9 ms·

A cautionary tale from the decline of SourceForge

130 points by zdw 5y ago

moonchrome 5y ago
Sourceforge brings me back to mid 2000s, learning programming and studying stuff like irrlicht and ogre3d. It's clear why sourceforge went away - GitHub is just better in every way imaginable.
- pbhjpbhj 5y ago
  Sourceforge became almost useless a long time before GitHub came on the scene though. AFAIR they were taken over by a commercially focused company and then added more advertising and inserted shovelware/malware into downloads. Again, my recollection (as a non-programmer) was Subversion repos were popular at this time -- launchpad.net linked source code was nearly all SVN -- and the likes of Tucows for MS Windows binaries, and other non-SF sites like Freshmeat became useful again. Then Linus came out with `git` and the ecosystem shifted. TL;DR to my recollection there was a gap between SF's decline and GitHub's rise, so the GitHub didn't cause SF's decline?
  - InfiniteRand 5y ago
    I agree with this recollection, there was a gap period (although that might have been a time when Github was less prominent but still existing)
  - fmajid 5y ago
    My recollection is that Sourceforge’s failure to embrace Git was their undoing, and the malware came later as they started circling the drain.
ashleyreddy 5y ago
They had a sneaky download button to download some adware vs the download link to the actual software you wanted in the first place. Easy to confuse the two.
- denton-scratch 5y ago
  "Sneaky" is an understatement; the download link to adware was more prominent than the download link for the product in the headline (which product was also often afflicted with adware). I found the article rather thin; I was hoping for some explanation of who made those disastrous decisions, and why.
- eesmith 5y ago
  That's the "ill-conceived DevShare" mentioned. From the paper: > While DevShare was an opt-in service, some projects complained that SourceForge bundled third-party adware in their downloads without their consent.25 Ads were added to project download pages with fake download buttons to trick users into clicking on the ad. Often, clicking on these ads resulted in the download of adware. > Management focused on ROI; SourceForge was expensive to run and did not have a plan to bring in revenue. This led to the introduction of DevShare, but since management did not understand the open source ethos and the development team was not included in management decisions, DevShare was a major failure. It prioritized ROI over trust and bundled adware with project downloads. Many projects started leaving SourceForge, citing DevShare as a main reason.
  - beej71 5y ago
    That was a bummer. There was that point in time that ending up on SourceForge felt like ending up on one of those shady download pages. GitHub by comparison was a delight.
    - runlevel1 5y ago
      When they made the download button send you to an interstitial page with ads and a countdown timer before starting the download, that felt eerily like those shady download sites.
  - mcherm 5y ago
    Yes, I someone who lived through that period I can confirm: I used SourceForge regularly until The point where it was proven to my satisfaction that the malware being added to downloads was not a fluke or a hack, but an intentional choice by management. Then, I instantly flipped to having a very strong commitment to never again trust SourceForge. You've probably heard about how a reputation is built over years but can be destroyed in an instant... that's exactly what happened here. Part of the reason is that from the point of view of the person downloading (binary executable) software, the most important feature the site provided was my trust that they would give me the same binary I was asking for. In a similar vein, if I discovered that a bank had been intentionally lying about account balances and adjusting them in the bank's favor to make a profit, I would immediately and permanently sever my relationship with that bank.
raxxorraxor 5y ago
Don't know if it was really community management or its architecture. But the incentives to monetize the site ever more aggressively is probably the most important factor. Ads and bundling malware (here: unwanted software) with downloads won't be received very well. The malware even had a negative influence on projects themselves. Example I know of was filezilla, which many never used or trusted again. I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers.
- deleted 5y ago
  [deleted]
- kbenson 5y ago
