15 ms·

GIMP-Win project wasn’t hijacked, just abandoned

228 points by chris-at 11y ago

chris-at 11y ago
> Based on our prior outreach to the GIMP-Win author, we understand that they had concerns about the presence of misleading third-party ads on SourceForge. They were not alone in those concerns — we were also concerned — leading us to establish a program to enable users and developers to help us remove misleading and confusing ads. right.
StavrosK 11y ago
So what they did was take an abandoned project, add their adware installer and release it?
- chris-at 11y ago
  https://plus.google.com/+gimp/posts/cxhB1PScFpe https://plus.google.com/+gimp/posts/cxhB1PScFpe > It appears that +SourceForge took over the control of the 'GIMP for Windows' account and is now distributing an ads-enabled installer of GIMP. They also locked out original owner of the account, Jernej Simončič, who has been building the Windows versions of GIMP for our project for years.
  - arcatek 11y ago
    Apparently happened with VLC too... > We also got outed of our +VLC project on sourceforge... > But it does not matter, we moved to our infrastructure a long time ago to our own, which is better and more powerful!
  - bill_from_tampa 11y ago
    It appears SF closed the abandoned 'gimp for windows' account, and opened a new account maintained by a sourceforge editor specifically labeled as a mirror which explained in detail what happened.
- DanBC 11y ago
  Was it an abandoned project, or was did the project just stop using Sourceforge?
  - jlgaddis 11y ago
    > Was it an abandoned project ... No. > ... or was did the project just stop using Sourceforge? Yes.
ww520 11y ago
The GIMP developer has asked SourceForge to remove the installer. Guess they just ignore him. https://mail.gnome.org/archives/gimp-developer-list/2015-May/msg00098.html https://mail.gnome.org/archives/gimp-developer-list/2015-May...
- giancarlostoro 11y ago
  This alone seems like reason enough not to use SourceForge even if just for mirroring a project. Which is what a lot of projects do including some Linux Distributions, what are alternative hosts at that point though?
  - rylee 11y ago
    Gitlab, Bitbucket, GitHub are the big three. There's a whole lot of others, but those are the ones I know off the top of my head.
    - datenwolf 11y ago
      There's also Gitorious
      - sytse 11y ago
        GitLab CEO here, Gitorious was acquired by GitLab https://about.gitlab.com/2015/03/03/gitlab-acquires-gitorious/ https://about.gitlab.com/2015/03/03/gitlab-acquires-gitoriou...
        carussell 11y ago
        It seems like there's an opportunity here for the big three. I'm thinking something along the lines of, "Don't like the way services like SourceForge are handling your project nowadays? There are better services to use; here's a list. Obviously, we'd like you to use ours. We've already set up a home for you on our service in anticipation of your stay with us, which we think you'd enjoy. You'll find that it's already fully furnished, even. Here are the keys. Give us the go-ahead and we'll aggressively pursue the takedown of badware distributors." The benefits to any of the three who go for this plan would be the host's association with such high-profile projects. GitHub may look at this and decide that at this point in their trajectory, there's just not enough in it for them, but it seems like either GitLab or Atlassian could benefit from it.
baldfat 11y ago
This makes me even more angry at SourceForge and not less. 1) There is nothing clear and open about the project being abandoned by the author 2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? 3) Is SourceForge just going to maintain any project that leaves them and makes a mirror? The sad state of Download.com and SourceForge keeps getting grimmer and grimmer.
- jarcane 11y ago
  Not to mention that sleazy line about 'helping their users avoid malware'. The search hijacker that came with my copy of FileZilla Server was the first such infection I've had in a decade.
  - adam12 11y ago
    Same here. I'm done with Sourceforge.
  - tomswartz07 11y ago
    I'm sure you're probably aware, but just in case: Ninite.com is a great resource for getting tools like this (and things like Chrome, Firefox, etc) without all of the packaged adware. I use it almost exclusively to get all of my dev tools on a Windows machine.
    - piyush_soni 11y ago
      Wow. I didn't know about it, thanks!
    - junto 11y ago
      If you already have some of those app installed, do you still need to select them on the install page or not?
      - mdekkers 11y ago
        yeah you get a custom installer
Xylemon 11y ago
I've heard about how SF has been some financial trouble, but isn't all this adware nonsense just going to hurt them more in the end? Surely some crowdfunding option could've been more of a viable effort...
- coldpie 11y ago
  They've been getting scummier and scummier. They've been doing this ad bundling thing for years, and their entire website is basically unusable without adblock. Someone at Slashdot enterprises has no idea what they're doing. At any rate, SourceForge is going to die soon. I wouldn't be surprised if Google starts to delist them for distributing malware.
- forthefuture 11y ago
  AOL has proven that as long as a sizable portion of your users are technically inept, you can extract value out of them like foie gras.
- marcosdumay 11y ago
  SF current administrator is a company despised by many of their end users. They had the option of crowfunding before it was sold, but do not have anymore.
- davidgerard 11y ago
  They're owned by a job ads and recruitment company. It's been years since they gave a hoot about the open-source businesses.
r721 11y ago
>Mirrored projects are sometimes used to deliver easy-to-decline third-party offers It's as if they know the majority of experienced users would decline those "enticing" offers.
- pbhjpbhj 11y ago
  Adobe pull this same scummy move with Flash downloads; Oracle do it with Java too. Surprised me recently setting up someone's Win 8.1 laptop as I had thought that such moves were now illegal in the EU - perhaps they are?
  - Cthulhu_ 11y ago
    Legally, no - after all, people give their express permission by leaving the box ticked. The newish anti-spam measures in the Netherlands actually forbid the 'Yes I would like to receive spam' checkboxes to be pre-checked - has to be opt-in instead of opt-out.
    - pbhjpbhj 11y ago
      I thought that was the ruling for applying whatever directive it was - that the box couldn't be pre-checked to install other software but instead the user had to check it (as in your spam example). [research ensues!] http://europa.eu/rapid/press-release_MEMO-11-675_en.htm http://europa.eu/rapid/press-release_MEMO-11-675_en.htm see (3) "Banning pre-ticked boxes on websites". I'm sure Oracle - or whoever - would argue that as the consumer isn't paying they don't have to abide by the regulation but Oracle are being paid to do it so I don't see how that's any better (in fact it's worse really).
deleted 11y ago
[deleted]
notwhereyouare 11y ago
Given that the author hasn't given them permission to distribute GIMP, much less a modified installer of GIMP, can he send a DMCA to them?
- colinbartlett 11y ago
  Does an author need to grant permission for anyone to distribute his/her GPL'ed source?
  - cowsandmilk 11y ago
    They cannot file a DMCA because there are no copyright issues. This is why popular open source projects should seek trademark protection on their names. Sure, people get angry about Mozilla's protection of the Firefox trademark, but this demonstrates that there are legitimate reasons to trademark a name so you can protect it from malicious operators.
    - nandhp 11y ago
      Which is presumably why Firefox's downloads aren't modified (I checked yesterday): http://sourceforge.net/projects/firefox.mirror/ http://sourceforge.net/projects/firefox.mirror/
  - doodpants 11y ago
    The GPL itself grants permission. Further, it prevents anyone from denying anyone else such permission. That's the whole purpose of the GPL.
