla. This is an issue that plagues most Windows freewares, everyone is integrating offers to the installer. Even FileHippo started this recently. The download manager (wrapper) of these 2 companies are provided by the same Israeli company InstallCore.
ro-mx 12y ago
sadly it is true
ro-mx 12y ago
sadly it is very true
Cthulhu_ 12y ago
For Windows and my own servers I don't even bother with FTP anymore, it's just another possible entry into my servers. WinSCP / SCP itself works fine, no FTP server required.
ExpiredLink 12y ago
Someone tries to monetize his GPLd software in an unfriendly way.
nikolak 12y ago
As far as I remember this is an opt-in feature for developers who host their projects on sourceforge that makes the installer offer additional software, by 3rd parties, to be installed. That additional software may be malicious.
gavreh 12y ago
Seems to me like there's a market for a reasonably priced, excellent, simple, Windows FTP client. (cross-platform bonus points)
- deleted 12y ago
  [deleted]
debacle 12y ago
SourceForce itself pushes a lot of malware these days. If your software comes in an installer, I wouldn't trust it.
ghantila 12y ago
If you really need FileZilla, you can directly download the portable version with this workaround. Visit http://downloads.sourceforge.net/project/filezilla/FileZilla_Client/3.10.0/FileZilla_3.10.0_win32.zip http://downloads.sourceforge.net/project/filezilla/FileZilla... to directly start downloading Or, switch to someother FTP client. References: List of FTP Server Software - https://en.wikipedia.org/wiki/List_of_FTP_server_software https://en.wikipedia.org/wiki/List_of_FTP_server_software Comparision of FTP Client Software - https://en.wikipedia.org/wiki/Comparison_of_FTP_client_software https://en.wikipedia.org/wiki/Comparison_of_FTP_client_softw...
- TazeTSchnitzel 12y ago
  Or get the PortableApps.com version.
- el_duderino 12y ago
  Or just download via ninite.com & auto installs w/o the crapware.
- Buge 12y ago
  Or click the direct download link on the front page. https://i.imgur.com/o7sE9aP.png https://i.imgur.com/o7sE9aP.png
jayess 12y ago
If you read through this thread [1] on the filezilla forums, you'll see that the administrator defends the use of SourceForge over and over. My guess is that they're receiving kickbacks of some sort for the installation of said malware. [1] https://forum.filezilla-project.org/viewtopic.php?f=1&t=32945 https://forum.filezilla-project.org/viewtopic.php?f=1&t=3294...
- TazeTSchnitzel 12y ago
  Yes, SourceForge give you money, I believe.
- danielweber 12y ago
  Someone has to pay the bills. I think the world would be better if people just expected to pay a small amount for software, but we don't live in that world, and so we get "free" software you can download "for free" that installs a bunch of crap so the developers can get paid.
  - nine_k 12y ago
    Up until rather recently, it was hard to pay or receive sub-dollar amounts. This problem is solved on the two mobile platforms (though Apple still takes a much larger cut from payments). Paypal / Stripe / Square sort of solve it in the web space. But we still lack a nice software store (or several) where you could pay a piece of software and pay a nominal amount (or more if you choose to donate), knowing that you won't receive any malware / nagware in exchange, and that a large cut of your payment goes to the authors and maintainers. Similar things seem to happen around indie musical tracks, so probably the model could survive in the "indie" software area.
    - reitanqild 12y ago
      Yep, I love it when I find good music on youtube abd a link to bandcamp where I can pay a small minimum amount (or more). They seem to have done something right as me and others typically pay well over the minimum price
Someone1234 12y ago
Just want to be clear about something: - This program (bundling) is opt in for the project (Filezilla) and SourceForge ("the pimp") pays Filezilla ("the whore") for each download. - This isn't recent. In fact it started well over a year ago and was well publicized. - Even a year ago it was all very malware-y. - A lot of people were super dismissive about this issue a year ago (see Reddit threads and here). In fact many supported the practice. - Those same people are now whining about it. - Suggesting that "but Github exists!" as a solution entirely misses the point. Sourceforge pays the project money, and both Sourceforge and the project profit. So unless Github can match that (hint: it cannot) then that is a non-starter.
- drzaiusapelord 12y ago
  This is why I have high hopes for integration with the Microsoft store in Windows 10. I'd be pretty happy giving the Filezilla people .99 cents, assuming no 3rd party installer tricks. MS would store my credit card, it would be a one-click process, take the onus of hosting from Sourceforge/Filezilla, and pay a nice little chunk of change on the side directly to the Filezilla people. Of course, anyone is free to fork it and host it for free. There are a lot of little things that drive me crazy about Filezilla. I imagine others have the same issues. I could see a fork with good management being very successful.
  - almostdvs 12y ago
    Remember your units!! http://verizonmath.blogspot.com/2006/12/verizon-doesnt-know-dollars-from-cents.html http://verizonmath.blogspot.com/2006/12/verizon-doesnt-know-...
  - lsaferite 12y ago
