Goodbye, Sourceforge

http://helb.github.io/goodbye-sourceforge/

by chris-at • 11 years ago

459 155 11 years ago

helb.github.io

na85• 11 years ago

I find this state of affairs rather tragic. To see what was one of the pioneers of the global open-source movement reduced to such infamy.

wyclif• 11 years ago

Tragic, but I see no reason to shed any tears. Sites come and go, and when they change hands the new operators are often sleazy. Today we have Github. If they end up doing the same thing, there will be a new VCS site. Nerds won't tolerate crapware.

72deluxe• 11 years ago

I remember when they were bought by VA (I think?), the same time as Slashdot changed hands I think.

I remember signing up for an account years ago and having to use Putty and SSH keys to upload data which was revolutionary to FTP-aware me. There was an awful lot of software on there (who remembers visiting freshmeat.net to look for daily updates or search for software too????) but I think it would be sad to not realise how great it was that they offered free hosting and tools. They used to have a compile-farm that you could use to build software on different platforms and architectures but this got retired a long time ago.

For the free tools you got, it wasn't bad! I think "nerds" are quick to forget that. It was FREE

Cthulhu_• 11 years ago

TBF, the way I see it they only did the hosting and making the money; I don't remember them actively supporting open source or the ideals behind it, or being open source developers themselves and contributing, or making their own software open source. Having a revenue model that involves making your users guess which DOWNLOAD button will actually download the application is not the open source spirit.

sanswork• 11 years ago

The code running the site was original open source but they closed it a long time ago. Probably as part of one of the many buy outs over its history. GForge came from it.

Nullabillity• 11 years ago

AFAIK their website was originally open source, with GForge, FusionForge, and GNU's Savannah based on it. Then they had a longer stint staying closed, but they opened back up a couple of years ago, and their current software, Allura, is open source again, though (slightly ironically) now as part of Apache.

hahamrfunnyguy• 11 years ago

The guess the download crap appeared in the past 8-10 years. Before that the site was fairly trustworthy even though there was always ads and the like.

yAnonymous• 11 years ago

It's high time that SF lands on malware blocklists.

nekopa• 11 years ago

I was shocked the other day when I went to grab FileZilla from SF, and my virus scanner tagged it for malware. I hadn't realized it had fallen so far as to bundle crapware. SF used to be my goto site for looking for weird open source stuff. Now I guess I will have to finally take SF off my list goto sites.

You either die a hero or live long enough to become the villain.

laurent1234564• 11 years ago

It was FileZilla's developers who decided to bundle crapware with their installer on SF so can't really blame SF on this.

See there: https://forum.filezilla-project.org/viewtopic.php?t=31127

"This is by design. In any case, nothing is forced upon you, all offers are entirely optional and are only being displayed during setup."

tonyedgecombe5• 11 years ago

I guess this is what happens when people aren't willing to pay for software, there are plenty of really good ftp clients out there for not very much money.

castell• 11 years ago

I switched to WinSCP and never looked back.

signal11• 11 years ago

FileZilla has other issues as well: for example, for the longest time they refused to encrypt stored passwords, although the bug's been reopened now so they may change their mind: http://trac.filezilla-project.org/ticket/5530

smegel• 11 years ago

See there: https://forum.filezilla-project.org/viewtopic.php?t=31127

Strange, almost every comment on this page say the crapware was added by SourceForge, e.g.

The offers are added by SourceForge, they are borderline crapware to put it nicely.

eterm• 11 years ago

If I were a project manager who run a sourceforge account the last thing I would do now is abandon it.

Why? Because SF have proven if I were to do so they'd take my work under my name and bundle their crap into it. The only way to stop that is to keep it active.

That feeling of being trapped into a terrible system because it'll screw over people even worse if you leave.

nudpiedo• 11 years ago

That's illegal (with the European laws).

maaaats• 11 years ago

Which laws?

netheril96• 11 years ago

Could the hypothetical you remove the project?

