GIMP-Win project wasn’t hijacked, just abandoned

https://sourceforge.net/blog/gimp-win-project-wasnt-hijacked-just-abandoned/

by chris-at • 11 years ago

228 201 11 years ago

chris-at2• 11 years ago

Based on our prior outreach to the GIMP-Win author, we understand that they had concerns about the presence of misleading third-party ads on SourceForge. They were not alone in those concerns — we were also concerned — leading us to establish a program to enable users and developers to help us remove misleading and confusing ads.

right.

StavrosK• 11 years ago

So what they did was take an abandoned project, add their adware installer and release it?

chris-at2• 11 years ago

https://plus.google.com/+gimp/posts/cxhB1PScFpe

It appears that +SourceForge took over the control of the 'GIMP for Windows' account and is now distributing an ads-enabled installer of GIMP. They also locked out original owner of the account, Jernej Simončič, who has been building the Windows versions of GIMP for our project for years.

arcatek• 11 years ago

Apparently happened with VLC too...

We also got outed of our +VLC project on sourceforge...
But it does not matter, we moved to our infrastructure a long time ago to our own, which is better and more powerful!

bill_from_tampa2• 11 years ago

It appears SF closed the abandoned 'gimp for windows' account, and opened a new account maintained by a sourceforge editor specifically labeled as a mirror which explained in detail what happened.

DanBC3• 11 years ago

Was it an abandoned project, or was did the project just stop using Sourceforge?

jlgaddis5• 11 years ago

Was it an abandoned project ...

No.

... or was did the project just stop using Sourceforge?

Yes.

ww5202• 11 years ago

The GIMP developer has asked SourceForge to remove the installer. Guess they just ignore him.

https://mail.gnome.org/archives/gimp-developer-list/2015-May...

giancarlostoro• 11 years ago

This alone seems like reason enough not to use SourceForge even if just for mirroring a project. Which is what a lot of projects do including some Linux Distributions, what are alternative hosts at that point though?

rylee2• 11 years ago

Gitlab, Bitbucket, GitHub are the big three. There's a whole lot of others, but those are the ones I know off the top of my head.

baldfat• 11 years ago

This makes me even more angry at SourceForge and not less.

1) There is nothing clear and open about the project being abandoned by the author

2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money?

3) Is SourceForge just going to maintain any project that leaves them and makes a mirror?

The sad state of Download.com and SourceForge keeps getting grimmer and grimmer.

jarcane• 11 years ago

Not to mention that sleazy line about 'helping their users avoid malware'.

The search hijacker that came with my copy of FileZilla Server was the first such infection I've had in a decade.

adam12• 11 years ago

Same here. I'm done with Sourceforge.

tomswartz073• 11 years ago

I'm sure you're probably aware, but just in case:

Ninite.com is a great resource for getting tools like this (and things like Chrome, Firefox, etc) without all of the packaged adware.

I use it almost exclusively to get all of my dev tools on a Windows machine.

shortstuffsushi• 11 years ago

It had been over a year since I installed FileZilla, but I re-imaged one of my machines and needed it. Hopped out to SourceForge not thinking too much of it (not a fan of the UI and ads within, but I know my way around to avoid them at least). Started the install and it wants to install MacKeeper. Can't begin to describe how disgusted I was. I wasn't sure if that was caused by SF or FZ, though.

ww5202• 11 years ago

Google should demote the GIMP search term leading to SourceForge's download page, or mark the page as infested with malware.

detaro• 11 years ago

I guess you are looking for https://www.google.com/safebrowsing/report_badware/ ?

zamalek4• 11 years ago

4) The reason why they did it is actually completely irrelevant. "I killed him because he slept with my wife" doesn't change the fact that you committed murder.

Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced?

Edit: The difference between murder and manslaughter has now been explained, multiple, multiple times. Manslaughter is still a crime and in that way it is still the same. The comparison was used as a device to elaborate why the reasoning was unimportant, the difference between murder and manslaughter isn't important within that context. Suffice to say, now that I have been corrected repeatedly over this nonsense, this would have been a better anecdote:

"I killed him because he slept with my wife" doesn't change the fact that you killed someone.

striking• 11 years ago

(not totally relevant but) technically that would be a crime of passion murder, and in some cases would result in a charge of "Voluntary Manslaughter" rather than "First Degree Murder". [1] Reason does matter, sometimes. Although in this case, Sourceforge just needs to stop.

[1] https://en.wikipedia.org/wiki/Murder_(United_States_law)#Deg...

userbinator4• 11 years ago

Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced?

