3 ms·

Can someone provide a link to filezilla thats not through sourceforge? I just posted an Ask HN about this.

andyjohnson0 11y ago
Two trusted packages available at https://chocolatey.org/packages?q=filezilla https://chocolatey.org/packages?q=filezilla Also available from https://ninite.com/ https://ninite.com/
- wernercd 11y ago
  for the real lazy: https://ninite.com/?select=filezilla https://ninite.com/?select=filezilla I hadn't thought of choco, but good call on that.
- b101010 11y ago
  Why are the packages from chocolatey trusted? I am not familiar with chocolatey but the powershell script on https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla (click show files) contains the following $url = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win32-setup.exe/download" $url64bit = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win64-setup.exe/download" So its still fetching executables from sourceforge using plain http with no checksums or signatures in sight. On the assumption that executable does include the sourceforge malware, The silent install argument ("/S") passed to the executable by chocolatey seems to be the only reason its not installed along with filezilla. Is there any reason to believe ninite does anything different?
  - swies 11y ago
    We should play this up more on our site, but Ninite (I'm a co-founder and we're YC W08) does this stuff right. All our .exes are signed, app config information comes over https, and downloads are all checked for hashes that match our testing before being automated. We're not just naively adding silent switches either, we'll automate clicks to get through less well-behaved installers when needed. Why can you trust Ninite? Money. Thousands of businesses pay us for Ninite Pro and the free version is our marketing department. We're extremely careful to make sure our updates come out on time and junk free.
skrowl 11y ago
If you're on Windows, consider upgrading to WinSCP (http://winscp.net/eng/docs/free_sftp_client_for_windows http://winscp.net/eng/docs/free_sftp_client_for_windows). Not only is it a nicer UI and updated more often, but they have direct downloads with no crapware.
kpcyrd 11y ago
http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla_3.5.3-2_amd64.deb http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla... I know, this isn't very helpful, but if you don't like how software is distributed for your system there's still the option to use a system that solved this during the '90s.
bhayden 11y ago
I would recommend not using Filezilla at all, honestly. The creator was entirely unapologetic about bundling malware.

Two trusted packages available at https://chocolatey.org/packages?q=filezilla https://chocolatey.org/packages?q=filezilla Also available from https://ninite.com/ https://ninite.com/

wernercd 11y ago
for the real lazy: https://ninite.com/?select=filezilla https://ninite.com/?select=filezilla I hadn't thought of choco, but good call on that.
b101010 11y ago
Why are the packages from chocolatey trusted? I am not familiar with chocolatey but the powershell script on https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla (click show files) contains the following $url = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win32-setup.exe/download" $url64bit = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win64-setup.exe/download" So its still fetching executables from sourceforge using plain http with no checksums or signatures in sight. On the assumption that executable does include the sourceforge malware, The silent install argument ("/S") passed to the executable by chocolatey seems to be the only reason its not installed along with filezilla. Is there any reason to believe ninite does anything different?
- swies 11y ago
  We should play this up more on our site, but Ninite (I'm a co-founder and we're YC W08) does this stuff right. All our .exes are signed, app config information comes over https, and downloads are all checked for hashes that match our testing before being automated. We're not just naively adding silent switches either, we'll automate clicks to get through less well-behaved installers when needed. Why can you trust Ninite? Money. Thousands of businesses pay us for Ninite Pro and the free version is our marketing department. We're extremely careful to make sure our updates come out on time and junk free.

skrowl 11y ago

If you're on Windows, consider upgrading to WinSCP (http://winscp.net/eng/docs/free_sftp_client_for_windows http://winscp.net/eng/docs/free_sftp_client_for_windows). Not only is it a nicer UI and updated more often, but they have direct downloads with no crapware.

kpcyrd 11y ago

http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla_3.5.3-2_amd64.deb http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla... I know, this isn't very helpful, but if you don't like how software is distributed for your system there's still the option to use a system that solved this during the '90s.

bhayden 11y ago

I would recommend not using Filezilla at all, honestly. The creator was entirely unapologetic about bundling malware.