Wow, yeah, this thread: https://forum.filezilla-project.org/viewtopic.php?f=1&t=3294...

I think it is best to avoid these guys.

While I initially thought this as well, at some point the site admin (botg) posts this:

""MalSign.Generic.F84". Looks like a typical false-positive generated by a heuristic.

There is no malware in the SourceForge Downloader, you can safely use it to install FileZilla. While the SourceForge Installer may present third-party offers, they are clearly labeled as such. All third-party offers can easily be declined. Nothing unwanted is being installed without your consent. Declining offers does not prevent nor otherwise disturb the installation of FileZilla.

If you do not wish to use the SourceForge installer, have a look at the additional download options listed on the FileZilla website."

His stance seems to be that it's not malware, rather a false positive (I have no proof to claim he's wrong and if he is, it could be a honest mistake; he's trusting SF, which I understand), and he mentions that you can also download Filezilla from their own website, without the SF installer.

That seems pretty reasonable to me, but again: at first I got the impression they (FileZilla's owners) simply didn't care.

I hate what SF has been doing, and I refuse to use their installers (although I'm primarily a Linux-user so I don't have to worry about these installers, thankfully), but I don't really feel like the FileZilla owners should be avoided as it looks like they're simply trusting SourceForge, nothing more. I hope I'm right. ;)

my main issue is that, the offers only exist to either affect the people who don't know any better (and would probably chose the opposite if they were more educated about such practices), or those that mis-click.

Most people, when presented with a) a logo (of a group they trust), and b) accept or decline, they are going to make assumptions and not read the middle.

Which ends up affecting a lot of users: every bad review relating to the installer and every complaint in the forums (once again, in relation to the installer), is a person who has been deceived and had a negative experience, because of a decision of the FZ developers (and the installer is choose-able by the project developer, last I inquired)

Filezilla's community is toxic and the projects creator can be aptly described as tyrannical.

If you use Mac check out Transmit by Panic. It's the best FTP client I've ever used.

If you don't need anything fancy, Finder's own ”Go -> Connect to Server” menu option can open FTP sites.

I'll second the Transmit recommendation. As a bonus, it nicely supports AWS S3 and S3-compatible object stores.

Filezilla is free and cross-platform. That was a lot of the appeal to me.

I use CyberDuck which has free edition and is open source too. It doesn’t support Linux although.

I don't think you can count it as free if it comes loaded with malware.

To be clear though, it's the SF installer not FZ itself. You can most certainly go and compile it yourself.

Filezilla isn't malware. The SF installer is malware

How does Transmit compare to Cyberduck?

I've heard similar things about FileZilla and it's creator. Do you have any recommendations for an open source, GUI-based, Linux FTP client?

Most of the time I simply scp or rsync files as neccessary, however I use FileZilla to manage files on my phone and tablets via FTP. I've never found the FTP/SFTP/SMB support in Thunar to be all that reliable...

Maybe Midnight Commander? It can open FTP-connections (and shell connections, too, allowing secure copying of files over SSH rather than FTP), has that well-known dual pane layout, and, while not a GUI application, can be controlled the same way a GUI application can without even needing X. :)

IIRC GNOME has FTP and SFTP support, so you should be able to just use Nautilus.

I'm not using GNOME. I'm using XFCE, and unfortunately in my experience Thunar (the XFCE file manager) doesn't handle those sorts of connections too well. I think it's more to do with the FUSE layer beneath it (possibly the same driver that's used by GNOME).

For sftp, you can just mount it locally with sshfs and then use $FILE_MANAGER

Unfortunately, like I say, I've tried that (using Thunar - the otherwise fantastic file manager in XFCE). I'm not sure if it's Thunar's fault, or it's the FUSE layer beneath it, but I've always found it to be a little unreliable. Plus I like to be able to see connection logs and manage the activity queue in the same way I do with FileZilla.

unfortunately I haven't. For the most part, I'm a Windows user, so I've been using Explorer for plain FTP to my phone (which, while not great, does do the job more-than-well-enough for my uses)

Here's a recommendation: stop using FTP.