No. The adware is part of the installer, and is considered separate by the GPL:

http://www.gnu.org/licenses/gpl-faq.en.html#GPLCompatInstall...

dalke5• 11 years ago

The adware is not part of the GPL'ed code. It almost certainly counts as "mere aggregation". See http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#Me... or http://www.gnu.org/licenses/gpl-faq.html#MereAggregation .

coldtea2• 11 years ago

4) The reason why they did it is actually completely irrelevant. "I killed him because he slept with my wife" doesn't change the fact that you committed murder.

Hate, well, love to be pedantic, but it actually it does matter.

Courts and society alike take the reason for a murder (e.g. self-defense, revenge because of having been abused, being crazy or intoxicated etc.) into consideration for less harsh sentences or even acquital.

Lawtonfogle6• 11 years ago

Self defense, manslaughter, second degree, first degree...

Intent and reason is quite important. It is the difference between receiving no punishment and receiving the death penalty (in places that still have it).

jrochkind12• 11 years ago

The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money?

That it is open source does generally allow anyone to do this, right?

But yeah, Sourceforge sucks.

ExpiredLink• 11 years ago

That it is open source does generally allow anyone to do this, right?

Their malware is open source?

ninkendo• 11 years ago

I'm not sure the GPL allows you to fork something under the same name though, right? Copyright law still lets you own the name of your project?

That's why the typical workflow is to say in the header of your GPL license "Foo is copyright John Doe... Permission to modify is provided ..."

Sourceforge may be allowed to redistribute software with malware but as far as I can tell, copyright law should stop them from calling the software by the same name, right?

Does the author have a copyright on the gimp-win name? Maybe I don't understand the law correctly though, IANAL, etc.

mahouse• 11 years ago

2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money?

Well, why not?

Cthulhu_2• 11 years ago

Because using your power to do a hostile takeover of an open source project is just bad taste. They'd be free to make a fork of the project and host it on their site, but taking over someone's account / project without their permission is a case of power abuse.

dec0dedab0de2• 11 years ago

if all they did was setup a mirror with ad's on the page nobody would care.

ntakasaki2• 11 years ago

This makes me even more angry at SourceForge and not less.

YCombinator also invested in a company that did this.

http://www.istartedsomething.com/20130115/y-combinator-is-fu...

Here's pg's response:

2. The apps that get installed are "crapware."
This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things.

https://news.ycombinator.com/item?id=5092711

moron4hire4• 11 years ago

Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but-not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time.

What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.

piyush_soni2• 11 years ago

I didn't know about that. Too bad, and the way PG was defending a crapware installing product was really unconvincing. Any application which installs other ones by relying on accidental clicks by users is without a doubt doing wrong.

JohnTHaller• 11 years ago

It's also worth mentioning that one reason for Chrome's market share is this exact practice. When you let Java automatically update itself and download the new version on Windows, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you want to download Flash plugin for Opera or Mozilla and go to Adobe's site, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you let the free version of Avast update itself on Windows, if you don't uncheck two boxes, surprise... you get Google Chrome installed asking to be default browser AND Google toolbar installed into IE.

fapjacks2• 11 years ago

He's defending it because he's been kind of douchey the last few years.

prodigal_erik• 11 years ago

YC funding should not be taken as any kind of ethical seal of approval. It's not their job, and they are demonstrably bad at it. pg described AirBnB as "among the nicest of all the people we've funded" and their CTO was already a huge spammer and now a repeat offender.

jasonlotito• 11 years ago

1) There is nothing clear and open about the project being abandoned by the author

Then you say:

2) The author left SourceForge...

Pretty sure if you left SF with the project still up on SF, any reasonable person could consider that abandoning the project. A more responsible thing would have been to remove the project entirely and shut it down.

3) Is SourceForge just going to maintain any project that leaves them and makes a mirror?

I assume you mean the only obvious option is to remove the project entirely (or disable from view) for those that leave. Leaving up old code at the scale of GIMP has the potential for leaving up unpatched code that is still downloaded and used. If your opinion is that nothing should have been done at all, I think that's far worse than what anything SF did.

SwellJoe3• 11 years ago

What's interesting is that SF.net seems to not care if you have removed the project. Or, even if the project never existed at SourceForge, at all. In the previous thread about this issue, someone linked to the sf-editor1 account, which has projects for a huge swath of software, including software that has never been hosted at SourceForge.

https://sourceforge.net/u/sf-editor1/profile/

It is part of their "mirror directory" project, which seems designed merely to get traffic from popular Open Source software, and occasionally inject malware into downloads that they can dupe people into getting from SF.net rather than the authoritative source.

And, of course, in this case, the author of Gimp-Win has plainly stated they did not abandon the SF project. They were locked out by SourceForge staff.

I'm all for caution before reaching for the pitchforks and the torches, but there's an awful lot of very large, very credible, projects saying, "Yes, SourceForge did this to our project."

I sent them an email yesterday asking for clarification, but have not received a reply.

davidgerard3• 11 years ago

In this case, the maintainer was still maintaining the page - he found out when he was locked out of his account.

TrevorJ• 11 years ago

They use the term abandoned when really, it sounds like the more correct description is that the client decided to go with a different service. In that case, it would be akin to G+ reviving your profile page after you moved to Facebook, and populating it with your Facebook posts without your permission. That doesn't seem ok

Nullabillity2• 11 years ago

It could (and should) be clearer, of course, but doesn't basically every open source license allow doing what they're doing? Isn't this one of the FSF's four freedoms?

TheLoneWolfling• 11 years ago

More like G+ reviving your profile page after you moved to Facebook, and populating it with your Facebook posts with injected product placement without your permission.

Xylemon• 11 years ago

I've heard about how SF has been some financial trouble, but isn't all this adware nonsense just going to hurt them more in the end? Surely some crowdfunding option could've been more of a viable effort...

coldpie• 11 years ago

They've been getting scummier and scummier. They've been doing this ad bundling thing for years, and their entire website is basically unusable without adblock. Someone at Slashdot enterprises has no idea what they're doing. At any rate, SourceForge is going to die soon. I wouldn't be surprised if Google starts to delist them for distributing malware.

forthefuture• 11 years ago

AOL has proven that as long as a sizable portion of your users are technically inept, you can extract value out of them like foie gras.

marcosdumay• 11 years ago

SF current administrator is a company despised by many of their end users. They had the option of crowfunding before it was sold, but do not have anymore.

davidgerard3• 11 years ago

They're owned by a job ads and recruitment company. It's been years since they gave a hoot about the open-source businesses.

r721• 11 years ago

Mirrored projects are sometimes used to deliver easy-to-decline third-party offers

It's as if they know the majority of experienced users would decline those "enticing" offers.

pbhjpbhj2• 11 years ago

Adobe pull this same scummy move with Flash downloads; Oracle do it with Java too. Surprised me recently setting up someone's Win 8.1 laptop as I had thought that such moves were now illegal in the EU - perhaps they are?

Cthulhu_2• 11 years ago

Legally, no - after all, people give their express permission by leaving the box ticked.

The newish anti-spam measures in the Netherlands actually forbid the 'Yes I would like to receive spam' checkboxes to be pre-checked - has to be opt-in instead of opt-out.

notwhereyouare• 11 years ago

Given that the author hasn't given them permission to distribute GIMP, much less a modified installer of GIMP, can he send a DMCA to them?

colinbartlett• 11 years ago

Does an author need to grant permission for anyone to distribute his/her GPL'ed source?

cowsandmilk• 11 years ago

They cannot file a DMCA because there are no copyright issues.

This is why popular open source projects should seek trademark protection on their names.

Sure, people get angry about Mozilla's protection of the Firefox trademark, but this demonstrates that there are legitimate reasons to trademark a name so you can protect it from malicious operators.

doodpants• 11 years ago

The GPL itself grants permission. Further, it prevents anyone from denying anyone else such permission. That's the whole purpose of the GPL.

reidrac• 11 years ago

They have permission as long as they comply with the license (GNU GPL v3+) and the author can't revoke a license already granted unless the license allows to do so, and the GPL doesn't allow it.

See: "The Non-Revocable GPL" http://www.groklaw.net/article.php?story=2006062204552163

qrmn• 11 years ago

100% scummy. Question is, what do we do about it?

I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, should it be? v2?/v3?) Where's the installer's source? It wraps it in one linked executable file and presents itself as an installer for it, so I am not clear that any "mere aggregation" defence would hold?

There's also a reasonable argument that this brings the official project into disrepute: The GIMP may not be trademarked, but would it have to be?

Firefox, of course, is trademarked. I dearly hope they've never wrapped Firefox installers with adware, because Mozilla would not like that.

DSMan195276• 11 years ago

I would assume that a non-GPL installer for GPL software would be fine, because it doesn't actually run the software, just installs it as a set of files (If it does run the program, generally it doesn't interact with it). I would equate it to using something like GNU 'indent' on proprietary software - I doubt using a GPL program to modify data would cause that data to have to be under the GPL or any other license.

What is very possible is that if they integrated their installer into GIMP's installer (Since GIMP already has it's own installer), GIMP's installer is GPL so their modification would be a GPL violation unless they make the code available. If all their installer does is run GIMP's installer though, then there's no violation AFAIK.

true_religion2• 11 years ago

They could just make the code available for the installer.

It's not as if an installer is software worth protecting via copyright in 2015.

joshstrange• 11 years ago

I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, should it be? v2?/v3?)

I would assume that adding in stipulations like this would actually be more of a hinderance. Who decides what is "crapware" vs legit software? I can see use cases where you would want an installer to install more than just 1 GPL app (ninite?) and I'm sure it has further implications...

Lawtonfogle6• 11 years ago

The easy solution is that everything not required by the software being installed must be opt in. You can bundle, but it must be opt in.

simosx• 11 years ago

Sourceforge took over more than 300 dormant projects.

Here is the list, http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/

castell• 11 years ago

On the list Apache Hadoop, Apache Lucene, OpenOffice, SQLite, etc. wow - if all these downloads come with an malware installer..

aikah• 11 years ago

Question what are the alternative solutions to distribute window binaries freely,without adware like sf or download.com ? github used to allow binary distribution but not anymore, and I don't feel like tags are a good way to do that.

taspeotis• 11 years ago

github used to allow binary distribution but not anymore

Sorry I must be missing something, what's wrong with "Upload a release asset" [1].

[1] https://developer.github.com/v3/repos/releases/#upload-a-rel...

djpowell• 11 years ago

Github used to have a simple binary files service, this was removed with no replacement, and then the release asset system was added shortly after.

I only recently found out release assets.

userbinator4• 11 years ago

Depending on the download volume you expect, you could host it yourself.

bill_from_tampa2• 11 years ago

In all fairness, the page for gimp-win on sourceforge clearly states it is a mirror of a project that is no longer distributed by the upstream author through sourceforge --

"Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information. " -> this links to a page that explains in detail what you are getting.

I don't have a windows installation handy so I can't 'test' the SF installer to see if the adware or add-on programs are easy to identify and accept or refuse -- has anybody tried that?

epaga• 11 years ago

The whole blog post can be summarised in the one sentence "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers."

Makes me pretty sad since I still remember the days when SourceForge was one of the good guys.

moron4hire4• 11 years ago

When would that have been, the year 2000? I remember as early as 2003 thinking they were junk because of the intrusive banner ads with no borders that only said "Download Now!" You actually had to look for the smallest download link, verify it was actual text, then hover over it to check to see if the URL ended in your expected file name.

Rexxar• 11 years ago

They were never good guys: they start by an $10 billion IPO with the ticker "LNUX" to ride on linux success.

https://en.wikipedia.org/wiki/Geeknet#Initial_public_offerin...

http://www.nytimes.com/1999/12/10/business/a-tiny-company-wi...

adekok• 11 years ago

"Mirrored projects are sometimes used to deliver easy-to-decline third-party offers."

If they just mirrored the project, no one would be complaining. Having another place to download copies of the official releases is a good idea.

The issue is they changed the release. They advertised it as "mirror of Gimp-Win version X". And it wasn't. It was Gimp-Win version X with a boatload of adware / crapware. This made the Gimp-Win people upset that the crapware was being falsely associated with their product.

If SF had advertised it as "SF Version of Gimp-Win with magic crapware", people would be less upset. And fewer people would download it, of course. Which isn't what SF wants.

Their self-serving statement about "mirror" is a lie. The people who wrote it should be ashamed of themselves.

ncr100• 11 years ago

Seriously!

How this was done was wrong.

SF writes: "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available."

It's wrong because it's disingenuous - an insincere representation of the GIMP maintainers package, to include adware in the package.

SF insufficiently differentiates this "gimp-win" project with the small, coded byline: "Brought to you by: sf-editor1" (http://sourceforge.net/projects/gimp-win/files/)

Let's be blatant and honest: this is "SF-GIMP" not GIMP. It's being operated here under the guise of the authors and currently not sufficiently identified as a fork.

SF skirts "adoption responsibility" by simply writing a post to some unrelated blog article after the fact and create a collection of unrelated "deceptive ad blocking" website tools.

RECOMMENDATIONS TO SF:

* Be up front and bold about "adopting"!

* Free software or not this adoption stinks!

neomech• 11 years ago

I moved my project to github after one of their "enticing" offers installed a vpn client that redirected all my traffic and inserted ads into my browsing, when I installed filezilla. The installer they add is designed to make it very easy to install their "offers"without your realising it. I'm very wary of any code on sf now.

Someone1234• 11 years ago

The Filezilla team also deserve some credit in that case, as they opted-in to the ads on purpose (the Filezilla team gets kickbacks from each adware install).

scrollaway6• 11 years ago

There is zero excuse for what they did, and zero excuse for what they have been doing for the past years.

Once again reposting what I said in the other thread (which seems to have been modded off the frontpage, sad).

I'm one of the lead devs of LXQt and an LXDE sysadmin. We use Sourceforge for our mailing lists and some LXDE legacy stuff.

I'm absolutely sick of them. It's not the first time this has happened. I've been pushing for us to move off SF for a while and this is a good occasion to push for it harder.

I've sent an email [1] detailing plans to move. I am urging everyone who still has projects on Sourceforge to do the same.

If you have similar migration problems to solve as the ones I've highlighted in the email, please contact me directly and we can share the workload. My email is available on my Github profile [2].

[1] http://sourceforge.net/p/lxde/mailman/message/34148903/ [2] https://github.com/jleclanche

Touche• 11 years ago

It's unfortunate there aren't many good hosted mailing list services out there. Google Groups makes it hard to use without a google id, and mailman is tricky to setup/maintain.

aDevilInMe• 11 years ago

Have a look at freelists www.freelists.org/

scrollaway6• 11 years ago

I wish Github would get into that business. Easily set up MLs for organizations/projects and integrate them, do what they do in regular issues (markdown processing, autolinking issues etc).

In fact, I wish anyone would do that. I've had detailed plans of what a service like that would look like for over two years, and no time to take a stab at it myself. If someone here is actually interested, feel free to contact me.

themartorana• 11 years ago

Full disclosure, I know one of the owners, and it's a SaaS, not exactly free, but we've been using Group Buzz:

http://groupbuzz.io/

It was originally built for sizable coworking communities but is pretty decent. Mail integrated, daily digests, etc.

Still a WIP but pretty mature at this point.

xioxox• 11 years ago

If your project uses GPL-compatible licenses, then you can use gna.org [1]. Unfortunately the website is a bit old fashioned and git isn't supported for version control, but it's fine for web and mail hosting for Free software.

[1] http://gna.org/

pquerna• 11 years ago

I've been using https://groups.io/ for a few small things, feels much better than Google Groups.

lloydde• 11 years ago

google groups

Then there is the spam. Once targeted the spam can get really bad. Meteor JS suffered this and moved to the open source forum software http://www.discourse.org.

grayclhn• 11 years ago

I haven't used it for anything serious, but librelist looks promising: http://librelist.com/

david-given• 11 years ago

I have a bunch of minor projects on SF, which I'm now going to look into moving, and yes, migrating the mailing list is the hard part. Project hosting on my own server is easy; mailing list hosting is not. (I used to run my own mailing lists. Never, ever, again.)

One option is to migrate away from mailing lists and towards something like a forum; but forums, while they provide very low barrier-to-entry, produce a fundamentally terrible user experience. (Yes, including HN. This text box I'm typing into is an embarrassment.)

What I'd really like, I suppose, is a service which provides an easy-to-use web forum with an SMTP gateway for those people who hate forums. And then have it all hosted via my project website so that I don't have to redirect people to some dubious third pary site. Bet I'm not going to find one, though...

copx• 11 years ago

I am urging everyone who still has projects on Sourceforge to do the same.

Where is that other great free service which hosts large binary assets, web sites, wikis, forums, and trackers i.e. everything you need for a project.

Github is only a solution for software without meaningful binary assets where the user is expected to build the software himself and no community interaction beyond pull requests and issue reports is desired.

There is no free alternative to SF for many users, that is the problem. And well, "free", that is the key word here, at the end of the day SF has to make money somehow. As a non-paying SF user I cannot really complain about ads.

microtonal• 11 years ago

I have no experience with them, but I've seen some projects using Bintray:

https://bintray.com/

Apparently, they have some integration with GitHub as well.

scrollaway6• 11 years ago

Ad-supported business models are OK when the website is view-driven. When the site is download-driven, web ads will never make up for the bandwidth costs, so you'll often end up with sites distributing adware to make up for it (target the area of your product that is actually being used).

So this is a broken model that Sourceforge entered itself into. You absolutely can and should complain that a service has a broken business model resulting in a horrible user experience.

amk_• 11 years ago

https://launchpad.net ?

darkr• 11 years ago

Github is only a solution for software without meaningful binary assets where the user is expected to build the software himself and no community interaction beyond pull requests and issue reports is desired.

GitHub Releases addresses this (i.e you can release compiled binary assets as your "release", rather than just an archive of the repository). Also, GitHub Pages is pretty useful if you want to build a user-facing site for your project.

edit: typo

ljani• 11 years ago

How large assets are we talking about? GitHub allows hosting up to 1GB/file: https://help.github.com/articles/distributing-large-binaries...

flavor8• 11 years ago

For binary assets, why not just rent a cheap digital ocean box? You get a 20GB server for $5/mo.

Throw up an nginx install to forward part of the site to github, and downloads direct from disk, and you have a nice - and fully customizable - project setup.

oso2k• 11 years ago

Software distribution used to be done via FTP sites, separate from the project web pages, documentation, issue tracker, etc. iBiblio [0] will still host stuff for distribution. There's also Savannah.nongnu.org [1] which is an old fork of the SF code.

[0] http://www.ibiblio.org/share/

[1] http://savannah.nongnu.org/

hamburglar• 11 years ago

Given that the parent company of SF.net was recently purchased by Hot Topic, of all companies (presumably primarily for ThinkGeek), I doubt SF.net is long for this world.

Edit: doh, I didn't realize they had been sold off already. Never mind. :)

ksherlock• 11 years ago

slashdot and source forge were sold off to dice a couple years back.

ntakasaki2• 11 years ago

Dice Holdings also bought Slashdot, and now there are things that look out of place, like the Kate Upton ad for God of War, Slashdot Deals [1], and annoying ads as tweets on the twitter account which made me unfollow.

[1] https://deals.slashdot.org/?utm_source=slashdot&utm_medium=n...

Would be interesting to see if Slashdot posts this story.

johnduhart2• 11 years ago

Slashdot Deals

This has to be some prank, they can't be serious about that.

johnduhart2• 11 years ago

You wouldn't believe what launched today: http://sourceforge.net/blog/introducing-sourceforge-deals/

nodata• 11 years ago

Bye sourceforge!

danellis• 11 years ago

I'm astonished they lasted this long. The only unique thing they ever did was their compile farm, now long gone.

_lce02• 11 years ago

Lets take action and report the website so browsers warn users once they try to navigate to the page.

https://www.stopbadware.org/

Please report the entire website, not just some project. They had distributed enough malware already.

moron4hire4• 11 years ago

> Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available.

So in other words, GIMP-Win was hijacked, just not by a 3rd party.

JimmaDaRustla• 11 years ago

Source Forge has been doing this for a while now, not just gimp.

Pretty sure I downloaded Synergy and it deceivingly downloaded a common installer which was small and installed adware as it downloaded the proper executable which you desired to download in the first place

DanBC3• 11 years ago

There are two problems.

1) wrapping the software in the sourceforge installer which includes adware. (That's what you mention).

2) having a page that looks like an official project page and distributing the software. This is bad for bla bunch of reasons, including 1) above.

zak_mc_kracken• 11 years ago

That is some crazy amount of spin. SourceForge started their path down the scummy side a while ago but this is really taking it to a new level.

You'd think that if they really cared, they would back pedal on what they did, but no, instead, they double down by trying to justify what they did and "welcoming further discussions".

Also, this:

deliver easy-to-decline third-party offers

How about delivering third-party offers that users need to opt in instead?

Terrible, terrible company and organization.

Lawtonfogle6• 11 years ago

Software that requires opt out should be considered as malicious as software that doesn't give the ability to opt out.

thebouv• 11 years ago

I have good memories of SF being the hub of OSS back in the day. I was particularly fond of how projects could actively post types of people they were looking for (artists, doc writers, etc) instead of just relying on being stumbled upon and/or just listing an issue.

However, recently, I cringe if I somehow end up at an SF link. Feels like I'm on the wrong side of the Internet and that I can't trust any downloads from them.

Lawtonfogle6• 11 years ago

Why don't they (SourceForge but also all the other software vendors out there, even Oracle with the Java and Ask.com bundling) just have it so it automatically installs all the crapware instead of asking you? Last I checked, it was because this would get them treated as outright malicious. I suggest that we consider such offers where the default option is to install them to be considered as malicious as installing them without asking.

owly• 11 years ago

Sourceforge has been dead to me for a while now. I think it started with FileZilla.

fithisux• 11 years ago

It is a pitty because I use SF often. I think that the problems could be solved if we could use something like pkgsrc on Windows.

Unfortunately this is not a reality or an option but it would be a good alternative.

Msys2 project gives a few of these apps as binaries. But it would be more user friendly if we could just download from a source repository and compile locally on windows.

carussell6• 11 years ago

Windows 10 is supposed to finally ship with something resembling a proper package manager. Or something.

m_mueller• 11 years ago

Isn't this a problem with overly permissive licences used in most OSS? AFAIK there is nothing stopping any commercial entity to just resell you OSS as-is (in case of GPL they just have to link to sources as well). There's also nothing stopping them from putting ad- and malware in, correct? IMO it might be a good idea to put some limits into OSS licences - even if most projects wouldn't have the means for litigation, at least it would give pause to some legal departments of such companies trying to abuse OSS. I'd also advocate to have a standard license similar to creative commons for non-commercial use. Why not adding some semi-enforced sponsorship element into OSS projects that are heavily used commercially?

TazeTSchnitzel3• 11 years ago

The problem isn't the bundling of malware per se. It's SourceForge hijacking the site.

carussell6• 11 years ago

This is true of any software that's freely redistributable. There's nothing particular to FOSS that enables what's going on in this case. (In theory, the source allows them to change it at the source-level and bake the badware in, but SourceForge doesn't seem to be doing that.)

abulman• 11 years ago

Whenever a download link (and more often than not, for me, it's usually for a server-based tool) goes to Sourceforge, I cringe - more than a little. For Linux based tools, its because a simple 'wget' for a file is going to end up with a comlex filename that I have to rename. This, at least, is a simple problem for me to fix.

For desktop software, I'm more concerned after hearing of projects being wrapped in Adware/malware. This is a particular problem on sites like http://download.cnet.com. I've been online since at least 1996, and those sites used to be great to be able to find useful software. Now, I prefer to not install much new software, in order to keep a stable desktop (and it does work - I've only had to wipe my desktop and install Windows from scratch once or twice in my entire online career, I get new PCs more often).

I've even seen jobs posted on some sites to work on open-source code - but then the project is hosted on sourceforge.net, and so it is using Subversion for version control. While I may be expert on the underlying technologies that particular project used (and the language) - its not something that would ever convince me to help them - not even while being well paid (and working remotely, which is what I'm aiming to do from now on).

SwellJoe3• 11 years ago

So, this is a reminder (and a very harsh one) that trusting third parties with your projects may be a risky decision. I see many people suggesting moving off of SourceForge to Github. While we moved most of our stuff to github years ago, and I like github and have no major complaints about them today, I'm having doubts about the wisdom of staying on any third party hosting site, no matter how nice they seem today.

Let's put this in context: SourceForge was once (this was many, many years ago) a deeply trustworthy entity. They were excellent stewards of Open Source projects. They consistently took guidance from the community, and wouldn't have chosen profits over users or projects (though, certainly, they've profited).

Markets change, leadership changes, acquisitions happen. One day, we may not recognize github as the entity we know today, just as we don't recognize the entity that SourceForge has become.

I'm not saying don't move to github. Obviously, nobody should be starting new projects on SourceForge and github is one of the better third party alternatives. But, it may be worth thinking about what happens when we as an Open Source community build up another SF.net like entity. A central repository for all the most popular Open Source software, controlled by one profit-driven corporation.

Maybe it was worth the tradeoff. Maybe SourceForge provided enough value over the years to where it's not worth belly-aching about having to rebuild our communities around new tools (maybe even another third party tool), and to educate users that SourceForge is now an untrustworthy provider that should be avoided. Maybe we have to just mourn the loss of a once great supporter of Open Source software and move on to another that will likely, someday, also turn its back on Open Source values in pursuit of profits.

I hate trash-talking SourceForge so harshly, as projects I've been involved in have been well-served by SF.net in the past (and even now, we're pushing out terabytes of downloads through their mirrors, even though we've moved our revision control to github long ago). But, the company as it exists today is nothing like what it once was. I must assume none of the original founders remain given how far this strays from the original vision of the thing, and certainly it's been through multiple acquisitions and leadership changes. Maybe I shouldn't feel so bad about it...maybe the SourceForge I knew has been dead for years, and I just didn't notice as it's taken a while to start to smell.

drzaiusapelord2• 11 years ago

Why can't someone make a hosting site with a no crapware rule? I understand monetization is a big issue, but I'd be willing to sit through a 10-15 second forced ad to get a nice FOSS product. This mentality of installing random "utilities" and search hijackers on PC's needs to end. I can't imagine these things outpaying video ads directed right at our demographic.