    I think this is a point a lot of open source projects miss. They can, and probably should, sell the software even though it is open source. Trademark (?) protection would prevent a third party from using their name even though it was open source (at least I think so based on the whole Iceweasel event). Personally, I'd also gladly pay Filezilla a small amount even though it's open source.
gojomo 12y ago
Separate from any particular issue with Filezilla: all Sourceforge downloads are via insecure HTTP, so could be redirected elsewhere, or corrupted in transit, to deliver malware. Even if you try to use an HTTPS link, Sourceforge redirects to a plain HTTP download.
- AlyssaRowan 12y ago
  And if you ask them about this, you get no reply. Which is interesting. Yes, they should be regarded as a malware site these days. It's a shame, really. Some other site should probably mirror the projects that aren't anywhere else and host them properly.
NKCSS 12y ago
Just make sure to add ?nowrap to the end of the url and you'll download the orignal package without that crapware installer sourceforge adds.
- userbinator 12y ago
  Sounds like a job for a userscript. ...and someone has already made one for SF and a few other sites: http://userscripts-mirror.org/scripts/review/417459 http://userscripts-mirror.org/scripts/review/417459
- gesman 12y ago
  If that is indeed that easy - everyone should be aware of this. Assuming sourceforge will not get rid of that feature after too many people start using it.
smrtinsert 12y ago
It works really well unfortunately. I would prefer my installations without the potential for malware, but I don't see another sftp client as mature as filezilla. There used to be a ton and then it emerged as the best. fwiw it seems the auto updates are malware free.
- squeaky-clean 12y ago
  I always install FileZilla through Ninite or apt-get, so I know my installation is clean, but I'd like to stop using and recommending FileZilla out of principle because of this (and reading the responses on the filezilla forum). Everyone else in my office uses FileZilla as well, and I'm sure many of them used the sourceforge installer and didn't fully read the options. But you're right, I don't know any other decent FTP clients that I would recommend. Maybe someone on HN knows of a good alternative?
  - cdvonstinkpot 12y ago
    > I don't know any other decent FTP clients that I would recommend. I use a paid version of SmartFTP & like it. Combines Filezilla with Putty.
- trurl42 12y ago
  WinSCP is a nice alternative. http://winscp.net/ http://winscp.net/
  - arca_vorago 12y ago
    WinSCP is far superior to filezilla. At my last job stuck using a Windows machine for some things, I ended up using it quite extensively. Every bug I submitted to the author was fixed within months. He is also active on the forums, though has a bit of a Linus Torvalds style... which can be offputting for some. Filezilla use will drop down because most admins I know that hear about this will immediately write it off as too dangerous to even try to get around. Sure you can dig into the sourceforge files and maybe find a clean version, or maybe find a checksumed mirror, but would you really trust it?
codegeek 12y ago
i m an idiot but does this impact the linux version ? I use Filezilla on my ubuntu that I downloaded around September'2014 and not sure if I downloaded from Sourceforge. I am guessing this issue is only for Windows, right ?
- towelguy 12y ago
  If you used `apt-get install filezilla` then no. Does anyone know if sourceforge include malware for their Linux binaries?
  - primaryobjects 12y ago
    I installed via the Linux Mint package manager and found no issues of malware.
otikik 12y ago
Is there a fork without the malware?
kefs 12y ago
I haven't trusted anything from SourceForge since they were compromised 4 years ago, regardless of their 'data validation'. https://sourceforge.net/blog/sourceforge-attack-full-report/ https://sourceforge.net/blog/sourceforge-attack-full-report/
_lce0 12y ago
Can we file a report against SF? Then when users attempt to enter the site browsers will warn about the dangers.
ChrisArchitect 12y ago
so easy to avoid by just toggling the Direct Download Link option at top of file list to On
jackmaney 12y ago
As time marched on, I've found myself more and more hesitant to use SourceForge at all, even to download things. If a project isn't available on GitHub, BitBucket, or through a package manager, then I'm very unlikely to download the source.
bborud 12y ago
Nobody should use Sourceforge. I rarely take projects seriously when hosted on Sourceforge.
krzrak 12y ago
I think Google should mark SourceForge as malware site.
jdlyga 12y ago
What happened to you Sourceforge? I hope the same thing doesn't happen to Github in 10 years.
jdlyga 12y ago
What happened to you Sourceforge? I hope the same thing doesn't happen to Github in 10 years.
deleted 12y ago
[deleted]
irishjohn 12y ago
What about doing a Fork of it? Clean build. Call it Forkzilla.
robert_tweed 12y ago
Just an FYI for those cases when you need to download something that isn't available anywhere other than SourceForge: there's a small, plain-text "direct download" link under the big download button. They tend to move this around a bit to make it harder to spot, but it's always been there since the malware-infested download manager was introduced. The malware & crapware is entirely limited to SF's download manager. The application binaries themselves are totally clean.
smilepet_26 12y ago
I faced the same problem. This is a total mess and I could not believe that a most reputed web program like Filezilla hosted at Sourceforge is a malicious software. The best thing should be that Filezilla should be available for download from https://filezilla-project.org https://filezilla-project.org firsthand.
