Filezilla bug report on how they embraced shipping malware five years ago: https://trac.filezilla-project.org/ticket/8888

Blog post from sourceforge during the "dark times" where they announced they were partnering with teams like Filezilla to ship you malware: https://sourceforge.net/blog/today-we-offer-devshare-beta-a-sustainable-way-to-fund-open-source-software/

Sourceforce ended this practice in 2016. Filezilla's devs want to keep it going: https://forum.filezilla-project.org/viewtopic.php?t=48441

@satchmoz How about building from source instead of downloading precompiled binaries?

https://filezilla-project.org/sourcecode.php

@robots Not exactly end user friendly.

Also, sorry. I don't get how anyone can continue to trust the dev at this point. Even if you built your own binaries at this point you would need to audit the source code every release.

@satchmoz How not exactly?

>Even if you built your own binaries at this point you would need to audit the source code every release

I'm pretty sure they are adding them through the installer, not the program "per se". In any case, you wouldn't need to audit the whole source code, just the commit changes.

@robots Even so, better to use an app from a developer who hasn't broken your trust??