4 ms·

I'm confused, what's the problem with them being hosted on SourceForge?

iamflimflam1 11y ago
See here: http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/ http://www.howtogeek.com/218764/warning-don%E2%80%99t-downlo... and here: http://www.information-age.com/industry/software/123459675/hotbed-malware-another-blow-sourceforge-google-discovers-588-pages-malicious-software http://www.information-age.com/industry/software/123459675/h... etc...
- sambe 11y ago
  The second article suggests GitHub has a similar problem and the first says that SourceForge has an opt-in policy. I can obviously understand people wanting to boycott SF but no-one is talking about avoiding GH downloads. Did I miss an element of this story?
  - nissehulth 11y ago
    I guess the main difference is that it is SF themselves that add some of the crapware in binaries distributed by them. As far as I know, Github have never done that. That people may upload malware to their github repo is quite different.
Maxious 11y ago
SourceForge has been wrapping adware around executables http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ http://arstechnica.com/information-technology/2015/05/source...
jackmaney 11y ago
As others have pointed out, SourceForge has become a malware distribution network.
- radiorental 11y ago
  I haven't seen evidence of malware, just adware wrappers from sourceforge. It's a small, but important, difference.
  - sbarre 11y ago
    Depends on your definition of malware I guess.
  - makomk 11y ago
    It's hard to see exactly what SourceForge are offering because apparently they do VM detection and their installer is much better behaved when running in a VM, and most folks don't have a spare physical machine they can test it on and wipe afterwards. Which I think says a lot about how malicious their installers actually are.
  - lambda 11y ago
    adware is a type of malware.

See here: http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/ http://www.howtogeek.com/218764/warning-don%E2%80%99t-downlo... and here: http://www.information-age.com/industry/software/123459675/hotbed-malware-another-blow-sourceforge-google-discovers-588-pages-malicious-software http://www.information-age.com/industry/software/123459675/h... etc...

sambe 11y ago
The second article suggests GitHub has a similar problem and the first says that SourceForge has an opt-in policy. I can obviously understand people wanting to boycott SF but no-one is talking about avoiding GH downloads. Did I miss an element of this story?
- nissehulth 11y ago
  I guess the main difference is that it is SF themselves that add some of the crapware in binaries distributed by them. As far as I know, Github have never done that. That people may upload malware to their github repo is quite different.

Maxious 11y ago

SourceForge has been wrapping adware around executables http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ http://arstechnica.com/information-technology/2015/05/source...

jackmaney 11y ago

As others have pointed out, SourceForge has become a malware distribution network.

radiorental 11y ago
I haven't seen evidence of malware, just adware wrappers from sourceforge. It's a small, but important, difference.
- sbarre 11y ago
  Depends on your definition of malware I guess.
- makomk 11y ago
  It's hard to see exactly what SourceForge are offering because apparently they do VM detection and their installer is much better behaved when running in a VM, and most folks don't have a spare physical machine they can test it on and wipe afterwards. Which I think says a lot about how malicious their installers actually are.
- lambda 11y ago
  adware is a type of malware.