aleem 12y ago
The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.
- DanBC 12y ago
  What's the alternative? It's a good thing that the developer does not give you a false sense of security. http://security.stackexchange.com/questions/39321/should-i-use-filezilla http://security.stackexchange.com/questions/39321/should-i-u...
  - electrotype 12y ago
    A master password, no?
    - DanBC 12y ago
      No. See the acres of discussion about Google Chrome not having a master password. The fact that they caved in and no provide a master password does not mean it's a good idea.
      - pb2au 12y ago
        The argument that I recall for Chrome not having an optional master password was that it was often less secure than using the system's encrypted data store for their account, if available. Requiring a master password to decrypt the network passwords is a perfectly fine idea if you want to maintain portability and reduce the chance that your network passwords are accidentally exposed. An attacker has to both have the password file and either figure out the master password or have code execution privileges on the user's account to gain the network passwords. This is more secure than trying to ensure the password file doesn't get "misplaced" (e.g. on an unencrypted drive, in unencrypted backups, unintentionally through a fileserver, etc).
aleem 12y ago
The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.
aleem 12y ago
The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.
aleem 12y ago
The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.
cordite 12y ago
Ever since 2007-2008, Source Forge and places like CNET really started to lose trust for me. When I noticed something from source forge had some sort of downloading tool I put my hands down and refused to continue with that sort of thing. We have enough Ask Tool bar kind of crap from Oracle Java installers, and when useful tools step to doing similar things, it really makes me lose respect and find alternatives. As a developer, I need to have a work environment that is robust and dependable. Additional promotional packages that can slip through will disrupt or degrade my work. That is not something I can take and feel sane.
Pxtl 12y ago
I wonder if Mozilla could argue that Filezilla is infringing on their trademark and damaging their reputation because of this. I mean, it's an open-source client for a common internet protocol that ends in "zilla". It would be easy for users to assume that Filezilla is affiliated with Mozilla. And up until the move to Sourceforge's adware downloader system, that would have been fine for everybody - they're both good products. But now? Now filezilla is riding on mozilla's coattails with the confusion and profiting from it, to the detriment of mozilla's reputation.
- deleted 12y ago
  [deleted]
yellowapple 12y ago
I've been a long-time user of WinSCP anyway, regardless of FileZilla's antics. Seems to work better, for me at least. Unfortunately, this is a reminder that free software isn't a guarantee of software freedom or safety.
DunningKE 12y ago
I've had a similar experience trying to install OpenCV. I use windows, and I couldn't figure out why something like OpenCV could possibly have malware with it. When I downloaded it, chrome said "Stop! This is malware!" I thought that there was no way there could be a problem with the file unless Sorceforge was having issues. What fixed the issue for me was downloading from a different mirror. So perhaps some of the mirrors are compromised?
jongalloway2 12y ago
This is a solved problem: https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla Chocolatey packages include silent, malware free installers
abandonliberty 12y ago
Solution: Use the zip version. It's portable. Avoid sourceforge where possible. The download page even says: >This installer may include bundled offers. Check below for more options. Yes, it's a bit dirty. Valid discussion here is how to make open source viable, otherwise pimps like sourceforge will exist. Now get off my lawn with your fancy installers :)
zer01 12y ago
Also let's not forget that Filezilla will silently cache all your credentials in plaintext without telling you :(
nyar 12y ago
I haven't paid for the program and have not installed any adware on my machine, I am happy with the product and have no qualm with someone who has spent their time making something to try to profit from it. I'm not the sort of person who opts-in to install malware so its not an issue to me. If I wanted to be upset about something I would buy a commercial, ad-free, program and complain that it does not have features of filezilla.
nyar 12y ago
I haven't paid for the program and have not installed any adware on my machine, I am happy with the product and have no qualm with someone who has spent their time making something to try to profit from it. I'm not the sort of person who opts-in to install malware so its not an issue to me. If I wanted to be upset about something I would buy a commercial, ad-free, program and complain that it does not have features of filezilla.
AlyssaRowan 12y ago
Wow. They even wrap the source packages, and the portable ones. Bastards.
yAnonymous 12y ago
Is there a good cross-platform alternative to FileZilla? Or seeing as it's licensed under GPLv2, maybe we should just setup a GitHub repo with the latest source and links to pre-compiled binaries.
blueskin_ 12y ago
Sourceforge has been doing this for years. I would never download anything from there these days.

