so yeah, it seems like there&#x27;s kind of a conflict of interest here. if there&#x27;s no way for a user to know whether the project opted in to revenue sharing, then how can they trust the project?<p>in other words, in my view, a project that opts in to revenue sharing with crapware bundlers who are known to sometimes distrubute malware, is behaving unethically.<p>so now i don&#x27;t trust filezilla dev&#x27;s in general, even if i get an package signed by my distro or whatever. very dissapointing. worse still, it makes projects that didn&#x27;t opt in suspect in my view, simply because they are on sourceforge; if i can&#x27;t find out whether they opted in, how can i know any project isn&#x27;t taking kickbacks?<p>i really hope i&#x27;m missing something here....