6 ms·

I was shocked the other day when I went to grab FileZilla from SF, and my virus scanner tagged it for malware. I hadn't realized it had fallen so far as to bund

by nekopa 11y ago

I was shocked the other day when I went to grab FileZilla from SF, and my virus scanner tagged it for malware. I hadn't realized it had fallen so far as to bundle crapware. SF used to be my goto site for looking for weird open source stuff. Now I guess I will have to finally take SF off my list goto sites. You either die a hero or live long enough to become the villain.

laurent123456 11y ago
It was FileZilla's developers who decided to bundle crapware with their installer on SF so can't really blame SF on this. See there: https://forum.filezilla-project.org/viewtopic.php?t=31127 https://forum.filezilla-project.org/viewtopic.php?t=31127 "This is by design. In any case, nothing is forced upon you, all offers are entirely optional and are only being displayed during setup."
- tonyedgecombe 11y ago
  I guess this is what happens when people aren't willing to pay for software, there are plenty of really good ftp clients out there for not very much money.
  - fapjacks 11y ago
    Exactly. Just look at all the software for Linux. :T
    - tonyedgecombe 11y ago
      Outside of developer tools the software landscape for Linux doesn't look that great.
      - tracker1 11y ago
        Well, Steam seems to be growing pretty nicely... Also, for most users a good Browser is all they need. Which is why I love Chromebooks as an option for most people.
      - fapjacks 11y ago
        If your worldview is limited to "games" and "audio", then sure, you're right.
        the_af 11y ago
        This doesn't detract from your point, but... there are plenty of games for Linux nowadays. It cannot compete with Windows, of course, but thanks to Steam, the Humble Bundle, etc., we can now enjoy a multitude of videogames, including AAA titles. And plenty of indies, of course.
        fapjacks 11y ago
        There are! It's exciting to see so many games coming to Linux. I don't generally play games in my spare time, but I am glad the state of the art is beginning to make its way to this side.
  - laurent123456 11y ago
    The thing is open source programs often build their success on the fact they are free, get a lot users quickly, feedback and discussions on their forums on how to improve it, free translations from users, sometime patches, etc. Then when they suddenly exploit all this by adding ads, people are understandably upset. It's just a fact of life that open source software won't make you rich. Either they are ok with it, or they create a commercial product from the start. But adding crapware afterwards is not a proper solution.
    - tonyedgecombe 11y ago
      I'm not trying to justify it, just observing that when you don't pay anything then you can expect this sort of behaviour.
      - zouhair 11y ago
        Yes, paid software riddled with malware, rootkits and other niceties is unheard for. Bad people do bad things. Paying or not paying has nothing to do with it.
        tonyedgecombe 11y ago
        I disagree, paying customers wouldn't put up with a malware infested version of FileZilla, this stuff only really exists at the "free" end of the market.
        douche 11y ago
        This is empirically false. Video games have shipped with highly-intrusive rootkits and malware disguised as DRM for years, and it tends to be worse on the higher-end products, vs the shovelware/free-to-play/open-source.
        tonyedgecombe 11y ago
        You can find a few counter examples but they never last because the commercial pressure is too high, the obvious example is Sony, are they still deploying rootkits? Lenovo is another example that has started cleaning up its act. Would these companies change if their only source of funds was the malware? I don't think so.
- castell 11y ago
  I switched to WinSCP and never looked back.
- signal11 11y ago
  FileZilla has other issues as well: for example, for the longest time they refused to encrypt stored passwords, although the bug's been reopened now so they may change their mind: http://trac.filezilla-project.org/ticket/5530 http://trac.filezilla-project.org/ticket/5530
  - nkoren 11y ago
    Wow. Quoth one of FileZilla's developers: "Whether passwords are stored encrypted or in plaintext makes no difference in security." Just... wow.
    - FooBarWidget 11y ago
      This isn't "wow", it's true. The plaintext password is required to login to servers, so if you store it locally in an encrypted form then the decryption key must also be stored locally. If an attacker was able to get your encrypted password then the attacker is just as easily able to get your encryption key. For the same reason, Pidgin and many other IM programs also do not encrypt the password.
      - clinta 11y ago
        The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it, as well as protect against offline reading of the files. It doesn't stop every attack, but it's not useless.
        gruez 11y ago
        >This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it Outside of enterprise environments, most windows installations are single user. Even if it's a multi-user system, the data would already be protected by NTFS permissions if it was stored in the user's profile folder. >as well as protect against offline reading of the files no, it doesn't[1][2] [1] http://passcape.com/windows_password_recovery_dpapi_decoder http://passcape.com/windows_password_recovery_dpapi_decoder [2] http://www.dpapick.com/ http://www.dpapick.com/
- smegel 11y ago
  > See there: https://forum.filezilla-project.org/viewtopic.php?t=31127 https://forum.filezilla-project.org/viewtopic.php?t=31127 Strange, almost every comment on this page say the crapware was added by SourceForge, e.g. > The offers are added by SourceForge, they are borderline crapware to put it nicely.
  - laurent123456 11y ago
    SourceForge offers developers to add crapware to their installer in exchange for a revenue. This is completely optional and I suppose most dev don't do it (I distribute some semi-popular installer on SF and they've never forced me to include adwares). The FileZilla developers have never been very vocal about this so most of their comments is a generic "Nothing unwanted is being installed without your consent", but they are the ones who have accepted to add the adware. And even though they also have clean installers, they put the ad-enabled link first.
  - pionar 11y ago
    Yeah, but FileZilla consented to it.

