4 ms·

Well Sourceforge literally bundled malware for a while. So everyone had to move. https://news.ycombinator.com/item?id=31110206 https://news.ycombinator.com/ite

Well Sourceforge literally bundled malware for a while. So everyone had to move. https://news.ycombinator.com/item?id=31110206 https://news.ycombinator.com/item?id=31110206 This articles about the open source distribution side but I will also point out that the number of developers who don’t realise your remote GitHub repo can be located on any machine with an ssh connection and nothing more is surprising. As in people use private GitHub repos thinking that’s THE way you work with git. If GitHub was just for open source hosting I suspect they’d have trouble monetising like sourceforge clearly did which led to scammy attempts to make money. But they always had this huge usage of private GitHub repos supporting the rest. This must have helped a lot imho.

schacon 2y ago
This is not my recollection, at least at the time. I remember meeting with one of the SourceForge founders and being a little star struck. SourceForge was a huge deal at the time and we totally felt like we were the underdogs in that arena. Perhaps later they got more desperate, but in 2008, SourceForge was the 900lb gorilla.
- AnotherGoodName 2y ago
  2013 is when the binaries had malware included although even in 2008 they were guilty of having 5 download buttons due to excessive and unpoliced inline advertising with only one of those buttons being the holy grail that linked to the download you actually wanted. Choose wisely.
  - beAbU 2y ago
    I completely forgot about the absolute gamble that was "which big green button is the actual download button this time" when using SourceForge and Tucows back in the day.
- kstrauser 2y ago
  Who is "we"?
  - schacon 2y ago
    Sorry, "we" is GitHub. I'm the author of the article and one of the GH cofounders.
    - kstrauser 2y ago
      Oh! Heh, that makes sense now.
    - relaxing 2y ago
      Well damn. So much for the “Github had better taste” thesis. Still, Sourceforge was a terrible user experience. Github was a breathe of fresh air.
- michaelt 2y ago
  To help our recollections, let's look at Sourceforge's browse page, from back in 2008: https://web.archive.org/web/20081118033645/http://sourceforge.net/softwaremap/ https://web.archive.org/web/20081118033645/http://sourceforg... They did indeed host quite a lot of stuff, and it was undeniably popular as a place to get your binaries hosted free of charge. But at the same time, is it being used as a source code repository? A lot of those projects don't show the CVS/SVN features. And sourceforge never hosted the biggest and most established projects, Linux and Gnu and PHP and Java and Qt and Perl and Python were all doing their own thing. And pretty much every project visible on that page had its own separate website, very few projects hosted on sourceforge exclusively.
  - relaxing 2y ago
    No, you’d upload source tarballs. Live public access to VCS wasn’t a thing for most projects.
  - giantrobot 2y ago
    SourceForge was the upstream source of truth for a huge percentage of small apps bundled by various distros (and BSD ports etc). Even when the upstream maintainers just uploaded the latest tarball to SF and didn't use their hosted VCS, just the hosting was a major boon to all of the tiny teams and individual maintainers of FOSS projects.
zargon 2y ago
> your remote GitHub repo can be located on any machine It's such a an easy mistake to say that you did it while explaining you don't need GitHub for git repos. :)
- deleted 2y ago
  [deleted]
marcosdumay 2y ago
> If GitHub was just for open source hosting I suspect they’d have trouble monetising like sourceforge clearly did It made it harder to monetize, but it enabled Source Forge to use a huge amount of voluntarily-given bandwidth and saved them a fortune at a time bandwidth was crazy-expensive. Bandwidth costs were one of the reasons something like GitHub didn't appear earlier, and suddenly popped-up a lot of times out of nowhere.
arp242 2y ago
> Sourceforge literally bundled malware for a while. So everyone had to move. This was after SourceForge hugely declined in popularity. The correct sequence of events is: 1. SourceForge massively declined in popularity, 2. and then in a desperate attempt to extract cash they started bundling malware. Not the other way around. All of this had little to no effect on the migration away from SourceForge, which was already well underway in 2013 when the first controversy started. It may have expedited thing somewhat, but not even sure about that. See for example [1] from 2011, which shows GitHub is already beating SourceForge by quite a margin. I found that article because it's used as a citation for "In response to the DevShare adware, many users and projects migrated to GitHub" on Wikipedia, which is simple flat-out wrong – that DevShare incident didn't happen until 2013 (I have removed that from the Wikipedia page now). It's baffles me how people keep getting the sequence of events wrong on HN. The reason is simple that SourceForge is just not very good and never was very good. Part of that is because of the ad-driven business model, part of that is that many features were just not done very well. Who actually used the SourceForge issue tracker or VCS browser? Almost no one, because it's crap. [1]: https://redmonk.com/sogrady/2011/06/02/blackduck-webinar/ https://redmonk.com/sogrady/2011/06/02/blackduck-webinar/
dom96 2y ago
I distinctly remember that what annoyed me about SourceForge was that it hid the source code behind multiple clicks. GitHub was a breath of fresh air because it made the source code front and center.
huijzer 2y ago
I suspect that Microsoft has just accepted losses year after year after year. That’s what they do. They are very willing to invest heavily in projects that they think will work out in the long-run, see also their OpenAI investements.
Cyberdog 2y ago
> your remote GitHub repo can be located on any machine with an ssh connection Technically true, but GitHub provides so many more tools that it's almost silly to do so. Aside from the "hub" in GitHub such that it is often the first and only way that some people will look for projects they're interested in, you also get the nice web interface for quick code browsing, issue queues, the ability to add and remove people with a simple GUI rather than SSH key management, wikis, email notifications, and so on and so on. Some of this can be mitigated by using a self-hosted web-based Git tool like GitLab, Gitea, Phorge, etc. But you still lose the "everyone uses it because everyone uses it" factor of GitHub on top of whatever GitHub features the clones may lack.
jrochkind1 2y ago
The malware bundling was long after SourceForge had precipitously declined in popularity, not the original cause of it, no?

schacon 2y ago

This is not my recollection, at least at the time. I remember meeting with one of the SourceForge founders and being a little star struck. SourceForge was a huge deal at the time and we totally felt like we were the underdogs in that arena. Perhaps later they got more desperate, but in 2008, SourceForge was the 900lb gorilla.

