Firefox download on SourceForge

http://sourceforge.net/projects/firefox.mirror/

by eridal • 11 years ago

137 128 11 years ago

sourceforge.net

th0br0• 11 years ago

Also see http://sourceforge.net/mirror/ I guess. Weird behaviour.

Drakim• 11 years ago

You'd think with all the bad press lately that they would lay a little low.

drtse4• 11 years ago

Looks like it's there since 2011-11-28.

wumbernang• 11 years ago

The phrase "circling the drain" comes to mind. Last ditch attempt at pretending to be relevant by gaming the search industry.

rcthompson2• 11 years ago

So, this is Sourceforge mirroring a popular open source project that's hosted elsewhere in order to garner more traffic? Is that what's going on here?

imglorp• 11 years ago

Yeah. I'm okay with it because it says right there,

    Hey, this isn't a SourceForge project! Check out the 
    SourceForge Open Source Mirror Directory for more 
    information.

plus the url also clearly says ".mirror", so they're not pretending to be the authoritative page on the product. It's no more creepy than Tucows or C-Net at this point. Just a regular spam laden download site.

JoshTriplett8• 11 years ago

Except for the part where they add malware to the download. Mozilla has gone after various shady sites distributing "Firefox" with malware, and I hope they do so in this case too.

jordigh7• 11 years ago

Argh, we really need to get Octave-Forge off SF. Octave itself is hosted on GNU servers, but all of the Octave-Forge add-on packages are in SF.

The thing is, there isn't really anything that easy to move to. No, no github, because we don't like git. We have a bunch of Mercurial repos. We could try moving them to bitbucket, but this also leaves the question of what to to do with our webpage hosting, which is currently on SF.

And no matter what we decide doing, it's all a bunch of work that nobody really wants to do.

At least when SF first approached us with their "revenue sharing" bullshit we refused. I think this means our downloads are clean so far.

mdekkers2• 11 years ago

At least when SF first approached us with their "revenue sharing" bullshit we refused. I think this means our downloads are clean so far.

I think it means they just get to keep more money...?

jordigh7• 11 years ago

I really don't see any malicious downloads here. Do you?

http://sourceforge.net/projects/octave/files/Octave%20Forge%...

mhurron• 11 years ago

it's all a bunch of work that nobody really wants to do

A lot of people don't want to do things they have to do. It's a question of if you're going to wait for SF to hyjack your downloads or move preemptivly.

Also, apperently bitbucket will host static pages, I don't know if that works for you.

JoshTriplett8• 11 years ago

No, no github, because we don't like git. We have a bunch of Mercurial repos.

Any particular reason?

We could try moving them to bitbucket, but this also leaves the question of what to to do with our webpage hosting, which is currently on SF.

You could move your repositories to bitbucket but mirror the single repository for your webpage content to GitHub to use their hosting. (And if that repository is currently Mercurial, see git-cinnabar by Mike Hommey: https://github.com/glandium/git-cinnabar/ )

Or, it looks like bitbucket may have a similar feature: http://pages.bitbucket.org/

jordigh7• 11 years ago

Any particular reason?

Lots of reasons. I'd rather not go into an argument about it. It's not something that can be fixed: git is a no-go for us.

but mirror the single repository for your webpage content to GitHub to use their hosting.

I'd rather break free, not change masters.

geofft2• 11 years ago

Can you use Alioth? If you have a few Debian developers involved, it should be straightforward to set up a project and get accounts for everyone else, and it's very much like SourceForge.

https://lists.debian.org/debian-devel-announce/2003/03/msg00...

"We'll approve ... free software/documentation where a Debian developer is heavily involved (part of the core team for example). The project request should ideally be done by a Debian developer."

Alternatively, can you get your webpage hosting onto gnu.org?

jordigh7• 11 years ago

We actually have quite of a good rapport with our Debian packagers... so perhaps moving to Alioth could be a possibility, even though Octave itself is not a Debian package per se.

As for GNU, the problem is that we only have static sites there. It's not a huge problem, but it might be a good solution.