Grue32• 11 years ago

GIMP-win owner actually did upload new binaries to SF account. There hasn't been a GIMP release for a while, but the SF repo was never abandoned. SF is blatantly lying about this. So no, not abandoning the account won't save you.

hrjet• 11 years ago

they'd take my work under my name and bundle their crap into it.

Oh, is that a thing? I was surprised when the Lobo project's admin rights were handed over to some relatively unknown developer. I had a long and confusing discussion with the new project admin here: https://github.com/UprootLabs/gngr/issues/87#issuecomment-86...

wldlyinaccurate• 11 years ago

I've found that Sourceforge is still the only place you can get a lot of good-but-unmaintained software. I was there just the other week for the Saxon project[1], and it was painful to see how low SF have sunk.

I wonder if it would be possible (and legal) for somebody who isn't the project owner to copy some of these unmaintained projects into another system?

[1] http://sourceforge.net/projects/saxon/

pan692• 11 years ago

I remembered Saxon being an Apache project, but it's not. I must have remembered wrong. Anyhow, it should be an Apache project.

http://www.apache.org/#projects-list

guard-of-terra• 11 years ago

Xalan is Apache project so there will be redundancy.

(I remember they had a dozen Java MVC frameworks 10 years ago tho)

inimino• 11 years ago

Saxon has a free version and an "enterprise" version, and the developer also operates a consulting business around it, so it's not a likely candidate for an Apache project.

imron2• 11 years ago

The project is licensed under the MPL 2.0 (and 1.0) which states:

Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license ... to use, reproduce, make available, modify, display, perform, distribute, and otherwise exploit its Contributions, either on an unmodified basis, with Modifications, or as part of a Larger Work;

So the answer (at least for Saxon) is yes! Just make sure you conform to the licence requirements and you're good to go.

TazeTSchnitzel• 11 years ago

I recently needed SourceForge to get ahold of a usbtb binary, an alternative USB printer driver for OS X part of GutenPrint. Despite being unchanged for 7 years, it still works on Yosemite.

laurent1234564• 11 years ago

To be honest I can't say I have any good memory of Sourceforge. It used to a heavy website with a confusing UI, and never really got better over the years. When Google Code started, I was glad I could move to it, and then GitHub.

DanBC• 11 years ago

There was a time when it had just opened when it was a really useful place to get opensource software.

The Usenet group alt.comp.freeware converted several people to the idea of open source by having links to sourceforge posted there.

coldpie• 11 years ago

Yeah. I started getting involved with OSS in the mid-00s. I suspect SourceForge's heyday was before that. So SF has always been a slightly shady repository of software in my view, though the adware bundling is a new low.

jcd748• 11 years ago

In the late 90s, Sourceforge (and Freshmeat) were really good places to get software. But even in the early 00s, it felt dusty and dated.

danellis• 11 years ago

Yeah, they always had a horribly confusing UI that made it non-obvious how to get to a project's homepage, even -- the thing that should be front and centre! However, I did enjoy playing around with their compile farm when they had that. Think it only lasted a couple of years, though.

cmrdporcupine2• 11 years ago

Yeah I don't get this "SourceForge, once a trustworthy source code hosting site" -- that is simply untrue. Maybe for the 1st year or two after its launch, but it has been subject to all sorts of crappy management since at least 1999/2000. I used to have projects there, and contribute to projects there (argh memories of terrible CVS) and it was always slow, always had a terrible UI, and very early in its history became submerged in bad ads and out-links to bad content.

It should just die.

vsl2• 11 years ago

That you misremember it or are too young to know better doesn't mean that it "is simply untrue". It's not, it was valuable for many years. It's your revisionist history that is simply untrue.

lepht• 11 years ago

It used to be significantly different:

https://web.archive.org/web/20010418143406/http://sourceforg...

davesque• 11 years ago

Agreed. I remember Sourceforge when it was just getting started and it always had a terrible interface and bad usability. I remember always being annoyed when I was forced to download something through them.

