Filezilla blocks download for EU users | Hacker News Reader

Filezilla blocks download for EU users

filezilla-project.org

71 pointspseudotrash43 comments

That is incredibly rich coming from __FileZilla__, one of the few OSS projects that accepts money from malware makers to catch out unwary windows users.

I wonder if they're actually more worried about having the EU go after them legally if some EU member loses data or money directly because of that malware?

It may be rich coming from them, but it doesn't mean they are wrong in this case.

> money from malware makers to catch out unwary windows users.

As an active user of FileZilla, can you elaborate on this? Any links or sources where I can read about it? Thank you.

The default download link installs malware/adware alongside FileZilla. If you go to the actual downloads page, you get the vanilla version.

It was adware and not malware, from what I can tell.

Just do a Google search for FileZilla and malware. It's been an issue for many years now, and lots of people have written about it.

There was a thread on the old FileZilla support forum[1] where the developer describes the adware included in the installer offered to unwary downloaders, which sounds a but shady but is probably not malware.

A lot of AV engines use crowdsourced classifiers like virustotal to flag “potentially unwanted applications (PUA)” as a threat and quarantine, but the term “malware” is a category reserved for destructive or criminal application behavior. I’m not convinced that is what was or is bundled with “sponsored” Filezilla installers.

At some point the bundled adware was apparently something called OpenCandy related to ask.com, and the developer of FileZilla is alleged to have concealed rather than disclosed it.[2]

The adware-free installer was/is reported to be available for download freely on the same site, but for the extra browsing effort.

[1] https://web.archive.org/web/20190526065704/https://forum.fil...

[2] https://malwaretips.com/threads/sourceforge-net-adds-adware-...

>probably not malware?

Fundamentally, malware is about deception. If the user understands what is being done and why (we're tracking everything we can, then selling that to everyone) then it's not malware. The typical adware hosted on FileZilla shows a screen in the middle of the install process with multiple paragraphs of text in a font smaller than everything else, which vaguely refers to ad supported software and a link to a privacy policy that nobody reads or understands.

I don't know if there's a legal definition of malware, that's definitely malware in my understanding of the word.

Malware is defined many industry standard places, like NIST 800-61 which is the Computer Incident Response Guide, US-CERT, and EU-CERT.

From what is your understanding of the term malware derived?

Fundamentally, malware is about destructive application behavior. It’s a negatively charged term that should be reserved for tools created/used with actual malice by threat actors.

Oh, this isn't in any way a new thing. They've been pulling this shit for probably over a decade now.

Naturally the whole time they've tried to paint themselves as innocent victims, and wouldn't people PLEASE just try running the malware themselves to find out it's all an innocent misunderstanding.

Meanwhile, the several in-depth analyses of the various "extra" payloads delivered by their installer always come to: "It's 100% malware, delivered using evasion techniques that try to avoid system/virus detection, and have no place in legitimate software. DO NOT use this".

Please don't fall for their bullshit.

> The CRA goes against this principle by imposing unavoidable liability on producers of free software, requiring them to make their development, testing, and documentation activities much harder and complex.

If the EU wants this, they should use part of their budget to fund it.

This is the same argument for businesses using FOSS, if you want support, pay for it, otherwise you get what you pay for.

EU does fund a lot of FOSS

I see that the Linux Foundation has posted a blog opposed to this. I wonder if they could single-handedly destroy this legislation by revoking the license for Linux in the EU.

Of course this would be difficult because existing contributions can't be relicensed. But they could maybe start accepting new patches with a non-Eurpoe license. Or does the GPL prevent this as they are building on GPL code and need the same license? I double the EU would be ok with running on outdated Linux or trying to maintain their own.

My gut feeling is that EU wouldn't cave and would be OK on running on outdated Linux. There is really no citizen influence on block wide policies so I doubt a protests would work or that any majority of non-technical people would care.

Microsoft would be thrilled.

They cannot revoke the licence under the GPL. If new patches are under a non-Europe licence, then they cannot be combined and redistributed with the existing GPLv2 codebase.