- reidrac 11y ago
  They have permission as long as they comply with the license (GNU GPL v3+) and the author can't revoke a license already granted unless the license allows to do so, and the GPL doesn't allow it. See: "The Non-Revocable GPL" http://www.groklaw.net/article.php?story=2006062204552163 http://www.groklaw.net/article.php?story=2006062204552163
qrmn 11y ago
100% scummy. Question is, what do we do about it? I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, should it be? v2?/v3?) Where's the installer's source? It wraps it in one linked executable file and presents itself as an installer for it, so I am not clear that any "mere aggregation" defence would hold? There's also a reasonable argument that this brings the official project into disrepute: The GIMP may not be trademarked, but would it have to be? Firefox, of course, is trademarked. I dearly hope they've never wrapped Firefox installers with adware, because Mozilla would not like that.
- DSMan195276 11y ago
  I would assume that a non-GPL installer for GPL software would be fine, because it doesn't actually run the software, just installs it as a set of files (If it does run the program, generally it doesn't interact with it). I would equate it to using something like GNU 'indent' on proprietary software - I doubt using a GPL program to modify data would cause that data to have to be under the GPL or any other license. What is very possible is that if they integrated their installer into GIMP's installer (Since GIMP already has it's own installer), GIMP's installer is GPL so their modification would be a GPL violation unless they make the code available. If all their installer does is run GIMP's installer though, then there's no violation AFAIK.
  - true_religion 11y ago
    They could just make the code available for the installer. It's not as if an installer is software worth protecting via copyright in 2015.
- joshstrange 11y ago
  > I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, should it be? v2?/v3?) I would assume that adding in stipulations like this would actually be more of a hinderance. Who decides what is "crapware" vs legit software? I can see use cases where you would want an installer to install more than just 1 GPL app (ninite?) and I'm sure it has further implications...
simosx 11y ago
Sourceforge took over more than 300 dormant projects. Here is the list, http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ http://sourceforge.net/u/sf-editor3/profile/
- castell 11y ago
  On the list Apache Hadoop, Apache Lucene, OpenOffice, SQLite, etc. wow - if all these downloads come with an malware installer..
aikah 11y ago
Question what are the alternative solutions to distribute window binaries freely,without adware like sf or download.com ? github used to allow binary distribution but not anymore, and I don't feel like tags are a good way to do that.
- taspeotis 11y ago
  > github used to allow binary distribution but not anymore Sorry I must be missing something, what's wrong with "Upload a release asset" [1]. [1] https://developer.github.com/v3/repos/releases/#upload-a-release-asset https://developer.github.com/v3/repos/releases/#upload-a-rel...
  - djpowell 11y ago
    Github used to have a simple binary files service, this was removed with no replacement, and then the release asset system was added shortly after. I only recently found out release assets.
- userbinator 11y ago
  Depending on the download volume you expect, you could host it yourself.
bill_from_tampa 11y ago
In all fairness, the page for gimp-win on sourceforge clearly states it is a mirror of a project that is no longer distributed by the upstream author through sourceforge -- "Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information. " -> this links to a page that explains in detail what you are getting. I don't have a windows installation handy so I can't 'test' the SF installer to see if the adware or add-on programs are easy to identify and accept or refuse -- has anybody tried that?
epaga 11y ago
The whole blog post can be summarised in the one sentence "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers." Makes me pretty sad since I still remember the days when SourceForge was one of the good guys.
- moron4hire 11y ago
  When would that have been, the year 2000? I remember as early as 2003 thinking they were junk because of the intrusive banner ads with no borders that only said "Download Now!" You actually had to look for the smallest download link, verify it was actual text, then hover over it to check to see if the URL ended in your expected file name.
- Rexxar 11y ago
  They were never good guys: they start by an $10 billion IPO with the ticker "LNUX" to ride on linux success. https://en.wikipedia.org/wiki/Geeknet#Initial_public_offering https://en.wikipedia.org/wiki/Geeknet#Initial_public_offerin... http://www.nytimes.com/1999/12/10/business/a-tiny-company-without-profits-goes-public-with-a-bang.html http://www.nytimes.com/1999/12/10/business/a-tiny-company-wi...
- adekok 11y ago
  > "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers." If they just mirrored the project, no one would be complaining. Having another place to download copies of the official releases is a good idea. The issue is they changed the release. They advertised it as "mirror of Gimp-Win version X". And it wasn't. It was Gimp-Win version X with a boatload of adware / crapware. This made the Gimp-Win people upset that the crapware was being falsely associated with their product. If SF had advertised it as "SF Version of Gimp-Win with magic crapware", people would be less upset. And fewer people would download it, of course. Which isn't what SF wants. Their self-serving statement about "mirror" is a lie. The people who wrote it should be ashamed of themselves.
- ncr100 11y ago
  Seriously! How this was done was wrong. SF writes: "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available." It's wrong because it's disingenuous - an insincere representation of the GIMP maintainers package, to include adware in the package. SF insufficiently differentiates this "gimp-win" project with the small, coded byline: "Brought to you by: sf-editor1" (http://sourceforge.net/projects/gimp-win/files/ http://sourceforge.net/projects/gimp-win/files/) Let's be blatant and honest: this is "SF-GIMP" not GIMP. It's being operated here under the guise of the authors and currently not sufficiently identified as a fork. SF skirts "adoption responsibility" by simply writing a post to some unrelated blog article after the fact and create a collection of unrelated "deceptive ad blocking" website tools. RECOMMENDATIONS TO SF: * Be up front and bold about "adopting"! * Free software or not this adoption stinks!
neomech 11y ago
I moved my project to github after one of their "enticing" offers installed a vpn client that redirected all my traffic and inserted ads into my browsing, when I installed filezilla. The installer they add is designed to make it very easy to install their "offers"without your realising it. I'm very wary of any code on sf now.
- Someone1234 11y ago
  The Filezilla team also deserve some credit in that case, as they opted-in to the ads on purpose (the Filezilla team gets kickbacks from each adware install).
scrollaway 11y ago
There is zero excuse for what they did, and zero excuse for what they have been doing for the past years. Once again reposting what I said in the other thread (which seems to have been modded off the frontpage, sad). I'm one of the lead devs of LXQt and an LXDE sysadmin. We use Sourceforge for our mailing lists and some LXDE legacy stuff. I'm absolutely sick of them. It's not the first time this has happened. I've been pushing for us to move off SF for a while and this is a good occasion to push for it harder. I've sent an email [1] detailing plans to move. I am urging everyone who still has projects on Sourceforge to do the same. If you have similar migration problems to solve as the ones I've highlighted in the email, please contact me directly and we can share the workload. My email is available on my Github profile [2]. [1] http://sourceforge.net/p/lxde/mailman/message/34148903/ http://sourceforge.net/p/lxde/mailman/message/34148903/ [2] https://github.com/jleclanche https://github.com/jleclanche
