This is an old revision of the document!
OpenCandy
WinSCP uses OpenCandy advertising module in its installation program.
OpenCandy is advertising application. It is similar to Google AdSense, except it displays advertisements in installation program instead of websites. These advertisements promote another software packages. The advertisements are selected by providers of software being installed (in case of WinSCP it means WinSCP developers). When user installing a software (WinSCP) chooses to install promoted package, revenue is generated and shared between OpenCandy and software providers (WinSCP developers).
Advertisement
Is it Adware?
Some may consider OpenCandy an adware. In principle it is. It is a way to recover software development costs using advertisement.
On the other hand, OpenCandy does not demonstrate the negative characteristics commonly associated with adware:
- Advertisement is only shown as a one step of software installation. Once software (WinSCP) is installed, you do not receive any more advertisements.
- No unwanted software is installed. User has to explicitly choose to install promoted software to actually receive it.
- No private information is collected. Installation program collects only information necessary to choose relevant advertisement, such as geo-location, operating system and language. Note that this is about the same amount of information, any web page you visit receives from your web browser. Collected data is sent to
opencandy.winscp.net. It also downloads advertisement image frommedia.opencandy.com(though it does not send any information there). See more details about information being collected.
For details see OpenCandy privacy policy.
Can I avoid OpenCandy?
Yes you can. Use /NOCANDY parameter when starting installation program.
You can download WinSCP 4.3.2 from the WinSCP download page, a version without OpenCandy.
You can also use portable executable, thus avoiding installation program with OpenCandy.
Advertisement
What does an OpenCandy recommendation look like?
Below it an example of OpenCandy recommendation screen in WinSCP installation program. Use the Install … button (or similar) to choose to install the recommended application. Use the Do not install … button (or similar) to continue installing WinSCP without installing the recommended application.
Adware Alerts
Occasionally you may receive alert from your antivirus or other security application regarding the WinSCP installer/OpenCandy.
Most notably, Microsoft Windows Defender has started recently to trigger WinSCP installer. See corresponding entry on Adware:Win32/OpenCandy on Microsoft security site. The article correctly describes OpenCandy functionality in a similar way as this page. And correspondingly it states that security threat from OpenCandy is low.