7 ms·

Don't know if it was really community management or its architecture. But the incentives to monetize the site ever more aggressively is probably the most import

Don't know if it was really community management or its architecture. But the incentives to monetize the site ever more aggressively is probably the most important factor. Ads and bundling malware (here: unwanted software) with downloads won't be received very well. The malware even had a negative influence on projects themselves. Example I know of was filezilla, which many never used or trusted again. I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers.

deleted 5y ago
[deleted]
kbenson 5y ago
> I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers. Some projects use the gist page for their web page, and some use the release downloads as the download binary they link to. Sometimes, just as was often the case with sourceforge, the main project repo page was the main page for the project. If you think github is more exclusive to developers and peers, I think that's just your own bias in how you use it coming though, as many non-developer people I mention it to know what it is if it comes up in conversation. I see them as extremely similar, to the point that on the relevant point of how it's used by the public I'm having a hard time coming up with differences.
hnlmorg 5y ago
SourceForge was originally developer focused so I wouldn't be so quick to assume the two aren't comparable. Github Releases produces download links, Github Actions can be used to compile assets and Github Pages can host the website. Thus a lot of developers do use Github as a one stop shop. Also worth remembering that most end users don't really care who hosts the EXE they want to download, whether that's Github or elsewhere. The only things that will stop Github going the way of SourceForge is that: 1. It's owned by Microsoft. They'd be damaging their own reputation twofold. Once because of the malware on the Github and a second time because of their OS, Windows, running like crap after that malware is installed. 2. There's a general movement away from [edit: manually] downloading binaries (as there should be!) -- even on Windows package managers are becoming more commonly used.
- robonerd 5y ago
  Which windows package managers build from source? I thought they were all binary package managers.
  - ramesh31 5y ago
    >Which windows package managers build from source? I thought they were all binary package managers. I think the GP meant downloading random binaries through a web browser, as most people do on Windows. Package managers with hash verification are a million times safer than that.
    - robonerd 5y ago
      Checking a hash is safer only if the person who commits the "known good hash" to the package repository actually verifies that goodness. If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release.
      - ramesh31 5y ago
        >If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release. Nothing short of a full code review will save you from a malicious supply chain attack. This is currently exploding with NPM as well, so building from source doesn't save you here either. See the node-ipc debacle from a few weeks ago [0], and also my own post from last week about a malware infected NPM module [1]. The reality is that yes, the days of being able to trust anything downloaded from a stranger on the internet are pretty much over now. But known-hash package management is still a good first layer of security versus downloading random binaries from the web. [0] https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://nvd.nist.gov/vuln/detail/CVE-2022-23812 [1] https://news.ycombinator.com/item?id=30963600 https://news.ycombinator.com/item?id=30963600
duxup 5y ago
Yup the "that's not what I thought I was downloading" aspect made SourceForge untrustworthy and I was just done with SourceForge and any links to SourceForge at that point.
mysterydip 5y ago
sample size of 1, but I'd say 25% of the time I'm downloading a binary release from github, as I don't want to spend the time setting up a specific environment just to compile xyz. I just want the tool/app as a consumer. The other 75% is code I want to incorporate into some project I'm working on as a developer.
pyuser583 5y ago
The malware especially.
dahdum 5y ago
> Example I know of was filezilla, which many never used or trusted again. Sourceforge probably killed a lot of projects with adware, but Filezilla ruined their own reputation and continue to stealthily distribute adware/malware.
- MaxBarraclough 5y ago
  The freeware Paint.NET project did something similar. For years their download page had deceptive Download Now links which were actually spam/advertising/malware. It looks like they no longer do this, for what that's worth, but I still don't recommend it to people. A pity as the application itself is very good.
  - guidoism 5y ago
    The Minecraft modding community is full of this shit. And it’s ten year olds that don’t know any better who have to learn the hard way about this stuff. I regularly wonder how much it would really cost to host those assets somewhere else that didn’t do that. Or GitHub! Why don’t the devs just move their mods to GitHub!?!?
    - MaxBarraclough 5y ago
      Are you sure they're bundling malware just to pay for hosting? It could be the other way round: they realise GitHub might ban them for pulling that kind of thing, so they host elsewhere. Are the mods generally FOSS? That would enable cleaned-up forks, although in the case of Filezilla this doesn't seem to have happened, which I find somewhat surprising.
