7 ms·

Their mirrors system is working very well. It's very easy to distribute big files (like ISO images) through Sourceforge's mirrors. No wonder that Adobe's leaked

Their mirrors system is working very well. It's very easy to distribute big files (like ISO images) through Sourceforge's mirrors. No wonder that Adobe's leaked users database was (or still is) being distributed using Sourceforge mirrors.

leeoniya 13y ago
i cant imagine that it's better than torrent
- conductor 13y ago
  I don't think it is. Sourceforge is very user-oriented (in contrast, GitHub is very coder-oriented). Non tech-savvy users don't know how to download software using torrents while HTTP just works using one click.
  - Semaphor 13y ago
    > Sourceforge is very user-oriented For users with adblock. I would never send my technically illiterate friends to SF as there is a high chance they click on an ad instead of the real download.
- hnriot 13y ago
  most companies block torrent downloads. edit - I mean when at work, I can't torrent any large ova's or iso's. Sadly fortune 500 america will hardly ever allow torrent through their firewall for obvious reasons.
- JohnTHaller 13y ago
  Most companies block torrents. And software that does torrent downloads often gets flagged as badware. We considered building torrent into the PortableApps.com Platform and getting users to help share bandwidth with other users, but those stumbling blocks are pretty big ones.
  - fredsted 13y ago
    >Most companies block torrents. Most companies also block random software like PortableApps.com.
    - JohnTHaller 13y ago
      You'd be surprised how very few do. We keep things clean, well-behaved, and virus-free for a reason.
      - fredsted 13y ago
        I know you do - I use your apps. But I think writing off torrents because companies filter them isn't a reason to do so. As long as they can download random executables and run them, they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.
        JohnTHaller 13y ago
        Torrents themselves are blocked by most corporate firewalls (and many university ones). Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.
        fredsted 13y ago
        >Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. >Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn. I think that's a little far-fetched, nearly all open source projects utilize torrents for distribution with noone blocking them. Torrents are just the default way of providing high-speed software mirrors these days.
idupree 13y ago
It's hard to download from Sourceforge using HTTPS. (Or even to use HTTPS to get the SHA hash of a download.) Can you tell me how to do it, so I can download from Sourceforge without risk of a man-in-the-middle modifying the download to, say, contain malicious code?
- simonhn 13y ago
  Navigating to the directory from the 'Files' tab and clicking the 'i' icon to the right of each filename available for download displays the 'View details' panel with the SHA1 hash of that file. Is that not enough?
  - idupree 13y ago
    No, because you can't access that hash from https://sourceforge.net/ https://sourceforge.net/ ( https://sourceforge.net/ https://sourceforge.net/ is just a redirect to http). It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet. In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html http://idupree.dreamwidth.org/3233.html ) HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.

leeoniya 13y ago

i cant imagine that it's better than torrent

conductor 13y ago
I don't think it is. Sourceforge is very user-oriented (in contrast, GitHub is very coder-oriented). Non tech-savvy users don't know how to download software using torrents while HTTP just works using one click.
- Semaphor 13y ago
  > Sourceforge is very user-oriented For users with adblock. I would never send my technically illiterate friends to SF as there is a high chance they click on an ad instead of the real download.
hnriot 13y ago
most companies block torrent downloads. edit - I mean when at work, I can't torrent any large ova's or iso's. Sadly fortune 500 america will hardly ever allow torrent through their firewall for obvious reasons.
JohnTHaller 13y ago
Most companies block torrents. And software that does torrent downloads often gets flagged as badware. We considered building torrent into the PortableApps.com Platform and getting users to help share bandwidth with other users, but those stumbling blocks are pretty big ones.
- fredsted 13y ago
  >Most companies block torrents. Most companies also block random software like PortableApps.com.
  - JohnTHaller 13y ago
    You'd be surprised how very few do. We keep things clean, well-behaved, and virus-free for a reason.
    - fredsted 13y ago
      I know you do - I use your apps. But I think writing off torrents because companies filter them isn't a reason to do so. As long as they can download random executables and run them, they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.
      - JohnTHaller 13y ago
        Torrents themselves are blocked by most corporate firewalls (and many university ones). Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.
        fredsted 13y ago
        >Adding torrent abilities to the PortableApps.com Platform, even if we custom wrote it to work with our app store, would encourage places to block our whole platform. >Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn. I think that's a little far-fetched, nearly all open source projects utilize torrents for distribution with noone blocking them. Torrents are just the default way of providing high-speed software mirrors these days.

idupree 13y ago

It's hard to download from Sourceforge using HTTPS. (Or even to use HTTPS to get the SHA hash of a download.) Can you tell me how to do it, so I can download from Sourceforge without risk of a man-in-the-middle modifying the download to, say, contain malicious code?

simonhn 13y ago
Navigating to the directory from the 'Files' tab and clicking the 'i' icon to the right of each filename available for download displays the 'View details' panel with the SHA1 hash of that file. Is that not enough?
- idupree 13y ago
  No, because you can't access that hash from https://sourceforge.net/ https://sourceforge.net/ ( https://sourceforge.net/ https://sourceforge.net/ is just a redirect to http). It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet. In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html http://idupree.dreamwidth.org/3233.html ) HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.