Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourceforge Hijacks the Nmap Sourceforge Account

seclists.org

Post reply on HN
Print view View original

31–40 of 201 posts

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#31

Post by ghshephard »

heyalexej wrote: post #20
chinathrow wrote: post #12

If your old account is listed here, you getting fuxxored: http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ Edit: added http://sourceforge.net/u/sf-editor/profile/ which includes MySQL and a few other high profile projects.

Plenty popular names on there. That's shocking.

To be clear - there is a difference between mirroring (which is good netizen behavior, and to be complimented), and trojaning (which is modifying the upstream sources before delivering them to users - which is decidedly not good netizen behavior).

It's important to understand which is which for those accounts.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#32

Post by corobo »

ghshephard wrote: post #19
nononononono wrote: post #13

So what decent release tarball storage services are there today if github's autogenerated release tarballs don't do it for you?

Given that a VPS like Digital Ocean will give you 1 Terabyte/month for $5/month, isn't it straightforward to hose your own tarball now? I see the nmap tarball is 20 Megabytes = 50,000 downloads. The cost of hosting should be easily covered by your user base.

The problem isn't really in the overall bandwidth usage though, it's the concurrency.

Would the $5/month droplet stand up to a surge of people coming in for a latest release, or a bit of press coverage? Would there be enough bandwidth that everyone gets the file fast or would they all slow to a crawl

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#33

Post by heyalexej »

I just scraped Google for the indexed mirrors.

  site:sourceforge.net/projects/ inurl:mirror -inurl:files -inurl:reviews -inurl:compare -inurl:support
Gave me these[0] 253 indexed projects. Would be interesting to crawl the entire website to see if there's more.

[0] http://git.io/vkb3N

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#36

Post by DanBC »

simias wrote: post #22
chinathrow wrote: post #12

If your old account is listed here, you getting fuxxored: http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ Edit: added http://sourceforge.net/u/sf-editor/profile/ which includes MySQL and a few other high profile projects.

I didn't know they did this at this scale. I'm suprised by all the big names in the projects they've highjacked: I see apache, drupal, firefox, libreoffice, mysql, postgresql, redmine, sqlite, thunderbird, vlc, virtualbox and many, many others. They're really going all in with that.

But go look at the actual firefox they list.

http://sourceforge.net/projects/firefox points to some personal build of firefox. http://sourceforge.net/projects/firefox.mirror seems a lot more official. I have no idea what binary you get from either of them.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#37

Post by [deleted] »

simias wrote: post #22
chinathrow wrote: post #12

If your old account is listed here, you getting fuxxored: http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ Edit: added http://sourceforge.net/u/sf-editor/profile/ which includes MySQL and a few other high profile projects.

I didn't know they did this at this scale. I'm suprised by all the big names in the projects they've highjacked: I see apache, drupal, firefox, libreoffice, mysql, postgresql, redmine, sqlite, thunderbird, vlc, virtualbox and many, many others. They're really going all in with that.

[deleted]

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#39

Post by DigitalSea »

Sourceforge needs to call it a day. Its day of relevancy is over, once upon a time it filled a need but we have Github, Bitbucket and much better choices now. What we are seeing is a site that is lost and will never be able to earn back the respect that it once had.
Post reply on HN