  > I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers. Some projects use the gist page for their web page, and some use the release downloads as the download binary they link to. Sometimes, just as was often the case with sourceforge, the main project repo page was the main page for the project. If you think github is more exclusive to developers and peers, I think that's just your own bias in how you use it coming though, as many non-developer people I mention it to know what it is if it comes up in conversation. I see them as extremely similar, to the point that on the relevant point of how it's used by the public I'm having a hard time coming up with differences.
- hnlmorg 5y ago
  SourceForge was originally developer focused so I wouldn't be so quick to assume the two aren't comparable. Github Releases produces download links, Github Actions can be used to compile assets and Github Pages can host the website. Thus a lot of developers do use Github as a one stop shop. Also worth remembering that most end users don't really care who hosts the EXE they want to download, whether that's Github or elsewhere. The only things that will stop Github going the way of SourceForge is that: 1. It's owned by Microsoft. They'd be damaging their own reputation twofold. Once because of the malware on the Github and a second time because of their OS, Windows, running like crap after that malware is installed. 2. There's a general movement away from [edit: manually] downloading binaries (as there should be!) -- even on Windows package managers are becoming more commonly used.
jmwilson 5y ago
Link to the cited paper, instead of a blurb written about the paper: https://onlinelibrary.wiley.com/doi/10.1002/spe.2874 https://onlinelibrary.wiley.com/doi/10.1002/spe.2874 https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/spe.2874?download=true https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/spe.28... (PDF)
HidyBush 5y ago
No matter how many years pass, downloading something from SourceForge feels like downloading a sketchy patched executable from a eastern european forum or a game mod from some community managed website.
- nomemory 5y ago
  As an Eastern European I don't understand what's wrong with Eastern European forums.
  - HidyBush 5y ago
    where have I said that they have something "wrong"?
    - dudeman13 5y ago
      The words just before it were "a sketchy patched executable". People are bound to infer there is something wrong with it, regardless of whatever your intentions might have been.
      - deleted 5y ago
        [deleted]
  - manwe150 5y ago
    I think they meant it as a compliment, with a heavy dose of not knowing why or how though. Just that it worked.
  - avalys 5y ago
    I just took it to mean it's sketchy downloading and running a binary from a forum where you don't speak the language. You have no idea if the vibe on the forum is friendly or hostile, if the first response to the post you're downloading from is someone saying "Hey, thanks for the great work as always!" - or someone coordinating an identity theft scam - or both! I think because of the abundance of expertise in low-level machine language there, many cracked deDRM'd binaries or patched executables for abandonware games come out of Eastern Europe, hence the association.
themerone 5y ago
Sourceforge also suffered because it was project oriented and not code oriented. On Github everything revolves around the repo (No repo, no project.) The proportion of projects on Sourceforge that didn't have single commit was staggering and made it really hard to discover legitimate projects. There certainly are plenty of immature and barely started projects on Github, but Sourceforge had devolved into a wasteland for people to post ideas in hopes that developers would flock to their aid.
mwcampbell 5y ago
It seems to me that the most obvious explanation for the decline of SourceForge is that it gave (gives?) too much away free of charge. In this respect, it seems to me that GitHub, Bitbucket, and hosted GitLab are no better. This is making me stop and think about whether I should use GitHub for my primary open-source project. Will GitHub become the next SourceForge? Is it already happening? I respect SourceHut's decision to charge all users (at least once it leaves alpha), but GitHub's network effect is strong, and as much as I respect Drew for pushing toward a free software future, I need Windows and Mac CI. Maybe I should set up something self-hosted; I can afford it, at least for now.
- cryptonector 5y ago
  Maybe. GitHub and others have deeper pockets and provide more services (CI/CD) and so they have more ways to monetize (build cycles, private repos, org sizes, and so on).
- DrSiemer 5y ago
  Github has something extremely valuable on their hands: the perfect dataset to teach an AI how to program.
- Beltalowda 5y ago
