Hacker News Reader

Comment by SwellJoe | Hacker News Reader

Our Webmin website, mailing lists, downloads, and a few other things are still running on SourceForge, for the time being. (I guess it counts as "big", with 3+ million downloads a year, it has always been a top-ten project in its category at SF.net.)

We moved revision control to github several years ago.

We just haven't had time lately to figure out what to do about the SF.net malware situation, but I can't imagine we'll stay there for too much longer, given the circumstances. We don't provide a Windows installer, so we're probably not at any immediate risk from SourceForge practices, but it doesn't seem like a smart place to be, given their behavior.

View on HN

I got malware in the installer for Filezilla on my Mac. They shove malware in all sorts of non-windows stuff these days...

I didn't believe you at first, but I just went to install it and...wow...

https://imgur.com/a/o6cSW

FileZilla are one of the few major projects who actually agree to this. Complain about it on their forums and you'll get a ban.

FileZilla opted in for this service, and gets a percentage of the revenue generated by installing these malware.

I thought you were going to show a virus result - the screen you showed is very unambiguously an opt-in screen, it even has the term "Accept" (as opposed to some other word like next or install) making you look at it - if the text said something else you would be very likely to just click it. The button at the left 'skip' is also clear about your other option (if it said 'cancel' it would sound like you're aborting installation.)

I just don't see how this is a trick. There's not even a "default" option here, except for the Accept button being on the right. How can anyone possibly click the word "Accept" without even glancing at the text surrounding it - even a glance shows you the giant icon with the slogan "Mac Cleaner Clean Up Junk Files on Your Mac"? If you look at the bullet points, the first one clearly identifies what it does. So it's an opt-in screen. There's no default. The action word is "Accept" and the top bullet is about the additional software you would be installing, with a giant picture and caption showing the same thing. Or you can click "skip."

This is above-board if you're going to do this sort of thing. Hell, given how above-board it is I might just click "Accept" in this case! (knowing that the devs opted into it as well.)

It is very, very hard to read this as anything other than an opt-in screen. How can you be any less ambiguous??

EDIT: I didn't even notice, there is even grey small text that spells this out in completely unambiguous words! (Thank you for considering this offer from our advertiser...your choice does not affect installation of FileZilla.)

I honestly don't even know that I would ask FileZilla to change anything whatsoever about this screen. It's great!

It's a trick because everyone just clicks accept blindly. They know this, that's why it's part of the installation process.

Most users think the way to install a program is to click next-next-next untill the program is installed. Since they downloaded Filezilla, they will expect that program to install, and not other crap. Are they to blame for not reading? Maybe. But nobody actually wants crapware in their machines, so bundling it with your software so that stupid users get it installed is not nice.

This definitely isn't the worst offender out there, but you're judging it on a bunch of subjective criteria; some will agree with you, others will still be 'fooled'. Although Sourceforge isn't probably a very common installation source for unexperienced users, I'm willing to bet at least some will end up there via a search engine. Bear in mind that some people will literally have no idea what 'MacKeeper' etc. is, and will assume that it's necessary.

The only objective measure is "is this software required for what I'm installing"; clearly, in this case, MacKeeper fails. There is a degree of trickery, sure, but they are unequivocally trying to trick people into installing something other than what they intended.

I actually got caught on one of these from Adobe - I was doing a flash install, that I'd done many times before, and so was on auto-pilot. It's a bit like clicking send on an email and then remembering you needed to add an attachment (thank you Mozilla for attachment reminders!); a split second after clicking I realised that what I'd clicked on was not the normal license or whatever - by that point it's already installing.

You say it's a great screen, unambiguous, very clear. But you then say:

> EDIT: I didn't even notice, there is even grey small text that spells this out in completely unambiguous words! (Thank you for considering this offer from our advertiser...your choice does not affect installation of FileZilla.)

Doesn't the fact that you didn't notice it make you at least pause?

I am ad tolerant. I do not run an ad blocker. If an ad is relevant to my interests I will click it. (I click maybe one ad every six months. I've never bought anything as the result of an ad.) And I loathe this kind of bundling.

We know that users are unable to read dialog boxes. Ask anyone who's worked in support about their experiences of getting people to read back an error message that's displayed on their screen. Every support channel on the Internet will ask people to post screenshots or to copy and paste the output.

IMO there should be an industry standard for how the screens should be worded, what they should look like, what buttons they can or can't include. Yes, we'd see many fewer people installing the malware but that's the point: no-one wants it. I tolerte ads but I see no reason to switch from Google supplied ads to some random adnetwork.

I mean I didn't have to notice, because I didn't have to get that far. I didn't read the rest of the bullet points either. It was just totally unambiguous to me, probably thanks to the giant picture.

I should clarify that I was only referring to this screenshot - https://i.imgur.com/hNDdz4P.png - the other one is worse but I didn't notice ggp had an album of two (unless they changed it.) without the picture it would be a lot worse.

I think people are upset about this not just because extra software is being requested to be installed during the desired installation (it's not just an ad, it's an embedded installer), and not just because SF is trading in on their past reputation, but also because of the type of software that is being installed. Malware is too strong a term for it, it's possibly adware, but definitely junkware. It's software that purports to "make your system run faster" and the methods it goes about to accomplish this may actually make it run slower (clearing the system cache) or even cause corruption (clearing the system cache incorrectly). The software may actually cause problems on your computer while making unsubstantiated claims of helping it.