There is a provision in section 8 of the GPLv2 that allows excluding certain countries, but it can only be activated in the face of copyright or patent restrictions on the distribution of the software. IANAL, but one approach to activate this provision might be to implement a patented technique within the kernel, for which the patent licence only allows implementations outside the EU.

I just downloaded an update through my already installed client. I'm in Germany, so obviously the block is not working.

File sharing program with dwindling userbase embargoes itself in EU political protest; fails

The filezilla installer will install adware on a windows PC if you leave the default options (as of 1-2yrs ago)

Well they're not wrong, despite being quite questionable themselves.

Unpopular thought, but eu’s CRA may reduce open source software availability, increasing scarcity and thus leading to a potential indie market. Software is one of the few industries where people have freely made the product of their labor available in large quantity, dramatically reducing their prospect of earning independently just by writing software. The more indie software makers the more proper engineering can be done - as opposed to simply giving it for free to corporations.

TLDR: In protest of the Cyber Resilience Act. FOSS projects have been raising alarms for a while. Today ITRE voted. Now it's game over for FOSS in Europe

No it isn't. These kind of laws and doom saying is repeated again and again. Wait a week and see. Nothing changed.

> it's game over for FOSS in Europe

You mean the European Union. The rest of the world will be fine.

The CRA isn't law yet.

Also, I don't see the problem myself:

> In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software.

I'm not sure where people get the idea that donations are considered commercial activity. Support subscriptions and such make you liable (but I don't see why that would be a problem). Ubuntus's Snap store is a platform through which the manufacturer monetises other services. Half open source (i.e. FileZilla Pro) also counts as closed source software, of course.

Most of the protests seem to come from people who operate a business that sells their open source software and wants to remain off the hook to get an advantage over their closed source competition.

We'll just get it off torrents with malware embedded. Very cyber resilient.

is there a explainer of what the legislation is supposed to do and how does it harm foss?

i have had trouble with understanding the push for EVERYONE doing https even in localhost because "security". boo.

i live in a place where by law ISPs need to have DPI. they can access any communication regardless of SSL or https or anything in between so why should i bother with the added nonsense of "much security" when it is not supposed to even work?

i understand there are attempts to make https to be as transparent when it works but why should that not be restricted to banking transactions or login pages and payment links? again, DPI.

now this cyber resillience act which i am assuming wants to "security".

what kind of security?

This post by the The Apache Software Foundation is fairly complete:

> And what makes matters worse is that the type of open source organizations most affected are also exactly those that, today, tend to have very mature security processes, with vulnerabilities getting triaged, fixed, and disclosed responsibly with CVEs to match. While it generally is further downstream; with the companies that place the product on the market — that the CRA needs to drive significant improvement. It now risks doing the reverse.

But all organizations (ECLIPSE, LINUX, ...) raised alarms

https://news.apache.org/foundation/entry/save-open-source-th...

Edit: https://nitter.kavin.rocks/search?f=tweets&q=cyber+Resilienc...

Very good description, and if the protections from OSS are not enough I expect more noise in the next weeks/months

> There is of course an elephant in the room: the well-oiled mechanism that “The internet treats censorship as a malfunction and routes around it” (John Perry Barlow).

The parliament position reads:

> Only free and open-source software made available on the market in the course of a commercial activity should be covered by this Regulation

> Whether a free and open- source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements.

> (10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting.

The corresponding HN submission: https://news.ycombinator.com/item?id=36783445

> i live in a place where by law ISPs need to have DPI.

Which law? I know ISPs in India are mandated to record session information but I haven't heard of DPI being mandatory.

> they can access any communication regardless of SSL or https or anything in between

No, DPI can't magically break encryption. Your ISP can't access encrypted content.

> No, DPI can't magically break encryption. Your ISP can't access encrypted content.

they can if they require you to install a certificate and they man in the middle everything.

> they can if they require you to install a certificate and they man in the middle everything.

Not exactly relevant because no ISP outside Kazakhstan is doing that.

you should ask before making that statement -- I suspect you will be surprised at the answers

I don't know how the US ISPs run things but this doesn't happen in the EU.

Nobody in the US would comply with forced root CAs. It breaks 4A.

And nobody in the US could ever break that and get away with it! Not one Single American!

No Such American

Reply on news.ycombinator.com