  GitHub is essentially a "freemium" business; a lot of businesses use it and pay for it. This is quite different from SourceForge which never really had such a model, and AFAIK relied 100% on ads. At its peak SourceForge had about $23m in revenue, and GitHub has ~$300m currently. While both serve the same purpose, they're very different as a business. GitLab and BitBucket have similar business models (with some differences). I can't predict the future, but I see no reason why GitHub should "become the next SourceForge". The SourceForge exodus to GitHub was already well underway (and, at the time, also Google Code, BitBucket, Launchpad) because they offered vastly superior products than SourceForge, which was always a mess. People seem to have a lot of rose-coloured glasses about SourceForge, but their UI was clunky (even for the time), slow, chaotic with all the ease of use as your tax form, stuff often didn't work, etc. The whole adware fiasco was the death rattle of an already declining business that couldn't build a vaguely decent product.
nerdkid93 5y ago
I feel like this linked page has more info then the page that OP posted: https://onlinelibrary.wiley.com/doi/10.1002/spe.2874 https://onlinelibrary.wiley.com/doi/10.1002/spe.2874
divbzero 5y ago
Is there a natural tendency for open source software repositories to be run by private companies? Perhaps the cost of development and maintenance make it difficult for non-profit organizations provide comparable services?
- mcherm 5y ago
  I don't think the cost of development is an issue, but the cost of hosting certainly is. Open source organizations have a lot of resources (programmers, reputation, etc) but it is rare for them to have much money.
scruffyherder 5y ago
They got bought out and not only was the adware removed, the guy was fired. If anything the lesson is there is never a follow up or redemption arc for giving stuff away for free. The plus is all the trendy concern trolls are on Github, so I live peacefully among the ancient ruins of sourceforge.net
- fmajid 5y ago
  WordPress, in a moment of weakness in 2005 started pushing shady SEO advertising on WP.org. I self-hosted my blog so wasn’t directly affected but I noticed before the story broke in the tech press: https://waxy.org/2005/03/wordpress_websi/ https://waxy.org/2005/03/wordpress_websi/ https://ma.tt/2005/04/a-response/ https://ma.tt/2005/04/a-response/
lozenge 5y ago
Does anybody else remember uploading binaries to an FTP site and then refreshing a page which lists the last 10 uploads Source Forge has received and ticking boxes to "claim" the files into your project? So bizarre.
- Beltalowda 5y ago
  To this day it's still the most arcane and weirdest workflow I've ever used (or rather, was inflicted upon me) by far.
iamleppert 5y ago
Lack of investment in the actual technology, poor vision for what the product could be...they focused on extracting short term value at the expense of long term value. A key example is the interstitial page with the countdown timer whenever you want to download anything that forces you to sit there and watch an ad. Anytime you see something like that, run. Those kinds of decisions are made at the board level to generate revenue, generally because the investors don't have enough money to actually keep the company running and working on higher value, longer term bets. If not made at the board level, it's symptomatic of a dysfunctional and incompetent product organization that doesn't really care about the product, and views what they are doing as a job they'll be gone from in a few months or year anyway.
jbellis 5y ago
I read the paper but came away feeling that their attempts to find something quantitative failed. The graphs didn't particularly correlate with the periods of decline and downfall and my guess is that if you showed the researchers the graphs before telling them it was sourceforge, they would have struggled to identify whether and when the company was failing.
deleted 5y ago
[deleted]
tgsovlerkhgsel 5y ago
Aside from the malware issue, which the new owners seem to have addressed, Sourceforge also had a confusing and unpleasant to use UI, especially for downloads. Optics matter - people make decisions based on their feelings about a site. (They seem to have improved that too, although the site is still quite cluttery even with an adblocker).
everybodyknows 5y ago
I find this bit puzzling: >Forges are online collaborative platforms to support the development of distributed open source software. While once mighty keepers of open source vitality, software forges are rapidly becoming less and less relevant. By the definition proposed, is not GitHub a "forge", and "relevant" enough?
- pbhjpbhj 5y ago
  I can't quite recall, but IIRC there were a few places named .*forge.* that fit this definition. So yes, but would you call $project on gitlab.com a git hub, or would you call Reddit a chan site.
aklemm 5y ago
When Sourceforge was top-dog and very useful to the open source community, it was a time when individuals weren’t willing to pay for things online at all, much less for lucrative monthly subscriptions.