Frondo• 11 years ago

Bitbucket does static site hosting!

https://confluence.atlassian.com/display/BITBUCKET/Publishin...

Would that work for Octave-forge?

wzdd• 11 years ago

Mercurial works well with github, as it can communicate with git servers. I've used github in the past with several Mercurial projects without issue.

So you can move to github and keep hg.

BFay• 11 years ago

Have you looked into hosting from universities? I recently read about plans to move Pure Data (flow-based audio programming environment) to Oregon State University's Open Source Labs. Maybe they would be open to hosting Octave-Forge.

http://osuosl.org/services/hosting

sj4nz• 11 years ago

uBlock Origin appears to protect browser navigation to all sourceforge.net links now.

mdekkers2• 11 years ago

Why am I not surprised that the owner of Sourceforge, DHI Group Inc., is a recruitment firm...

drift• 11 years ago

"Millions of people use SourceForge every day to search for Open Source software"

metasean• 11 years ago

On the linked page:

Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information.

which links to: http://sourceforge.net/mirror/

The Open Source Mirror Directory is an extension to our existing software directory, where we'll be mirroring projects that are not hosted on SourceForge, and SourceForge projects that have been abandoned.

ChuckMcM• 11 years ago

Exactly this, and it is why I think they really are trying to be download.com. By 'mirroring' anything and everything and some SEO magic (they have a lot of residual link authority with the big G) they get themselves to the top of the list of links where to get package <x>.

Perhaps its time for Google to "adjust" their host rank?

kubiiii• 11 years ago

Especially when chrome considers sf downloads as hazardous.

jdiez17• 11 years ago

Interesting how they don't mention anything about the bloatware in that "SourceForge Open Source Mirror Directory" page.

DanBC2• 11 years ago

It's bad in this case because the original was some random user's collection of modified Firefox for personal use. Mozilla have never used sourceforge to distribute Firefox. But they (or their auto tools) saw the name and activity and they mirrored the account and then linked it to the wrong content - not to the original modified firefox for personal use, but to official firefox.

neomech• 11 years ago

Are they including any "offers" with the installer?

thomasfoster963• 11 years ago

"229 downloads this week." "Last updated 2/6/2015"

Now, if you click the 'read more' link, you'll find that the Firefox download available on sourceforge was actually last updated 10th June 2014. 53 weeks ago. 10 major version numbers ago.

rcthompson2• 11 years ago

Are you sure? It says version 38.0.5, which is the same as what I'm running right now.

krisdol• 11 years ago

I think there's a difference between "latest version" and "latest release". If an admin forgets to update the release pointer, I guess it's possible for that to get stale. Regardless, SF should absolutely not hijack any projects, let alone ones that have pushed new binaries in the last few months (even if they're not releases).

thomasfoster963• 11 years ago

It says 30.0 for me.

callahad• 11 years ago

On Windows 8.1, I also get offered 38.0.5, and its checksum matches that of the normal 38.0.5 en-US installer from https://www.mozilla.org/en-US/firefox/all/

rogeryu• 11 years ago

I see 8.0.1 and get to download that.

thomasfoster963• 11 years ago

Firefox 8.0.1?

xpda• 11 years ago

I have a project on SourceForge that I haven't touched in 2-3 years. Its SourceForge listing says it was updated within the past month. Weird. The files have not been changed.

monsterix• 11 years ago

I have this weird feeling that there has been some bad force working up against Firefox ever since they declared their all out war against user tracking (was anti ad-bearers).

I could be wrong but there are signs and absurd behavior like umpteen number of resignations at the top, Firefox Apps been published with strange love from private players like telefonica/others etc.

Isn't there a smell somewhere here?

zabraxias• 11 years ago

Nothing as interesting as that. Mozilla has had a "let's try and be friends" approach with the ad industry for a few years (see 3rd party cookies) but the recent introductions like pocket and Hello are simply features some group in management decided were needed. The open governance approach means our source of income (various search referrals) is all we'd need to stay afloat for quite a while. Having said that it's a smart play to get into the mobile OS game and continue on the browser-as-a-platform path.