      - madaxe_again 5y ago
        No, they’re bundling malware because the sites that host mods are a cesspool, reminiscent of the 90’s warez scene - the downloads are all “type the third word from this page, the second word from this page, then click this sponsored link, then wait in a ‘queue’ where we show you video ads - and then you can download your mod at 20kbps” I’m surprised they don’t split them up into 1.44mb rar archives “for your convenience”.
DocTomoe 5y ago
Hm, I may be wrong here (it's been over a decade...) but I remember Sourceforge being more about the code (in a simplified, VCS-style distribution directory which may have, but often did not have binaries), and Freshmeat being all about installable packaged software.
rhacker 5y ago
The worst was ads on the download page that were allowed to say "DOWNLOAD" in green large letters. You ended up downloading JUST the malware and not even the thing you were interested in.
- stevenicr 5y ago
  This reminds me of the ads on dslreports ' speed test page. (Click here to start speedtest!) I've reported them to google - but they still run.
  - metadat 5y ago
    I wonder what the criteria is for reported malicious ads to actually end up being removed and de-listed by Google? "Murder for hire" (or any legally unambiguous high-profile crime enabler) -> Guaranteed removal. GReply: "Look how much we care" "Run the dslreports malware infected" -> No meaningful action is taken by Google, they want 'dat DSLReports.exe $$$! GReply: <Crickets> "Fuck yo and pwn your network" -> ? GReply: <Crickets> The juicier question is: How many straight up virus vendors have proliferated through Google ads and chrome 0-days? That's not going to be publicly available data. Why not? Seems like as a service operator, the right thing is informing clients who $BIGCO helped get infected with virii or malware. If notification upon discovery were mandated, at least some of the pool of desolation which undeniably exists (directly thanks to Google AdHoles) would be cleaned up. Is Google too proud to admit this happens? Protecting users, especially the most defenseless in the case of Ads, is consistently not a real priority for BigG. Companies are full of people, and being humans we all makes mistakes or overlook things for too long. That would be okay if good faith efforts truly existed.
    - stevenicr 5y ago
      I'd pay to see the data on how many paid google ads ran for 'flashplayer' 'flash' and similar. After watching people I know search for it (years ago) and click the first result (which was never the actual flashplayer) - they must of infected 10s of thousands. Also terms like 'social security admin' 'new social sec card'- I watched my mom do the same thing - g-search, click first results.. start filling in info, second screen more personal info, third screen start to question whyu.. fourth screen - wait this ain't right.. sigh.
munk-a 5y ago
I think a huge difference between github and sourceforge is that user base and the fact that github ends up being used by a lot of private companies wanting to host their private repositories (and being willing to pay money to do so). To my knowledge (I was very young during the period when sourceforge was still good) sourceforge never really attracted private customers by offering value adds to CVS/SVN so it didn't have a reliable non-donation revenue model. Github has accumulated a cash cow in the form of a lot of companies using it for issue tracking and as a nice UI into their repository state - this doesn't make them secure for ever, they do have some very real competition and the fact that they are maintaining an ecosystem means they have a lot of costs beyond just hosting but I think they're in a place where, if they started to inject obnoxious ads, they believe their revenue would suffer even in the short term.
- zeruch 5y ago
  "To my knowledge (I was very young during the period when sourceforge was still good) sourceforge never really attracted private customers by offering value adds to CVS/SVN so it didn't have a reliable non-donation revenue model." Correct. At the time it was a much tough hill to climb; the business climate was still not ready for it by and large; quite resistant actually, hence why for a while an on-prem version of the software was developed and sold and supported.
- fmajid 5y ago
  The Information had an excellent article a few years back about the conflict between the Enterprise sales people and those responsible for the community. The latter won and it was the right business decision. Thinking of GitHub as yet another enterprise software development tool rather than the premier social network for developers shows a breathtaking lack of vision.
itronitron 5y ago
Yeah, I can't believe the authors didn't mention the malware fiasco as the primary contributor of SourceForge's demise. Before it's downfall it had several useful open source and widely used libraries. Post malware it's use was banned by many employers.
zeruch 5y ago
"But the incentives to monetize the site ever more aggressively is probably the most important factor." That itself was forced by the dot com fallout that killed the parent company hardware business and made SF a more critical leg for revenue. It all went downhill from there, especially when new leadership came in. Disclosure: I worked at VA Linux/SF for 4 years (1998-2002), was on the SFDN "launch" team, and am still friends with a few of the original SF core guys. We all view what happened to SF as a tragedy.

