Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourceforge Hijacks the Nmap Sourceforge Account

seclists.org

Post reply on HN
Print view View original

61–70 of 201 posts

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#61

Post by leojfc »

corobo wrote: post #32
ghshephard wrote: post #19

Earlier quoted context omitted.

Given that a VPS like Digital Ocean will give you 1 Terabyte/month for $5/month, isn't it straightforward to hose your own tarball now? I see the nmap tarball is 20 Megabytes = 50,000 downloads. The cost of hosting should be easily covered by your user base.

The problem isn't really in the overall bandwidth usage though, it's the concurrency. Would the $5/month droplet stand up to a surge of people coming in for a latest release, or a bit of press coverage? Would there be enough bandwidth that everyone gets the file fast or would they all slow to a crawl

What about providing a BitTorrent link? The main server could provide a backstop seed, and presumably enough other people would seed too for any decent-sized project.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#63

Post by Qantourisc »

omegafail wrote: post #10
neslinesli93 wrote: post #9

In spite of account hijacking, GIMP was still downloaded by almost 15k people this week. Six days ago they took over Audacity project as well, which was downloaded by more than 150k this week[0]. [0] http://sourceforge.net/projects/audacity/

What will happen if I run Audacity installer from sourceforge? I have done that an hour ago. Should I be concerned?

Well assume you now have some malware/spyware/adware on your pc now, and assume you need to clean it off. Or check the hash of the installer with some reference bin from a trusted source.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#64

Post by mintplant »

maxst wrote: post #57

What about all the other websites? http://filehippo.com/download_nmap http://www.softpedia.com/get/Network-Tools/Misc-Networking-T... http://www.majorgeeks.com/files/details/nmap_security_scanne... http://www.chip.de/downloads/Nmap_13013407.html

It feels a bit different here, at least to me. Nmap had a Sourceforge account, but now it's been taken away from them -- "hijacked", as the post describes it. And Sourceforge at least used to be a reputable site and has (had?) some lingering aura of trust around it.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#65

Post by smegel »

danieltillett wrote: post #50
smegel wrote: post #42

Sourceforge is now on my personal blocklist for Google search results. Along with expertsexchange which I added years ago, and Quora which may surprise some.

What is wrong with Quora. You may not like their business model, but I don't think they are doing anything terrible like source forge.

Unless it changed recently, but I used to click there through Google search results and still get some blurred out page, or only one answer, or a timeout that tried to make me register.

And quite frankly, I prefer the rather diverse universe of stackexchange sites.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#66

Post by omegafail »

Qantourisc wrote: post #63
omegafail wrote: post #10

Earlier quoted context omitted.

What will happen if I run Audacity installer from sourceforge? I have done that an hour ago. Should I be concerned?

Well assume you now have some malware/spyware/adware on your pc now, and assume you need to clean it off. Or check the hash of the installer with some reference bin from a trusted source.

The hash matched the official installer. I doubt they are crazy enough to deliberately hide malware without prompting.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#67

Post by dagw »

mverwijs wrote: post #52

The BOFH in me is more upset with the software projects that abandonded those accounts without properly closing them.

The problem is that it is basically impossible to completely close and remove a software project from Sourceforge. The best you can do is tag it as "inactive" or "relocated" and provide a link to the new site, but the project site will still exist.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#68

Post by bad_user »

pjc50 wrote: post #43
ghshephard wrote: post #14

This is the sort of behavior you get from a company that's lost, and is now trying to extract every penny they can from whatever shenanigans they can get away with. If they have no future brand value to be concerned about, then, from a game-theoretic approach, it's actually a pretty rational profit seeking move. (As long as they don't incur any downstream liabilities from outright illegal activity for which they migh…

You either go bankrupt as a hero or live long enough to become the monetisation villain.

Sounds like a wise saying that I've read on every submission about Sourceforge, problem is that I think it is in general bullshit.

If we'll look down in history, I think there are very few villains that have acted as heroes when starting out. The signs that such companies are assholes are in general there, from the start. As an example, I don't remember a time in which Sourceforge was the hero, as much as I try. Since as long as I remember Sourceforge, it was always the "necessary evil", the nuisance you have to deal with because bandwidth was (and still is) very expensive.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#69

Post by philjackson »

runn1ng wrote: post #51
chinathrow wrote: post #12

If your old account is listed here, you getting fuxxored: http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ Edit: added http://sourceforge.net/u/sf-editor/profile/ which includes MySQL and a few other high profile projects.

Damn, that's a lot of projects. OpenOffice, Apache server, hadoop, Audacity, CDex, Colloquy, that's all projects I have at one at my computers, and I haven't gotten to "D" yet. This is depressing

Seems weird that I could install Hadoop and get some shitty toolbar as a result.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#70

Post by omegafail »

smegel wrote: post #65
danieltillett wrote: post #50

Earlier quoted context omitted.

What is wrong with Quora. You may not like their business model, but I don't think they are doing anything terrible like source forge.

Unless it changed recently, but I used to click there through Google search results and still get some blurred out page, or only one answer, or a timeout that tried to make me register. And quite frankly, I prefer the rather diverse universe of stackexchange sites.

I wouldn't mind hitting Quora through Google on occasion, but sometimes they actually have just a stub page, where the question isn't answered at all, so it shouldn't rank so high.
Post reply on HN