- Touche 11y ago
  It's unfortunate there aren't many good hosted mailing list services out there. Google Groups makes it hard to use without a google id, and mailman is tricky to setup/maintain.
  - aDevilInMe 11y ago
    Have a look at freelists www.freelists.org/
    - tomswartz07 11y ago
      I love their Terms of Service: > I have read and agree to the above terms , and agree that if I ask FreeLists for email addresses or send SPAM using their resources, they have permission to inflict severe pain on me with large, blunt objects. [emphasis mine]
      - digi_owl 11y ago
        Oh that brings to mind the old User Friendly comic attitude. We really need more of that these days.
ntakasaki 11y ago
Dice Holdings also bought Slashdot, and now there are things that look out of place, like the Kate Upton ad for God of War, Slashdot Deals [1], and annoying ads as tweets on the twitter account which made me unfollow. [1] https://deals.slashdot.org/?utm_source=slashdot&utm_medium=navbar&utm_campaign=dealshp_1 https://deals.slashdot.org/?utm_source=slashdot&utm_medium=n... Would be interesting to see if Slashdot posts this story.
- johnduhart 11y ago
  > Slashdot Deals This has to be some prank, they can't be serious about that.
- johnduhart 11y ago
  You wouldn't believe what launched today: http://sourceforge.net/blog/introducing-sourceforge-deals/ http://sourceforge.net/blog/introducing-sourceforge-deals/
nodata 11y ago
Bye sourceforge!
- danellis 11y ago
  I'm astonished they lasted this long. The only unique thing they ever did was their compile farm, now long gone.
_lce0 11y ago
Lets take action and report the website so browsers warn users once they try to navigate to the page. https://www.stopbadware.org/ https://www.stopbadware.org/ Please report the entire website, not just some project. They had distributed enough malware already.
moron4hire 11y ago
>> Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available. So in other words, GIMP-Win was hijacked, just not by a 3rd party.
JimmaDaRustla 11y ago
Source Forge has been doing this for a while now, not just gimp. Pretty sure I downloaded Synergy and it deceivingly downloaded a common installer which was small and installed adware as it downloaded the proper executable which you desired to download in the first place
- DanBC 11y ago
  There are two problems. 1) wrapping the software in the sourceforge installer which includes adware. (That's what you mention). 2) having a page that looks like an official project page and distributing the software. This is bad for bla bunch of reasons, including 1) above.
zak_mc_kracken 11y ago
That is some crazy amount of spin. SourceForge started their path down the scummy side a while ago but this is really taking it to a new level. You'd think that if they really cared, they would back pedal on what they did, but no, instead, they double down by trying to justify what they did and "welcoming further discussions". Also, this: > deliver easy-to-decline third-party offers How about delivering third-party offers that users need to opt in instead? Terrible, terrible company and organization.
- Lawtonfogle 11y ago
  Software that requires opt out should be considered as malicious as software that doesn't give the ability to opt out.
thebouv 11y ago
I have good memories of SF being the hub of OSS back in the day. I was particularly fond of how projects could actively post types of people they were looking for (artists, doc writers, etc) instead of just relying on being stumbled upon and/or just listing an issue. However, recently, I cringe if I somehow end up at an SF link. Feels like I'm on the wrong side of the Internet and that I can't trust any downloads from them.
Lawtonfogle 11y ago
Why don't they (SourceForge but also all the other software vendors out there, even Oracle with the Java and Ask.com bundling) just have it so it automatically installs all the crapware instead of asking you? Last I checked, it was because this would get them treated as outright malicious. I suggest that we consider such offers where the default option is to install them to be considered as malicious as installing them without asking.
owly 11y ago
Sourceforge has been dead to me for a while now. I think it started with FileZilla.
fithisux 11y ago
It is a pitty because I use SF often. I think that the problems could be solved if we could use something like pkgsrc on Windows. Unfortunately this is not a reality or an option but it would be a good alternative. Msys2 project gives a few of these apps as binaries. But it would be more user friendly if we could just download from a source repository and compile locally on windows.
- carussell 11y ago
  Windows 10 is supposed to finally ship with something resembling a proper package manager. Or something.
m_mueller 11y ago
Isn't this a problem with overly permissive licences used in most OSS? AFAIK there is nothing stopping any commercial entity to just resell you OSS as-is (in case of GPL they just have to link to sources as well). There's also nothing stopping them from putting ad- and malware in, correct? IMO it might be a good idea to put some limits into OSS licences - even if most projects wouldn't have the means for litigation, at least it would give pause to some legal departments of such companies trying to abuse OSS. I'd also advocate to have a standard license similar to creative commons for non-commercial use. Why not adding some semi-enforced sponsorship element into OSS projects that are heavily used commercially?
- TazeTSchnitzel 11y ago
  The problem isn't the bundling of malware per se. It's SourceForge hijacking the site.
- carussell 11y ago
  This is true of any software that's freely redistributable. There's nothing particular to FOSS that enables what's going on in this case. (In theory, the source allows them to change it at the source-level and bake the badware in, but SourceForge doesn't seem to be doing that.)
abulman 11y ago
Whenever a download link (and more often than not, for me, it's usually for a server-based tool) goes to Sourceforge, I cringe - more than a little. For Linux based tools, its because a simple 'wget' for a file is going to end up with a comlex filename that I have to rename. This, at least, is a simple problem for me to fix. For desktop software, I'm more concerned after hearing of projects being wrapped in Adware/malware. This is a particular problem on sites like http://download.cnet.com http://download.cnet.com. I've been online since at least 1996, and those sites used to be great to be able to find useful software. Now, I prefer to not install much new software, in order to keep a stable desktop (and it does work - I've only had to wipe my desktop and install Windows from scratch once or twice in my entire online career, I get new PCs more often). I've even seen jobs posted on some sites to work on open-source code - but then the project is hosted on sourceforge.net, and so it is using Subversion for version control. While I may be expert on the underlying technologies that particular project used (and the language) - its not something that would ever convince me to help them - not even while being well paid (and working remotely, which is what I'm aiming to do from now on).
SwellJoe 11y ago
