Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I was shocked the other day when I went to grab FileZilla from SF, and my virus scanner tagged it for malware. I hadn't realized it had fallen so far as to bundle crapware. SF used to be my goto site for looking for weird open source stuff. Now I guess I will have to finally take SF off my list goto sites.

You either die a hero or live long enough to become the villain.



It was FileZilla's developers who decided to bundle crapware with their installer on SF so can't really blame SF on this.

See there: https://forum.filezilla-project.org/viewtopic.php?t=31127

"This is by design. In any case, nothing is forced upon you, all offers are entirely optional and are only being displayed during setup."


FileZilla has other issues as well: for example, for the longest time they refused to encrypt stored passwords, although the bug's been reopened now so they may change their mind: http://trac.filezilla-project.org/ticket/5530


Wow. Quoth one of FileZilla's developers:

  "Whether passwords are stored encrypted or in plaintext
   makes no difference in security."
Just... wow.


This isn't "wow", it's true. The plaintext password is required to login to servers, so if you store it locally in an encrypted form then the decryption key must also be stored locally. If an attacker was able to get your encrypted password then the attacker is just as easily able to get your encryption key.

For the same reason, Pidgin and many other IM programs also do not encrypt the password.


The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it, as well as protect against offline reading of the files.

It doesn't stop every attack, but it's not useless.


>This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it

Outside of enterprise environments, most windows installations are single user. Even if it's a multi-user system, the data would already be protected by NTFS permissions if it was stored in the user's profile folder.

>as well as protect against offline reading of the files

no, it doesn't[1][2]

[1] http://passcape.com/windows_password_recovery_dpapi_decoder

[2] http://www.dpapick.com/


Those tools require the users windows password to decrypt the encrypted blob. So yes, it does protect against offline reading of the files.


Why can't the decryption key be derived from a password?


Because that defeats the purpose of storing your passwords locally.


I would much rather have 1 master password, that unlocks 50 different passwords...


They may be operating under Pidgin's logic whereby if they can decrypt the password without user intervention, then all the information needed by a malicious user to decrypt the password is already on the system to be grabbed.

Still should go with the browser/password manager approach of using a master password to decrypt the password database.


They are correct.

Software that encrypts passwords without a master password are just selling you sneak-oil.


I switched to WinSCP and never looked back.


> See there: https://forum.filezilla-project.org/viewtopic.php?t=31127

Strange, almost every comment on this page say the crapware was added by SourceForge, e.g.

> The offers are added by SourceForge, they are borderline crapware to put it nicely.


SourceForge offers developers to add crapware to their installer in exchange for a revenue. This is completely optional and I suppose most dev don't do it (I distribute some semi-popular installer on SF and they've never forced me to include adwares).

The FileZilla developers have never been very vocal about this so most of their comments is a generic "Nothing unwanted is being installed without your consent", but they are the ones who have accepted to add the adware. And even though they also have clean installers, they put the ad-enabled link first.


Yeah, but FileZilla consented to it.


I guess this is what happens when people aren't willing to pay for software, there are plenty of really good ftp clients out there for not very much money.


The thing is open source programs often build their success on the fact they are free, get a lot users quickly, feedback and discussions on their forums on how to improve it, free translations from users, sometime patches, etc. Then when they suddenly exploit all this by adding ads, people are understandably upset.

It's just a fact of life that open source software won't make you rich. Either they are ok with it, or they create a commercial product from the start. But adding crapware afterwards is not a proper solution.


I'm not trying to justify it, just observing that when you don't pay anything then you can expect this sort of behaviour.


Yes, paid software riddled with malware, rootkits and other niceties is unheard for.

Bad people do bad things. Paying or not paying has nothing to do with it.


I disagree, paying customers wouldn't put up with a malware infested version of FileZilla, this stuff only really exists at the "free" end of the market.


This is empirically false. Video games have shipped with highly-intrusive rootkits and malware disguised as DRM for years, and it tends to be worse on the higher-end products, vs the shovelware/free-to-play/open-source.


You can find a few counter examples but they never last because the commercial pressure is too high, the obvious example is Sony, are they still deploying rootkits? Lenovo is another example that has started cleaning up its act.

Would these companies change if their only source of funds was the malware? I don't think so.


lenovo is still bundling crap with their laptops. nothing has changed, they got rid of the specific thing that caused the outrage, that's all.


Not really, It's just that it's obvious at the free end of the market.

Proprietary software can do whatever it feels like on your computer and you would be hard pressed to know until it was too late.

A few large companies have been implicated in root-kits / backdoors / random horrible deliberate security practices. These are probably just as destructive as replacing your browser search bar or installing some fake AV software.

Free isn't the problem. Bundling crap-ware with otherwise audit-able open source software is the problem.


And who puts up with it in the "free" end of the market?


Exactly. Just look at all the software for Linux. :T


Outside of developer tools the software landscape for Linux doesn't look that great.


Well, Steam seems to be growing pretty nicely... Also, for most users a good Browser is all they need. Which is why I love Chromebooks as an option for most people.


If your worldview is limited to "games" and "audio", then sure, you're right.


This doesn't detract from your point, but... there are plenty of games for Linux nowadays. It cannot compete with Windows, of course, but thanks to Steam, the Humble Bundle, etc., we can now enjoy a multitude of videogames, including AAA titles. And plenty of indies, of course.


There are! It's exciting to see so many games coming to Linux. I don't generally play games in my spare time, but I am glad the state of the art is beginning to make its way to this side.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: