22 ms·

How far the once-mighty SourceForge has fallen

364 points by danparsonson 13y ago

ck2 13y ago
What might be really dangerous is I think they also run rpmforge (aka repoforge) and many people use them on servers for yum updates as they have newer packages sometimes. If they start messing with the releases for servers, we've got big problems. Wait, no I might be wrong about this, I really thought they were related but rpmforge might be a completely different project. Yeah I am probably wrong based on this old page: http://web.archive.org/web/20060208035034/http://rpmforge.net/about.php http://web.archive.org/web/20060208035034/http://rpmforge.ne... They just re-used the "forge" name which fine but confused me and I guess I assumed it was run by sourceforge awhile back. Sourgeforge however is owned by Slashdot's parent company, of that I am virtually positive.
- hkmurakami 13y ago
  That parent company would be GeekNet, Inc. http://finance.yahoo.com/q/pr?s=GKNT+Profile http://finance.yahoo.com/q/pr?s=GKNT+Profile
  - Zirro 13y ago
    "In September 2012, Dice Holdings acquired SourceForge from its previous owner Geeknet" says Wikipedia. https://en.wikipedia.org/wiki/SourceForge#Acquisition https://en.wikipedia.org/wiki/SourceForge#Acquisition
    - eterm 13y ago
      But Slashdot is also listed on the Dice Holdings page. http://www.diceholdingsinc.com/ http://www.diceholdingsinc.com/
    - cothomps 13y ago
      Correct - the various companies have been re-orged into a slightly separate entity called "Slashdot Media": http://slashdotmedia.com http://slashdotmedia.com
bcraven 13y ago
It's all gone download.com - new cockney rhyming slang anyone?
- bencollier49 13y ago
  What does download.com rhyme with?
  - talktwomey 13y ago
    Pete Tong
    - toyg 13y ago
      which, for non-cockneys, is slang for "quite wrong".
      - rorykoehein 13y ago
        * just "wrong"
harrytuttle 13y ago
Agree entirely. SourceForge is unfortunately one of those places that puts me off projects these days. It's a baron land of advertising and poorly maintained products that just add noise.
- tubs 13y ago
  A baron land would be a land ruled by a baron, a barren land is what you see Sourceforge as.
  - PaulHoule 13y ago
    I thought that SourceForge was a barren land years ago, at least ever since they started putting interstitial ads in the downloads. As someone who sits in front of Windows but does a lot of development over ssh in Unix this is slap in the face. There are both manual and automatic ways to get the real url that you could type into axel, curl or wget, but it just shows a lack of respect for customers. I made a point to keep open source projects away from sourceforge because it was a ghetto, the same reason I didn't want to be seen on myspace. Just knowing a project is on sourceforge would bias me to think the project is not worth thinking about.
    - AdrianRossouw 13y ago
      i'm confused. don't you need to take 10 seconds to choose a mirror while we show you these ads? /s
    - Dylan16807 13y ago
      Right click and copy the url at the top of the page? I don't understand what the problem is with showing an ad underneath it.
  - pessimizer 13y ago
    Just an eggcorn, everybody has them:)
  - harrytuttle 13y ago
M4v3R 13y ago
The sad thing is that strategy works and it works quite well. Most people that are not very technical will just click "Next" and "Agreed" blindly to complete software installation. I've seen numerous PCs plagued with toolbars and crapware for that specific reason. I always try to educate them to always read what's on screen and never agree for the "toolbar thing", but it's mostly a lost fight.
- userulluipeste 13y ago
  No, it is not a lost fight. You did the right thing to rise their awareness at least once, what they will do after is their responsibility. It is one thing when they are not technical and unaware, and it is a totally different thing when they chose to be ignorant, do stupid things and support the consequences. In the second case they just are deserving it.
- damian2000 13y ago
  It happened to a 9 yo nephew of mine last weekend - he ended up with a fake antivirus + search engine hijacker on his laptop - reduced him to tears. Pretty disgraceful stuff.
  - thelukester 13y ago
    Your 9 yo installed fake antivirus + search engine hijacker. First of all, what the hell are you doing letting a 9 yo browse on a machine with root privileges? Secondly, that has nothing to do with this story. As the article is wrongly accuses DevShare of being drive-by and malware. It is neither. An article written by someone with more than 2 brain cells can be found here: http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/ http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/
    - ams6110 13y ago
      I wasn't much older than 9 when I first used a computer, and certainly had root access (I guess that's what you'd call it, because the machine had no notion of multiple users).
- 13y ago
jpswade 13y ago
http://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwww.gluster.org%2F2013%2F08%2Fhow-far-the-once-mighty-sourceforge-has-fallen%2F http://webcache.googleusercontent.com/search?q=cache:http%3A...
deleted 13y ago
[deleted]
616c 13y ago
I cannot access the article as the server is down right now, but saw a summary on a forum. [0] Was this not one of the first major no-no's of computer law in the user, starting with cases like Specht vs. Netscape? [1] [0] http://inagist.com/all/370801094563467264/ http://inagist.com/all/370801094563467264/ [1] https://en.wikipedia.org/wiki/Specht_v._Netscape_Communications_Corp https://en.wikipedia.org/wiki/Specht_v._Netscape_Communicati....
jacquesm 13y ago
The mighty gluster blog seems to have fallen as well. "error establishing database connection"
coffeeaddicted 13y ago
Can you recommend alternatives that offer all their features? We use currently for example sourcecontrol, forums, bugtrackers, a wiki, the image galleries and their website hosting. I'm often unhappy with SF, but it's not quite that easy finding that kind of service elsewhere.
- nailer 13y ago
  github has source control, a bug tracker, and website hosting. Don't know about forums and wikis.
  - webignition 13y ago
    GitHub certainly has wikis, I often use project wikis to document various bits and bobs.
  - zaphoyd 13y ago
    wikis yes. forums.. not really unless you abuse the bug tracker. Github+Google Groups seems to be the complete package these days. BitBucket also provides website/wiki/issue tracker/source control features.
    - coffeeaddicted 13y ago
      Yeah, it's probably a good solution for new projects. The problem with existing projects is when you already have a quarter million posts in your forum and don't want to lose them. Although maybe a mix of providers - keeping forums on SF and moving the rest of the project might be a solution.
  - eksith 13y ago
    Forum is one area Github is in a great position to enter right now. Wrangling bug tracker to act as a forum is a bit of a hack so a proper place for developers to interact and discuss projects would be most welcome.
    - 13y ago
RyanMcGreal 13y ago
How far the gluster server has fallen. Here's the text of the article: ---- How far the once mighty SourceForge has fallen… [Editor's note: This post is the opinion of the author and not necessarily that of the Gluster Community] TLDR: SourceForge, once a mighty force for the good of Open Source, has fallen far from its previous lofty heights. Dice, the new owners, bribe strongly encourage the top projects to use a new (closed source only) installer that pushes spyware / adware / malware. Developers using SourceForge should migrate away from it if they want to keep their integrity. End users using projects hosted on SourceForge should immediately find an alternative. Full version: When people download software from SourceForge, or any major repository of Open Source software, they expect the software to be trustworthy. (baring unintentional bugs) They do not expect the software to be a source of “drive by installer” style malware, spyware, adware, or any other unrelated/unintended software. SourceForge’s new owners, Dice, have consciously and deliberately moved to a model violating this trust. With their recent changes, users downloading from SourceForge now receive a special closed source installer which attempts to foist unrelated third party software onto them. For example, when a user clicks on this: http://sourceforge.net/projects/filezilla/files/FileZilla_Client/3.7.3/FileZilla_3.7.3_win32-setup.exe/download They instead receive this: http://ak.pipoffers.apnpartners.com/static/partners/dynamic/SFFZ/SFInstaller_SFFZ_filezilla_8992693_.exe This is a “drive-by installer”, designed to catch less technical users and the unwary, to fill their computers with malware / junk ware / crime ware. As abused by the notorious ask.com toolbar and others: FileZilla_drive_by_downloader_smaller It gets worse. When SourceForge introduced this, it bribed encouraged the top projects to participate by giving them a cut of the take. So these co-operating projects are also knowingly selling their users down the river. I’m not against monetisation at all, we all have lives and need to pay our bills. But not through abusing user trust. Not through preying on the unskilled or unwary. To misquote Marge Simpson; “They not only crossed the line, they threw up on it.” If you’re a developer or contributor to a SourceForge project, please ask them to move to a new project host (there are several). And cease all further involvement until it’s complete. I’ve already done so with mine. If you’re a user of a SourceForge project, please find and use an alternative project instead. We should all demonstrate our commitment to user safety and personal integrity around this issue.
- Filligree 13y ago
voltagex_ 13y ago
I also posted this some time ago.
simula67 13y ago
The web installer was initially not detecting the proxy at my workplace. Hopefully popular projects like Filezilla will move their download binaries off Sourceforge.
EvaK_de 13y ago
At least SourceForge still offers a download option for the hosted projects, unlike Google Code...
af3 13y ago
Hey guys, do you know an alternative service that provides mailing lists (no Ggle groups please)?
- reidrac 13y ago
  I don't know why you don't want to use Google Groups, but depending on your reasons you may like http://librelist.com/ http://librelist.com/ There's also Yahoo! Groups.
laymil 13y ago
LWN had a similar feature posted yesterday which has significantly more background information. http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/ http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/
drderidder 13y ago
There's a lot of good software on SourceForge still. How long before SF starts holding it ransom? Sounds like a good time to fork your favourite SF-hosted code to another service as a backup.
peterwwillis 13y ago
Okay. So SourceForge is pooping in the fishbowl at it's own party. Instead of picking up and leaving, maybe we could just make a concerted effort to ask Sourceforge to stop doing this? You don't have to demand everyone boycott a useful service like this every time something you don't like happens.
- threeseed 13y ago
  Are you serious ? Because you can't possibly think that asking SourceForge to "please stop making money" in order to please a handful of users will actually work.
  - deleted 13y ago
    [deleted]
Thiz 13y ago
SourceForge is to github what myspace is to facebook what gm is to tesla and what slashdot is to digg, now to reddit and so on
joshuahedlund 13y ago
So SourceForge downloads are becoming as bad as Cnet? Even the once-reputable members of the download hosting industry seem to be heading towards a rather unfortunate Nash equilibrium... Hopefully Github can sustain their model without it.
- bdcravens 13y ago
  Github has plenty of customers who pay for private repos. They're profitable and have had some serious investment dollars injected.
haberman 13y ago
For the youngins out there, 10-15 years ago SourceForge was like GitHub is now. It was extremely popular and reputable for open-source hosting. I remember thinking that one of the first considerations when naming a new project was: is MYPROJECTNAME.sourceforge.net available? Never expected to see it decline into the spammy sketch-ville that it is now.
- charonn0 13y ago
  It's like a swanky hotel in a nice neighborhood deciding to start renting rooms by the hour.
JohnTHaller 13y ago
The article gets a few things very wrong. First off, there are no drive-by installers. It's an offer-based installer. Meaning that when you run it, you get a single offer of an additional product. Second, it's offering you either trialware (a trial version of a for-sale product that they hope you buy after trying) or adware (like an Ask.com toolbar to ad to your browser). The author of this blog post is either outright lying about it doing drive-by-installers and malware or is clueless about what the terminology actually means. The last time this was posted on HN, I did a quick writeup on my understanding of it (reposted here): "For the curious, this is an optional program at SourceForge being offered to developers as a way to monetize their work. The developer needs to specifically request it. SourceForge gets a cut, so does the developer. The installer is their first stab at this process and is using the bundling technology from Ask.com. As offer-based installers go, this one is about as good as it gets. It makes a single offer and has an Accept and Decline button with the user selecting whichever one they want (not a pre-checked box accepting the offer above a Next/Continue button). If accepted, the installer installs the offered software and it gets a standard entry in Windows' Add/Remove Programs that works as expected. If declined, the installer continues. The installer then downloads the originally-requested software. The two issues with the current installer are that (1) it is served in place of the requested file with no indication that a substitution is made as the user downloads and (2) it requests admin rights before it starts downloading the software, which can be a security issue. Roberto (who posted the article) has stated that they are working on #1 in terms of the text shown on SourceForge as you select to download and download. As for #2, there may be some ways to rework the installer so this is not an issue. I'll mention it to him when I speak to him. SourceForge has one other revenue-share program with developers where you place the SourceForge-branded download buttons on your own website that link to your downloads on SourceForge and you get a small cut of the ad revenue made from the download page. If I recall correctly, SourceForge has been losing money for a few years now. Dice Holdings picked up SourceForge and Slashdot while Geek.com kept ThinkGeek.com, so they are now separate entities. These new experiments are attempts to get SourceForge to be self-sustaining/profitable. Ad revenue alone likely won't cut it. Unfortunately, Google Code, Github and others don't offer the full breadth of services that SourceForge does for open source projects. Google Code, Github, and others have all ditched binary downloads, so SourceForge is one of the only providers to make binary downloads available to Windows and Mac user at no charge. This is why SourceForge is popular for real apps (FileZilla, Pidgin, PortableApps.com, etc) and Github is popular for components (node.js, jquery, rails, etc). The code zips available at other providers are of no use to end users. As full disclosure, I run PortableApps.com, one of SourceForge's largest projects pushing quite a few TBs of downloads through their mirror network. We make use of the SF-branded download buttons revenue share program but do not make use of nor have any plans to use the "enhanced" installers. Everything I've discussed here is already publicly available, I just thought it would be handy to have in one place." After that post, it was pointed out to me that Github has added in the ability to host binaries, but I would wager they wouldn't take kindly to the kind of bandwidth that the major SF projects like PortableApps.com push through. I've also been in touch with Roberto who made the mentioned post on SourceForge about some suggestions and options including doing an open source installer that the end-user/sysadmin can verify before installing instead of it being a downloader installer with the offer built in but not the app you want.
lbenes 13y ago
This article is full of hyperbole and exaggerations. I downloaded the latest filezilla with the offer-installer "malware" and scanned it with Avira free antivirus, and MS Security Essentials. Both of them reported no problem. I then was able to install filezilla without the offer-installer just by not clicking on the checkmark. After the installation, my VM ran normally, no pop-ups, no changed homepage in firefox or IE. People that write this drivel make the open source community look like a bunch of nutjob, hippy zealots with no grasp of reality. Ads pay the bills and sadly some open source developers have mouths to feed.
- UncleBubba 13y ago
  The problem with these install "wrappers" is that they run with elevated privileges and you do not know what they're doing. This wrapper presents the same problems as OpenCandy. Can you get the source to the installer? No. Can you guarantee the wrapper only does what they say it's doing. No. Do you have a fiduciary or contractual relationship with the publisher upon which you can rely if their software causes you harm? Probably not. Avira Free and MS Essentials are certainly not the be-all, end-all to code verification, so don't feel too secure after using them, either.
- UncleBubba 13y ago
  And people who identify security hazards for the unknowing masses (a group into which your apparent ignorance places you) aren't nutjobs or hippies anymore than you are a shrill dilettante. There are honest ways to monetize development without jeopardizing the safety of a tremendous number of users; unfortunately, this ain't it. Next time, present your argument without the name calling. It works better. Edit: Typo
njharman 13y ago
SourceForge has been a POS and dead to me for many years. I'm not sure it ever achieved "mightyness". Back when VA failed at what they were trying to do and started SourceForge, it was needed and they deserve praise for trail-blazing / attempting something big. But, I never really felt they carried through successfully.
opello 13y ago
I'm not sure if it's possible to get the released file out of SourceForge, but my complaint would be (as a user that generally verifies cryptographic checksums) that what I downloaded didn't match what the project advertised. Looks like some remedy in the case of FileZilla is that they host their own installer as well: http://download.filezilla-project.org/FileZilla_3.7.3_win32-setup.exe http://download.filezilla-project.org/FileZilla_3.7.3_win32-... (Which matches the SF.net hosted FileZilla_3.7.3.sha512 list.) Edit: Looks like the original files can be gotten if you make your own direct link, e.g.: http://softlayer-dal.dl.sourceforge.net/project/filezilla/FileZilla_Client/3.7.3/FileZilla_3.7.3_win32-setup.exe http://softlayer-dal.dl.sourceforge.net/project/filezilla/Fi...
jms703 13y ago
wait. sourceforge is still around? i doubt those that use it read hacker news.
yogo 13y ago
> With their recent changes, users downloading from SourceForge now receive a special closed source installer which attempts to foist unrelated third party software onto them. I think this deserves an obligatory "if you aren't paying for the product, you are the product." It seems to always turn out that way. After all, these projects are popular because they are good, and they are good because the developer or developers commit the time to develop, test, and support these projects. Naturally, there has to be a way to make money in order to keep these projects going, hence the Dice move. I'm not saying I agree with it, but I think it's reasonable. In other words, there is no such thing as a free lunch.
zeruch 13y ago
As someone who was once part of the original "Ignition Team" at VA Linux for SF.net, and who is still close friends with two of the original core SF team (the first iteration of SF.net was done by just four people in <120 days IIRC) we're all pretty much in sad agreement that it's just a husk of what it once was. It's certainly dead to me.
ChuckMcM 13y ago
Short version; our author objects to how SourceForge has been monetizing their traffic. I didn't particularly like the tone, it seemed pretty mocking to me. I did not feel like that was called for. I will suggest that at some point, if you live long enough, you will cross paths with someone you knew as a young person, someone you liked and respected, who was either charged with robbery or who was earning money in a way that you don't condone. I would ask that you judge carefully at that point. It happened to me when I drove by a friend from high school who was in the median strip asking stopped traffic for money. Living in the world requires things, supplies, water, food, housing. Unless you can make those things on your own, you're stuck trading money for them. And to trade money, you have to get money. The longer you don't have enough money the lower and lower your standards tend to go. Some folks sadly decide to simply stop trying and check out of the system permanently. Life is real. So when you see a site like SourceForge, you might ask what happened, or perhaps what changed, but it doesn't get you any points for judging them harshly for trying to survive. GitHub is the new hawtness and I love what those folks are doing, but I've not seen the press release that says they are operationally profitable yet, or even cash flow positive. That will change, and when it changes you may see them having to push "partner" software your way, they may have some other plan by then, or they may just sort of evaporate in some giant acqui-hire [1]. [1] Personally I think that Github being bought by, or displaced by, an infrastructure service play like Amazon's AWS is the most likely outcome.
- dasil003 13y ago
  As far as I know Github has always been profitable.
  - ChuckMcM 13y ago
    That is entirely possible, I found this definitive statement from their press release when they raised $100MM from Horowitz: "We've done all this without any outside investment. Our company has been profitable for years, is growing fast, and doesn't need money. So why bother?" And they went on to raise $100M. Presumably their business model scales with their feature set. I hope this continues for them as I like their service and their approach.
pearjuice 13y ago
The decline started years ago with the "Wait five seconds and we will redirect you to the real download page" filled with fake download buttons describing "Tired of waiting? DOWNLOAD" et cetera. They never improved their core product (repositories are still hell to navigate through) and only added interface elements and tweaked the UI to get you to.click on ads. A shame, because before that Sourceforge was the go-to place to download homebrew, free alternatives to proprietary software. Github is great, but as it looks right now they fail to pull in those big legacy software packages. Their main audience seems to be web dev.
logn 13y ago
I was just thinking the other day how much I like sourceforge. Their site has continued to improve. It's much more usable now than it used to be. I'm ok with sf monetizing their site the best they can. They've long been an advocate of open source and I appreciate an alternative to github. It's too bad the shakeup with Dice and split off of ThinkGeek, but it makes sense. Keep in mind, sf was the alternative to sites like Cnet and download.com which were/are far worse. I'm thankful for what they've done for driving FOSS adoption over the years, especially for authors on $0 budgets before the era of abundant cloud computing on the cheap, which we realize now had significant hidden costs, including human rights.
mratzloff 13y ago
> I’m not against monetisation at all, we all have lives and need to pay our bills. OK, I'm game. How should SourceForge monetize? Just about everyone here is running ad blocking software, not that display ads pay much anymore. Not that anyone will tolerate seeing an ad for the free software they're downloading. Should SourceForge charge a monthly fee to projects? To users? Perhaps SourceForge should arrange licensing deals to make white label SourceForge clones? Maybe they should just start doing consulting on the side?
- derekp7 13y ago
  Don't they already have paid commercial hosting (along with a paid self-hosted version of their site)? I thought it was free only for software meeting one of their approved free licenses. Otherwise you have to pay.
  - mratzloff 13y ago
    Most of their projects are free licenses.