283 points by Sami_Lehtinen 12y ago

https://www.virustotal.com/fi/file/d0d418efb07df4378b24bccaced697bf34745de33ad1521beffa18565d9f2e1c/analysis/1420630836/ https://www.virustotal.com/fi/file/d0d418efb07df4378b24bccac... If you download the package, it will be unique malware packet for you. So if you check it with virus total, it's not the same file.

loosescrews 12y ago
As usual, Avira is right on the money with "Adware/InstallC.buzg." ESET is pretty good too with "a variant of Win32/InstallCore.UQ." None of the other providers clearly identified it.

RubyPinch 12y ago

isn't this more, the SourceForge wrapper is acting unsafely? regardless, this has been happening for the entire last year with the consent of the developers: https://forum.filezilla-project.org/viewforum.php?f=1&sid=13d72227c55b2204476060d348e64d37 https://forum.filezilla-project.org/viewforum.php?f=1&sid=13... I would be very doubtful they will listen to their users any further about the harm it does. I'll probably avoid FZ from now on, I don't exactly enjoy using software that is openly hostile towards me

necrobrit 12y ago
Wow, yeah, this thread: https://forum.filezilla-project.org/viewtopic.php?f=1&t=32945 https://forum.filezilla-project.org/viewtopic.php?f=1&t=3294... I think it is best to avoid these guys.
- cyphax 12y ago
  While I initially thought this as well, at some point the site admin (botg) posts this: ""MalSign.Generic.F84". Looks like a typical false-positive generated by a heuristic. There is no malware in the SourceForge Downloader, you can safely use it to install FileZilla. While the SourceForge Installer may present third-party offers, they are clearly labeled as such. All third-party offers can easily be declined. Nothing unwanted is being installed without your consent. Declining offers does not prevent nor otherwise disturb the installation of FileZilla. If you do not wish to use the SourceForge installer, have a look at the additional download options listed on the FileZilla website." His stance seems to be that it's not malware, rather a false positive (I have no proof to claim he's wrong and if he is, it could be a honest mistake; he's trusting SF, which I understand), and he mentions that you can also download Filezilla from their own website, without the SF installer. That seems pretty reasonable to me, but again: at first I got the impression they (FileZilla's owners) simply didn't care. I hate what SF has been doing, and I refuse to use their installers (although I'm primarily a Linux-user so I don't have to worry about these installers, thankfully), but I don't really feel like the FileZilla owners should be avoided as it looks like they're simply trusting SourceForge, nothing more. I hope I'm right. ;)
  - RubyPinch 12y ago
    my main issue is that, the offers only exist to either affect the people who don't know any better (and would probably chose the opposite if they were more educated about such practices), or those that mis-click. Most people, when presented with a) a logo (of a group they trust), and b) accept or decline, they are going to make assumptions and not read the middle. Which ends up affecting a lot of users: every bad review relating to the installer and every complaint in the forums (once again, in relation to the installer), is a person who has been deceived and had a negative experience, because of a decision of the FZ developers (and the installer is choose-able by the project developer, last I inquired)
grimmfang 12y ago
Filezilla's community is toxic and the projects creator can be aptly described as tyrannical. If you use Mac check out Transmit by Panic. It's the best FTP client I've ever used.
- ceejayoz 12y ago
  I'll second the Transmit recommendation. As a bonus, it nicely supports AWS S3 and S3-compatible object stores.
- slenk 12y ago
  Filezilla is free and cross-platform. That was a lot of the appeal to me.
  - tonyedgecombe 12y ago
    I don't think you can count it as free if it comes loaded with malware.
    - c0wb0yc0d3r 12y ago
      To be clear though, it's the SF installer not FZ itself. You can most certainly go and compile it yourself.
    - slenk 12y ago
      Filezilla isn't malware. The SF installer is malware
  - makzan 12y ago
    I use CyberDuck which has free edition and is open source too. It doesn’t support Linux although.
- 0942v8653 12y ago
  How does Transmit compare to Cyberduck?
- rogual 12y ago
davb 12y ago
I've heard similar things about FileZilla and it's creator. Do you have any recommendations for an open source, GUI-based, Linux FTP client? Most of the time I simply scp or rsync files as neccessary, however I use FileZilla to manage files on my phone and tablets via FTP. I've never found the FTP/SFTP/SMB support in Thunar to be all that reliable...
- RubyPinch 12y ago
  unfortunately I haven't. For the most part, I'm a Windows user, so I've been using Explorer for plain FTP to my phone (which, while not great, does do the job more-than-well-enough for my uses)
- TazeTSchnitzel 12y ago
  IIRC GNOME has FTP and SFTP support, so you should be able to just use Nautilus.
  - davb 12y ago
    I'm not using GNOME. I'm using XFCE, and unfortunately in my experience Thunar (the XFCE file manager) doesn't handle those sorts of connections too well. I think it's more to do with the FUSE layer beneath it (possibly the same driver that's used by GNOME).
- cyphax 12y ago
  Maybe Midnight Commander? It can open FTP-connections (and shell connections, too, allowing secure copying of files over SSH rather than FTP), has that well-known dual pane layout, and, while not a GUI application, can be controlled the same way a GUI application can without even needing X. :)
- okasaki 12y ago
  For sftp, you can just mount it locally with sshfs and then use $FILE_MANAGER
  - davb 12y ago

