I was shocked the other day when I went to grab FileZilla from SF, and my virus scanner tagged it for malware. I hadn't realized it had fallen so far as to bundle crapware. SF used to be my goto site for looking for weird open source stuff. Now I guess I will have to finally take SF off my list goto sites.
You either die a hero or live long enough to become the villain.
FileZilla has other issues as well: for example, for the longest time they refused to encrypt stored passwords, although the bug's been reopened now so they may change their mind: http://trac.filezilla-project.org/ticket/5530
This isn't "wow", it's true. The plaintext password is required to login to servers, so if you store it locally in an encrypted form then the decryption key must also be stored locally. If an attacker was able to get your encrypted password then the attacker is just as easily able to get your encryption key.
For the same reason, Pidgin and many other IM programs also do not encrypt the password.
The windows crypto APIs can encrypt secrets secured by the windows account. This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it, as well as protect against offline reading of the files.
It doesn't stop every attack, but it's not useless.
>This would protect against attacks by other users on the system who don't have permissions to impersonate the user who encrypted it
Outside of enterprise environments, most windows installations are single user. Even if it's a multi-user system, the data would already be protected by NTFS permissions if it was stored in the user's profile folder.
>as well as protect against offline reading of the files
They may be operating under Pidgin's logic whereby if they can decrypt the password without user intervention, then all the information needed by a malicious user to decrypt the password is already on the system to be grabbed.
Still should go with the browser/password manager approach of using a master password to decrypt the password database.
SourceForge offers developers to add crapware to their installer in exchange for a revenue. This is completely optional and I suppose most dev don't do it (I distribute some semi-popular installer on SF and they've never forced me to include adwares).
The FileZilla developers have never been very vocal about this so most of their comments is a generic "Nothing unwanted is being installed without your consent", but they are the ones who have accepted to add the adware. And even though they also have clean installers, they put the ad-enabled link first.
I guess this is what happens when people aren't willing to pay for software, there are plenty of really good ftp clients out there for not very much money.
The thing is open source programs often build their success on the fact they are free, get a lot users quickly, feedback and discussions on their forums on how to improve it, free translations from users, sometime patches, etc. Then when they suddenly exploit all this by adding ads, people are understandably upset.
It's just a fact of life that open source software won't make you rich. Either they are ok with it, or they create a commercial product from the start. But adding crapware afterwards is not a proper solution.
I disagree, paying customers wouldn't put up with a malware infested version of FileZilla, this stuff only really exists at the "free" end of the market.
This is empirically false. Video games have shipped with highly-intrusive rootkits and malware disguised as DRM for years, and it tends to be worse on the higher-end products, vs the shovelware/free-to-play/open-source.
You can find a few counter examples but they never last because the commercial pressure is too high, the obvious example is Sony, are they still deploying rootkits? Lenovo is another example that has started cleaning up its act.
Would these companies change if their only source of funds was the malware? I don't think so.
Not really, It's just that it's obvious at the free end of the market.
Proprietary software can do whatever it feels like on your computer and you would be hard pressed to know until it was too late.
A few large companies have been implicated in root-kits / backdoors / random horrible deliberate security practices. These are probably just as destructive as replacing your browser search bar or installing some fake AV software.
Free isn't the problem. Bundling crap-ware with otherwise audit-able open source software is the problem.
Well, Steam seems to be growing pretty nicely... Also, for most users a good Browser is all they need. Which is why I love Chromebooks as an option for most people.
This doesn't detract from your point, but... there are plenty of games for Linux nowadays. It cannot compete with Windows, of course, but thanks to Steam, the Humble Bundle, etc., we can now enjoy a multitude of videogames, including AAA titles. And plenty of indies, of course.
There are! It's exciting to see so many games coming to Linux. I don't generally play games in my spare time, but I am glad the state of the art is beginning to make its way to this side.
You either die a hero or live long enough to become the villain.