So, this is a reminder (and a very harsh one) that trusting third parties with your projects may be a risky decision. I see many people suggesting moving off of SourceForge to Github. While we moved most of our stuff to github years ago, and I like github and have no major complaints about them today, I'm having doubts about the wisdom of staying on any third party hosting site, no matter how nice they seem today. Let's put this in context: SourceForge was once (this was many, many years ago) a deeply trustworthy entity. They were excellent stewards of Open Source projects. They consistently took guidance from the community, and wouldn't have chosen profits over users or projects (though, certainly, they've profited). Markets change, leadership changes, acquisitions happen. One day, we may not recognize github as the entity we know today, just as we don't recognize the entity that SourceForge has become. I'm not saying don't move to github. Obviously, nobody should be starting new projects on SourceForge and github is one of the better third party alternatives. But, it may be worth thinking about what happens when we as an Open Source community build up another SF.net like entity. A central repository for all the most popular Open Source software, controlled by one profit-driven corporation. Maybe it was worth the tradeoff. Maybe SourceForge provided enough value over the years to where it's not worth belly-aching about having to rebuild our communities around new tools (maybe even another third party tool), and to educate users that SourceForge is now an untrustworthy provider that should be avoided. Maybe we have to just mourn the loss of a once great supporter of Open Source software and move on to another that will likely, someday, also turn its back on Open Source values in pursuit of profits. I hate trash-talking SourceForge so harshly, as projects I've been involved in have been well-served by SF.net in the past (and even now, we're pushing out terabytes of downloads through their mirrors, even though we've moved our revision control to github long ago). But, the company as it exists today is nothing like what it once was. I must assume none of the original founders remain given how far this strays from the original vision of the thing, and certainly it's been through multiple acquisitions and leadership changes. Maybe I shouldn't feel so bad about it...maybe the SourceForge I knew has been dead for years, and I just didn't notice as it's taken a while to start to smell.
- drzaiusapelord 11y ago
  Why can't someone make a hosting site with a no crapware rule? I understand monetization is a big issue, but I'd be willing to sit through a 10-15 second forced ad to get a nice FOSS product. This mentality of installing random "utilities" and search hijackers on PC's needs to end. I can't imagine these things outpaying video ads directed right at our demographic. In the age of cheap bandwidth and cheap servers, how is this not massively profitable?
dilap 11y ago
Wow, it's not clear at all that the SF page is a "mirror" of the official project, and for now it remains the first google result. What assholes.
userbinator 11y ago
Personally, I see this as one of the natural consequences of permissively-licensed software, and the freedom of being able to obtain such from the open Internet. This is a feature, not a bug. If you want something with more security guarantees, then use the walled-garden app stores. It reduces your chances of getting malware, but also reduces the choices available to you. Whether or not people like what SF is doing does not change the fact that it is legal under the GPL. I hate adware myself, but if someone chooses to distribute it legally, then I respect their freedom to... and the only thing I would do is tell the users so they can make an informed decision. The official GIMP site has made a notice about this already. As long as computing platforms exist which allow users to install any software, from anywhere they choose, they will eventually install something they don't want (and even in walled-garden app store environments they still manage to.) Something to think about: "Freedom is not worth having if it does not include the freedom to make mistakes."
- TazeTSchnitzel 11y ago
  The problem is SourceForge hijacking the GIMP site
  - userbinator 11y ago
    The official site is http://www.gimp.org/ http://www.gimp.org/ and it has nothing to do with SourceForge.
    - TazeTSchnitzel 11y ago
      So? SourceForge hijacked the GIMP page on SourceForge, which shows up in search results for GIMP downloads.
m_mueller 11y ago
Isn't this a problem with overly permissive licences used in most OSS? AFAIK there is nothing stopping any commercial entity to just resell you OSS as-is (in case of GPL they just have to link to sources as well). There's also nothing stopping them from putting ad- and malware in, correct? IMO it might be a good idea to put some limits into OSS licences - even if most projects wouldn't have the means for litigation, at least it would give pause to some legal departments of such companies trying to abuse OSS. I'd also advocate to have a standard license similar to creative commons for non-commercial use. Why not adding some semi-enforced sponsorship element into OSS projects that are heavily used commercially?
helb 11y ago
So in fact it was hijacked… by SF. My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off. Also, old HN post on "what happened to Sourceforge": https://news.ycombinator.com/item?id=6700115 https://news.ycombinator.com/item?id=6700115
- jlgaddis 11y ago
  > My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off. Please do. IIRC, most (all?) of their mirrors are provided by third-parties who are graciously offering their resources and SourceForge is taking advantage of them to serve up and profit from adware/malware installers.
u04f061 11y ago
They are doing something with GIMP what they did to VLC.
Pxtl 11y ago
So they take the code from a 3rd party, compile it into an installer with malware bolted on, and reap the profits from the malware. Yeah, hijacked.
proactivesvcs 11y ago
I'm sure we only hear about "easy to decline/opt-out/remove" software when it is something nobody ever wants. If the first feature of your software is that it's easy to decline, maybe it's time to pack up shop.
nothrabannosir 11y ago
They show their true colors in the last paragraph: We welcome further discussion about how SourceForge can best serve the GIMP-Win author. Just stop. How disingenuous can you be? What a disgrace. Do we really need to go there? Ok, how about: "completely suspend and remove the project, and don't let the name be reclaimed." Source Forge is trying to convince us they never thought of that. Really? Give me a break. You knew. You just don't care. Fine, you don't. But don't try to play that off as ignorance. "Oh, yeah, please enlighten us with further discussion!" Get out of here, stop wasting our time. They could just as well have done away with the blog post and put up an image of a giant middle finger, instead. At least that would have been honest.
- astrodust 11y ago
  We should start discussing how they can shut themselves down and rid the world of the blight that SourceForge has become. RubyForge folded and the world was better off.
codazoda 11y ago
"Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available." Well, there's your problem.
fixermark 11y ago
tl;dr "Hey, it's not our fault that we adopted policies so offensive to the project maintainer that they utterly washed their hands of us, but the license of GIMP basically prevents them from preventing us from distributing the software inside of our third-party shovelware bundle..." Good job SourceForge. A++ would never download anything from again.
DanBC 11y ago
Gimp should just push an update that has a "Stop using Sourceforge" splash screen and see if Sourceforge distributes that new version. It's a shame. Sourceforge used to be really good.
worklogin 11y ago
I also notice this isn't covered by Slashdot, who is owned by DHI, who owns Sourceforge.
kjs3 11y ago
I think I've recommended sourceforge.net be added to the webfilter global block list at every client I've worked with in the last 5 years. Once I pointed out the risk of their drive-by download strategy, no one has said no, and very rarely has an end-user complained (something almost always remedied by finding a legitimate download site for them).
fapjacks 11y ago
Fuck SourceForge. The people that bought it blew it.
helb 11y ago
http://helb.github.io/goodbye-sourceforge/ http://helb.github.io/goodbye-sourceforge/