leni536 12y ago

Open source software really should abandon SourceForge. You can't even download any binaries through HTTPS from them. Even if you log in the download links redirect to plain HTTP.

jmuguy 12y ago

We've been sending Windows clients to https://ninite.com/filezilla/ https://ninite.com/filezilla/ to download it but perhaps we ought to start avoiding it completely. I don't particularly like any other FTP client I've used in Windows, but its been a while since I looked.

thrillgore 12y ago
I've been a fan of Cyberduck for quite some time now.
- glomph 12y ago
  hmm I did not know there was a windows version.
- micro-ram 12y ago
  I like Cyberduck for quickly creating expiring S3 download links.
whoisthemachine 12y ago
That's a neat website and product. I've often wanted a quasi-package manager for Windows. Now I use Linux almost exclusively however :/.
- aswerty 12y ago
  For something a bit less "quasi" there is https://chocolatey.org/ https://chocolatey.org/.
- panzi 12y ago
  A friend of mine uses this: http://portableapps.com/ http://portableapps.com/ (I use Linux.)
- slantyyz 12y ago
  If you're on Windows, it's a great site. I just had to provision a new laptop, and it saved me a ton of time, since I was able to install about a third of my checklist with a single download.

jpmonette 12y ago

It sounds more like a SourceForge issue than FileZilla. SourceForge used to provide clean binaries, but I guess they changed that process in the past year or two to bundle apps in the installer wrapper. You need to be extremely careful during the installation process to make sure that you do not accidentally install some extra software. The same happen to uTorrent - they also added tricky question during the install process to include advertisement, change default browser and such. That's a sad way to earn money - the end-users will definitely move on because of that.

pc86 12y ago
Unfortunately it must work because people keep doing it. If it didn't increase revenue companies would stop doing it. It's the same with those timed modal windows on blogs. They piss a lot of people off. But they also increase email capture rates, and sites with large audiences usually see revenue increase as a result.
- geekamongus 12y ago
  > Unfortunately it must work because people keep doing it. If it didn't increase revenue companies would stop doing it. Unless it's a desperate attempt at saving a sinking ship.
  - TazeTSchnitzel 12y ago
    If SourceForge want to stay afloat, they should reinvent themselves as a decent GitHub alternative or pivot. Bundling malware for kickbacks and keeping the old site design won't take them anywhere good.
Cthulhu_ 12y ago
FileZilla could choose to move away from SourceForge, to be honest - any party staying with SF after stunts like this (and this isn't the first one) are as corrupt as SF themselves are IMO
- 12y ago

_cpancake 12y ago

There's really no reason to use SourceForge anymore. GitHub can do almost everything SourceForge can do, aside from app reviews I guess. GitHub also doesn't make you feel like you're in 2004.

longlivegnu 12y ago
some people want that 2004 feel. Also some people don't like github, __even the creator of git doesn't like github__
- TazeTSchnitzel 12y ago
  Linus's problems with GitHub are mostly with how it handles pull requests, IIRC.
  - longlivegnu 12y ago
    As well as commit messages, he said it's fine as a mirror
    - lomnakkus 12y ago
      Indeed, but how is any of this relevant to the OP?
- estefan 12y ago
  > __even the creator of git doesn't like github__ That's like saying "even the creator of baked beans doesn't like Tesco". So what?
  - longlivegnu 12y ago
    If the creator of a software critiques your SaaS that uses his software maybe you should pay more attention to it? I am sure Linus knows git a lot better than most of us.

zuck9 12y ago

This is not about SourceForge or FileZilla. This is an issue that plagues most Windows freewares, everyone is integrating offers to the installer. Even FileHippo started this recently. The download manager (wrapper) of these 2 companies are provided by the same Israeli company InstallCore.

ro-mx 12y ago

sadly it is true

ro-mx 12y ago

sadly it is very true

Cthulhu_ 12y ago

For Windows and my own servers I don't even bother with FTP anymore, it's just another possible entry into my servers. WinSCP / SCP itself works fine, no FTP server required.

