Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“It appears that SourceForge took control of the 'GIMP for Windows' account”

plus.google.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#61

Post by Someone1234 »

zyxley wrote: post #54
makomk wrote: post #44

Earlier quoted context omitted.

Doesn't matter. Someone elsewhere in the discussion found out what they're doing - Sourceforge now has a policy of taking over the project pages of projects that've moved off Sourceforge and running the pages themselves as mirrors (apparently with added extras in the installers): http://sourceforge.net/mirror/ If you remove all the installers, they'll just get them off your website instead. If anything, removing ever…

I wonder if there are any OSS licenses with a legally valid "except for Sourceforge" addendum available.

OSS can just use trademarks to stop SF from redistributing the binaries under that specific name (thus will kill their search rank).

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#62

Post by walterbell »

biot wrote: post #28
etix wrote: post #24

This is precisely for these reasons we stopped distributing VLC via SF.net in 2013. I even wrote about it: https://blog.l0cal.com/2013/05/02/rethinking-vlc-mirrors-inf...

Have you checked your site on an iPad? It's alternating the font size between small and large several times a second, resulting in a strobe effect that never stops. Yikes!

Bizarre. Happens only in landscape mode.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#63

Post by daveloyall »

As noted in other comments, the GIMP installer on http://sourceforge.net/projects/gimp-win/files/ is now bit-for-bit identical to the one on http://download.gimp.org/pub/gimp/v2.8/windows/ (let's call this one official).

Does anybody have a copy of the "value added" installer?

How did it work? Was it a wrapper which contained a copy of the official installer? Did it have the same filename? Was there some identifier in the URL? A cookie?

In other words, can we programmatically identify other hijacked projects?

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#64

Post by yellowapple »

makomk wrote: post #51
JoshTriplett wrote: post #10

Earlier quoted context omitted.

OpenOffice has not been relevant for a while; development has moved to LibreOffice. See https://lwn.net/Articles/637735/

They're distributing LibreOffice now too, presumably without bothering to ask for the permission of the actual developers.

They technically don't need permission to perform the redistribution, seeing as LibreOffice is FOSS and distribution of software is permitted.

However, they do need permission to claim to be representatives of the LibreOffice developers.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#65

Post by makomk »

daveloyall wrote: post #63

As noted in other comments, the GIMP installer on http://sourceforge.net/projects/gimp-win/files/ is now bit-for-bit identical to the one on http://download.gimp.org/pub/gimp/v2.8/windows/ (let's call this one official). Does anybody have a copy of the "value added" installer? How did it work? Was it a wrapper which contained a copy of the official installer? Did it have the same filename? Was there some identifier i…

It was a small wrapper that downloads the actual installer, loaded from a different site to their usual mirrors because they outsourced the whole "bundling unwanted software" functionality to a third party. I don't still have a copy because I downloaded it in a temporary test VM, sorry.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#66

Post by JoshTriplett »

yellowapple wrote: post #64
makomk wrote: post #51

Earlier quoted context omitted.

They're distributing LibreOffice now too, presumably without bothering to ask for the permission of the actual developers.

They technically don't need permission to perform the redistribution, seeing as LibreOffice is FOSS and distribution of software is permitted. However, they do need permission to claim to be representatives of the LibreOffice developers.

And whether they need permission or not, bundling malware into the installer is evil.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#67

Post by JohnTHaller »

daveloyall wrote: post #63

As noted in other comments, the GIMP installer on http://sourceforge.net/projects/gimp-win/files/ is now bit-for-bit identical to the one on http://download.gimp.org/pub/gimp/v2.8/windows/ (let's call this one official). Does anybody have a copy of the "value added" installer? How did it work? Was it a wrapper which contained a copy of the official installer? Did it have the same filename? Was there some identifier i…

It's a 730KB downloader installer as used by FileZilla, Angry IP Scanner, and other apps on SF that participate in the Dev Share program. You run it, it shows offers, then downloads the actual GIMP installer and runs that. I did a Virus Total scan of it earlier and the results are here: https://www.virustotal.com/en/file/a63a337b0aa6b2686440802eb...

It seems they've disabled the ability for the GIMP downloader installer posted earlier today to be able to download GIMP now. Possibly so other sites don't distribute it further thinking it's the real GIMP installer?

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#68

Post by zyxley »

Someone1234 wrote: post #61
zyxley wrote: post #54

Earlier quoted context omitted.

I wonder if there are any OSS licenses with a legally valid "except for Sourceforge" addendum available.

OSS can just use trademarks to stop SF from redistributing the binaries under that specific name (thus will kill their search rank).

Good point.

Re: “It appears that SourceForge took control of the 'GIMP for Windows' account”

#69

Post by fomojola »

SwellJoe wrote: post #58
makomk wrote: post #46

Earlier quoted context omitted.

Abandoned projects and "projects that are not hosted on SourceForge", which appears to include projects that still have a Sorceforge page that's actively maintained if the project has moved elsewhere. So if you move off SF.net, they'll take over your page there and use it to distribute adware-enhanced versions of your software. Incredibly underhanded.

Moving doesn't prevent this or protect users, and it actually would potentially trigger such a takeover by SF.net? So, there is no escape? I'm really finding this hard to believe. It's just incredible. I mean, I've had a bit of a love-hate relationship with SF.net forever, but it's always been the kind of thing you might have with a bratty sibling (i.e. you wish they were doing more with their lives, but you still lo…

Shame really: for a while SourceForge was THE place to go for open source software.

They claim (at the bottom of http://sourceforge.net/mirror/) that "If you have an Open Source project outside of SourceForge, we'd like to hear from you. If you want your project mirrored on our site, or if you don't want your project mirrored on our site, please let us know. Or there's any other service that we can extend to your project community, we'd like to hear that, too. Contact us at communityteam@sourceforge.net and we'll be sure the message gets to the right people."

People should email them at communityteam@sourceforge.net and ask to be un-mirrored. Maybe that will work.

Post reply on HN