My experience ranges across platforms which is why I call out this ridiculous bias when I see it, especially when it uses dumb examples like Filezilla to represent the whole. Look at the other options for Filezilla downloads. The default Mac one is the same bundled crap from the same source. The Linux one is from the same source too. Of course I would be unreasonable to criticize the other platforms if the forum post was about those instead.

> One hardly ever needs to run on trusted executables, for any reason. If you do, they come from one or two trusted sources, not one of hundreds of private websites

That's just not true if you want up to date software. I can list a ton of software to the contrary and lots of installing that includes just extracting tarballs, or installing their deb/rpm you download, or if they use the distro package manager, they just have you add their server and cert.

> GUI 'wizard' that takes 10 minutes, frequent attention and 20 clicks

Well if you're just gonna give false impressions with hyperbole, a rational discussion can't be had.

Regardless, the issues with installation are primarily the choice of the devs, not the OS. These days they more look like the installation of Nodejs, Go, PgAdmin, VSCode, etc (i.e. minimal MSI's or just zip extracts) than complicated adware of yore. That this is not clear and you think 10 minute wizards with 20 clicks is normal makes it seem like you are not familiar with the platforms you talk about.

> The Linux one is from the same source too.

Not in practise. The Linux version of Filezilla will usually be sourced from a package manager:

  $ apt show filezilla
  Package: filezilla
  Version: 3.28.0-1
  …
  Description: Full-featured graphical FTP/FTPS/SFTP client

Even Filezilla's own website says "It is highly recommended to use the package management system of your distribution".

A huge portion of the software a typical user requires is available in the standard repository of a Linux distribution. I have one extra Apt repository configured that would be reasonable for a normal user to install: Skype.

Meh, they don't keep versions up to date. That version in the apt repo is several versions behind (not to mention how far behind they are on 16.04 repos), not something you usually want to do with network software like Filezilla. My comment listed just 4 pieces of software off the top of my head I installed on a fresh desktop recently, and I wouldn't get any of them from default apt install.

Repos of major distributions tend to keep security updates current. I can go to the source repo if I want the latest-and-greatest. And running a couple of releases behind is something I quite like to do, because bugs.

Honorable providers, for example the Tor and MPTCP projects, run their own repositories, with GnuPG-authenticated packages. You get up-to-date builds, with no crap.

So long as the provider remains honorable. If they decided to bundle malicious programs -- or someone who took control if their domain and private key did -- they easily could.

They could publish updates to the program, publish new dependencies, or even publish updates to packages you normally get from your main distro repository. If you're doing apt-get update (or equivalent) how closely do you scrutinize the list of changes?

Yes. You gotta trust the provider.

But this negates the advantage of having a small number of trusted repos if you need to add third-party repos for every project.

Sure. And it's a tradeoff. The Tor and MPTCP projects came to mind, because I trust them. And there aren't many others that I trust.

My problem is that I prefer Debian stable, which is very conservative about package updates. But sometimes I end up using Ubuntu, because its repo includes newer packages.

Also, my core systems do not include anything except stable Debian. I only use third-party repos in project-specific VMs. I even use Oracle's MySQL Workbench in an Ubuntu VM. And even Windows 10 VMs, when I need Excel or other Windows-only apps. That is, compartmentalization.

Just because the version is older doesn't mean it's insecure. Distros do backport patches, esp. if you run LTS versions.

I certainly would use my package manager to install this. Having the latest version isn't critical, and if it was, I would compile from source. Apt likely protects you from exactly what's being discussed here, as well as from the need to compile from source.

I don't think the comparison of the "wizard" to installing from apt or similar is hyperbole. I'm familiar with the typical Windows apps install process, and I do indeed warrant that that is a realistic comparison. GUI software is more difficult to automate and presents information in a way that's difficult to absorb at a glance, for me.

The 'wizard' does not require a steady 10 minutes of attention, but I don't think 20 clicks is an exaggeration. How many sounds right to you? If you want, I can write an essay contrasting software installation on these platforms because what I wrote sounds right on to me. The fact is that standard procedure to install software on Windows involves clicking "next" over and over again after downloading a binary from some random website.