“It appears that SourceForge took control of the 'GIMP for Windows' account” • Hacker News Board

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#31

Post by mzjs » Wed, May 27, 2015, 5:13 PM UTC

JohnTHaller wrote: post #30

geofft wrote: post #14

What are the reasons for people to use SourceForge today? Why hasn't everyone else ( especially major projects like GIMP and Audacity) moved off? Here are some possibilities I can think of, but I'm curious if they're correct: - Mailing list hosting - Non-git repository hosting, for projects that prefer CVS or SVN - Shell account (though it doesn't seem very useful) - Features GitHub has but few others do (binary host…

One reason is discoverability as they have a rather extensive searchable directory of open source software. Another reason for quite a while was binary hosting, which github originally supported, then discontinued, but finally added again in July 2013. Additionally, the ability to use any open source license or combinations of licenses, as Google Code supported binary downloads during the time github didn't but only…

Github lets you use any license you want.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#32

Post by JohnTHaller » Wed, May 27, 2015, 5:22 PM UTC

mzjs wrote: post #31

JohnTHaller wrote: post #30

Earlier quoted context omitted.

One reason is discoverability as they have a rather extensive searchable directory of open source software. Another reason for quite a while was binary hosting, which github originally supported, then discontinued, but finally added again in July 2013. Additionally, the ability to use any open source license or combinations of licenses, as Google Code supported binary downloads during the time github didn't but only…

Github lets you use any license you want.

Right. I meant it as a comparison to Google Code, hence mentioning it during the time period that Google Code supported binary downloads but github did not.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#33

Post by Karunamon » Wed, May 27, 2015, 5:22 PM UTC

shiggerino wrote: post #26

Karunamon wrote: post #6

Wow. Is this legally actionable? Yeah yeah, their server and so forth, but pretending to be somebody is generally seen as a Bad Thing© by the courts.

What's with the copyright symbol?

A copyright that's been registered by Sourceforge ;)

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#34

Post by ender1 » Wed, May 27, 2015, 5:28 PM UTC

ksherlock wrote: post #17

baldfat wrote: post #15

Earlier quoted context omitted.

The only issue is that Sourceforge made nice binaries available. Most people have no idea how to use git and/or build their own binaries.

Even before they started adding malware installers, downloads redirected through an extra ad page (and interfered with curl, wget, etc).

wget at least isn't affected, as long as you copy the link from the files page (the one that normally displays ads and a countdown timer in browser - it'll download the file directly with wget, since they apparently do user-agent sniffing).

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#35

Post by kierank » Wed, May 27, 2015, 5:36 PM UTC

The number of people casually suggesting github for large binaries on HN is incredible and funny. They should try downloading something from github in Asia and they'll learn why local mirrors are useful.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#36

Post by SwellJoe » Wed, May 27, 2015, 5:38 PM UTC

ksherlock wrote: post #21

cillian64 wrote: post #13

Is there anything suggesting it's SourceForge itself doing this and not just (an improbably widespread, admittedly) set of account breaches? It makes sense -- acquire accounts, enable ads, profit.

"The Open Source Mirror Directory is an extension to our existing software directory, where we'll be mirroring projects that are not hosted on SourceForge, and SourceForge projects that have been abandoned. " Why are we doing this? We want the SourceForge software directory to be as useful as possible. When you come here to search for a piece of software, we want you to be able to find it, and find the most up to dat…

So...they're claiming to "maintain" projects, and that means turning them into adware?

That's so underhanded and nasty that it's difficult to believe. If true, it means SourceForge has effectively become the nemesis of every software developer who ever used their services. And, it means every software developer who cares about software freedom and privacy must move everything off of SourceForge.

We host Webmin on SF.net, still, and it is downloaded over 3 million times per year, making it one of the most popular packages in the system administration category for over a decade (last I checked a few years ago, it was second only to phpmyadmin). They've never done anything weird or underhanded with our stuff (but most of our packages are signed and setup in such a way that fiddling with them would be somewhat challenging). Given its popularity, I would assume it would be a likely target for this sort of thing. But, maybe it's only "abandoned" projects? (Whatever that means, since it sounds like the original author in this case did not consider their project abandoned.)

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#37

Post by SwellJoe » Wed, May 27, 2015, 5:45 PM UTC

shiggerino wrote: post #27

baldfat wrote: post #15

Earlier quoted context omitted.

The only issue is that Sourceforge made nice binaries available. Most people have no idea how to use git and/or build their own binaries.

Surely hosting static files on the internet is trivial to accomplish these days, even without the help of Malwareforge.

Trivial, technically, but can still be an unwanted cost for projects that push a lot of bits out. Our software at SF.net burns through several terabytes of bandwidth each year for several million package downloads. We've always appreciated their network of mirrors. But, it seems like it's time to move away from SourceForge.

We already relocated our revision control to github (though I'm considering another move to a self-hosted thing on Phabricator or gogs or gitlab, as I'm more cautious about using third party services for this kind of stuff these days).

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#38

Post by SwellJoe » Wed, May 27, 2015, 5:47 PM UTC

prokoudine wrote: post #4

subudeepak wrote: post #2

Any other projects affected ? Would be nice to start a list of all affected projects. This could also be a case of targeted attack on the gimp account.

http://sourceforge.net/u/sf-editor1/profile/ Nice list. Got Audacity there, for instance.

Several of those are projects that were never hosted at SourceForge, aren't they? Firefox, for example, I don't believe was ever an SF project. WordPress, I don't recall ever seeing on SourceForge. Are they altering the binaries they are posting on their "mirror"?

This is very confusing.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#39

Post by krisdol » Wed, May 27, 2015, 5:52 PM UTC

JohnTHaller wrote: post #30

geofft wrote: post #14

What are the reasons for people to use SourceForge today? Why hasn't everyone else ( especially major projects like GIMP and Audacity) moved off? Here are some possibilities I can think of, but I'm curious if they're correct: - Mailing list hosting - Non-git repository hosting, for projects that prefer CVS or SVN - Shell account (though it doesn't seem very useful) - Features GitHub has but few others do (binary host…

One reason is discoverability as they have a rather extensive searchable directory of open source software. Another reason for quite a while was binary hosting, which github originally supported, then discontinued, but finally added again in July 2013. Additionally, the ability to use any open source license or combinations of licenses, as Google Code supported binary downloads during the time github didn't but only…

I will second the Discovery aspect as being something that I like about SF when I first used it in the early 2000s. The reason I liked it so much was because I was a kid looking for free games to play on my PC, who soon learned to equate opensource == free, who then started browsing SF's games category (played a lot of BZflag).

That said, with projects and people leaving SF, and their UI leaving a lot to be desired, there are so many more options I'd first use for project discovery.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#40

Post by makomk » Wed, May 27, 2015, 5:55 PM UTC

geofft wrote: post #14

What are the reasons for people to use SourceForge today? Why hasn't everyone else ( especially major projects like GIMP and Audacity) moved off? Here are some possibilities I can think of, but I'm curious if they're correct: - Mailing list hosting - Non-git repository hosting, for projects that prefer CVS or SVN - Shell account (though it doesn't seem very useful) - Features GitHub has but few others do (binary host…

GIMP did move off Sourceforge back in November 2013[1]. Unfortunately, because there were a bunch of links pointing there it still ranks very highly in searches for GIMP. I'm not sure if there's even any way to delete a Sourceforge project.

[1] See the top story on http://www.gimp.org/