130 points by zdw 5y ago

Sourceforge brings me back to mid 2000s, learning programming and studying stuff like irrlicht and ogre3d. It's clear why sourceforge went away - GitHub is just better in every way imaginable.

pbhjpbhj 5y ago
Sourceforge became almost useless a long time before GitHub came on the scene though. AFAIR they were taken over by a commercially focused company and then added more advertising and inserted shovelware/malware into downloads. Again, my recollection (as a non-programmer) was Subversion repos were popular at this time -- launchpad.net linked source code was nearly all SVN -- and the likes of Tucows for MS Windows binaries, and other non-SF sites like Freshmeat became useful again. Then Linus came out with `git` and the ecosystem shifted. TL;DR to my recollection there was a gap between SF's decline and GitHub's rise, so the GitHub didn't cause SF's decline?
- InfiniteRand 5y ago
  I agree with this recollection, there was a gap period (although that might have been a time when Github was less prominent but still existing)
- fmajid 5y ago
  My recollection is that Sourceforge’s failure to embrace Git was their undoing, and the malware came later as they started circling the drain.

ashleyreddy 5y ago

They had a sneaky download button to download some adware vs the download link to the actual software you wanted in the first place. Easy to confuse the two.

denton-scratch 5y ago
"Sneaky" is an understatement; the download link to adware was more prominent than the download link for the product in the headline (which product was also often afflicted with adware). I found the article rather thin; I was hoping for some explanation of who made those disastrous decisions, and why.
eesmith 5y ago
That's the "ill-conceived DevShare" mentioned. From the paper: > While DevShare was an opt-in service, some projects complained that SourceForge bundled third-party adware in their downloads without their consent.25 Ads were added to project download pages with fake download buttons to trick users into clicking on the ad. Often, clicking on these ads resulted in the download of adware. > Management focused on ROI; SourceForge was expensive to run and did not have a plan to bring in revenue. This led to the introduction of DevShare, but since management did not understand the open source ethos and the development team was not included in management decisions, DevShare was a major failure. It prioritized ROI over trust and bundled adware with project downloads. Many projects started leaving SourceForge, citing DevShare as a main reason.
- beej71 5y ago
  That was a bummer. There was that point in time that ending up on SourceForge felt like ending up on one of those shady download pages. GitHub by comparison was a delight.
  - runlevel1 5y ago
    When they made the download button send you to an interstitial page with ads and a countdown timer before starting the download, that felt eerily like those shady download sites.
- mcherm 5y ago
  Yes, I someone who lived through that period I can confirm: I used SourceForge regularly until The point where it was proven to my satisfaction that the malware being added to downloads was not a fluke or a hack, but an intentional choice by management. Then, I instantly flipped to having a very strong commitment to never again trust SourceForge. You've probably heard about how a reputation is built over years but can be destroyed in an instant... that's exactly what happened here. Part of the reason is that from the point of view of the person downloading (binary executable) software, the most important feature the site provided was my trust that they would give me the same binary I was asking for. In a similar vein, if I discovered that a bank had been intentionally lying about account balances and adjusting them in the bank's favor to make a profit, I would immediately and permanently sever my relationship with that bank.

raxxorraxor 5y ago

Don't know if it was really community management or its architecture. But the incentives to monetize the site ever more aggressively is probably the most important factor. Ads and bundling malware (here: unwanted software) with downloads won't be received very well. The malware even had a negative influence on projects themselves. Example I know of was filezilla, which many never used or trusted again. I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers.