by nekopa 11y ago

laurent123456 11y ago

It was FileZilla's developers who decided to bundle crapware with their installer on SF so can't really blame SF on this. See there: https://forum.filezilla-project.org/viewtopic.php?t=31127 https://forum.filezilla-project.org/viewtopic.php?t=31127 "This is by design. In any case, nothing is forced upon you, all offers are entirely optional and are only being displayed during setup."

tonyedgecombe 11y ago
I guess this is what happens when people aren't willing to pay for software, there are plenty of really good ftp clients out there for not very much money.
- fapjacks 11y ago
  Exactly. Just look at all the software for Linux. :T
  - tonyedgecombe 11y ago
    Outside of developer tools the software landscape for Linux doesn't look that great.
    - tracker1 11y ago
      Well, Steam seems to be growing pretty nicely... Also, for most users a good Browser is all they need. Which is why I love Chromebooks as an option for most people.
    - fapjacks 11y ago
      If your worldview is limited to "games" and "audio", then sure, you're right.
      - the_af 11y ago
        This doesn't detract from your point, but... there are plenty of games for Linux nowadays. It cannot compete with Windows, of course, but thanks to Steam, the Humble Bundle, etc., we can now enjoy a multitude of videogames, including AAA titles. And plenty of indies, of course.
        fapjacks 11y ago
        There are! It's exciting to see so many games coming to Linux. I don't generally play games in my spare time, but I am glad the state of the art is beginning to make its way to this side.
- laurent123456 11y ago
  The thing is open source programs often build their success on the fact they are free, get a lot users quickly, feedback and discussions on their forums on how to improve it, free translations from users, sometime patches, etc. Then when they suddenly exploit all this by adding ads, people are understandably upset. It's just a fact of life that open source software won't make you rich. Either they are ok with it, or they create a commercial product from the start. But adding crapware afterwards is not a proper solution.
  - tonyedgecombe 11y ago
    I'm not trying to justify it, just observing that when you don't pay anything then you can expect this sort of behaviour.
    - zouhair 11y ago
      Yes, paid software riddled with malware, rootkits and other niceties is unheard for. Bad people do bad things. Paying or not paying has nothing to do with it.
      - tonyedgecombe 11y ago
        I disagree, paying customers wouldn't put up with a malware infested version of FileZilla, this stuff only really exists at the "free" end of the market.
        douche 11y ago
        This is empirically false. Video games have shipped with highly-intrusive rootkits and malware disguised as DRM for years, and it tends to be worse on the higher-end products, vs the shovelware/free-to-play/open-source.
        tonyedgecombe 11y ago
        You can find a few counter examples but they never last because the commercial pressure is too high, the obvious example is Sony, are they still deploying rootkits? Lenovo is another example that has started cleaning up its act. Would these companies change if their only source of funds was the malware? I don't think so.
castell 11y ago
I switched to WinSCP and never looked back.
signal11 11y ago
FileZilla has other issues as well: for example, for the longest time they refused to encrypt stored passwords, although the bug's been reopened now so they may change their mind: http://trac.filezilla-project.org/ticket/5530 http://trac.filezilla-project.org/ticket/5530
- nkoren 11y ago
  Wow. Quoth one of FileZilla's developers: "Whether passwords are stored encrypted or in plaintext makes no difference in security." Just... wow.
  - FooBarWidget 11y ago
    This isn't "wow", it's true. The plaintext password is required to login to servers, so if you store it locally in an encrypted form then the decryption key must also be stored locally. If an attacker was able to get your encrypted password then the attacker is just as easily able to get your encryption key. For the same reason, Pidgin and many other IM programs also do not encrypt the password.
    - clinta 11y ago
      The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it, as well as protect against offline reading of the files. It doesn't stop every attack, but it's not useless.
      - gruez 11y ago
        >This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it Outside of enterprise environments, most windows installations are single user. Even if it's a multi-user system, the data would already be protected by NTFS permissions if it was stored in the user's profile folder. >as well as protect against offline reading of the files no, it doesn't[1][2] [1] http://passcape.com/windows_password_recovery_dpapi_decoder http://passcape.com/windows_password_recovery_dpapi_decoder [2] http://www.dpapick.com/ http://www.dpapick.com/
smegel 11y ago
> See there: https://forum.filezilla-project.org/viewtopic.php?t=31127 https://forum.filezilla-project.org/viewtopic.php?t=31127 Strange, almost every comment on this page say the crapware was added by SourceForge, e.g. > The offers are added by SourceForge, they are borderline crapware to put it nicely.
- laurent123456 11y ago
  SourceForge offers developers to add crapware to their installer in exchange for a revenue. This is completely optional and I suppose most dev don't do it (I distribute some semi-popular installer on SF and they've never forced me to include adwares). The FileZilla developers have never been very vocal about this so most of their comments is a generic "Nothing unwanted is being installed without your consent", but they are the ones who have accepted to add the adware. And even though they also have clean installers, they put the ad-enabled link first.
- pionar 11y ago
  Yeah, but FileZilla consented to it.