364 points by danparsonson 13y ago

ck2 13y ago

What might be really dangerous is I think they also run rpmforge (aka repoforge) and many people use them on servers for yum updates as they have newer packages sometimes. If they start messing with the releases for servers, we've got big problems. Wait, no I might be wrong about this, I really thought they were related but rpmforge might be a completely different project. Yeah I am probably wrong based on this old page: http://web.archive.org/web/20060208035034/http://rpmforge.net/about.php http://web.archive.org/web/20060208035034/http://rpmforge.ne... They just re-used the "forge" name which fine but confused me and I guess I assumed it was run by sourceforge awhile back. Sourgeforge however is owned by Slashdot's parent company, of that I am virtually positive.

hkmurakami 13y ago
That parent company would be GeekNet, Inc. http://finance.yahoo.com/q/pr?s=GKNT+Profile http://finance.yahoo.com/q/pr?s=GKNT+Profile
- Zirro 13y ago
  "In September 2012, Dice Holdings acquired SourceForge from its previous owner Geeknet" says Wikipedia. https://en.wikipedia.org/wiki/SourceForge#Acquisition https://en.wikipedia.org/wiki/SourceForge#Acquisition
  - eterm 13y ago
    But Slashdot is also listed on the Dice Holdings page. http://www.diceholdingsinc.com/ http://www.diceholdingsinc.com/
  - cothomps 13y ago
    Correct - the various companies have been re-orged into a slightly separate entity called "Slashdot Media": http://slashdotmedia.com http://slashdotmedia.com

bcraven 13y ago

It's all gone download.com - new cockney rhyming slang anyone?

bencollier49 13y ago
What does download.com rhyme with?
- talktwomey 13y ago
  Pete Tong
  - toyg 13y ago
    which, for non-cockneys, is slang for "quite wrong".
    - rorykoehein 13y ago
      * just "wrong"

harrytuttle 13y ago

Agree entirely. SourceForge is unfortunately one of those places that puts me off projects these days. It's a baron land of advertising and poorly maintained products that just add noise.

tubs 13y ago
A baron land would be a land ruled by a baron, a barren land is what you see Sourceforge as.
- PaulHoule 13y ago
  I thought that SourceForge was a barren land years ago, at least ever since they started putting interstitial ads in the downloads. As someone who sits in front of Windows but does a lot of development over ssh in Unix this is slap in the face. There are both manual and automatic ways to get the real url that you could type into axel, curl or wget, but it just shows a lack of respect for customers. I made a point to keep open source projects away from sourceforge because it was a ghetto, the same reason I didn't want to be seen on myspace. Just knowing a project is on sourceforge would bias me to think the project is not worth thinking about.
  - AdrianRossouw 13y ago
    i'm confused. don't you need to take 10 seconds to choose a mirror while we show you these ads? /s
  - Dylan16807 13y ago
    Right click and copy the url at the top of the page? I don't understand what the problem is with showing an ad underneath it.
- pessimizer 13y ago
  Just an eggcorn, everybody has them:)
- harrytuttle 13y ago

M4v3R 13y ago

The sad thing is that strategy works and it works quite well. Most people that are not very technical will just click "Next" and "Agreed" blindly to complete software installation. I've seen numerous PCs plagued with toolbars and crapware for that specific reason. I always try to educate them to always read what's on screen and never agree for the "toolbar thing", but it's mostly a lost fight.

userulluipeste 13y ago
No, it is not a lost fight. You did the right thing to rise their awareness at least once, what they will do after is their responsibility. It is one thing when they are not technical and unaware, and it is a totally different thing when they chose to be ignorant, do stupid things and support the consequences. In the second case they just are deserving it.
damian2000 13y ago
It happened to a 9 yo nephew of mine last weekend - he ended up with a fake antivirus + search engine hijacker on his laptop - reduced him to tears. Pretty disgraceful stuff.
- thelukester 13y ago
  Your 9 yo installed fake antivirus + search engine hijacker. First of all, what the hell are you doing letting a 9 yo browse on a machine with root privileges? Secondly, that has nothing to do with this story. As the article is wrongly accuses DevShare of being drive-by and malware. It is neither. An article written by someone with more than 2 brain cells can be found here: http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/ http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/
  - ams6110 13y ago
    I wasn't much older than 9 when I first used a computer, and certainly had root access (I guess that's what you'd call it, because the machine had no notion of multiple users).
13y ago

jpswade 13y ago

http://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwww.gluster.org%2F2013%2F08%2Fhow-far-the-once-mighty-sourceforge-has-fallen%2F http://webcache.googleusercontent.com/search?q=cache:http%3A...

deleted 13y ago

[deleted]

616c 13y ago

I cannot access the article as the server is down right now, but saw a summary on a forum. [0] Was this not one of the first major no-no's of computer law in the user, starting with cases like Specht vs. Netscape? [1] [0] http://inagist.com/all/370801094563467264/ http://inagist.com/all/370801094563467264/ [1] https://en.wikipedia.org/wiki/Specht_v._Netscape_Communications_Corp https://en.wikipedia.org/wiki/Specht_v._Netscape_Communicati....