deleted 5y ago
[deleted]
kbenson 5y ago
> I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers. Some projects use the gist page for their web page, and some use the release downloads as the download binary they link to. Sometimes, just as was often the case with sourceforge, the main project repo page was the main page for the project. If you think github is more exclusive to developers and peers, I think that's just your own bias in how you use it coming though, as many non-developer people I mention it to know what it is if it comes up in conversation. I see them as extremely similar, to the point that on the relevant point of how it's used by the public I'm having a hard time coming up with differences.
hnlmorg 5y ago
SourceForge was originally developer focused so I wouldn't be so quick to assume the two aren't comparable. Github Releases produces download links, Github Actions can be used to compile assets and Github Pages can host the website. Thus a lot of developers do use Github as a one stop shop. Also worth remembering that most end users don't really care who hosts the EXE they want to download, whether that's Github or elsewhere. The only things that will stop Github going the way of SourceForge is that: 1. It's owned by Microsoft. They'd be damaging their own reputation twofold. Once because of the malware on the Github and a second time because of their OS, Windows, running like crap after that malware is installed. 2. There's a general movement away from [edit: manually] downloading binaries (as there should be!) -- even on Windows package managers are becoming more commonly used.

jmwilson 5y ago

Link to the cited paper, instead of a blurb written about the paper: https://onlinelibrary.wiley.com/doi/10.1002/spe.2874 https://onlinelibrary.wiley.com/doi/10.1002/spe.2874 https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/spe.2874?download=true https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/spe.28... (PDF)

HidyBush 5y ago

No matter how many years pass, downloading something from SourceForge feels like downloading a sketchy patched executable from a eastern european forum or a game mod from some community managed website.

nomemory 5y ago
As an Eastern European I don't understand what's wrong with Eastern European forums.
- HidyBush 5y ago
  where have I said that they have something "wrong"?
  - dudeman13 5y ago
    The words just before it were "a sketchy patched executable". People are bound to infer there is something wrong with it, regardless of whatever your intentions might have been.
    - deleted 5y ago
      [deleted]
- manwe150 5y ago
  I think they meant it as a compliment, with a heavy dose of not knowing why or how though. Just that it worked.
- avalys 5y ago
  I just took it to mean it's sketchy downloading and running a binary from a forum where you don't speak the language. You have no idea if the vibe on the forum is friendly or hostile, if the first response to the post you're downloading from is someone saying "Hey, thanks for the great work as always!" - or someone coordinating an identity theft scam - or both! I think because of the abundance of expertise in low-level machine language there, many cracked deDRM'd binaries or patched executables for abandonware games come out of Eastern Europe, hence the association.

themerone 5y ago

Sourceforge also suffered because it was project oriented and not code oriented. On Github everything revolves around the repo (No repo, no project.) The proportion of projects on Sourceforge that didn't have single commit was staggering and made it really hard to discover legitimate projects. There certainly are plenty of immature and barely started projects on Github, but Sourceforge had devolved into a wasteland for people to post ideas in hopes that developers would flock to their aid.

mwcampbell 5y ago

It seems to me that the most obvious explanation for the decline of SourceForge is that it gave (gives?) too much away free of charge. In this respect, it seems to me that GitHub, Bitbucket, and hosted GitLab are no better. This is making me stop and think about whether I should use GitHub for my primary open-source project. Will GitHub become the next SourceForge? Is it already happening? I respect SourceHut's decision to charge all users (at least once it leaves alpha), but GitHub's network effect is strong, and as much as I respect Drew for pushing toward a free software future, I need Windows and Mac CI. Maybe I should set up something self-hosted; I can afford it, at least for now.

cryptonector 5y ago
Maybe. GitHub and others have deeper pockets and provide more services (CI/CD) and so they have more ways to monetize (build cycles, private repos, org sizes, and so on).
DrSiemer 5y ago
Github has something extremely valuable on their hands: the perfect dataset to teach an AI how to program.
Beltalowda 5y ago
GitHub is essentially a "freemium" business; a lot of businesses use it and pay for it. This is quite different from SourceForge which never really had such a model, and AFAIK relied 100% on ads. At its peak SourceForge had about $23m in revenue, and GitHub has ~$300m currently. While both serve the same purpose, they're very different as a business. GitLab and BitBucket have similar business models (with some differences). I can't predict the future, but I see no reason why GitHub should "become the next SourceForge". The SourceForge exodus to GitHub was already well underway (and, at the time, also Google Code, BitBucket, Launchpad) because they offered vastly superior products than SourceForge, which was always a mess. People seem to have a lot of rose-coloured glasses about SourceForge, but their UI was clunky (even for the time), slow, chaotic with all the ease of use as your tax form, stuff often didn't work, etc. The whole adware fiasco was the death rattle of an already declining business that couldn't build a vaguely decent product.

