Sophisticated users will know to download the unbundled installer, and maybe even go so far as to verify the hash.

But that sideskirts the question of whether to continue using software where the authors are willing to put their users at risk by monetizing with what is apparently malware bundles.

FileZilla is by all accounts a fantastic piece of software. I’ve used it for years, both the client and the server, and it’s no doubt provided significant value to me over the years.

And yet I’ve never paid the FileZilla authors a penny for their services.

So while I didn’t force the FileZilla authors down this dark path that they’ve chosen to use for monetization, I accept that I am part of the problem.