ExpiredLink 12y ago

Someone tries to monetize his GPLd software in an unfriendly way.

nikolak 12y ago

As far as I remember this is an opt-in feature for developers who host their projects on sourceforge that makes the installer offer additional software, by 3rd parties, to be installed. That additional software may be malicious.

gavreh 12y ago

Seems to me like there's a market for a reasonably priced, excellent, simple, Windows FTP client. (cross-platform bonus points)

deleted 12y ago
[deleted]

debacle 12y ago

SourceForce itself pushes a lot of malware these days. If your software comes in an installer, I wouldn't trust it.

ghantila 12y ago

If you really need FileZilla, you can directly download the portable version with this workaround. Visit http://downloads.sourceforge.net/project/filezilla/FileZilla_Client/3.10.0/FileZilla_3.10.0_win32.zip http://downloads.sourceforge.net/project/filezilla/FileZilla... to directly start downloading Or, switch to someother FTP client. References: List of FTP Server Software - https://en.wikipedia.org/wiki/List_of_FTP_server_software https://en.wikipedia.org/wiki/List_of_FTP_server_software Comparision of FTP Client Software - https://en.wikipedia.org/wiki/Comparison_of_FTP_client_software https://en.wikipedia.org/wiki/Comparison_of_FTP_client_softw...

TazeTSchnitzel 12y ago
Or get the PortableApps.com version.
el_duderino 12y ago
Or just download via ninite.com & auto installs w/o the crapware.
Buge 12y ago
Or click the direct download link on the front page. https://i.imgur.com/o7sE9aP.png https://i.imgur.com/o7sE9aP.png

jayess 12y ago

If you read through this thread [1] on the filezilla forums, you'll see that the administrator defends the use of SourceForge over and over. My guess is that they're receiving kickbacks of some sort for the installation of said malware. [1] https://forum.filezilla-project.org/viewtopic.php?f=1&t=32945 https://forum.filezilla-project.org/viewtopic.php?f=1&t=3294...

TazeTSchnitzel 12y ago
Yes, SourceForge give you money, I believe.
danielweber 12y ago
Someone has to pay the bills. I think the world would be better if people just expected to pay a small amount for software, but we don't live in that world, and so we get "free" software you can download "for free" that installs a bunch of crap so the developers can get paid.
- nine_k 12y ago
  Up until rather recently, it was hard to pay or receive sub-dollar amounts. This problem is solved on the two mobile platforms (though Apple still takes a much larger cut from payments). Paypal / Stripe / Square sort of solve it in the web space. But we still lack a nice software store (or several) where you could pay a piece of software and pay a nominal amount (or more if you choose to donate), knowing that you won't receive any malware / nagware in exchange, and that a large cut of your payment goes to the authors and maintainers. Similar things seem to happen around indie musical tracks, so probably the model could survive in the "indie" software area.
  - reitanqild 12y ago
    Yep, I love it when I find good music on youtube abd a link to bandcamp where I can pay a small minimum amount (or more). They seem to have done something right as me and others typically pay well over the minimum price

Someone1234 12y ago

Just want to be clear about something: - This program (bundling) is opt in for the project (Filezilla) and SourceForge ("the pimp") pays Filezilla ("the whore") for each download. - This isn't recent. In fact it started well over a year ago and was well publicized. - Even a year ago it was all very malware-y. - A lot of people were super dismissive about this issue a year ago (see Reddit threads and here). In fact many supported the practice. - Those same people are now whining about it. - Suggesting that "but Github exists!" as a solution entirely misses the point. Sourceforge pays the project money, and both Sourceforge and the project profit. So unless Github can match that (hint: it cannot) then that is a non-starter.

drzaiusapelord 12y ago
This is why I have high hopes for integration with the Microsoft store in Windows 10. I'd be pretty happy giving the Filezilla people .99 cents, assuming no 3rd party installer tricks. MS would store my credit card, it would be a one-click process, take the onus of hosting from Sourceforge/Filezilla, and pay a nice little chunk of change on the side directly to the Filezilla people. Of course, anyone is free to fork it and host it for free. There are a lot of little things that drive me crazy about Filezilla. I imagine others have the same issues. I could see a fork with good management being very successful.
- almostdvs 12y ago
  Remember your units!! http://verizonmath.blogspot.com/2006/12/verizon-doesnt-know-dollars-from-cents.html http://verizonmath.blogspot.com/2006/12/verizon-doesnt-know-...
- lsaferite 12y ago
  I think this is a point a lot of open source projects miss. They can, and probably should, sell the software even though it is open source. Trademark (?) protection would prevent a third party from using their name even though it was open source (at least I think so based on the whole Iceweasel event). Personally, I'd also gladly pay Filezilla a small amount even though it's open source.

gojomo 12y ago

Separate from any particular issue with Filezilla: all Sourceforge downloads are via insecure HTTP, so could be redirected elsewhere, or corrupted in transit, to deliver malware. Even if you try to use an HTTPS link, Sourceforge redirects to a plain HTTP download.

