4 ms·

Nooooooo why on SourceForge :-(

• CamperBob2 10y ago
  Fortunately it's a .tar.gz rather than an executable, so the amount of harm SourceForge can do is limited.
  • Cyph0n 10y ago
    We're going to need a SHA-1 or something - they could just rezip the compromised binary.
  • phjesusthatguy3 10y ago
    Sourceforge's new owners claim[0] they stopped doing that stuff. I haven't checked to see if it's true but I know it's been discussed on HN before. [0]https://sourceforge.net/blog/sourceforge-acquisition-and-future-plans/ https://sourceforge.net/blog/sourceforge-acquisition-and-fut...
  • loeg 10y ago
    How so? They could drop an executable named "configure" in the tarball. I don't think they would, but they're not really limited by the format.
• dlmetcalf 10y ago
  Indeed. People interested in open source for this type of stuff are usually interested in security. Recommend moving the project.
  • wiml 10y ago
    People who are interested in security would be verifying the pgp signature on the tarball. (What's that? It's unsigned?)
    • dlmetcalf 10y ago
      That too.
• rcarmo 10y ago
  I just clicked on their cookie prompt and saw my browser being redirected to PayPal for some reason. Shut down the tab immediately and don't intend to check out the project at all.
  • vertex-four 10y ago
    Err, I have no idea what you saw, but it definitely wasn't your browser being redirected to PayPal - unless you somehow accidentally clicked on the "Donate" button.