nerdkid93 5y ago

I feel like this linked page has more info then the page that OP posted: https://onlinelibrary.wiley.com/doi/10.1002/spe.2874 https://onlinelibrary.wiley.com/doi/10.1002/spe.2874

divbzero 5y ago

Is there a natural tendency for open source software repositories to be run by private companies? Perhaps the cost of development and maintenance make it difficult for non-profit organizations provide comparable services?

mcherm 5y ago
I don't think the cost of development is an issue, but the cost of hosting certainly is. Open source organizations have a lot of resources (programmers, reputation, etc) but it is rare for them to have much money.

scruffyherder 5y ago

They got bought out and not only was the adware removed, the guy was fired. If anything the lesson is there is never a follow up or redemption arc for giving stuff away for free. The plus is all the trendy concern trolls are on Github, so I live peacefully among the ancient ruins of sourceforge.net

fmajid 5y ago
WordPress, in a moment of weakness in 2005 started pushing shady SEO advertising on WP.org. I self-hosted my blog so wasn’t directly affected but I noticed before the story broke in the tech press: https://waxy.org/2005/03/wordpress_websi/ https://waxy.org/2005/03/wordpress_websi/ https://ma.tt/2005/04/a-response/ https://ma.tt/2005/04/a-response/

lozenge 5y ago

Does anybody else remember uploading binaries to an FTP site and then refreshing a page which lists the last 10 uploads Source Forge has received and ticking boxes to "claim" the files into your project? So bizarre.

Beltalowda 5y ago
To this day it's still the most arcane and weirdest workflow I've ever used (or rather, was inflicted upon me) by far.

iamleppert 5y ago

Lack of investment in the actual technology, poor vision for what the product could be...they focused on extracting short term value at the expense of long term value. A key example is the interstitial page with the countdown timer whenever you want to download anything that forces you to sit there and watch an ad. Anytime you see something like that, run. Those kinds of decisions are made at the board level to generate revenue, generally because the investors don't have enough money to actually keep the company running and working on higher value, longer term bets. If not made at the board level, it's symptomatic of a dysfunctional and incompetent product organization that doesn't really care about the product, and views what they are doing as a job they'll be gone from in a few months or year anyway.

jbellis 5y ago

I read the paper but came away feeling that their attempts to find something quantitative failed. The graphs didn't particularly correlate with the periods of decline and downfall and my guess is that if you showed the researchers the graphs before telling them it was sourceforge, they would have struggled to identify whether and when the company was failing.

deleted 5y ago

[deleted]

tgsovlerkhgsel 5y ago

Aside from the malware issue, which the new owners seem to have addressed, Sourceforge also had a confusing and unpleasant to use UI, especially for downloads. Optics matter - people make decisions based on their feelings about a site. (They seem to have improved that too, although the site is still quite cluttery even with an adblocker).

everybodyknows 5y ago

I find this bit puzzling: >Forges are online collaborative platforms to support the development of distributed open source software. While once mighty keepers of open source vitality, software forges are rapidly becoming less and less relevant. By the definition proposed, is not GitHub a "forge", and "relevant" enough?

pbhjpbhj 5y ago
I can't quite recall, but IIRC there were a few places named .*forge.* that fit this definition. So yes, but would you call $project on gitlab.com a git hub, or would you call Reddit a chan site.

aklemm 5y ago

When Sourceforge was top-dog and very useful to the open source community, it was a time when individuals weren’t willing to pay for things online at all, much less for lucrative monthly subscriptions.