AlyssaRowan 12y ago
And if you ask them about this, you get no reply. Which is interesting. Yes, they should be regarded as a malware site these days. It's a shame, really. Some other site should probably mirror the projects that aren't anywhere else and host them properly.

NKCSS 12y ago

Just make sure to add ?nowrap to the end of the url and you'll download the orignal package without that crapware installer sourceforge adds.

userbinator 12y ago
Sounds like a job for a userscript. ...and someone has already made one for SF and a few other sites: http://userscripts-mirror.org/scripts/review/417459 http://userscripts-mirror.org/scripts/review/417459
gesman 12y ago
If that is indeed that easy - everyone should be aware of this. Assuming sourceforge will not get rid of that feature after too many people start using it.

smrtinsert 12y ago

It works really well unfortunately. I would prefer my installations without the potential for malware, but I don't see another sftp client as mature as filezilla. There used to be a ton and then it emerged as the best. fwiw it seems the auto updates are malware free.

squeaky-clean 12y ago
I always install FileZilla through Ninite or apt-get, so I know my installation is clean, but I'd like to stop using and recommending FileZilla out of principle because of this (and reading the responses on the filezilla forum). Everyone else in my office uses FileZilla as well, and I'm sure many of them used the sourceforge installer and didn't fully read the options. But you're right, I don't know any other decent FTP clients that I would recommend. Maybe someone on HN knows of a good alternative?
- cdvonstinkpot 12y ago
  > I don't know any other decent FTP clients that I would recommend. I use a paid version of SmartFTP & like it. Combines Filezilla with Putty.
trurl42 12y ago
WinSCP is a nice alternative. http://winscp.net/ http://winscp.net/
- arca_vorago 12y ago
  WinSCP is far superior to filezilla. At my last job stuck using a Windows machine for some things, I ended up using it quite extensively. Every bug I submitted to the author was fixed within months. He is also active on the forums, though has a bit of a Linus Torvalds style... which can be offputting for some. Filezilla use will drop down because most admins I know that hear about this will immediately write it off as too dangerous to even try to get around. Sure you can dig into the sourceforge files and maybe find a clean version, or maybe find a checksumed mirror, but would you really trust it?

codegeek 12y ago

i m an idiot but does this impact the linux version ? I use Filezilla on my ubuntu that I downloaded around September'2014 and not sure if I downloaded from Sourceforge. I am guessing this issue is only for Windows, right ?

towelguy 12y ago
If you used `apt-get install filezilla` then no. Does anyone know if sourceforge include malware for their Linux binaries?
- primaryobjects 12y ago
  I installed via the Linux Mint package manager and found no issues of malware.

otikik 12y ago

Is there a fork without the malware?

kefs 12y ago

I haven't trusted anything from SourceForge since they were compromised 4 years ago, regardless of their 'data validation'. https://sourceforge.net/blog/sourceforge-attack-full-report/ https://sourceforge.net/blog/sourceforge-attack-full-report/

_lce0 12y ago

Can we file a report against SF? Then when users attempt to enter the site browsers will warn about the dangers.

ChrisArchitect 12y ago

so easy to avoid by just toggling the Direct Download Link option at top of file list to On

jackmaney 12y ago

As time marched on, I've found myself more and more hesitant to use SourceForge at all, even to download things. If a project isn't available on GitHub, BitBucket, or through a package manager, then I'm very unlikely to download the source.

bborud 12y ago

Nobody should use Sourceforge. I rarely take projects seriously when hosted on Sourceforge.

krzrak 12y ago

I think Google should mark SourceForge as malware site.

jdlyga 12y ago

What happened to you Sourceforge? I hope the same thing doesn't happen to Github in 10 years.

jdlyga 12y ago

What happened to you Sourceforge? I hope the same thing doesn't happen to Github in 10 years.

deleted 12y ago

[deleted]

irishjohn 12y ago

What about doing a Fork of it? Clean build. Call it Forkzilla.

robert_tweed 12y ago

Just an FYI for those cases when you need to download something that isn't available anywhere other than SourceForge: there's a small, plain-text "direct download" link under the big download button. They tend to move this around a bit to make it harder to spot, but it's always been there since the malware-infested download manager was introduced. The malware & crapware is entirely limited to SF's download manager. The application binaries themselves are totally clean.

smilepet_26 12y ago

I faced the same problem. This is a total mess and I could not believe that a most reputed web program like Filezilla hosted at Sourceforge is a malicious software. The best thing should be that Filezilla should be available for download from https://filezilla-project.org https://filezilla-project.org firsthand.

aleem 12y ago

The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.