228 points by chris-at 11y ago

> Based on our prior outreach to the GIMP-Win author, we understand that they had concerns about the presence of misleading third-party ads on SourceForge. They were not alone in those concerns — we were also concerned — leading us to establish a program to enable users and developers to help us remove misleading and confusing ads. right.

StavrosK 11y ago

So what they did was take an abandoned project, add their adware installer and release it?

chris-at 11y ago
https://plus.google.com/+gimp/posts/cxhB1PScFpe https://plus.google.com/+gimp/posts/cxhB1PScFpe > It appears that +SourceForge took over the control of the 'GIMP for Windows' account and is now distributing an ads-enabled installer of GIMP. They also locked out original owner of the account, Jernej Simončič, who has been building the Windows versions of GIMP for our project for years.
- arcatek 11y ago
  Apparently happened with VLC too... > We also got outed of our +VLC project on sourceforge... > But it does not matter, we moved to our infrastructure a long time ago to our own, which is better and more powerful!
- bill_from_tampa 11y ago
  It appears SF closed the abandoned 'gimp for windows' account, and opened a new account maintained by a sourceforge editor specifically labeled as a mirror which explained in detail what happened.
DanBC 11y ago
Was it an abandoned project, or was did the project just stop using Sourceforge?
- jlgaddis 11y ago
  > Was it an abandoned project ... No. > ... or was did the project just stop using Sourceforge? Yes.

ww520 11y ago

The GIMP developer has asked SourceForge to remove the installer. Guess they just ignore him. https://mail.gnome.org/archives/gimp-developer-list/2015-May/msg00098.html https://mail.gnome.org/archives/gimp-developer-list/2015-May...

giancarlostoro 11y ago
This alone seems like reason enough not to use SourceForge even if just for mirroring a project. Which is what a lot of projects do including some Linux Distributions, what are alternative hosts at that point though?
- rylee 11y ago
  Gitlab, Bitbucket, GitHub are the big three. There's a whole lot of others, but those are the ones I know off the top of my head.
  - datenwolf 11y ago
    There's also Gitorious
    - sytse 11y ago
      GitLab CEO here, Gitorious was acquired by GitLab https://about.gitlab.com/2015/03/03/gitlab-acquires-gitorious/ https://about.gitlab.com/2015/03/03/gitlab-acquires-gitoriou...
      - carussell 11y ago
        It seems like there's an opportunity here for the big three. I'm thinking something along the lines of, "Don't like the way services like SourceForge are handling your project nowadays? There are better services to use; here's a list. Obviously, we'd like you to use ours. We've already set up a home for you on our service in anticipation of your stay with us, which we think you'd enjoy. You'll find that it's already fully furnished, even. Here are the keys. Give us the go-ahead and we'll aggressively pursue the takedown of badware distributors." The benefits to any of the three who go for this plan would be the host's association with such high-profile projects. GitHub may look at this and decide that at this point in their trajectory, there's just not enough in it for them, but it seems like either GitLab or Atlassian could benefit from it.

baldfat 11y ago

This makes me even more angry at SourceForge and not less. 1) There is nothing clear and open about the project being abandoned by the author 2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? 3) Is SourceForge just going to maintain any project that leaves them and makes a mirror? The sad state of Download.com and SourceForge keeps getting grimmer and grimmer.

jarcane 11y ago
Not to mention that sleazy line about 'helping their users avoid malware'. The search hijacker that came with my copy of FileZilla Server was the first such infection I've had in a decade.
- adam12 11y ago
  Same here. I'm done with Sourceforge.
- tomswartz07 11y ago
  I'm sure you're probably aware, but just in case: Ninite.com is a great resource for getting tools like this (and things like Chrome, Firefox, etc) without all of the packaged adware. I use it almost exclusively to get all of my dev tools on a Windows machine.
  - piyush_soni 11y ago
    Wow. I didn't know about it, thanks!
  - junto 11y ago
    If you already have some of those app installed, do you still need to select them on the install page or not?
    - mdekkers 11y ago
      yeah you get a custom installer

Xylemon 11y ago

I've heard about how SF has been some financial trouble, but isn't all this adware nonsense just going to hurt them more in the end? Surely some crowdfunding option could've been more of a viable effort...

coldpie 11y ago
They've been getting scummier and scummier. They've been doing this ad bundling thing for years, and their entire website is basically unusable without adblock. Someone at Slashdot enterprises has no idea what they're doing. At any rate, SourceForge is going to die soon. I wouldn't be surprised if Google starts to delist them for distributing malware.
forthefuture 11y ago
AOL has proven that as long as a sizable portion of your users are technically inept, you can extract value out of them like foie gras.
marcosdumay 11y ago
SF current administrator is a company despised by many of their end users. They had the option of crowfunding before it was sold, but do not have anymore.
davidgerard 11y ago
They're owned by a job ads and recruitment company. It's been years since they gave a hoot about the open-source businesses.

r721 11y ago

>Mirrored projects are sometimes used to deliver easy-to-decline third-party offers It's as if they know the majority of experienced users would decline those "enticing" offers.

pbhjpbhj 11y ago
Adobe pull this same scummy move with Flash downloads; Oracle do it with Java too. Surprised me recently setting up someone's Win 8.1 laptop as I had thought that such moves were now illegal in the EU - perhaps they are?
- Cthulhu_ 11y ago
  Legally, no - after all, people give their express permission by leaving the box ticked. The newish anti-spam measures in the Netherlands actually forbid the 'Yes I would like to receive spam' checkboxes to be pre-checked - has to be opt-in instead of opt-out.
  - pbhjpbhj 11y ago
    I thought that was the ruling for applying whatever directive it was - that the box couldn't be pre-checked to install other software but instead the user had to check it (as in your spam example). [research ensues!] http://europa.eu/rapid/press-release_MEMO-11-675_en.htm http://europa.eu/rapid/press-release_MEMO-11-675_en.htm see (3) "Banning pre-ticked boxes on websites". I'm sure Oracle - or whoever - would argue that as the consumer isn't paying they don't have to abide by the regulation but Oracle are being paid to do it so I don't see how that's any better (in fact it's worse really).

deleted 11y ago

[deleted]

notwhereyouare 11y ago

Given that the author hasn't given them permission to distribute GIMP, much less a modified installer of GIMP, can he send a DMCA to them?