jacquesm 13y ago

The mighty gluster blog seems to have fallen as well. "error establishing database connection"

coffeeaddicted 13y ago

Can you recommend alternatives that offer all their features? We use currently for example sourcecontrol, forums, bugtrackers, a wiki, the image galleries and their website hosting. I'm often unhappy with SF, but it's not quite that easy finding that kind of service elsewhere.

nailer 13y ago
github has source control, a bug tracker, and website hosting. Don't know about forums and wikis.
- webignition 13y ago
  GitHub certainly has wikis, I often use project wikis to document various bits and bobs.
- zaphoyd 13y ago
  wikis yes. forums.. not really unless you abuse the bug tracker. Github+Google Groups seems to be the complete package these days. BitBucket also provides website/wiki/issue tracker/source control features.
  - coffeeaddicted 13y ago
    Yeah, it's probably a good solution for new projects. The problem with existing projects is when you already have a quarter million posts in your forum and don't want to lose them. Although maybe a mix of providers - keeping forums on SF and moving the rest of the project might be a solution.
- eksith 13y ago
  Forum is one area Github is in a great position to enter right now. Wrangling bug tracker to act as a forum is a bit of a hack so a proper place for developers to interact and discuss projects would be most welcome.
  - 13y ago

RyanMcGreal 13y ago

How far the gluster server has fallen. Here's the text of the article: ---- How far the once mighty SourceForge has fallen… [Editor's note: This post is the opinion of the author and not necessarily that of the Gluster Community] TLDR: SourceForge, once a mighty force for the good of Open Source, has fallen far from its previous lofty heights. Dice, the new owners, bribe strongly encourage the top projects to use a new (closed source only) installer that pushes spyware / adware / malware. Developers using SourceForge should migrate away from it if they want to keep their integrity. End users using projects hosted on SourceForge should immediately find an alternative. Full version: When people download software from SourceForge, or any major repository of Open Source software, they expect the software to be trustworthy. (baring unintentional bugs) They do not expect the software to be a source of “drive by installer” style malware, spyware, adware, or any other unrelated/unintended software. SourceForge’s new owners, Dice, have consciously and deliberately moved to a model violating this trust. With their recent changes, users downloading from SourceForge now receive a special closed source installer which attempts to foist unrelated third party software onto them. For example, when a user clicks on this: http://sourceforge.net/projects/filezilla/files/FileZilla_Client/3.7.3/FileZilla_3.7.3_win32-setup.exe/download They instead receive this: http://ak.pipoffers.apnpartners.com/static/partners/dynamic/SFFZ/SFInstaller_SFFZ_filezilla_8992693_.exe This is a “drive-by installer”, designed to catch less technical users and the unwary, to fill their computers with malware / junk ware / crime ware. As abused by the notorious ask.com toolbar and others: FileZilla_drive_by_downloader_smaller It gets worse. When SourceForge introduced this, it bribed encouraged the top projects to participate by giving them a cut of the take. So these co-operating projects are also knowingly selling their users down the river. I’m not against monetisation at all, we all have lives and need to pay our bills. But not through abusing user trust. Not through preying on the unskilled or unwary. To misquote Marge Simpson; “They not only crossed the line, they threw up on it.” If you’re a developer or contributor to a SourceForge project, please ask them to move to a new project host (there are several). And cease all further involvement until it’s complete. I’ve already done so with mine. If you’re a user of a SourceForge project, please find and use an alternative project instead. We should all demonstrate our commitment to user safety and personal integrity around this issue.

Filligree 13y ago

voltagex_ 13y ago

I also posted this some time ago.

simula67 13y ago

The web installer was initially not detecting the proxy at my workplace. Hopefully popular projects like Filezilla will move their download binaries off Sourceforge.

EvaK_de 13y ago

At least SourceForge still offers a download option for the hosted projects, unlike Google Code...

af3 13y ago

Hey guys, do you know an alternative service that provides mailing lists (no Ggle groups please)?

reidrac 13y ago
I don't know why you don't want to use Google Groups, but depending on your reasons you may like http://librelist.com/ http://librelist.com/ There's also Yahoo! Groups.

laymil 13y ago

LWN had a similar feature posted yesterday which has significantly more background information. http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/ http://lwn.net/SubscriberLink/564250/0a106d6379c0d741/

drderidder 13y ago

There's a lot of good software on SourceForge still. How long before SF starts holding it ransom? Sounds like a good time to fork your favourite SF-hosted code to another service as a backup.

peterwwillis 13y ago

Okay. So SourceForge is pooping in the fishbowl at it's own party. Instead of picking up and leaving, maybe we could just make a concerted effort to ask Sourceforge to stop doing this? You don't have to demand everyone boycott a useful service like this every time something you don't like happens.

threeseed 13y ago
Are you serious ? Because you can't possibly think that asking SourceForge to "please stop making money" in order to please a handful of users will actually work.
- deleted 13y ago
  [deleted]

Thiz 13y ago

SourceForge is to github what myspace is to facebook what gm is to tesla and what slashdot is to digg, now to reddit and so on

joshuahedlund 13y ago

So SourceForge downloads are becoming as bad as Cnet? Even the once-reputable members of the download hosting industry seem to be heading towards a rather unfortunate Nash equilibrium... Hopefully Github can sustain their model without it.

bdcravens 13y ago
Github has plenty of customers who pay for private repos. They're profitable and have had some serious investment dollars injected.

haberman 13y ago

For the youngins out there, 10-15 years ago SourceForge was like GitHub is now. It was extremely popular and reputable for open-source hosting. I remember thinking that one of the first considerations when naming a new project was: is MYPROJECTNAME.sourceforge.net available? Never expected to see it decline into the spammy sketch-ville that it is now.

charonn0 13y ago
It's like a swanky hotel in a nice neighborhood deciding to start renting rooms by the hour.