The moment anyone decides to add bundleware to the official release would be a golden age for tech recruiters since most of the engineering staff would be already packed.

Source: Mozillian

zygy• 11 years ago

sudo cat "127.0.0.1 sourceforge.net" >> /etc/hosts

cosarara97• 11 years ago

I don't think this will do what you think it will do. First, you'd want to echo, not cat, and second, the sudo won't affect the redirection, which is done by the shell.

ytjohn• 11 years ago

I use "tee" for these scenarios.

echo "127.0.0.1 sourceforge.net" |sudo tee -a /etc/hosts

sirn2• 11 years ago

Slightly unrelated, I clicked the link and saw this: http://i.imgur.com/OpbdFfs.png

Apparently this is done by the uBlock Origin's own "uBlock Filters"[1][2] with this reason:

    # http://libregraphicsworld.org/blog/entry/anatomy-of-sourceforge-gimp-controversy
    # https://blog.l0cal.com/2015/06/02/what-happened-to-sourceforge/
    # Using `other` will cause the whole site to be blocked through strict blocking,
    # yet the site will render properly if a user still decide to go ahead.
    ||sourceforge.net^$other

I'm a little bit unsure whether this is a good thing or not. But personally, given SourceForge's recent behavior, I'm kinda happy that uBlock Origin did this (as SourceForge have clearly stepped into the ranks of malware-spreading sites).

[1] https://github.com/gorhill/uBlock/blob/ed130afc6f3a70e2c2a68...

[2] https://github.com/gorhill/uBlock/commit/c4e82357efaf18bac3f...

a3n• 11 years ago

I was a little annoyed at ubo when I read the earlier article about it doing exactly this.

But this action made me install ubo. Two minutes ago.

chisleu• 11 years ago

Yup, I was looking at an open source recommendation engine and went to read their wiki when I discovered it was all hosted on sourceforge. Nope. I'll write my own, thank you very much!

sfthrowagggg• 11 years ago

We need to get https://sourceforge.net/p/predef/wiki/Home/ mirrored off-SourceForge pronto. It's such a great C resource and SF doesn't deserve it.

samch• 11 years ago

Did you happen to turn on strict blocking behavior? I'm using ubo in Firefox with strict blocking off, and I'm not having any issues.

EDIT: Just tested strict blocking on my install and nothing prevents the link from displaying. I wonder what is different in my version.

sirn2• 11 years ago

I don't think so. I'm using the default settings. The filter come from the default uBlock filters‎ (the very recently-updated one, as it was added yesterday.)

jug• 11 years ago

I went into the extension's settings and forced a filter update. That did it. It's such a recent addition, that it probably hasn't had time to auto update itself yet. I actually just installed it too, which means that it is _not_ using the latest filters on a first install.

josephmx3• 11 years ago

Deciding to completely censor (edit: in practice, since few users are likely to dare/bother to skip warnings) legitimate (although unethical) websites seems sketchy. What happens when the uBlock maintainers decide that Facebook/Google/etc goes too far with their ethics - will they block that?

4ad• 11 years ago

What? You have complete control over which lists of filters to use.

gorhill2• 11 years ago

completely censor

Hyperbole.

This merely acts as a warning. Notice the buttons at the bottom to disable the blocking temporarily or permanently.

joshstrange4• 11 years ago

Interesting, I normally use hosts files to block ads and tracking scripts but this ability to bypass on an as-needed basis makes this (if the CPU/memory usage is not an issue) look much better. When I get some time I'm going to have to try out uBlock. Thanks for letting me know this exists.

radley• 11 years ago

I've been using Adblock Edge, but it's been discontinued in favor of uBlock.

https://bitbucket.org/adstomper/adblockedge

rossy• 11 years ago

I love it. If I installed an uBlock on, say, my grandparent's computer to try to prevent them from getting malware, I would be happy with it blocking SourceForge.

noelsusman• 11 years ago

I ran into that a few days ago and I was mildly annoyed. I didn't install uBlock to protect me from malware, I installed it to remove ads on pages that abuse my eyeballs with them. This just makes me wonder what else they'll do that goes outside the original scope of the software.