deleted 5y ago

[deleted]

kbenson 5y ago

> I don't know if you can compare sourceforge with github because the former was also used by many to get ready-to-use binaries where github is more exclusive to developers and peers. Some projects use the gist page for their web page, and some use the release downloads as the download binary they link to. Sometimes, just as was often the case with sourceforge, the main project repo page was the main page for the project. If you think github is more exclusive to developers and peers, I think that's just your own bias in how you use it coming though, as many non-developer people I mention it to know what it is if it comes up in conversation. I see them as extremely similar, to the point that on the relevant point of how it's used by the public I'm having a hard time coming up with differences.

hnlmorg 5y ago

SourceForge was originally developer focused so I wouldn't be so quick to assume the two aren't comparable. Github Releases produces download links, Github Actions can be used to compile assets and Github Pages can host the website. Thus a lot of developers do use Github as a one stop shop. Also worth remembering that most end users don't really care who hosts the EXE they want to download, whether that's Github or elsewhere. The only things that will stop Github going the way of SourceForge is that: 1. It's owned by Microsoft. They'd be damaging their own reputation twofold. Once because of the malware on the Github and a second time because of their OS, Windows, running like crap after that malware is installed. 2. There's a general movement away from [edit: manually] downloading binaries (as there should be!) -- even on Windows package managers are becoming more commonly used.

robonerd 5y ago
Which windows package managers build from source? I thought they were all binary package managers.
- ramesh31 5y ago
  >Which windows package managers build from source? I thought they were all binary package managers. I think the GP meant downloading random binaries through a web browser, as most people do on Windows. Package managers with hash verification are a million times safer than that.
  - robonerd 5y ago
    Checking a hash is safer only if the person who commits the "known good hash" to the package repository actually verifies that goodness. If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release.
    - ramesh31 5y ago
      >If the programs developer sells out and puts malware into their official binary releases, and the package maintainer doesn't notice this, then checking hashes doesn't protect you from the malicious release. Nothing short of a full code review will save you from a malicious supply chain attack. This is currently exploding with NPM as well, so building from source doesn't save you here either. See the node-ipc debacle from a few weeks ago [0], and also my own post from last week about a malware infected NPM module [1]. The reality is that yes, the days of being able to trust anything downloaded from a stranger on the internet are pretty much over now. But known-hash package management is still a good first layer of security versus downloading random binaries from the web. [0] https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://nvd.nist.gov/vuln/detail/CVE-2022-23812 [1] https://news.ycombinator.com/item?id=30963600 https://news.ycombinator.com/item?id=30963600

duxup 5y ago

Yup the "that's not what I thought I was downloading" aspect made SourceForge untrustworthy and I was just done with SourceForge and any links to SourceForge at that point.

mysterydip 5y ago

sample size of 1, but I'd say 25% of the time I'm downloading a binary release from github, as I don't want to spend the time setting up a specific environment just to compile xyz. I just want the tool/app as a consumer. The other 75% is code I want to incorporate into some project I'm working on as a developer.

pyuser583 5y ago

The malware especially.

dahdum 5y ago

> Example I know of was filezilla, which many never used or trusted again. Sourceforge probably killed a lot of projects with adware, but Filezilla ruined their own reputation and continue to stealthily distribute adware/malware.

MaxBarraclough 5y ago
The freeware Paint.NET project did something similar. For years their download page had deceptive Download Now links which were actually spam/advertising/malware. It looks like they no longer do this, for what that's worth, but I still don't recommend it to people. A pity as the application itself is very good.
- guidoism 5y ago
  The Minecraft modding community is full of this shit. And it’s ten year olds that don’t know any better who have to learn the hard way about this stuff. I regularly wonder how much it would really cost to host those assets somewhere else that didn’t do that. Or GitHub! Why don’t the devs just move their mods to GitHub!?!?
  - MaxBarraclough 5y ago
    Are you sure they're bundling malware just to pay for hosting? It could be the other way round: they realise GitHub might ban them for pulling that kind of thing, so they host elsewhere. Are the mods generally FOSS? That would enable cleaned-up forks, although in the case of Filezilla this doesn't seem to have happened, which I find somewhat surprising.
    - madaxe_again 5y ago
      No, they’re bundling malware because the sites that host mods are a cesspool, reminiscent of the 90’s warez scene - the downloads are all “type the third word from this page, the second word from this page, then click this sponsored link, then wait in a ‘queue’ where we show you video ads - and then you can download your mod at 20kbps” I’m surprised they don’t split them up into 1.44mb rar archives “for your convenience”.