JohnTHaller 13y ago

The article gets a few things very wrong. First off, there are no drive-by installers. It's an offer-based installer. Meaning that when you run it, you get a single offer of an additional product. Second, it's offering you either trialware (a trial version of a for-sale product that they hope you buy after trying) or adware (like an Ask.com toolbar to ad to your browser). The author of this blog post is either outright lying about it doing drive-by-installers and malware or is clueless about what the terminology actually means. The last time this was posted on HN, I did a quick writeup on my understanding of it (reposted here): "For the curious, this is an optional program at SourceForge being offered to developers as a way to monetize their work. The developer needs to specifically request it. SourceForge gets a cut, so does the developer. The installer is their first stab at this process and is using the bundling technology from Ask.com. As offer-based installers go, this one is about as good as it gets. It makes a single offer and has an Accept and Decline button with the user selecting whichever one they want (not a pre-checked box accepting the offer above a Next/Continue button). If accepted, the installer installs the offered software and it gets a standard entry in Windows' Add/Remove Programs that works as expected. If declined, the installer continues. The installer then downloads the originally-requested software. The two issues with the current installer are that (1) it is served in place of the requested file with no indication that a substitution is made as the user downloads and (2) it requests admin rights before it starts downloading the software, which can be a security issue. Roberto (who posted the article) has stated that they are working on #1 in terms of the text shown on SourceForge as you select to download and download. As for #2, there may be some ways to rework the installer so this is not an issue. I'll mention it to him when I speak to him. SourceForge has one other revenue-share program with developers where you place the SourceForge-branded download buttons on your own website that link to your downloads on SourceForge and you get a small cut of the ad revenue made from the download page. If I recall correctly, SourceForge has been losing money for a few years now. Dice Holdings picked up SourceForge and Slashdot while Geek.com kept ThinkGeek.com, so they are now separate entities. These new experiments are attempts to get SourceForge to be self-sustaining/profitable. Ad revenue alone likely won't cut it. Unfortunately, Google Code, Github and others don't offer the full breadth of services that SourceForge does for open source projects. Google Code, Github, and others have all ditched binary downloads, so SourceForge is one of the only providers to make binary downloads available to Windows and Mac user at no charge. This is why SourceForge is popular for real apps (FileZilla, Pidgin, PortableApps.com, etc) and Github is popular for components (node.js, jquery, rails, etc). The code zips available at other providers are of no use to end users. As full disclosure, I run PortableApps.com, one of SourceForge's largest projects pushing quite a few TBs of downloads through their mirror network. We make use of the SF-branded download buttons revenue share program but do not make use of nor have any plans to use the "enhanced" installers. Everything I've discussed here is already publicly available, I just thought it would be handy to have in one place." After that post, it was pointed out to me that Github has added in the ability to host binaries, but I would wager they wouldn't take kindly to the kind of bandwidth that the major SF projects like PortableApps.com push through. I've also been in touch with Roberto who made the mentioned post on SourceForge about some suggestions and options including doing an open source installer that the end-user/sysadmin can verify before installing instead of it being a downloader installer with the offer built in but not the app you want.

lbenes 13y ago

This article is full of hyperbole and exaggerations. I downloaded the latest filezilla with the offer-installer "malware" and scanned it with Avira free antivirus, and MS Security Essentials. Both of them reported no problem. I then was able to install filezilla without the offer-installer just by not clicking on the checkmark. After the installation, my VM ran normally, no pop-ups, no changed homepage in firefox or IE. People that write this drivel make the open source community look like a bunch of nutjob, hippy zealots with no grasp of reality. Ads pay the bills and sadly some open source developers have mouths to feed.

UncleBubba 13y ago
The problem with these install "wrappers" is that they run with elevated privileges and you do not know what they're doing. This wrapper presents the same problems as OpenCandy. Can you get the source to the installer? No. Can you guarantee the wrapper only does what they say it's doing. No. Do you have a fiduciary or contractual relationship with the publisher upon which you can rely if their software causes you harm? Probably not. Avira Free and MS Essentials are certainly not the be-all, end-all to code verification, so don't feel too secure after using them, either.
UncleBubba 13y ago
And people who identify security hazards for the unknowing masses (a group into which your apparent ignorance places you) aren't nutjobs or hippies anymore than you are a shrill dilettante. There are honest ways to monetize development without jeopardizing the safety of a tremendous number of users; unfortunately, this ain't it. Next time, present your argument without the name calling. It works better. Edit: Typo

njharman 13y ago

SourceForge has been a POS and dead to me for many years. I'm not sure it ever achieved "mightyness". Back when VA failed at what they were trying to do and started SourceForge, it was needed and they deserve praise for trail-blazing / attempting something big. But, I never really felt they carried through successfully.

