FileZilla

After 2 years started to use filezilla again. I did stop using it because of the password security. I am now seeing there is master password. And WOW, this is what i was looking for. Non problematic transfers and the (transfer panel) file by file showing, i can see any error easlier

Simple and very useful FTP

That saddens me greatly. I got caught off guard, I just assumed (given my previous experiences) that it was a normal install process and clicked through it without thinking, and it installed some obnoxious program on my computer. You know it is obnoxious when it magically has an install date of not-today, making it hard to find what got installed because it all happened so quickly.

Setup files include BUNDLEWARE, windows defender detecting unwanted program.
(Detected: PUA:Win32/FusionCore)

download the zip file (no installer) or get the portableapps version, to avoid the spyware the installer uses

Also to not save passwords to a plain text file you have to use the option "use master password", this will then encrypt your passwords. Otherwise you will need put filezilla inside an encrypted file using truecrypt and only mount it when you need to use it and make sure all the files (the ones that get stored as plain text) remain in there also. Then when you close the encrypted file, its all secure. Those are your 2 options to keep the passwords safe.

[Edited by s0me0ne, March 03]

In addition to my big long novel, the thread cited for bundleware shows that FileZilla probably deserves a more alarming tag, like malware, which I assume is a tag that exists. As discussed in that long comment, I'm skeptical of most of the meaningful statements made in that thread (on both sides of the argument), but it seems unlikely that FileZilla's accusers were entirely wrong/lying (they might have an ulterior motive for their accusations, and there might have been fewer people than accounts, but neither their motives nor possible subterfuge affect their claims, just my inclination to take it all on faith).
Should another tag be added?

The thread about viruses on FileZilla's forum is a mess, and leaves an absurd amount of unanswered questions for such a short conversation. I hope the discussion was continued and analyzed on Reddit with something resembling civility, since that thread could've answered a ton of the questions it raised if people could've been rational. I'll try to explain some of the reasons that thread makes me distrust botg (Tim, the developer and site admin) and the people making accusations in that thread, but I'm not sure this comment section is the place for me to post a comprehensive manifesto listing the crimes and merits I perceive in that thread lol (especially since someone may have already done so somewhere else).

I'm far from confident that any method of installing the FileZilla client is safe, but I find many things about its accusers to be questionable. Not every criticism of Tim's explanations and justifications is valid, but some of his claims were also nonsense. A lot of those criticisms and at least one of Tim's claims were too stupid to be believed by the people saying them. Maybe Tim was overwhelmed and tried to obfuscate because he couldn't provide legitimate answers quickly enough, but he knew there would likely be a record of the conversation even if the thread were deleted, and he's not stupid enough to throw out lies quickly if valid answers exist (plus, if it were possible to construct a comprehensive defense, he still would have presented it later).
It seems impossible to believe that there weren't deliberate lies on both sides, from Tim and some if not all of his accusers (I also suspect that there were fewer people making those accusations than there were accounts, but "I just came from Reddit" isn't unreasonable, and I join a new forum to post one or two replies all the time, so at first glance there's no real evidence of sock puppetry), so the possibility of coordinated accusations and sock puppetry leads me to distrust any claim that doesn't seem to be self-evident based on my own understanding of the concepts involved.

"It's a tautological false positive, by the very definition of the term, everything is potentially unwanted" doesn't explain away anything, and the guy saying it isn't that stupid -- so he's hoping other people are? AV software isn't struggling with the definition of "potentially unwanted" and just flagging everything because you didn't say "I want this."

The claim that false positives for malware sometimes occur deliberately for business reasons has nothing to do with the way different software functions. Carbon Black could reference real events and say "this is where the installer went to your mother's home and struck her in the face." If it picked well and lied well, I wouldn't know, and most users wouldn't know regardless of the quality of the deception. Or it could just add things in the log that didn't happen and tell the truth about what those things are, even though they didn't happen. I'm not accusing Carbon Black of any of this. I'm pointing out that how it examines things (or whether it even does) has nothing to do with its ability to lie, and there's no way FileZilla's main accusers would have believed that defense of Carbon Black's results. I'm also not sure what competitors any of these companies are flagging in the FileZilla package, so maybe there were no competitors for them to flag. Maybe the software has no motive to lie, and something like Carbon Black provides really compelling evidence. But the lie in Carbon Black's defense really damages the credibility of a lot of statements.

I can't properly analyze the whole conversation, and I've already written more than most people will read, but ultimately, botg and his accusers display a great deal of technical knowledge, and key instances of implausible stupidity, which seem like the kind of manipulative false argument one uses when a valid one doesn't come to mind or is somehow undesirable, and people are unlikely to notice that it's invalid, or that the person presenting it doesn't believe it. I should find a term for that, and/or an example that isn't extremely politically charged.

AV scans seemed problematic before I heard that some false positives appear deliberately for business reasons. It might suffice to say that "my [any AV scanner] flagged this" by itself is practically worthless, the accompanying data probably won't be very conclusive with my level of knowledge (and it's worthless to most people), and it might be an intentional lie anyway. I see people who know less than me insisting vehemently that a file is going to trojanvirus all over everyone because Norton said it contains something bad, and my only reaction is annoyance. Carbon is obviously something else, but most of these standard consumer threat scanners are like the boy who cried wolf. People are becoming less and less alarmed by these alerts.

Anyway, I'd love more info from anyone who has it, and I guess I'm not going to chronicle my whole journey in the comments here, but if I get a fairly satisfying answer, I'll at least post a review.

[Edited by idktho, February 28]