Disabling it was easy enough so I'm not too mad about it, but I still don't like it.

ytdht• 11 years ago

also unrelated, but I just installed ublock origin and tried http://dictionary.reference.com/ and it doesn't display correctly ... maybe I'll switch back to adblock-plus

gorhill2• 11 years ago

Using the same filter lists in uBlock and ABP will results in the same blocking behavior: It's all in the filter lists.

feld• 11 years ago

uBlock Origin blocked this link for me. So thanks, uBlock.

AdmiralAsshat• 11 years ago

Was it just hijacked, or are we only now noticing? Also, is it a strict binary mirror, or have they started to bundle it with crapware?

Considering the incidents involving Sourceforge in the last few weeks, I would be rather surprised if they just did this, considering how hilariously tone-deaf it would look.

zatkin2• 11 years ago

They also seem to have ownership over the openvz, MySQL, and PostgreSQL projects, too.[1] (You have to click "Show More +" to see the full list.)

[1] http://sourceforge.net/u/sf-editor/profile/

frik• 11 years ago

see also http://sourceforge.net/u/sf-editor1/profile/ this SF profile took over like a hundred high profile open source projects on SF (incl. Apache HTTP Server, Apache Hadoop, OpenOffice, Audacity, Google Closure Compiler, Epiphany, Evolution, Fedora, Fritzing, Gimp, HeidiSQL, Joomla, Lua for Windows, MySQL, PostgreSQL, VLC media player, VirtualBox, ... and many more)

Just yesterday VLC was on HN about moving away from SF "The story between VLC and Sourceforge": https://news.ycombinator.com/item?id=9714250

The mirrors (HEAnet & co) should refuse to add any new binaries from Sourceforge and we need a community driven website that coordinates open source download binary mirrors (based on what SF uses at the moment), and Archive.org/ArchiveTeam/etc should backup all SVN/CVS/etc repositories on Sorceforge, and Google then should remove them from their index or flag them as adware/scam.

zatkin2• 11 years ago

Wow, this is a lot worse than I initially thought.

gondo• 11 years ago

they have more accounts and many other popular projects assigned to those. so far the accounts are: http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ and projects such as: Apache HTTP Server, Apache Hadoop, Apache OpenOffice, Apache Solr, Drupal, Eclipse, Fedora, Joomla!, VLC media player, VirtualBox, WordPress, Xpdf, selenium, Thunderbird, SQLite ... to name a few

DanBC2• 11 years ago

Some of the big projects are nothing to do with the name though.

If you look at Fedora the new sourceforge hijack page links to Fedora, but the original sourceforge page was just some random software.

Mirror hijack: http://sourceforge.net/projects/fedora.mirror/

Original: http://sourceforge.net/projects/fedora/

afro88• 11 years ago

Description The first thing you’ll notice in Firefox is

all the malware we try and install without you noticing

ksk5• 11 years ago

It is quite sad to see this happen to Sourceforge. IIRC Sourceforge was bought for $20M or so. I wonder how GitHub plans to repay the $100M (+ interest) VC 'loan' and generate profit without 'whoring out' to google/other advertisers.

fweespeech• 11 years ago

Its a test bed for their SaaS & Enterprise product lines.

joshstrange4• 11 years ago

I never paid SF a dime but I pay Github every month. I imagine that factors in heavily...

inglor• 11 years ago

GitHub can always monetise the same way Stack Overflow does with ADs for their free users. An unintrusive AD you get if you're a free user wouldn't be too terrible or disturbing.

Another channel would be donations for hosting FOSS projects or something like that.

