Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourceforge Hijacks the Nmap Sourceforge Account

seclists.org

Post reply on HN
Print view View original

131–140 of 201 posts

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#131

Post by rythie »

ghshephard wrote: post #31
heyalexej wrote: post #20

Earlier quoted context omitted.

Plenty popular names on there. That's shocking.

To be clear - there is a difference between mirroring (which is good netizen behavior, and to be complimented), and trojaning (which is modifying the upstream sources before delivering them to users - which is decidedly not good netizen behavior). It's important to understand which is which for those accounts.

Sourceforge's mirrors are a complete miss-use of the term mirror. A mirror should be an exact copy of the source and should be approved by the original project, which I doubt any of these 'mirrors' are.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#132

Post by eli »

luso_brazilian wrote: post #25

Just submitted the story to Slashdot [1]. Sharing the same owner as Sourceforge let's see if it gets "buried" [2] (or "late released due to an editor vacation" [3] as it was their explanation) or if they publish it in a timely manner and within the spirit of the submission. [1] http://slashdot.org/submission/4487045/sourceforge-hijacks-t... [2] http://www.reddit.com/r/linux/comments/381q6r/slashdot_buryi... [3] http:…

Granted it's been, uh, a little while since I've last tried, but my recollection is that Slashdot's submission process has always been arbitrary and frustrating. I wouldn't necessarily attribute lost submissions to malice.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#134

Post by aaron695 »

I went to GIMP to get the latest version for Windows (Mine was 2+ years old)

Strange, it seems newer but the Windows version was the same as mine.

Google what up, randomly saw the Sourceforge controversy for GIMP in the news.

Went to straight to SourceForge and got my update. Because they could be bothered.

If you want Sourceforge to be evil, get your shit together GIMP. (Windows users are people too, plus appreciate all the work, but it'd be nice if you remembered us)

PS And remember that if you're GPL or whatever then don't complain when someone follows the rules but doesn't do what you want. Is it GPL or not?

You can't say you're anti censorship, as long as it's what you want. You can't say you're GPL as long as it's what you want.

People are free to add malware to the product. Account hijacking not so much.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#135

Post by Bill_Dimm »

dm2 wrote: post #99

SourceForge was sold in 2012 to a conglomerate company named "DHI GROUP INC" or "Dice Holdings Inc" that owns the following companies: Dice Open Web The IT Job Board ClearanceJobs eFinancialCareers Rigzone HEALTHeCAREERS BioSpace Hcareers SourceForge Slashdot WorkDigital

I remember thinking "I guess they want to get more of the tech community's mindshare to promote their job board" when Dice bought Slashdot. With the way they've alienated the tech community by trashing Slashdot and SourceForge, I wonder how many tech people will use their job board now.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#136

Post by strictnein »

TheMagicHorsey wrote: post #76
smegel wrote: post #42

Sourceforge is now on my personal blocklist for Google search results. Along with expertsexchange which I added years ago, and Quora which may surprise some.

Read that as expert sex change, and thought you were revealing some very personal information on HN.

That's why they added the - to the domain. experts-exchange.com

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#137

Post by ikeboy »

ghshephard wrote: post #14

This is the sort of behavior you get from a company that's lost, and is now trying to extract every penny they can from whatever shenanigans they can get away with. If they have no future brand value to be concerned about, then, from a game-theoretic approach, it's actually a pretty rational profit seeking move. (As long as they don't incur any downstream liabilities from outright illegal activity for which they migh…

>Of course, the game-theoretic response from the entire internet community is to make sure they never, ever, for any reasons whatsoever, ever click on a link that starts with "sourceforge.net"

That's a nice idealistic response, but what about when you can't find a file anywhere else?

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#138

Post by mikro2nd »

luso_brazilian wrote: post #25

Just submitted the story to Slashdot [1]. Sharing the same owner as Sourceforge let's see if it gets "buried" [2] (or "late released due to an editor vacation" [3] as it was their explanation) or if they publish it in a timely manner and within the spirit of the submission. [1] http://slashdot.org/submission/4487045/sourceforge-hijacks-t... [2] http://www.reddit.com/r/linux/comments/381q6r/slashdot_buryi... [3] http:…

Looks like your submission has made it to the /. front page. I confess I'm at a loss for a meaningful comment on what that says...

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#139

Post by nadams »

I think this is the time to remind people some projects (ie filezilla) are willingly distributing the malware with their projects. The developers reaction is basically "there is nothing wrong with it"[1].

I feel like there is a niche service to provide installers that have been decrapified. I'm not talking about ninite (which is private/commercial) but an open source repository of installers that you can "apt-get" for Windows. I know people have tried that in the past - but the problem is that the builds that are posted manually go out of date pretty quickly so I think this process would have to be automated.

[1] https://forum.filezilla-project.org/viewtopic.php?t=31127

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#140

Post by vaceletm »

ohitsdom wrote: post #113
vaceletm wrote: post #34

The only viable long term way for any open source project is to selfhost[1] [1] https://www.enalean.com/en/Open-source-community-host-yourse...

A site like Github that hosts open source projects brings a lot of value to the community. Great search, and the same UI when going from project to project. This would be much more cumbersome and time consuming if every project was on a different site with a different interface. Also, many open source projects don't have the money to afford bandwidth costs of providing large software downloads.

I'm not saying GitHub doesn't help. SourceForge did help at time. But if you value your freedom, you need to understand that, if you don't have the keys of your infrastructure, you are locked to the good will of the provider (and its stakeholders).

I don't buy the money argument. If you have the chance to be a successful enough open source project, you will find hosting companies ready to help you with free VMs.

If you are not that successful, you can use github & co without fear, nobody will try to insert crapware in your packages. And if you want to selfhost, even a raspberry pi will have enough power to serve your site.

Post reply on HN