I think it's a stretch to say that the EU is "encouraging" such scummy practices. It's likely that they just collated a list of all software used widely by government departments within the EU -- and thus FileZilla is on the list. Ultimately, a potential 0day causing RCE within a government department is more of a concern to the EU than the optional malware you get during FileZilla's installation.

> the optional malware you get during FileZilla's installation.

Think that through. The malware that comes with FileZilla is often reported to be pretty bad.

Agreed, potential a 0 day (especially when targeted) could also have a really bad effect.

But Filezilla's malware isn't theoretical, so could really be the bigger problem.

I haven't used Filezilla in a _long_ time -- is the malware optional? I imagine that most EU governments image their machines, so they IT departments likely aren't installing the malware.

And there is also the consideration that governments will continue to use Filezilla even if there isn't EU funding to make it more secure -- malware and all.

Good points. Yeah, I'd hope it's the IT departments doing images, rather than end users being able to install things.