In the age of cheap bandwidth and cheap servers, how is this not massively profitable?

carussell6• 11 years ago

People, even hackers, get unreasonably attached to names. Your last paragraph is key. If the company operating SourceForge today were doing what they're doing today under any other banner, no one looking to evaluate the options available to them would come away with the conclusion that TAFKA SourceForge would be the thing to go with.

dilap• 11 years ago

Wow, it's not clear at all that the SF page is a "mirror" of the official project, and for now it remains the first google result.

What assholes.

userbinator4• 11 years ago

Personally, I see this as one of the natural consequences of permissively-licensed software, and the freedom of being able to obtain such from the open Internet. This is a feature, not a bug.

If you want something with more security guarantees, then use the walled-garden app stores. It reduces your chances of getting malware, but also reduces the choices available to you.

Whether or not people like what SF is doing does not change the fact that it is legal under the GPL. I hate adware myself, but if someone chooses to distribute it legally, then I respect their freedom to... and the only thing I would do is tell the users so they can make an informed decision. The official GIMP site has made a notice about this already.

As long as computing platforms exist which allow users to install any software, from anywhere they choose, they will eventually install something they don't want (and even in walled-garden app store environments they still manage to.)

Something to think about: "Freedom is not worth having if it does not include the freedom to make mistakes."

TazeTSchnitzel3• 11 years ago

The problem is SourceForge hijacking the GIMP site

userbinator4• 11 years ago

The official site is http://www.gimp.org/ and it has nothing to do with SourceForge.

helb2• 11 years ago

So in fact it was hijacked… by SF.

My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off.

Also, old HN post on "what happened to Sourceforge": https://news.ycombinator.com/item?id=6700115

jlgaddis5• 11 years ago

My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off.

Please do. IIRC, most (all?) of their mirrors are provided by third-parties who are graciously offering their resources and SourceForge is taking advantage of them to serve up and profit from adware/malware installers.

u04f061• 11 years ago

They are doing something with GIMP what they did to VLC.

Pxtl• 11 years ago

So they take the code from a 3rd party, compile it into an installer with malware bolted on, and reap the profits from the malware.

Yeah, hijacked.

proactivesvcs• 11 years ago

I'm sure we only hear about "easy to decline/opt-out/remove" software when it is something nobody ever wants. If the first feature of your software is that it's easy to decline, maybe it's time to pack up shop.

nothrabannosir• 11 years ago

They show their true colors in the last paragraph:

We welcome further discussion about how SourceForge can best serve the GIMP-Win author.

Just stop. How disingenuous can you be? What a disgrace.

Do we really need to go there? Ok, how about: "completely suspend and remove the project, and don't let the name be reclaimed."

Source Forge is trying to convince us they never thought of that. Really? Give me a break. You knew. You just don't care. Fine, you don't. But don't try to play that off as ignorance. "Oh, yeah, please enlighten us with further discussion!" Get out of here, stop wasting our time.

They could just as well have done away with the blog post and put up an image of a giant middle finger, instead. At least that would have been honest.

astrodust• 11 years ago

We should start discussing how they can shut themselves down and rid the world of the blight that SourceForge has become.

RubyForge folded and the world was better off.

codazoda• 11 years ago

"Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available."

Well, there's your problem.

fixermark• 11 years ago

tl;dr "Hey, it's not our fault that we adopted policies so offensive to the project maintainer that they utterly washed their hands of us, but the license of GIMP basically prevents them from preventing us from distributing the software inside of our third-party shovelware bundle..."

Good job SourceForge. A++ would never download anything from again.

DanBC3• 11 years ago

Gimp should just push an update that has a "Stop using Sourceforge" splash screen and see if Sourceforge distributes that new version.

It's a shame. Sourceforge used to be really good.

worklogin• 11 years ago

I also notice this isn't covered by Slashdot, who is owned by DHI, who owns Sourceforge.

kjs3• 11 years ago

I think I've recommended sourceforge.net be added to the webfilter global block list at every client I've worked with in the last 5 years. Once I pointed out the risk of their drive-by download strategy, no one has said no, and very rarely has an end-user complained (something almost always remedied by finding a legitimate download site for them).

fapjacks2• 11 years ago

Fuck SourceForge. The people that bought it blew it.

helb2• 11 years ago

http://helb.github.io/goodbye-sourceforge/

GIMP-Win project wasn’t hijacked, just abandoned

Related Stories