colinbartlett 11y ago
Does an author need to grant permission for anyone to distribute his/her GPL'ed source?
- cowsandmilk 11y ago
  They cannot file a DMCA because there are no copyright issues. This is why popular open source projects should seek trademark protection on their names. Sure, people get angry about Mozilla's protection of the Firefox trademark, but this demonstrates that there are legitimate reasons to trademark a name so you can protect it from malicious operators.
  - nandhp 11y ago
    Which is presumably why Firefox's downloads aren't modified (I checked yesterday): http://sourceforge.net/projects/firefox.mirror/ http://sourceforge.net/projects/firefox.mirror/
- doodpants 11y ago
  The GPL itself grants permission. Further, it prevents anyone from denying anyone else such permission. That's the whole purpose of the GPL.
reidrac 11y ago
They have permission as long as they comply with the license (GNU GPL v3+) and the author can't revoke a license already granted unless the license allows to do so, and the GPL doesn't allow it. See: "The Non-Revocable GPL" http://www.groklaw.net/article.php?story=2006062204552163 http://www.groklaw.net/article.php?story=2006062204552163

qrmn 11y ago

100% scummy. Question is, what do we do about it? I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, should it be? v2?/v3?) Where's the installer's source? It wraps it in one linked executable file and presents itself as an installer for it, so I am not clear that any "mere aggregation" defence would hold? There's also a reasonable argument that this brings the official project into disrepute: The GIMP may not be trademarked, but would it have to be? Firefox, of course, is trademarked. I dearly hope they've never wrapped Firefox installers with adware, because Mozilla would not like that.

DSMan195276 11y ago
I would assume that a non-GPL installer for GPL software would be fine, because it doesn't actually run the software, just installs it as a set of files (If it does run the program, generally it doesn't interact with it). I would equate it to using something like GNU 'indent' on proprietary software - I doubt using a GPL program to modify data would cause that data to have to be under the GPL or any other license. What is very possible is that if they integrated their installer into GIMP's installer (Since GIMP already has it's own installer), GIMP's installer is GPL so their modification would be a GPL violation unless they make the code available. If all their installer does is run GIMP's installer though, then there's no violation AFAIK.
- true_religion 11y ago
  They could just make the code available for the installer. It's not as if an installer is software worth protecting via copyright in 2015.
joshstrange 11y ago
> I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, should it be? v2?/v3?) I would assume that adding in stipulations like this would actually be more of a hinderance. Who decides what is "crapware" vs legit software? I can see use cases where you would want an installer to install more than just 1 GPL app (ninite?) and I'm sure it has further implications...

simosx 11y ago

Sourceforge took over more than 300 dormant projects. Here is the list, http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor2/profile/ http://sourceforge.net/u/sf-editor3/profile/ http://sourceforge.net/u/sf-editor3/profile/

castell 11y ago
On the list Apache Hadoop, Apache Lucene, OpenOffice, SQLite, etc. wow - if all these downloads come with an malware installer..

aikah 11y ago

Question what are the alternative solutions to distribute window binaries freely,without adware like sf or download.com ? github used to allow binary distribution but not anymore, and I don't feel like tags are a good way to do that.

taspeotis 11y ago
> github used to allow binary distribution but not anymore Sorry I must be missing something, what's wrong with "Upload a release asset" [1]. [1] https://developer.github.com/v3/repos/releases/#upload-a-release-asset https://developer.github.com/v3/repos/releases/#upload-a-rel...
- djpowell 11y ago
  Github used to have a simple binary files service, this was removed with no replacement, and then the release asset system was added shortly after. I only recently found out release assets.
userbinator 11y ago
Depending on the download volume you expect, you could host it yourself.

bill_from_tampa 11y ago

In all fairness, the page for gimp-win on sourceforge clearly states it is a mirror of a project that is no longer distributed by the upstream author through sourceforge -- "Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information. " -> this links to a page that explains in detail what you are getting. I don't have a windows installation handy so I can't 'test' the SF installer to see if the adware or add-on programs are easy to identify and accept or refuse -- has anybody tried that?

epaga 11y ago

The whole blog post can be summarised in the one sentence "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers." Makes me pretty sad since I still remember the days when SourceForge was one of the good guys.

moron4hire 11y ago
When would that have been, the year 2000? I remember as early as 2003 thinking they were junk because of the intrusive banner ads with no borders that only said "Download Now!" You actually had to look for the smallest download link, verify it was actual text, then hover over it to check to see if the URL ended in your expected file name.
Rexxar 11y ago
They were never good guys: they start by an $10 billion IPO with the ticker "LNUX" to ride on linux success. https://en.wikipedia.org/wiki/Geeknet#Initial_public_offering https://en.wikipedia.org/wiki/Geeknet#Initial_public_offerin... http://www.nytimes.com/1999/12/10/business/a-tiny-company-without-profits-goes-public-with-a-bang.html http://www.nytimes.com/1999/12/10/business/a-tiny-company-wi...
adekok 11y ago
> "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers." If they just mirrored the project, no one would be complaining. Having another place to download copies of the official releases is a good idea. The issue is they changed the release. They advertised it as "mirror of Gimp-Win version X". And it wasn't. It was Gimp-Win version X with a boatload of adware / crapware. This made the Gimp-Win people upset that the crapware was being falsely associated with their product. If SF had advertised it as "SF Version of Gimp-Win with magic crapware", people would be less upset. And fewer people would download it, of course. Which isn't what SF wants. Their self-serving statement about "mirror" is a lie. The people who wrote it should be ashamed of themselves.
ncr100 11y ago
Seriously! How this was done was wrong. SF writes: "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available." It's wrong because it's disingenuous - an insincere representation of the GIMP maintainers package, to include adware in the package. SF insufficiently differentiates this "gimp-win" project with the small, coded byline: "Brought to you by: sf-editor1" (http://sourceforge.net/projects/gimp-win/files/ http://sourceforge.net/projects/gimp-win/files/) Let's be blatant and honest: this is "SF-GIMP" not GIMP. It's being operated here under the guise of the authors and currently not sufficiently identified as a fork. SF skirts "adoption responsibility" by simply writing a post to some unrelated blog article after the fact and create a collection of unrelated "deceptive ad blocking" website tools. RECOMMENDATIONS TO SF: * Be up front and bold about "adopting"! * Free software or not this adoption stinks!

neomech 11y ago

I moved my project to github after one of their "enticing" offers installed a vpn client that redirected all my traffic and inserted ads into my browsing, when I installed filezilla. The installer they add is designed to make it very easy to install their "offers"without your realising it. I'm very wary of any code on sf now.