To be clear, I personally wouldn't mind advertising and installing software from an installer if some minimum criteria were met:

1. The software being advertised was actually checked by someone to confirm it had some use, and was not in fact detrimental to the users.

2. The accept/install button was not put in place of the button that moves the install process along normally.

3. A separate installer window was launched to make it obvious what was happening. No quiet background installs allowed.

> How can you be any less ambiguous?? //

What would be less ambiguous would be when you download an installer for an app then the installer installs that app and doesn't attempt to trick you in to "accept"ing what you think is the initial app install but is in fact an entirely different app.

If you really wanted to let them add apps people don't want then at the point of download an unchecked box could have an offer for unrelated software and that offer would state something like "software we're getting paid to have installed on your computer". That too would be unambiguous.

It's like someone offers you a bag of sweets and as you take them they say "you're fine with cryptosporidium" under their breath; you think they muttered some marketing slogan and instead you get ill from the sweets. Perfectly acceptable, you even had chance to find out what was in the sweets /s.

Aside: What's your startup?

> What's your startup?

Extremely distasteful.

Their startup or my question, can you explain?

It's a completely irrelevant question and not everybody here has a startup.

Their profile states they have one - I checked the profile to see if they were a shill, they mentioned a startup. I think it could be pertinent; I don't see there being harm in asking, they don't have to answer.

Your question.

When you ask someone about an irrelevant detail related to their status in the community while you are discussing something unrelated, it implies (quite strongly) that you are trying to change the topic from what is at hand to a comparison of credentials, and it also implies that you believe your credentials to be better in some way, somehow giving you an upper hand.

If you are truly independently curious about their startup, ask them separately.

But you were not (you admitted as much). So it's distasteful.

The persons finds bundled malware acceptable. If they sell software, I'd like to avoid it. This is how I interpreted the question.

The person has clarified that they wanted to know if I ran a pertinent startup - nope! I don't have anything to do with a software download business model, I'm just a consumer. I install things all the time where I have to decline an offer, and I would never accidentally hit "Accept" under a giant picture of unrelated software.

If you do google the specific thing being advertised (as I would if I wanted to know exactly what I was accepting) you would find something quite mixed. It has nothing to do with the format of the offer though (or with me.) It's like an ad. In the specific screenshot I linked, which is this one: https://i.imgur.com/hNDdz4P.png

Yes, I have no problem seeing offers in that specific format in my personal case as a consumer. No, I have nothing to do with any of these companies.

I'd previously assumed that all smart consumers aware of the near-universal malwareness of bundled software would despise this sort of thing. I'm glad to have my wrong premises exposed.

Not with "Aside:", and not without any other context. Especially since they might bundle software (which you'd want to avoid) without having their own startup. So the question is completely unrelated (and the author of the question admitted it).

If one wants to ask a related question, ask a related question: "Do you bundle adware with any software that you distribute? If so, which software is that?"

Consider that many software installers ask you to accept terms of service. So, using "Accept" for the button feels very dishonest.

An alternative I would consider "honest"? Hmm... "Support us by installing this bundled software" maybe.

Unambiguous would be to offer two downloads, with filenames like "malware_supported_filezilla.dmg" and "just_filezilla.dmg"

Ambiguous or not, surely you can appreciate how ridiculous it is to be bundling closed-source malware with GPU-licensed open-source software, even if it is optional? It is precisely this kind of software that the GPL aims to protect against - people should be in control of their software, and not the other way round. The bundling of malware with Filezilla is so blatantly against the core ethos of GNU, and calls into question the morality of the creators/distributors of said software.

And the fact that it is so unexpected is what makes this misleading. You're installing open-source software, on a mac, no less. You're expecting the bottom-right button to continue the installation. I don't know how you can't see how easily it is for a user to accidentally install this malware.

Yea, there was a whole thread about this a few days ago - https://news.ycombinator.com/item?id=9623142

I actually installed the malware because I'd become so used to not dealing with this sort of stuff on my non-windows machines. The install process hijacks your browser by adding extensions, changing the search engines, blows away your prefs and cookies, installs some crap in the OS, etc. Huge pain in the butt. Totally my fault for just blindly bashing on the next button in the installer. I can assure you, the malware in Filezilla is quite real.

If you are on a Mac, use homebrew-cask (http://caskroom.io). It's like Brew, but for binaries. Works like a charm and you don't get the malware-injecting wrapper.

You should start using Cyberduck, it has a Free Client which pops up a window once you installed the free version (but the popup appears only ONCE and does not contain any malware or advertisments), and a paid version without a popup.

And Cyberduck also supports Rackspace Cloud Files and Amazon S3 containers.

Actually, by default, the popup appears every time you close the app, but there's a clear option to suppress it on subsequent occasions for 'this version'. I've never selected that option, so I'm not sure how fine-grained 'version' is; I actually like seeing the reminder because I will, definitely, one day, make a donation, so I appreciate the prompt!

still it only advertises itself, not any other software. that's why i would definitly trust cyberduck.

+1 for CyberDuck

Not to victim-blame here, but the fact that there's even an "installer" should be a huge red flag. There's no reason a simple FTP program can't be just an .app bundle.

Reply on news.ycombinator.com