11 ms·
GIMP Windows Installers move from Sourceforge to ftp.gimp.org
- chj 13y agoDownloading on Sourceforge hasn't been a pleasant experience for a long time, and we have to live with that because it's free. But now an installer? I have to say it's crazy.
- chrismorgan 13y agoAgain—that is opt-in only on the part of project maintainers. It is not mandatory.
- mathrawka 13y agoThe link in the article sums up the "what happened to Sourceforge" pretty well: http://www.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/ http://www.gluster.org/2013/08/how-far-the-once-mighty-sourc... The OSS project I maintained for several years was always in the top 10 downloaded lists on Sourceforge, but I got frustrated with how things were going and eventually moved the code to Github and hosted a simple website on my own. Honestly, I can't think of a reason why an OSS project would choose Sourceforge in this day and age.
- conductor 13y agoTheir mirrors system is working very well. It's very easy to distribute big files (like ISO images) through Sourceforge's mirrors. No wonder that Adobe's leaked users database was (or still is) being distributed using Sourceforge mirrors.
- leeoniya 13y agoi cant imagine that it's better than torrent
- conductor 13y agoI don't think it is. Sourceforge is very user-oriented (in contrast, GitHub is very coder-oriented). Non tech-savvy users don't know how to download software using torrents while HTTP just works using one click.
- Semaphor 13y ago> Sourceforge is very user-oriented For users with adblock. I would never send my technically illiterate friends to SF as there is a high chance they click on an ad instead of the real download.
- hnriot 13y agomost companies block torrent downloads. edit - I mean when at work, I can't torrent any large ova's or iso's. Sadly fortune 500 america will hardly ever allow torrent through their firewall for obvious reasons.
- JohnTHaller 13y agoMost companies block torrents. And software that does torrent downloads often gets flagged as badware. We considered building torrent into the PortableApps.com Platform and getting users to help share bandwidth with other users, but those stumbling blocks are pretty big ones.
- fredsted 13y ago>Most companies block torrents. Most companies also block random software like PortableApps.com.
- JohnTHaller 13y agoYou'd be surprised how very few do. We keep things clean, well-behaved, and virus-free for a reason.
- fredsted 13y ago
- idupree 13y agoIt's hard to download from Sourceforge using HTTPS. (Or even to use HTTPS to get the SHA hash of a download.) Can you tell me how to do it, so I can download from Sourceforge without risk of a man-in-the-middle modifying the download to, say, contain malicious code?
- simonhn 13y agoNavigating to the directory from the 'Files' tab and clicking the 'i' icon to the right of each filename available for download displays the 'View details' panel with the SHA1 hash of that file. Is that not enough?
- idupree 13y agoNo, because you can't access that hash from https://sourceforge.net/ https://sourceforge.net/ ( https://sourceforge.net/ https://sourceforge.net/ is just a redirect to http). It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet. In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html http://idupree.dreamwidth.org/3233.html ) HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.
- Theodores 13y agoI go to SourceForge for civiCRM and it works pretty well. However I am downloading something to install on a linux box where there is no .exe installer. I have heard that GitHub has been DDOSed a few times in recent times. Therefore, for me, it is swings and roundabouts.
- mathrawka 13y agoSourceforge used to get DDOSed as well. You can probably dig up some older articles on Google. But I am not sure about these days. Perhaps that is a sign of losing relevancy...
- smoyer 13y agoI used to love SourceForge so it's a bit painful to admit that it's no longer important enough to waste the bots needed for a DDOS on it. The reality seems to be that they're destroying themselves.
- JohnTHaller 13y agoThat article gets a lot of things very wrong as I pointed out when it was posted on HN last time (you'll see my comment at the top): https://news.ycombinator.com/item?id=6262347 https://news.ycombinator.com/item?id=6262347 Github is an option for some folks but not for us. We need solid file hosting with lots of bandwidth (pushing well over 50TB a month at SF) that will be sticking around next month and next year. In my comment linked above, I mention that Github ditched binary downloads (they did last year). In the ensuing discussion, it was pointed out that Github added the feature back in this year as 'Releases'. It remains to be seen if the feature will stick around, though, and I wouldn't put my all my eggs in that basket. When Github discontinued binary downloads last year, users were offered no alternative. So, it's not inconceivable that Github would pull the binary hosting feature again in the future as they stabilize their product offerings. SourceForge has been serving our binaries for 7 years now.
- jeswin 13y agoYou should then consider a better host. SourceForge is clearly a scamware host now; maybe ever since Dice.com took over. And to be honest, just seeing a file hosted on SourceForge casts doubts on the quality of the app. - Most users just click OK for installers, it is like the EULA - I am yet to see a toolbar that does anything useful to anybody; other than make their system slower and buggy. I hold a very low opinion of people (like Ask.com) who bundle things with the clear knowledge that most people are unknowingly installing their app/toolbar. Much worse than spammers. With your extensive experience with user behavior, it is interesting that you see this differently.
- jlgreco 13y ago> And to be honest, just seeing a file hosted on SourceForge casts doubts on the quality of the app. I couldn't agree more. Whenever a session of searching for a solution ultimately lands me on a sourceforge page, I feel a pit form in my stomach. When it happens it typically means one of two things, often both: I took a terribly wrong turn somewhere, and/or I am in for a world of hurt. Contrast this with finding myself on a github page, which very often signals success. My hypothesis is that a sourceforge page signals that the author is dated, the author has abandoned the software, or the author doesn't care much for the users.