DocTomoe 5y ago

Hm, I may be wrong here (it's been over a decade...) but I remember Sourceforge being more about the code (in a simplified, VCS-style distribution directory which may have, but often did not have binaries), and Freshmeat being all about installable packaged software.

rhacker 5y ago

The worst was ads on the download page that were allowed to say "DOWNLOAD" in green large letters. You ended up downloading JUST the malware and not even the thing you were interested in.

stevenicr 5y ago
This reminds me of the ads on dslreports ' speed test page. (Click here to start speedtest!) I've reported them to google - but they still run.
- metadat 5y ago
  I wonder what the criteria is for reported malicious ads to actually end up being removed and de-listed by Google? "Murder for hire" (or any legally unambiguous high-profile crime enabler) -> Guaranteed removal. GReply: "Look how much we care" "Run the dslreports malware infected" -> No meaningful action is taken by Google, they want 'dat DSLReports.exe $$$! GReply: <Crickets> "Fuck yo and pwn your network" -> ? GReply: <Crickets> The juicier question is: How many straight up virus vendors have proliferated through Google ads and chrome 0-days? That's not going to be publicly available data. Why not? Seems like as a service operator, the right thing is informing clients who $BIGCO helped get infected with virii or malware. If notification upon discovery were mandated, at least some of the pool of desolation which undeniably exists (directly thanks to Google AdHoles) would be cleaned up. Is Google too proud to admit this happens? Protecting users, especially the most defenseless in the case of Ads, is consistently not a real priority for BigG. Companies are full of people, and being humans we all makes mistakes or overlook things for too long. That would be okay if good faith efforts truly existed.
  - stevenicr 5y ago
    I'd pay to see the data on how many paid google ads ran for 'flashplayer' 'flash' and similar. After watching people I know search for it (years ago) and click the first result (which was never the actual flashplayer) - they must of infected 10s of thousands. Also terms like 'social security admin' 'new social sec card'- I watched my mom do the same thing - g-search, click first results.. start filling in info, second screen more personal info, third screen start to question whyu.. fourth screen - wait this ain't right.. sigh.

munk-a 5y ago

I think a huge difference between github and sourceforge is that user base and the fact that github ends up being used by a lot of private companies wanting to host their private repositories (and being willing to pay money to do so). To my knowledge (I was very young during the period when sourceforge was still good) sourceforge never really attracted private customers by offering value adds to CVS/SVN so it didn't have a reliable non-donation revenue model. Github has accumulated a cash cow in the form of a lot of companies using it for issue tracking and as a nice UI into their repository state - this doesn't make them secure for ever, they do have some very real competition and the fact that they are maintaining an ecosystem means they have a lot of costs beyond just hosting but I think they're in a place where, if they started to inject obnoxious ads, they believe their revenue would suffer even in the short term.

zeruch 5y ago
"To my knowledge (I was very young during the period when sourceforge was still good) sourceforge never really attracted private customers by offering value adds to CVS/SVN so it didn't have a reliable non-donation revenue model." Correct. At the time it was a much tough hill to climb; the business climate was still not ready for it by and large; quite resistant actually, hence why for a while an on-prem version of the software was developed and sold and supported.
fmajid 5y ago
The Information had an excellent article a few years back about the conflict between the Enterprise sales people and those responsible for the community. The latter won and it was the right business decision. Thinking of GitHub as yet another enterprise software development tool rather than the premier social network for developers shows a breathtaking lack of vision.

itronitron 5y ago

Yeah, I can't believe the authors didn't mention the malware fiasco as the primary contributor of SourceForge's demise. Before it's downfall it had several useful open source and widely used libraries. Post malware it's use was banned by many employers.

zeruch 5y ago

"But the incentives to monetize the site ever more aggressively is probably the most important factor." That itself was forced by the dot com fallout that killed the parent company hardware business and made SF a more critical leg for revenue. It all went downhill from there, especially when new leadership came in. Disclosure: I worked at VA Linux/SF for 4 years (1998-2002), was on the SFDN "launch" team, and am still friends with a few of the original SF core guys. We all view what happened to SF as a tragedy.