On a side note, looking now at their Wikipedia page, I'm shocked to see that they only started in 1999. I would have place them a year or two earlier in '97 or '98. Anyone else feel this way?

frik2• 11 years ago

Can Archive.org/etc backup all the open source projects from Sourceforge.org and Google Code? It would be a big loss if the unmaintained but often still very useful source code get lost forever.

anc84• 11 years ago

There is some work being done by the (unaffiliated) Archiveteam to do that, see http://archiveteam.org/index.php?title=SourceForge and http://archiveteam.org/index.php?title=Talk:SourceForge

Help if you can, it's fun! #archiveteam on EFNet.

fishbacon• 11 years ago

It looks like ArchiveTeam[1] already has a lot of SF archived.

[1]http://www.archiveteam.org/index.php?title=SourceForge

tempodox• 11 years ago

I still land on SF now and then, to download sources that are hosted there. But that only happens because another site's “Download” button sent me there. In the beginning I was very impressed with SF. But as others have said, the UI is rather confusing and those ads they've been showing would devalue any site they run on to “lower-tier crap you need rubber gloves for”. A sad development.

jongalloway26• 11 years ago

If you're downloading open source software on Windows, friendly reminder to get it via Chocolatey rather than ever clicking on a download button. Chocolatey has reviewed, silent, direct, crapware free downloads of just about anything you'd want.

https://chocolatey.org/packages

raesene92• 11 years ago

Not too sure you can rely on Chocolatey to be direct..? Last time I installed WinDirStat using Chocolatey it got the install file from Sourceforge (over an unencrypted HTTP connection)

http://imgur.com/fajFMUA

jongalloway26• 11 years ago

It links to official installers which are sometimes on SourceForge, but uses installer switches to set options to deselect crapware, do silent install, etc.

adam122• 11 years ago

Ninite is pretty slick and crapware free.

https://ninite.com/

I can't wait for the new package manager in Windows 10, though.

raesene92• 11 years ago

It would be cool to have a Windows "official" package manager, however I don't think their initial launch is going to be that.

From what I understand, it's more of a "package manager-manager" so it manages other systems (like Chocolatey) rather than running the repos itself.

joshschreuder• 11 years ago

Ninite is always the first thing I download on a newly imaged Windows PC. It makes it so easy to install all the programs I use frequently.

jongalloway26• 11 years ago

I used Ninite for years and recommend it to non-techy friends. As a dev, I prefer Chocolatey since it offers a lot more dev-focused packages, meta-packages, can be scripted, works with BoxStarter, etc.

Grue32• 11 years ago

Reviewed by whom? This and ninite are MITM software providers just like SourceForge. Even if they're safe now, you can't be sure they won't installing crapware in the future.

0xAA• 11 years ago

Same as with Linux distro maintainers. No guarantees, but this scheme is working for now.

agumonkey2• 11 years ago

Putty was installed quite weirdly though. Otherwise it was pretty exciting to use.

tracker13• 11 years ago

These days, I pretty much use GitExtensions for my gnu-win32 and git bits, it also includes Putty, iirc, but I don't interact with it much.

pjc50• 11 years ago

How is it paid for?

adam122• 11 years ago

They have a shop: http://www.cafepress.com/chocolatey

and a donate button at the bottom of the front page. I wonder how much money that can generate though.

jongalloway26• 11 years ago

They're working on Professional, Business and Enterprise plans that offer some more advanced enterprisey features and support: https://www.kickstarter.com/projects/ferventcoder/chocolatey...

Pretty similar to npm.

drjeats• 11 years ago

Can it do uninstalls well yet?

I tried to make a package for a simple binary last year (I believe it was premake4 or something). It was annoying to use, and other software I installed with it didn't have an uninstall option.

Package managers make me happy (love Homebrew on OSX), but I don't see a point if I can't also uninstall. I rarely install things from sources that need vetting.

jongalloway26• 11 years ago

Yes, and they've done some work on automatic uninstall so that there's less work required by packages to support uninstall: https://github.com/chocolatey/choco/wiki/CommandsUninstall

imron2• 11 years ago

I still have a project hosted on Sourceforge (http://sourceforge.net/projects/pinyinput/).

They haven't injected their own installer on downloads so for the time being I leave it there because I'm too lazy to move it off.