opello 13y ago

I'm not sure if it's possible to get the released file out of SourceForge, but my complaint would be (as a user that generally verifies cryptographic checksums) that what I downloaded didn't match what the project advertised. Looks like some remedy in the case of FileZilla is that they host their own installer as well: http://download.filezilla-project.org/FileZilla_3.7.3_win32-setup.exe http://download.filezilla-project.org/FileZilla_3.7.3_win32-... (Which matches the SF.net hosted FileZilla_3.7.3.sha512 list.) Edit: Looks like the original files can be gotten if you make your own direct link, e.g.: http://softlayer-dal.dl.sourceforge.net/project/filezilla/FileZilla_Client/3.7.3/FileZilla_3.7.3_win32-setup.exe http://softlayer-dal.dl.sourceforge.net/project/filezilla/Fi...

jms703 13y ago

wait. sourceforge is still around? i doubt those that use it read hacker news.

yogo 13y ago

> With their recent changes, users downloading from SourceForge now receive a special closed source installer which attempts to foist unrelated third party software onto them. I think this deserves an obligatory "if you aren't paying for the product, you are the product." It seems to always turn out that way. After all, these projects are popular because they are good, and they are good because the developer or developers commit the time to develop, test, and support these projects. Naturally, there has to be a way to make money in order to keep these projects going, hence the Dice move. I'm not saying I agree with it, but I think it's reasonable. In other words, there is no such thing as a free lunch.

zeruch 13y ago

As someone who was once part of the original "Ignition Team" at VA Linux for SF.net, and who is still close friends with two of the original core SF team (the first iteration of SF.net was done by just four people in <120 days IIRC) we're all pretty much in sad agreement that it's just a husk of what it once was. It's certainly dead to me.

ChuckMcM 13y ago

Short version; our author objects to how SourceForge has been monetizing their traffic. I didn't particularly like the tone, it seemed pretty mocking to me. I did not feel like that was called for. I will suggest that at some point, if you live long enough, you will cross paths with someone you knew as a young person, someone you liked and respected, who was either charged with robbery or who was earning money in a way that you don't condone. I would ask that you judge carefully at that point. It happened to me when I drove by a friend from high school who was in the median strip asking stopped traffic for money. Living in the world requires things, supplies, water, food, housing. Unless you can make those things on your own, you're stuck trading money for them. And to trade money, you have to get money. The longer you don't have enough money the lower and lower your standards tend to go. Some folks sadly decide to simply stop trying and check out of the system permanently. Life is real. So when you see a site like SourceForge, you might ask what happened, or perhaps what changed, but it doesn't get you any points for judging them harshly for trying to survive. GitHub is the new hawtness and I love what those folks are doing, but I've not seen the press release that says they are operationally profitable yet, or even cash flow positive. That will change, and when it changes you may see them having to push "partner" software your way, they may have some other plan by then, or they may just sort of evaporate in some giant acqui-hire [1]. [1] Personally I think that Github being bought by, or displaced by, an infrastructure service play like Amazon's AWS is the most likely outcome.

dasil003 13y ago
As far as I know Github has always been profitable.
- ChuckMcM 13y ago
  That is entirely possible, I found this definitive statement from their press release when they raised $100MM from Horowitz: "We've done all this without any outside investment. Our company has been profitable for years, is growing fast, and doesn't need money. So why bother?" And they went on to raise $100M. Presumably their business model scales with their feature set. I hope this continues for them as I like their service and their approach.

pearjuice 13y ago

The decline started years ago with the "Wait five seconds and we will redirect you to the real download page" filled with fake download buttons describing "Tired of waiting? DOWNLOAD" et cetera. They never improved their core product (repositories are still hell to navigate through) and only added interface elements and tweaked the UI to get you to.click on ads. A shame, because before that Sourceforge was the go-to place to download homebrew, free alternatives to proprietary software. Github is great, but as it looks right now they fail to pull in those big legacy software packages. Their main audience seems to be web dev.

logn 13y ago

I was just thinking the other day how much I like sourceforge. Their site has continued to improve. It's much more usable now than it used to be. I'm ok with sf monetizing their site the best they can. They've long been an advocate of open source and I appreciate an alternative to github. It's too bad the shakeup with Dice and split off of ThinkGeek, but it makes sense. Keep in mind, sf was the alternative to sites like Cnet and download.com which were/are far worse. I'm thankful for what they've done for driving FOSS adoption over the years, especially for authors on $0 budgets before the era of abundant cloud computing on the cheap, which we realize now had significant hidden costs, including human rights.

mratzloff 13y ago

> I’m not against monetisation at all, we all have lives and need to pay our bills. OK, I'm game. How should SourceForge monetize? Just about everyone here is running ad blocking software, not that display ads pay much anymore. Not that anyone will tolerate seeing an ad for the free software they're downloading. Should SourceForge charge a monthly fee to projects? To users? Perhaps SourceForge should arrange licensing deals to make white label SourceForge clones? Maybe they should just start doing consulting on the side?

derekp7 13y ago
Don't they already have paid commercial hosting (along with a paid self-hosted version of their site)? I thought it was free only for software meeting one of their approved free licenses. Otherwise you have to pay.
- mratzloff 13y ago
  Most of their projects are free licenses.