3 ms·

I find it slightly odd that sourceforge is so highly shunned after the malware incidents, while various other large companies [eg. microsoft (dodgy behaviour in

I find it slightly odd that sourceforge is so highly shunned after the malware incidents, while various other large companies [eg. microsoft (dodgy behaviour in skype, etc.), facebook (spying, selling data), lenovo (superfish), etc.] have been caught doing similar dodgy things and yet it feels like the general community has forgiven or at least grudgingly overlooking them. May or may not be true - that's just the feel I'm getting.

TAForObvReasons 8y ago
If they start buying up some startups and giving YC an exit or two, the community may forgive SourceForge.
xyrouter 8y ago
We also need to think a little about how the times were. Sourceforge rose to popularity in the early 2000s. Free and open source software (FOSS) was not just a matter of pragmatism or convenience. It was an ideology, a philosophy, and a movement strongly pushed forward by FSF, Open Source Initiative, various LUGs, and various special interest groups. Open source enthusiasts used to have very active and influential LUGs all throughout the world. There used to be free and open source software conferences all over the world with the sole agenda of increasing open source awareness among the general public. In those years, most of the developers who chose to host their projects on Sourceforge strongly believed in this ideology. GPLv2 was the most popular open source license then. Given all this, it makes sense that those early users who held freedom of software to be sacred were very pissed when Sourceforge decided to bundle closed source adware into the binaries of these open source projects without the explicit permission of these open source developers. Times have changed a lot since then. GPLv2/v3 license is now considered too restrictive and the MIT license is more popular. Most of the tech community understands the concept of open source more or less. The movement in favor of software freedom has begun to lose momentum. Open source software makes a lot of business sense, so we don't need the push for open source software anymore like we used to in the early 2000s. Even some people like me who once would run nothing but completely free operating system with free tools have now begun to use proprietary drivers because as we have grown older, got busy, with kids and family, the time spent tinkering with open source drivers is not worth it, we would rather use something that just works. When we use Microsoft and Facebook we know what we are getting into and most of us are more or less okay with it. It's different times and different kinds of users. That explains why Microsoft and Facebook do not get penalized as heavily as Sourceforge did. Sourceforge violated something that was held sacred during those times. Microsoft and Facebook have no notion of sacred-anything.
dpark 8y ago
SourceForge gets shunned first because it’s easy. There are lots of great alternatives to SourceForge. SourceForge was already on the decline before their adware bundling fiasco so continuing to not use SourceForge is no burden for most devs. Second, what SourceForge did was worse than your examples. They modified trusted applications to add essentially a malware payload. This is worse than Facebook collecting too much data and being shady with it. SourceForge was installing spyware on machines without permission. This betrayed the trust of both users and publishers and even damaged users’ trust in those publishers. The only one of your examples that is comparable is Lenovo’s Superfish mess, and in that case they only betrayed users, not publishers. Not that it actually makes it better, but it changes the impact to Lenovo. Disclosure: Microsoft employee.
- JohnTHaller 8y ago
  It's worth noting that SourceForge didn't modify trusted applications. They switched their download buttons on the site to download an "installer app" by default that would act as the installer, offer bundleware, and then live download the actual app installer as part of the install process. Apps like GIMP etc were never, to my knowledge, modified to bundle GIMP and bundleware within a single installer. Source: I was hosted on SourceForge at the time and approached about participating in DevShare. I researched it extensively and saved copies of the stub installers for things like GIMP as part of that research.
  - loganabbott 8y ago
    My company had nothing to do with it, but it's worth noting you're one of the few people who actually remembers the actual non-revisionist history.
  - giancarlostoro 8y ago
    Thanks for sharing the highly relevant piece of information. It always bothered me someone had to go through the effort to download the original source and rebuild the projects, just the thought of all the effort taken to do that... It seemed odd, I can imagine some projects having some obscure build processes (it happens) and the amount of effort taken to add in their spyware installer seemed a little crazy to me.

TAForObvReasons 8y ago

If they start buying up some startups and giving YC an exit or two, the community may forgive SourceForge.

xyrouter 8y ago

We also need to think a little about how the times were. Sourceforge rose to popularity in the early 2000s. Free and open source software (FOSS) was not just a matter of pragmatism or convenience. It was an ideology, a philosophy, and a movement strongly pushed forward by FSF, Open Source Initiative, various LUGs, and various special interest groups. Open source enthusiasts used to have very active and influential LUGs all throughout the world. There used to be free and open source software conferences all over the world with the sole agenda of increasing open source awareness among the general public. In those years, most of the developers who chose to host their projects on Sourceforge strongly believed in this ideology. GPLv2 was the most popular open source license then. Given all this, it makes sense that those early users who held freedom of software to be sacred were very pissed when Sourceforge decided to bundle closed source adware into the binaries of these open source projects without the explicit permission of these open source developers. Times have changed a lot since then. GPLv2/v3 license is now considered too restrictive and the MIT license is more popular. Most of the tech community understands the concept of open source more or less. The movement in favor of software freedom has begun to lose momentum. Open source software makes a lot of business sense, so we don't need the push for open source software anymore like we used to in the early 2000s. Even some people like me who once would run nothing but completely free operating system with free tools have now begun to use proprietary drivers because as we have grown older, got busy, with kids and family, the time spent tinkering with open source drivers is not worth it, we would rather use something that just works. When we use Microsoft and Facebook we know what we are getting into and most of us are more or less okay with it. It's different times and different kinds of users. That explains why Microsoft and Facebook do not get penalized as heavily as Sourceforge did. Sourceforge violated something that was held sacred during those times. Microsoft and Facebook have no notion of sacred-anything.

dpark 8y ago

SourceForge gets shunned first because it’s easy. There are lots of great alternatives to SourceForge. SourceForge was already on the decline before their adware bundling fiasco so continuing to not use SourceForge is no burden for most devs. Second, what SourceForge did was worse than your examples. They modified trusted applications to add essentially a malware payload. This is worse than Facebook collecting too much data and being shady with it. SourceForge was installing spyware on machines without permission. This betrayed the trust of both users and publishers and even damaged users’ trust in those publishers. The only one of your examples that is comparable is Lenovo’s Superfish mess, and in that case they only betrayed users, not publishers. Not that it actually makes it better, but it changes the impact to Lenovo. Disclosure: Microsoft employee.

JohnTHaller 8y ago
It's worth noting that SourceForge didn't modify trusted applications. They switched their download buttons on the site to download an "installer app" by default that would act as the installer, offer bundleware, and then live download the actual app installer as part of the install process. Apps like GIMP etc were never, to my knowledge, modified to bundle GIMP and bundleware within a single installer. Source: I was hosted on SourceForge at the time and approached about participating in DevShare. I researched it extensively and saved copies of the stub installers for things like GIMP as part of that research.
- loganabbott 8y ago
  My company had nothing to do with it, but it's worth noting you're one of the few people who actually remembers the actual non-revisionist history.
- giancarlostoro 8y ago
  Thanks for sharing the highly relevant piece of information. It always bothered me someone had to go through the effort to download the original source and rebuild the projects, just the thought of all the effort taken to do that... It seemed odd, I can imagine some projects having some obscure build processes (it happens) and the amount of effort taken to add in their spyware installer seemed a little crazy to me.