Someone1234 11y ago
The Filezilla team also deserve some credit in that case, as they opted-in to the ads on purpose (the Filezilla team gets kickbacks from each adware install).

scrollaway 11y ago

There is zero excuse for what they did, and zero excuse for what they have been doing for the past years. Once again reposting what I said in the other thread (which seems to have been modded off the frontpage, sad). I'm one of the lead devs of LXQt and an LXDE sysadmin. We use Sourceforge for our mailing lists and some LXDE legacy stuff. I'm absolutely sick of them. It's not the first time this has happened. I've been pushing for us to move off SF for a while and this is a good occasion to push for it harder. I've sent an email [1] detailing plans to move. I am urging everyone who still has projects on Sourceforge to do the same. If you have similar migration problems to solve as the ones I've highlighted in the email, please contact me directly and we can share the workload. My email is available on my Github profile [2]. [1] http://sourceforge.net/p/lxde/mailman/message/34148903/ http://sourceforge.net/p/lxde/mailman/message/34148903/ [2] https://github.com/jleclanche https://github.com/jleclanche

Touche 11y ago
It's unfortunate there aren't many good hosted mailing list services out there. Google Groups makes it hard to use without a google id, and mailman is tricky to setup/maintain.
- aDevilInMe 11y ago
  Have a look at freelists www.freelists.org/
  - tomswartz07 11y ago
    I love their Terms of Service: > I have read and agree to the above terms , and agree that if I ask FreeLists for email addresses or send SPAM using their resources, they have permission to inflict severe pain on me with large, blunt objects. [emphasis mine]
    - digi_owl 11y ago
      Oh that brings to mind the old User Friendly comic attitude. We really need more of that these days.

ntakasaki 11y ago

Dice Holdings also bought Slashdot, and now there are things that look out of place, like the Kate Upton ad for God of War, Slashdot Deals [1], and annoying ads as tweets on the twitter account which made me unfollow. [1] https://deals.slashdot.org/?utm_source=slashdot&utm_medium=navbar&utm_campaign=dealshp_1 https://deals.slashdot.org/?utm_source=slashdot&utm_medium=n... Would be interesting to see if Slashdot posts this story.

johnduhart 11y ago
> Slashdot Deals This has to be some prank, they can't be serious about that.
johnduhart 11y ago
You wouldn't believe what launched today: http://sourceforge.net/blog/introducing-sourceforge-deals/ http://sourceforge.net/blog/introducing-sourceforge-deals/

nodata 11y ago

Bye sourceforge!

danellis 11y ago
I'm astonished they lasted this long. The only unique thing they ever did was their compile farm, now long gone.

_lce0 11y ago

Lets take action and report the website so browsers warn users once they try to navigate to the page. https://www.stopbadware.org/ https://www.stopbadware.org/ Please report the entire website, not just some project. They had distributed enough malware already.

moron4hire 11y ago

>> Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available. So in other words, GIMP-Win was hijacked, just not by a 3rd party.

JimmaDaRustla 11y ago

Source Forge has been doing this for a while now, not just gimp. Pretty sure I downloaded Synergy and it deceivingly downloaded a common installer which was small and installed adware as it downloaded the proper executable which you desired to download in the first place

DanBC 11y ago
There are two problems. 1) wrapping the software in the sourceforge installer which includes adware. (That's what you mention). 2) having a page that looks like an official project page and distributing the software. This is bad for bla bunch of reasons, including 1) above.

zak_mc_kracken 11y ago

That is some crazy amount of spin. SourceForge started their path down the scummy side a while ago but this is really taking it to a new level. You'd think that if they really cared, they would back pedal on what they did, but no, instead, they double down by trying to justify what they did and "welcoming further discussions". Also, this: > deliver easy-to-decline third-party offers How about delivering third-party offers that users need to opt in instead? Terrible, terrible company and organization.

Lawtonfogle 11y ago
Software that requires opt out should be considered as malicious as software that doesn't give the ability to opt out.

thebouv 11y ago

I have good memories of SF being the hub of OSS back in the day. I was particularly fond of how projects could actively post types of people they were looking for (artists, doc writers, etc) instead of just relying on being stumbled upon and/or just listing an issue. However, recently, I cringe if I somehow end up at an SF link. Feels like I'm on the wrong side of the Internet and that I can't trust any downloads from them.

Lawtonfogle 11y ago

Why don't they (SourceForge but also all the other software vendors out there, even Oracle with the Java and Ask.com bundling) just have it so it automatically installs all the crapware instead of asking you? Last I checked, it was because this would get them treated as outright malicious. I suggest that we consider such offers where the default option is to install them to be considered as malicious as installing them without asking.

owly 11y ago

Sourceforge has been dead to me for a while now. I think it started with FileZilla.

fithisux 11y ago

It is a pitty because I use SF often. I think that the problems could be solved if we could use something like pkgsrc on Windows. Unfortunately this is not a reality or an option but it would be a good alternative. Msys2 project gives a few of these apps as binaries. But it would be more user friendly if we could just download from a source repository and compile locally on windows.

carussell 11y ago
Windows 10 is supposed to finally ship with something resembling a proper package manager. Or something.

m_mueller 11y ago

Isn't this a problem with overly permissive licences used in most OSS? AFAIK there is nothing stopping any commercial entity to just resell you OSS as-is (in case of GPL they just have to link to sources as well). There's also nothing stopping them from putting ad- and malware in, correct? IMO it might be a good idea to put some limits into OSS licences - even if most projects wouldn't have the means for litigation, at least it would give pause to some legal departments of such companies trying to abuse OSS. I'd also advocate to have a standard license similar to creative commons for non-commercial use. Why not adding some semi-enforced sponsorship element into OSS projects that are heavily used commercially?

TazeTSchnitzel 11y ago
The problem isn't the bundling of malware per se. It's SourceForge hijacking the site.
carussell 11y ago
This is true of any software that's freely redistributable. There's nothing particular to FOSS that enables what's going on in this case. (In theory, the source allows them to change it at the source-level and bake the badware in, but SourceForge doesn't seem to be doing that.)

abulman 11y ago

Whenever a download link (and more often than not, for me, it's usually for a server-based tool) goes to Sourceforge, I cringe - more than a little. For Linux based tools, its because a simple 'wget' for a file is going to end up with a comlex filename that I have to rename. This, at least, is a simple problem for me to fix. For desktop software, I'm more concerned after hearing of projects being wrapped in Adware/malware. This is a particular problem on sites like http://download.cnet.com http://download.cnet.com. I've been online since at least 1996, and those sites used to be great to be able to find useful software. Now, I prefer to not install much new software, in order to keep a stable desktop (and it does work - I've only had to wipe my desktop and install Windows from scratch once or twice in my entire online career, I get new PCs more often). I've even seen jobs posted on some sites to work on open-source code - but then the project is hosted on sourceforge.net, and so it is using Subversion for version control. While I may be expert on the underlying technologies that particular project used (and the language) - its not something that would ever convince me to help them - not even while being well paid (and working remotely, which is what I'm aiming to do from now on).