A while back I did move the main project page to its own domain, so I'm only really using Sourceforge for downloads and source control (although the project is stable and hasn't had commits for a long time so not even that really).

xrstf• 11 years ago

For a second there, I thought this was an official GitHub page and thought "Wow, those GitHub guys really have balls to attack SF that directly". But then I realized it is "helb" and not "help" in the URL.

yaph• 11 years ago

Wonder how many others thought exactly the same, I did too.

specto• 11 years ago

I assumed it wasn't, but I hoped

helb8• 11 years ago

Sorry about that… https://news.ycombinator.com/item?id=9624068

jotm• 11 years ago

They don't have to say anything when their users do it for them :-)

espadrine• 11 years ago

I think that was part of the reason to switch from github.com to github.io a while back. Their .io is user content and can be downgraded by Google independently from github.com.

billyhoffman• 11 years ago

Perhaps, but using a separate hostname github.io vs github.com is also a security mechanism. Project owners can supply rich content (read: HTML + JavaScript) on these .io pages. If these pages were on GitHub.com or subdomains of GitHub.com, this user supplied content can interact with and hijack the github.com cookies like session ids.

Yes, GitHub can use the domain attribute on a cookie to prevent this, but then you have designed a system that will fail open if you mess up. (i.e. potentially malicious user content would always be able to access a cookie, unless GitHub does something).

Better to just stick it on a separate domain entirely, and this is a commonly used practice. For example, Google does this with their googleusercontent.com domain

nilved• 11 years ago

And "io" instead of "com".

helb8• 11 years ago

Author here. Sorry about that confusion, i probably should host it elsewhere… Help/helb is not intentional, it's just my nickname since 2nd grade or so.

sounds• 11 years ago

You have a disclaimer at the bottom of the page. I was also confused by the help/helb thing until I saw the disclaimer.

fapjacks4• 11 years ago

Well, to be honest, this is exactly where Sourceforge has been headed for years and years. You could look at its behavior years ago and say "Yeah, follow this out on a line" and see this exact situation in the crystal ball. Sourceforge has been scummy (and getting scummier) for years and years.

tracker13• 11 years ago

I remember actually keeping a couple of service accounts on services that served as mirrors for SF for years just because they backed the service (early on, before a lot of the sleazy stuff started).

Unfortunately, short of registering a trademark with the PTO, it'd be difficult to get a lot of this crapware removed from SF.

jsingleton• 11 years ago

Perhaps it is worth asking the mirror services to put some pressure on as well as the content creators?

These are two popular mirrors in the UK & Ireland (both academic institutions):

http://www.mirrorservice.org/ (University of Kent)

http://ftp.heanet.ie/ (Ireland’s National Education and Research Network)

zokier• 11 years ago

I agree that this would be the best recourse if we could manage to muster some sort of coordinated exodus of mirrors. Mirror providers have at least some sort of power over SF due the service they are providing, something that project authors do not have. Many of the mirrors I think are academic and I don't think they too happy about SF being such leech that they are.

frik2• 11 years ago

As Github.com lacks afaik a binary hosting / download feature and Google Code closed its service (no new projects) - it would be great if all the Sourceforge mirrors (heanet, etc.) would be coordinated from an open source community instead of coordinated by Sourceforge.org. There is definitely a need for a binary hosting and mailing list website for open source projects, to fill the hole that Sourceforge may leave behind.

I remember the "BerliOS" from a Germany's Fraunhofer institute that was a kind of clone of Sourceforge, a open source project hosting service. It was closed in 2013 and some valuable code and binaries are lost forever.

pierrec• 11 years ago

Github does have a pretty good binary hosting / download feature, it's called Releases. There's even an API to automate it. It's not very widely used, perhaps because it only rolled out it 2013.