DanBC 12y ago
What's the alternative? It's a good thing that the developer does not give you a false sense of security. http://security.stackexchange.com/questions/39321/should-i-use-filezilla http://security.stackexchange.com/questions/39321/should-i-u...
- electrotype 12y ago
  A master password, no?
  - DanBC 12y ago
    No. See the acres of discussion about Google Chrome not having a master password. The fact that they caved in and no provide a master password does not mean it's a good idea.
    - pb2au 12y ago
      The argument that I recall for Chrome not having an optional master password was that it was often less secure than using the system's encrypted data store for their account, if available. Requiring a master password to decrypt the network passwords is a perfectly fine idea if you want to maintain portability and reduce the chance that your network passwords are accidentally exposed. An attacker has to both have the password file and either figure out the master password or have code execution privileges on the user's account to gain the network passwords. This is more secure than trying to ensure the password file doesn't get "misplaced" (e.g. on an unencrypted drive, in unencrypted backups, unintentionally through a fileserver, etc).

aleem 12y ago

The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.

aleem 12y ago

The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.

aleem 12y ago

The worst thing about FileZilla is clear text password files. The developer refuses to fix it I am not sure why.

cordite 12y ago

Ever since 2007-2008, Source Forge and places like CNET really started to lose trust for me. When I noticed something from source forge had some sort of downloading tool I put my hands down and refused to continue with that sort of thing. We have enough Ask Tool bar kind of crap from Oracle Java installers, and when useful tools step to doing similar things, it really makes me lose respect and find alternatives. As a developer, I need to have a work environment that is robust and dependable. Additional promotional packages that can slip through will disrupt or degrade my work. That is not something I can take and feel sane.

Pxtl 12y ago

I wonder if Mozilla could argue that Filezilla is infringing on their trademark and damaging their reputation because of this. I mean, it's an open-source client for a common internet protocol that ends in "zilla". It would be easy for users to assume that Filezilla is affiliated with Mozilla. And up until the move to Sourceforge's adware downloader system, that would have been fine for everybody - they're both good products. But now? Now filezilla is riding on mozilla's coattails with the confusion and profiting from it, to the detriment of mozilla's reputation.

deleted 12y ago
[deleted]

yellowapple 12y ago

I've been a long-time user of WinSCP anyway, regardless of FileZilla's antics. Seems to work better, for me at least. Unfortunately, this is a reminder that free software isn't a guarantee of software freedom or safety.

DunningKE 12y ago

I've had a similar experience trying to install OpenCV. I use windows, and I couldn't figure out why something like OpenCV could possibly have malware with it. When I downloaded it, chrome said "Stop! This is malware!" I thought that there was no way there could be a problem with the file unless Sorceforge was having issues. What fixed the issue for me was downloading from a different mirror. So perhaps some of the mirrors are compromised?

jongalloway2 12y ago

This is a solved problem: https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla Chocolatey packages include silent, malware free installers

abandonliberty 12y ago

Solution: Use the zip version. It's portable. Avoid sourceforge where possible. The download page even says: >This installer may include bundled offers. Check below for more options. Yes, it's a bit dirty. Valid discussion here is how to make open source viable, otherwise pimps like sourceforge will exist. Now get off my lawn with your fancy installers :)

zer01 12y ago

Also let's not forget that Filezilla will silently cache all your credentials in plaintext without telling you :(

nyar 12y ago

I haven't paid for the program and have not installed any adware on my machine, I am happy with the product and have no qualm with someone who has spent their time making something to try to profit from it. I'm not the sort of person who opts-in to install malware so its not an issue to me. If I wanted to be upset about something I would buy a commercial, ad-free, program and complain that it does not have features of filezilla.

nyar 12y ago

AlyssaRowan 12y ago

Wow. They even wrap the source packages, and the portable ones. Bastards.

yAnonymous 12y ago

Is there a good cross-platform alternative to FileZilla? Or seeing as it's licensed under GPLv2, maybe we should just setup a GitHub repo with the latest source and links to pre-compiled binaries.

blueskin_ 12y ago

Sourceforge has been doing this for years. I would never download anything from there these days.