Very hard question indeed.

ksk5• 11 years ago

Well, but Stack Overflow itself is not profitable (AFAIK they have not repaid the $70M). Also, look at the scummy things that Q&A sites like Quora end up doing after they find it difficult to stay afloat. Certainly, I trust Jeff & Joel to be much more ethical, but the new owners might not be.

schneidmaster• 11 years ago

GitHub has paid plans for private repositories and it can add up to a fair bit of MRR for enterprise organizations. https://github.com/pricing

They also make money off of their job board ($450 a listing) and could probably monetize a lot more here without angering too many users. https://jobs.github.com/

ksk5• 11 years ago

Yes, Hopefully it will add up to $100M+. Atleast one company must survive!

yellowapple2• 11 years ago

GitHub has paid plans in order for orgs to have private repos. Is that not enough?

ksk5• 11 years ago

Well, they have "a way" of charging users. Sourceforge had similar plans 11 years ago. Charge a premium for some extra project features. I guess a plan is something more detailed in my head. But sure, I'll cheer for their success.

joshstrange4• 11 years ago

FYI, to any/all people saying "They aren't bundling malware with this" you are forgetting a VERY important word: YET.

Their past indicates they will and what they have done so far fits the pattern nearly perfectly. I'd put money down that malware will be in this by the end of the year if not sooner.

colinbartlett• 11 years ago

And, really, how do we know they are not? Unless we're checking the hash of the download with that provided on Firefox's on website, who even knows what we are installing?

From a company with a history of stuffing adware down our throats.

Edit:

  % md5 firefox-*
  MD5 (firefox-genuine.dmg) = 71c3d44cd5a612489a70e0f2ef825ba9
  MD5 (firefox-sourceforge.dmg) = 71c3d44cd5a612489a70e0f2ef825ba9

So they are the same binary. All we need to do is create a Chrome extension that downloads the binary from both places and checks the hash then tells you if it's safe to download the SF one. Simple!

Note that it took 8 times as long to download the binary from Sourceforge compared to Firefox's own site.

dbcooper• 11 years ago

A bug has been filed at Mozilla for countering this:

https://bugzilla.mozilla.org/show_bug.cgi?id=1174745

apendleton2• 11 years ago

A notable difference here (as opposed to other open source projects that have received the same treatment on SourceForge) is that Mozilla owns the "Firefox" trademark, and has specific policies governing its use and the distribution of software that uses its name or branding:

https://www.mozilla.org/en-US/foundation/trademarks/policy/

It specifically precludes distributing modified versions of the software or installer and still calling it "Firefox" (with which they seem to be complying for the moment), and also specifies the manner in which the name and branding are to be used in website copy, like putting a "TM" symbol after the first mention (with which SF seems not to be complying at the moment). In other words: Mozilla has power here and could force them to take it down if they wanted. And they should, in my view, if for no other reason than because SF have been jerks about this whole thing and this is finally a situation where someone can actually do something about it.

qbrass2• 11 years ago

http://slashdotmedia.com/terms-of-use/

"By sending or transmitting to us Content, or by posting such Content to any area of the Sites, you grant us and our designees a worldwide, non-exclusive, sub-licensable (through multiple tiers), assignable, royalty-free, perpetual, irrevocable right to link to, reproduce, distribute (through multiple tiers), adapt, create derivative works of, publicly perform, publicly display, digitally perform or otherwise use such Content in any media now known or hereafter developed. You hereby grant the Company permission to display your logo, trademarks and company name on the Sites and in press and other public releases or filings. Further, by submitting Content to the Company, you acknowledge that you have the authority to grant such rights to the Company. PLEASE NOTE THAT YOU RETAIN OWNERSHIP OF ANY COPYRIGHTS, TRADEMARKS AND SERVICE MARKS IN ANY CONTENT YOU SUBMIT."

apendleton2• 11 years ago

Mozilla didn't submit it. SF took it upon themselves to republish Mozilla's content and marks. Mozilla isn't bound by these terms, and SF is bound by whatever terms Mozilla attaches to the use of its marks, since it owns them.

hobarrera• 11 years ago

uBlock₀ has prevented the following page from loading: http://sourceforge.net/projects/firefox.mirror/

I can't honestly say I don't agree with it's behaviour

Firefox download on SourceForge

Related Stories