Filezilla installer is suspicious again

Re:Filezilla installer is suspicious again by Symbiote on Saturday June 23, 2018 @08:53PM (#17384354)

> The Linux one is from the same source too.

Not in practise. The Linux version of Filezilla will usually be sourced from a package manager:

  $ apt show filezilla
  Package: filezilla
  Version: 3.28.0-1
  …
  Description: Full-featured graphical FTP/FTPS/SFTP client

Even Filezilla's own website says "It is highly recommended to use the package management system of your distribution".

A huge portion of the software a typical user requires is available in the standard repository of a Linux distribution. I have one extra Apt repository configured that would be reasonable for a normal user to install: Skype.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by kodablah on Saturday June 23, 2018 @09:08PM (#17384406)

Meh, they don't keep versions up to date. That version in the apt repo is several versions behind (not to mention how far behind they are on 16.04 repos), not something you usually want to do with network software like Filezilla. My comment listed just 4 pieces of software off the top of my head I installed on a fresh desktop recently, and I wouldn't get any of them from default apt install.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by zhte415 on Saturday June 23, 2018 @10:38PM (#17384645)

Repos of major distributions tend to keep security updates current. I can go to the source repo if I want the latest-and-greatest. And running a couple of releases behind is something I quite like to do, because bugs.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by mirimir on Saturday June 23, 2018 @09:32PM (#17384469)

Honorable providers, for example the Tor and MPTCP projects, run their own repositories, with GnuPG-authenticated packages. You get up-to-date builds, with no crap.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by gregmac on Sunday June 24, 2018 @10:21AM (#17386654)

So long as the provider remains honorable. If they decided to bundle malicious programs -- or someone who took control if their domain and private key did -- they easily could.

They could publish updates to the program, publish new dependencies, or even publish updates to packages you normally get from your main distro repository. If you're doing apt-get update (or equivalent) how closely do you scrutinize the list of changes?

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by mirimir on Sunday June 24, 2018 @04:54PM (#17388334)

Yes. You gotta trust the provider.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by shawnz on Sunday June 24, 2018 @09:07AM (#17386402)

But this negates the advantage of having a small number of trusted repos if you need to add third-party repos for every project.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by mirimir on Sunday June 24, 2018 @05:04PM (#17388382)

Sure. And it's a tradeoff. The Tor and MPTCP projects came to mind, because I trust them. And there aren't many others that I trust.

My problem is that I prefer Debian stable, which is very conservative about package updates. But sometimes I end up using Ubuntu, because its repo includes newer packages.

Also, my core systems do not include anything except stable Debian. I only use third-party repos in project-specific VMs. I even use Oracle's MySQL Workbench in an Ubuntu VM. And even Windows 10 VMs, when I need Excel or other Windows-only apps. That is, compartmentalization.

[ Parent | on HN ]

Re:Filezilla installer is suspicious again by zaarn on Monday June 25, 2018 @03:28AM (#17390558)

Just because the version is older doesn't mean it's insecure. Distros do backport patches, esp. if you run LTS versions.

[ Parent | on HN ]