SwellJoe 11y ago

So, this is a reminder (and a very harsh one) that trusting third parties with your projects may be a risky decision. I see many people suggesting moving off of SourceForge to Github. While we moved most of our stuff to github years ago, and I like github and have no major complaints about them today, I'm having doubts about the wisdom of staying on any third party hosting site, no matter how nice they seem today. Let's put this in context: SourceForge was once (this was many, many years ago) a deeply trustworthy entity. They were excellent stewards of Open Source projects. They consistently took guidance from the community, and wouldn't have chosen profits over users or projects (though, certainly, they've profited). Markets change, leadership changes, acquisitions happen. One day, we may not recognize github as the entity we know today, just as we don't recognize the entity that SourceForge has become. I'm not saying don't move to github. Obviously, nobody should be starting new projects on SourceForge and github is one of the better third party alternatives. But, it may be worth thinking about what happens when we as an Open Source community build up another SF.net like entity. A central repository for all the most popular Open Source software, controlled by one profit-driven corporation. Maybe it was worth the tradeoff. Maybe SourceForge provided enough value over the years to where it's not worth belly-aching about having to rebuild our communities around new tools (maybe even another third party tool), and to educate users that SourceForge is now an untrustworthy provider that should be avoided. Maybe we have to just mourn the loss of a once great supporter of Open Source software and move on to another that will likely, someday, also turn its back on Open Source values in pursuit of profits. I hate trash-talking SourceForge so harshly, as projects I've been involved in have been well-served by SF.net in the past (and even now, we're pushing out terabytes of downloads through their mirrors, even though we've moved our revision control to github long ago). But, the company as it exists today is nothing like what it once was. I must assume none of the original founders remain given how far this strays from the original vision of the thing, and certainly it's been through multiple acquisitions and leadership changes. Maybe I shouldn't feel so bad about it...maybe the SourceForge I knew has been dead for years, and I just didn't notice as it's taken a while to start to smell.

drzaiusapelord 11y ago
Why can't someone make a hosting site with a no crapware rule? I understand monetization is a big issue, but I'd be willing to sit through a 10-15 second forced ad to get a nice FOSS product. This mentality of installing random "utilities" and search hijackers on PC's needs to end. I can't imagine these things outpaying video ads directed right at our demographic. In the age of cheap bandwidth and cheap servers, how is this not massively profitable?

dilap 11y ago

Wow, it's not clear at all that the SF page is a "mirror" of the official project, and for now it remains the first google result. What assholes.

userbinator 11y ago

Personally, I see this as one of the natural consequences of permissively-licensed software, and the freedom of being able to obtain such from the open Internet. This is a feature, not a bug. If you want something with more security guarantees, then use the walled-garden app stores. It reduces your chances of getting malware, but also reduces the choices available to you. Whether or not people like what SF is doing does not change the fact that it is legal under the GPL. I hate adware myself, but if someone chooses to distribute it legally, then I respect their freedom to... and the only thing I would do is tell the users so they can make an informed decision. The official GIMP site has made a notice about this already. As long as computing platforms exist which allow users to install any software, from anywhere they choose, they will eventually install something they don't want (and even in walled-garden app store environments they still manage to.) Something to think about: "Freedom is not worth having if it does not include the freedom to make mistakes."

TazeTSchnitzel 11y ago
The problem is SourceForge hijacking the GIMP site
- userbinator 11y ago
  The official site is http://www.gimp.org/ http://www.gimp.org/ and it has nothing to do with SourceForge.
  - TazeTSchnitzel 11y ago
    So? SourceForge hijacked the GIMP page on SourceForge, which shows up in search results for GIMP downloads.

m_mueller 11y ago

helb 11y ago

So in fact it was hijacked… by SF. My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off. Also, old HN post on "what happened to Sourceforge": https://news.ycombinator.com/item?id=6700115 https://news.ycombinator.com/item?id=6700115

jlgaddis 11y ago
> My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off. Please do. IIRC, most (all?) of their mirrors are provided by third-parties who are graciously offering their resources and SourceForge is taking advantage of them to serve up and profit from adware/malware installers.

u04f061 11y ago

They are doing something with GIMP what they did to VLC.

Pxtl 11y ago

So they take the code from a 3rd party, compile it into an installer with malware bolted on, and reap the profits from the malware. Yeah, hijacked.

proactivesvcs 11y ago

I'm sure we only hear about "easy to decline/opt-out/remove" software when it is something nobody ever wants. If the first feature of your software is that it's easy to decline, maybe it's time to pack up shop.

nothrabannosir 11y ago

They show their true colors in the last paragraph: We welcome further discussion about how SourceForge can best serve the GIMP-Win author. Just stop. How disingenuous can you be? What a disgrace. Do we really need to go there? Ok, how about: "completely suspend and remove the project, and don't let the name be reclaimed." Source Forge is trying to convince us they never thought of that. Really? Give me a break. You knew. You just don't care. Fine, you don't. But don't try to play that off as ignorance. "Oh, yeah, please enlighten us with further discussion!" Get out of here, stop wasting our time. They could just as well have done away with the blog post and put up an image of a giant middle finger, instead. At least that would have been honest.

astrodust 11y ago
We should start discussing how they can shut themselves down and rid the world of the blight that SourceForge has become. RubyForge folded and the world was better off.

codazoda 11y ago

"Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available." Well, there's your problem.

fixermark 11y ago

tl;dr "Hey, it's not our fault that we adopted policies so offensive to the project maintainer that they utterly washed their hands of us, but the license of GIMP basically prevents them from preventing us from distributing the software inside of our third-party shovelware bundle..." Good job SourceForge. A++ would never download anything from again.

DanBC 11y ago

Gimp should just push an update that has a "Stop using Sourceforge" splash screen and see if Sourceforge distributes that new version. It's a shame. Sourceforge used to be really good.

worklogin 11y ago

I also notice this isn't covered by Slashdot, who is owned by DHI, who owns Sourceforge.

kjs3 11y ago

I think I've recommended sourceforge.net be added to the webfilter global block list at every client I've worked with in the last 5 years. Once I pointed out the risk of their drive-by download strategy, no one has said no, and very rarely has an end-user complained (something almost always remedied by finding a legitimate download site for them).

fapjacks 11y ago

Fuck SourceForge. The people that bought it blew it.

helb 11y ago

http://helb.github.io/goodbye-sourceforge/ http://helb.github.io/goodbye-sourceforge/