About Releases: https://github.com/blog/1547-release-your-software

An example: https://github.com/adobe/brackets/releases/

As for mailing lists, I guess their excuse is that they already provide possibilities for discussion in the issue tracker (which can be also interacted with entirely by mail). This is appropriate as a forum for developers - but not a forum for users, which would be out of Github's scope, IMO.

eps• 11 years ago

What's unsettling about this is that Slashdot also belongs to the same company that turned SF into the crapware distributor that it is now.

dredmorbius2• 11 years ago

Slashdot split from Thinkgeek a few years back.

simoncion• 11 years ago

Both Slashdot and SourceForge are currently owned by the company that owns Dice.com.

flyinghamster• 11 years ago

Not only that, but a quick search for GIMP on Slashdot turns up absolutely no discussion about the hijack. There was an <a href="http://yro.slashdot.org/story/13/11/07/2328228/gimp-citing-a... in 2013 that GIMP was moving</a>, and <a href="http://developers.slashdot.org/story/13/11/14/2036200/source... a week later</a> about SF's ad policies (LOL!), but absolutely nothing from this week. Color me unsurprised. I knew /. was heading downhill, but this is the final nail in the coffin.

wyldfire2• 11 years ago

Guilt by association? Perhaps SF is not the true source of badness/malware but instead they tend to host the projects most likely to include such malware.

connor4312• 11 years ago

No, they definitely are... http://arstechnica.com/information-technology/2015/05/source...

wyldfire2• 11 years ago

Tsk, that's pretty damning.

abritishguy• 11 years ago

SF takes over abandoned projects and ads the adware themselves.

bnferguson• 11 years ago

May be worth noting that GitHub supports SVN as well (https://help.github.com/articles/support-for-subversion-clie...), I believe some of the others do as well IIRC.

May be important to some legacy projects trying to get off of SF.

amyjess2• 11 years ago

If they also added a Mercurial bridge, that would be the final nail in SF's coffin.

It's sad that with Google Code going away, a lot of projects that chose Google Code for Mercurial are being pushed to switch to git (e.g. vim) because Google is pushing so hard for projects to be migrated to GitHub,

patio11• 11 years ago

Sourceforge is essentially a gigantic set of Google doorway pages which MITM downloads initiated by unsuspecting (largely non-technical) Internet users of popular free-as-in-beer projects. They're open about doing this. https://sourceforge.net/blog/gimp-win-project-wasnt-hijacked...

These "mirror" (MITM) pages outrank the authoritative sites for many projects because Sourceforge has been around for 10+ years and has superior trust/backlink profiles compared to the newer author-blessed sites which presently host the software. Gimp is actually fortunate in this regard -- gimp.org is stickied to the top spot when searching [gimp] and Sourceforge floats around #8 or so.

Sourceforge should get hit with Google's standard penalty, which is "we smite your rankings with the hammer of an avenging god." Minimally, Google should at least tighten up their enforcement of AdWords policies. Their "installers" are per-se violations of the Unwanted Software Policy (http://www.google.com/about/company/unwanted-software-policy...).

How about it, resident Googlers?

stfnppv• 11 years ago

There you go.

https://www.google.com/safebrowsing/report_badware/

dordoka• 11 years ago

Reported

Ueland• 11 years ago

Thank you, also reported the site now.

joshrivers• 11 years ago

Reported

gauravphoenix• 11 years ago

Reported. If you report, please provide some reason. I provided- "embeds malware/adware with downloads"

TrevorJ• 11 years ago

And done.

billsix• 11 years ago

I like that they open-sourced their engine. https://allura.apache.org/

moron4hire2• 11 years ago

> SourceForge, once a trustworthy source code hosting site...

No, SourceForge was always sleazy.

helb8• 11 years ago

It wasn't in 90s and early 00s… Along with Freshmeat (and The Linux Game Tome :)), they were pretty useful websites.

moron4hire2• 11 years ago

Wikipedia says SourceForge launched November of 1999. I remember as early as 2003 thinking it was sleazy how it tried to trick you into downloading adware with their big "Download Now!" ads. So maybe not literally "always", but certainly the majority of time.

helb8• 11 years ago

Author here. Thanks for your pull requests, I added some of the suggested services. Maybe some comparison table (like the one at Wikipedia) would be better than a simple list.

