Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sourceforge Hijacks the Nmap Sourceforge Account

seclists.org

Post reply on HN
Print view View original

191–200 of 201 posts

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#191

Post by maxst »

jackmaney wrote: post #190
maxst wrote: post #161

Earlier quoted context omitted.

I keep complete control over my projects, and I'll make sure it won't happen.

> I keep complete control over my projects Until they take that control from you. > I'll make sure it won't happen How ?

> Until they take that control from you.

They won't because I'm not abandoning my projects.

People who complain have one thing in common - they abandoned their projects on SF. It's kinda like letting the domain name expired and then complaining that somebody took over. Always keep an eye on your hosting and your domain names, folks.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#192

Post by kbenson »

maxst wrote: post #57

What about all the other websites? http://filehippo.com/download_nmap http://www.softpedia.com/get/Network-Tools/Misc-Networking-T... http://www.majorgeeks.com/files/details/nmap_security_scanne... http://www.chip.de/downloads/Nmap_13013407.html

Sourceforge was, for a long time, the definitive home for many, many popular open source projects. That they've cached in on this historical trust, and in some cases the fact that the thing they are "mirroring" actually was hosted there at some point, makes this worse.

For example, for years, I've used winscp.sf.net to get to WinSCP when I need it. As of now it redirects to what I believe is WinSCP's actual site, winscp.net. In the past, Sourceforge was the actual location to get the binary. If at some point they set up a "mirror" for WinSCP, there's a good chance that people visiting that haven't in a long time might just accept that if they get a download link at a sourceforge page, it's likely legit.

I can't say the same about any of the sites you listed.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#193

Post by yellowapple »

judofyr wrote: post #128
ksherlock wrote: post #119

Earlier quoted context omitted.

SourceForge used to have an enterprise revenue model, too. They bet the company (or at least the name) on it - VA Research -> VA Linux -> VA Software -> SourceForge -> GeekNet -> {Dice and HotTopic^WGameStop}. If Github ever pivots to selling t-shirts, run.

http://github.myshopify.com/

Welp. Time to switch to BitBucket, then.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#194

Post by yellowapple »

ikeboy wrote: post #137
ghshephard wrote: post #14

This is the sort of behavior you get from a company that's lost, and is now trying to extract every penny they can from whatever shenanigans they can get away with. If they have no future brand value to be concerned about, then, from a game-theoretic approach, it's actually a pretty rational profit seeking move. (As long as they don't incur any downstream liabilities from outright illegal activity for which they migh…

>Of course, the game-theoretic response from the entire internet community is to make sure they never, ever, for any reasons whatsoever, ever click on a link that starts with "sourceforge.net" That's a nice idealistic response, but what about when you can't find a file anywhere else?

So that's when we start downloading Sourceforge's files en masse (with ad-blockers enabled so that they're not rewarded for their misbehavior), stripping out the malware, and rehosting them somewhere.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#195

Post by yellowapple »

DanBC wrote: post #6

I'm surprised the nmap.mirror site doesn't have hundreds of reviews telling people to not use it, and pointing them to the official site. I'd be interested to see how sourceforge respond to DMCA requests.

It was around 10 (my own included) negative reviews as of a few minutes ago.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#196

Post by danieltillett »

smegel wrote: post #65
danieltillett wrote: post #50

Earlier quoted context omitted.

What is wrong with Quora. You may not like their business model, but I don't think they are doing anything terrible like source forge.

Unless it changed recently, but I used to click there through Google search results and still get some blurred out page, or only one answer, or a timeout that tried to make me register. And quite frankly, I prefer the rather diverse universe of stackexchange sites.

I also prefer the stack exchange sites, but there is some information of Quora that is just not available anywhere else.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#197

Post by jackmaney »

maxst wrote: post #191
jackmaney wrote: post #190

Earlier quoted context omitted.

> I keep complete control over my projects Until they take that control from you. > I'll make sure it won't happen How ?

> Until they take that control from you. They won't because I'm not abandoning my projects. People who complain have one thing in common - they abandoned their projects on SF. It's kinda like letting the domain name expired and then complaining that somebody took over. Always keep an eye on your hosting and your domain names, folks.

> They won't because I'm not abandoning my projects.

What makes you think that will make a difference? They'll hijack whatever they want that's hosted on their servers whenever they want to hijack it.

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#198

Post by maxst »

jackmaney wrote: post #197
maxst wrote: post #191

Earlier quoted context omitted.

> Until they take that control from you. They won't because I'm not abandoning my projects. People who complain have one thing in common - they abandoned their projects on SF. It's kinda like letting the domain name expired and then complaining that somebody took over. Always keep an eye on your hosting and your domain names, folks.

> They won't because I'm not abandoning my projects. What makes you think that will make a difference? They'll hijack whatever they want that's hosted on their servers whenever they want to hijack it.

Devs who never abandoned their projects are doing fine. Not one of them complained about "hostile takeover".

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#199

Post by jackmaney »

maxst wrote: post #198
jackmaney wrote: post #197

Earlier quoted context omitted.

> They won't because I'm not abandoning my projects. What makes you think that will make a difference? They'll hijack whatever they want that's hosted on their servers whenever they want to hijack it.

Devs who never abandoned their projects are doing fine. Not one of them complained about "hostile takeover".

And what makes you think that this couldn't change at literally any time?

Re: Sourceforge Hijacks the Nmap Sourceforge Account

#200

Post by mintplant »

maxst wrote: post #81
mintplant wrote: post #64

Earlier quoted context omitted.

It feels a bit different here, at least to me. Nmap had a Sourceforge account, but now it's been taken away from them -- "hijacked", as the post describes it. And Sourceforge at least used to be a reputable site and has (had?) some lingering aura of trust around it.

They had this "You Can Take Over Abandoned Projects" policy for years: https://sourceforge.net/p/forge/documentation/Abandoned%20Pr... I took over APNG project in 2011, nice short name, it was really abandoned, and I don't feel bad about it: https://sourceforge.net/projects/apng/

Sure, but this is Sourceforge itself doing the taking over, and they're offering the same downloads (plus their wrappers and what-not) rather than reusing the name for a different project.
Post reply on HN