- tobyjsullivan 13y agoThe state of affairs really is unfortunate. I think we can all attest to SourceForge having played a wonderful roll in the open software industry at one point. But how can anybody, no matter how loyal, support what it has become? Define your company values early.
- jevinskie 13y agoThis is also a problem with FileZilla. Sourceforge pushing adware? I never thought I would see the day - totally absurd! https://forum.filezilla-project.org/viewtopic.php?t=30240 https://forum.filezilla-project.org/viewtopic.php?t=30240
- deleted 13y ago[deleted]
- copx 13y agoSome people here seem to be seriously confused by anti-SF FUD. These ad-ware loaded installers are not the default. You have to explicitly opt-in. It provides SF and projects hosted there (a kinda shady) optional way to make money. The FileZilla installer contains ad-ware because the FileZilla developers chose to add it. It is their attempt to make money. I use SF too but none of my projects come with ad-ware installers. One should point out that bundling ad-ware is a common way developers of free (as in beer) software make money in the Windows world.. so SF has not cooked up some nefarious new scheme here.
- shadowmint 13y agoThere, fixed that typo for you: One should point out that bundling ad-ware is a common way *morally bankrupt money grabbing* developers of free (as in beer) software ...
- bad_user 13y agoAnd that's why companies like Apple or Google or Amazon or Microsoft, feel morally justified to lock-in users inside of their curated app stores. It's because of Windows and its ecosystem filled with all the scum this industry has to offer. People pay for valuable software. If people don't want to pay for your software, then it may mean that your software isn't worth paying for. And I can agree with ads loaded inside that software. In my eyes ads are a legitimate way of monetizing software. But pushing extra adware junk down on users' throats, especially plugins for other pieces of software, like browsers? That's taking it a step way too far. And this also hurts developers that are monetizing their apps by serving tasteful ads. Not to mention that it hurts the browser makers - for example my wife wants Chrome, not Firefox, because she doesn't have the expertise to keep her Firefox clean and because Firefox is more open, more extensible, I've never seen a Firefox instance on Windows that's not overloaded with third-party junk. But hey, lets poison the pool for everybody, right? Thanks guys for killing an otherwise viable business model, not to mention the only major browser built by a non-profit.
- ithinkso 13y agoIt is unbelievable what SourceForge, once amazing, became of.
- mburns 13y agoIs 'unbelievable' even remotely the right word?
- jackhammons 13y agoIt's a shame that a company which spearheaded free availability to open source code has sunken to the point of encouraging proprietary installers and adware laden applications.
- mschuster91 13y agoIf GitHub were to clone some of SFnet's features (full-featured web hosting, forum), I bet my behind on a mass SFnet exodus.
- Nux 13y agoAll good things come to an end.
- eliteraspberrie 13y agoAmazon Route 53 has a feature called Latency Based Routing, which you can use to distribute traffic to your own mirrors. With AWS, Rackspace and other similar cheap hosting, I see no reason for a SourceForge. By the way, SourceForge, Freecode (aka Freshmeat) and Slashdot were all acquired by Dice.com in September 2012.
- chrismorgan 13y agoThe GIMP uses an awful lot of bandwidth monthly, well into the terabytes monthly, I believe. PortableApps.com is another project and one which I know much more about due to my involvement; it goes through over 50TB per month and with something like S3 that is already well over $5,000 per month at a minimum. No reason for SourceForge?
- tedunangst 13y agoWhat are people downloading? At 20MB per download, that's more than 2.5 million downloads per month.
- keithpeter 13y agoYou beat me to the mental arithmetic there. I wonder what % of downloads are testing development releases and what % are downloading a stable version? I use GIMP on a linux laptop of course so it is the version in the Debian Stable repository (2.8.2 on Wheezy).
- Eiwatah4 13y ago$ 5000 seems way too much. 50 TB of traffic would cost something like $ 200 (if all downloads were from the US or Europe) to $ 450 (if all of were from South America) according to this page: https://aws.amazon.com/cloudfront/?navclick=true#pricing https://aws.amazon.com/cloudfront/?navclick=true#pricing That's still a lot of money, of course.
- josephlord 13y ago
- hrjet 13y agoSF didn't have a good sustenance plan. If they had a way to charge users directly (instead of bombarding them with ads), they could have continued to provide good service to open-source projects. As a user, it is a good idea to research the sustenance plan of a service before using it.
- jzzskijj 13y agoJust realized my Windows laptop is still at Gimp 2.6 and while at www.gimp.org let's take this as an opportunity to update to 2.8 series: Not Found The requested URL /pub/gimp/v2.8/windows/gimp-2.8.8-setup.exe was not found on this server. Bad timing for me apparently.
- teekert 13y agoBut where are the torrents? The ftp-site seems horribly congested.
- mng2 13y agoIt looks like there are several torrents out there, but an 'official' one would be nice to have.
- ash 13y agoBintray is a another service that hosts binaries for open source projects. Seems nice: https://bintray.com/ https://bintray.com/