About that help/helb confusion mentioned here – sorry about that, it's not intentional, it's just my nickname since 2nd grade or so.

cube00• 11 years ago

I like how you don't have an option to shut down your project to help clear those links from Google. Either you keep it up to date or SF will "step in" and do it for you.

LLWM• 11 years ago

That's the whole point of open source. If a developer abandons a project, someone else can pick it up and keep it going. And if you disagree with some of the developer's choices, you can fork the project and make your own version. Sourceforge is a great example of how someone evil can take advantage of the features of open source to do bad things.

grayclhn• 11 years ago

I'd amend that to "someone evil who's built up a 'good' reputation for long enough that they dominate search rankings...." I don't know that what sourceforge is doing is a unique situation, but it's AFAIK not a common one. It's not going to have the same effect if I start bundling open source installers with malware and hosting them on my own, for example.

jimwalsh• 11 years ago

Ah the old days when Sourceforge and Freshmeat were some of the go to places for OSS when I was learning Linux in the 90s. Occasionally I'll end up back at SF somehow and man how terrible it has become. Makes you really appreciate places like Github now a days.

coherentpony• 11 years ago

What about mailing lists?

david-given• 11 years ago

This is the biggest issue for me --- project hosting is easy, mailing lists are not. Particularly, migrating people to the new list is going to be hard. I've been looking at Google Groups but it doesn't seem to support import, although it does support a nice web interface (good for people who expect forums).

Does anyone have any recommendations?

helb8• 11 years ago

There were some suggestions in yesterday's thread – https://news.ycombinator.com/item?id=9617824

helb8• 11 years ago

So i changed the service list into a simple table. Also, Gitlab providers are listed separately. Any ideas for a domain name? :)

sytse• 11 years ago

gitalternatives.com is still available. By the way, thanks for including GitLab so prominently on your site. Any chance of including a column for free private repo's with unlimited collaborators? :)

AdamN• 11 years ago

I'm really surprised at how many people in this thread are Windows users frankly. I just presumed that most YC commenters were OS X/Linux people with a few FreeBSD, etc.. OSes floating around.

bunderbunder• 11 years ago

I'm really surprised you'd think it's standard for YCers to only use one operating system.

cgh• 11 years ago

He mentioned three in his comment, not one.

CWuestefeld• 11 years ago

This is a tangent, but...

Two nights ago I went to a "bleeding edge web" meetup. I was really struck by how universal, unspoken, and simply taken as a given it was that modern web development is done on a Unix box. Thus there was no room for any discussion about Windows alternatives, or even explanation for us third-worlders about what role certain tools - that at least I had never heard of - play in the ecosystem. I was completely alienated.

jackmaney• 11 years ago

In my experience, some things that Just Work on *nix systems or OS X either plain don't work on Windows or kinda-sorta-work after you do a weird workaround. Not all things, certainly, but enough to be a massive pain in the ass.

Unless you're coding for Windows only (eg C#, .Net, etc), Windows is the red-headed stepchild of development environments. I'm somewhat hopeful that this will start to change with the release of Windows 10.

pmelendez• 11 years ago

Some of us are OS agnostic and jumping around between several OSs everyday (Ubuntu, Win8.1, OSX in my case).

bougiefever• 11 years ago

GitHub has been the go-to online source control for so long, I'm sure no one will miss SF.

helb8• 11 years ago

Someone posted it to Reddit, discussion here: http://www.reddit.com/r/programming/comments/37pz5x/

Sleaker• 11 years ago

Whenever I've had to go to a sourceforge page to download software I always think, ugh I have to deal with this crap again? (UI, annoying redirects, can't find correct versions, etc) I honestly never understood why developers used the website for distributing binaries, I understand code hosting, but not the distribution (this was before they hijacked stuff).

Hopefully, this will hit a chord with enough projects that they will altogether stop using sourceforge.

vsl2• 11 years ago

10-15 years ago, there weren't that many other options.

jasonhansel• 11 years ago

Maybe GitHub should start mirroring Sourceforge projects :)

Goodbye, Sourceforge

Related Stories