AnotherGoodName 2y ago
2013 is when the binaries had malware included although even in 2008 they were guilty of having 5 download buttons due to excessive and unpoliced inline advertising with only one of those buttons being the holy grail that linked to the download you actually wanted. Choose wisely.
- beAbU 2y ago
  I completely forgot about the absolute gamble that was "which big green button is the actual download button this time" when using SourceForge and Tucows back in the day.
kstrauser 2y ago
Who is "we"?
- schacon 2y ago
  Sorry, "we" is GitHub. I'm the author of the article and one of the GH cofounders.
  - kstrauser 2y ago
    Oh! Heh, that makes sense now.
  - relaxing 2y ago
    Well damn. So much for the “Github had better taste” thesis. Still, Sourceforge was a terrible user experience. Github was a breathe of fresh air.
michaelt 2y ago
To help our recollections, let's look at Sourceforge's browse page, from back in 2008: https://web.archive.org/web/20081118033645/http://sourceforge.net/softwaremap/ https://web.archive.org/web/20081118033645/http://sourceforg... They did indeed host quite a lot of stuff, and it was undeniably popular as a place to get your binaries hosted free of charge. But at the same time, is it being used as a source code repository? A lot of those projects don't show the CVS/SVN features. And sourceforge never hosted the biggest and most established projects, Linux and Gnu and PHP and Java and Qt and Perl and Python were all doing their own thing. And pretty much every project visible on that page had its own separate website, very few projects hosted on sourceforge exclusively.
- relaxing 2y ago
  No, you’d upload source tarballs. Live public access to VCS wasn’t a thing for most projects.
- giantrobot 2y ago
  SourceForge was the upstream source of truth for a huge percentage of small apps bundled by various distros (and BSD ports etc). Even when the upstream maintainers just uploaded the latest tarball to SF and didn't use their hosted VCS, just the hosting was a major boon to all of the tiny teams and individual maintainers of FOSS projects.

zargon 2y ago

> your remote GitHub repo can be located on any machine It's such a an easy mistake to say that you did it while explaining you don't need GitHub for git repos. :)

deleted 2y ago
[deleted]

marcosdumay 2y ago

> If GitHub was just for open source hosting I suspect they’d have trouble monetising like sourceforge clearly did It made it harder to monetize, but it enabled Source Forge to use a huge amount of voluntarily-given bandwidth and saved them a fortune at a time bandwidth was crazy-expensive. Bandwidth costs were one of the reasons something like GitHub didn't appear earlier, and suddenly popped-up a lot of times out of nowhere.

arp242 2y ago

> Sourceforge literally bundled malware for a while. So everyone had to move. This was after SourceForge hugely declined in popularity. The correct sequence of events is: 1. SourceForge massively declined in popularity, 2. and then in a desperate attempt to extract cash they started bundling malware. Not the other way around. All of this had little to no effect on the migration away from SourceForge, which was already well underway in 2013 when the first controversy started. It may have expedited thing somewhat, but not even sure about that. See for example [1] from 2011, which shows GitHub is already beating SourceForge by quite a margin. I found that article because it's used as a citation for "In response to the DevShare adware, many users and projects migrated to GitHub" on Wikipedia, which is simple flat-out wrong – that DevShare incident didn't happen until 2013 (I have removed that from the Wikipedia page now). It's baffles me how people keep getting the sequence of events wrong on HN. The reason is simple that SourceForge is just not very good and never was very good. Part of that is because of the ad-driven business model, part of that is that many features were just not done very well. Who actually used the SourceForge issue tracker or VCS browser? Almost no one, because it's crap. [1]: https://redmonk.com/sogrady/2011/06/02/blackduck-webinar/ https://redmonk.com/sogrady/2011/06/02/blackduck-webinar/

dom96 2y ago

I distinctly remember that what annoyed me about SourceForge was that it hid the source code behind multiple clicks. GitHub was a breath of fresh air because it made the source code front and center.

huijzer 2y ago

I suspect that Microsoft has just accepted losses year after year after year. That’s what they do. They are very willing to invest heavily in projects that they think will work out in the long-run, see also their OpenAI investements.

Cyberdog 2y ago

> your remote GitHub repo can be located on any machine with an ssh connection Technically true, but GitHub provides so many more tools that it's almost silly to do so. Aside from the "hub" in GitHub such that it is often the first and only way that some people will look for projects they're interested in, you also get the nice web interface for quick code browsing, issue queues, the ability to add and remove people with a simple GUI rather than SSH key management, wikis, email notifications, and so on and so on. Some of this can be mitigated by using a self-hosted web-based Git tool like GitLab, Gitea, Phorge, etc. But you still lose the "everyone uses it because everyone uses it" factor of GitHub on top of whatever GitHub features the clones may lack.

jrochkind1 2y ago

The malware bundling was long after SourceForge had precipitously declined in popularity, not the original cause of it, no?