9 ms·

This makes me even more angry at SourceForge and not less. 1) There is nothing clear and open about the project being abandoned by the author 2) The author le

by baldfat 11y ago

This makes me even more angry at SourceForge and not less. 1) There is nothing clear and open about the project being abandoned by the author 2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? 3) Is SourceForge just going to maintain any project that leaves them and makes a mirror? The sad state of Download.com and SourceForge keeps getting grimmer and grimmer.

jarcane 11y ago
Not to mention that sleazy line about 'helping their users avoid malware'. The search hijacker that came with my copy of FileZilla Server was the first such infection I've had in a decade.
- adam12 11y ago
  Same here. I'm done with Sourceforge.
- tomswartz07 11y ago
  I'm sure you're probably aware, but just in case: Ninite.com is a great resource for getting tools like this (and things like Chrome, Firefox, etc) without all of the packaged adware. I use it almost exclusively to get all of my dev tools on a Windows machine.
  - piyush_soni 11y ago
    Wow. I didn't know about it, thanks!
  - junto 11y ago
    If you already have some of those app installed, do you still need to select them on the install page or not?
    - mdekkers 11y ago
      yeah you get a custom installer
    - jlgaddis 11y ago
      Not really. I typically use the Ninite installer on a clean, freshly installed Windows machine because the installer can be ran again in the future to update those same apps. Chrome/Firefox/etc. will auto-update themselves but for those apps that don't, they will be updated to the latest version if/when you re-run the same installer that you originally downloaded.
    - tomswartz07 11y ago
      If you already have them installed, Ninite will detect that and update them (if needed). It makes it handy to keep the 'installer' that you download, as it will go through and update all of the listed apps later on.
    - squeaky-clean 11y ago
      If you already have them installed, you do not have to select them, but Ninite will update them to their latest versions if you do. You can also keep the installer it gives you and re-run it later to update the programs.
  - mdekkers 11y ago
    ninite are awesome, and the paid service is well worth it. Disclaimer and full disclosure: I am not affiliated with them, just a happy user for many years
- shortstuffsushi 11y ago
  It had been over a year since I installed FileZilla, but I re-imaged one of my machines and needed it. Hopped out to SourceForge not thinking too much of it (not a fan of the UI and ads within, but I know my way around to avoid them at least). Started the install and it wants to install MacKeeper. Can't begin to describe how disgusted I was. I wasn't sure if that was caused by SF or FZ, though.
ww520 11y ago
Google should demote the GIMP search term leading to SourceForge's download page, or mark the page as infested with malware.
- detaro 11y ago
  I guess you are looking for https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/ ?
  - higherpurpose 11y ago
    The link that needs to be reported: http://sourceforge.net/projects/gimp-win/ http://sourceforge.net/projects/gimp-win/
    - _lce0 11y ago
      > The link that needs to be reported: http://sourceforge.net/ http://sourceforge.net/
zamalek 11y ago
4) The reason why they did it is actually completely irrelevant. "I killed him because he slept with my wife" doesn't change the fact that you committed murder. Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced? Edit: The difference between murder and manslaughter has now been explained, multiple, multiple times. Manslaughter is still a crime and in that way it is still the same. The comparison was used as a device to elaborate why the reasoning was unimportant, the difference between murder and manslaughter isn't important within that context. Suffice to say, now that I have been corrected repeatedly over this nonsense, this would have been a better anecdote: > "I killed him because he slept with my wife" doesn't change the fact that you killed someone.
- striking 11y ago
  (not totally relevant but) technically that would be a crime of passion murder, and in some cases would result in a charge of "Voluntary Manslaughter" rather than "First Degree Murder". [1] Reason does matter, sometimes. Although in this case, Sourceforge just needs to stop. [1]: https://en.wikipedia.org/wiki/Murder_(United_States_law)#Degrees_of_murder_in_the_United_States https://en.wikipedia.org/wiki/Murder_(United_States_law)#Deg...
  - zamalek 11y ago
    Yeah the main point was that the justification doesn't change what was done.
- userbinator 11y ago
  Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced? No. The adware is part of the installer, and is considered separate by the GPL: http://www.gnu.org/licenses/gpl-faq.en.html#GPLCompatInstaller http://www.gnu.org/licenses/gpl-faq.en.html#GPLCompatInstall...
- dalke 11y ago
  The adware is not part of the GPL'ed code. It almost certainly counts as "mere aggregation". See http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#MereAggregation http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#Me... or http://www.gnu.org/licenses/gpl-faq.html#MereAggregation http://www.gnu.org/licenses/gpl-faq.html#MereAggregation .
jrochkind1 11y ago
> The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? That it is open source does generally allow anyone to do this, right? But yeah, Sourceforge sucks.
- ExpiredLink 11y ago
  > That it is open source does generally allow anyone to do this, right? Their malware is open source?
- ninkendo 11y ago
  I'm not sure the GPL allows you to fork something under the same name though, right? Copyright law still lets you own the name of your project? That's why the typical workflow is to say in the header of your GPL license "Foo is copyright John Doe... Permission to modify is provided ..." Sourceforge may be allowed to redistribute software with malware but as far as I can tell, copyright law should stop them from calling the software by the same name, right? Does the author have a copyright on the gimp-win name? Maybe I don't understand the law correctly though, IANAL, etc.
  - dec0dedab0de 11y ago
    I'm not sure the GPL allows you to fork something under the same name though, right? Copyright law still lets you own the name of your project? That's trademark, not copyright. Though I believe some free/copyleft licenses allow you to require a name change if they make changes.
  - wongarsu 11y ago
    > Copyright law still lets you own the name of your project? Copyright doesn't apply to names. That's trademark laws. Contrary to copyright, trademarks have to be registered and cost money. There is no registered trademark for Gimp or gimp-win in the US or Europe.
  - caf 11y ago
    You can't copyright a name. You can trademark it, but unlike copyrights, trademarks have to be applied for and registered, and have to be actively defended.
mahouse 11y ago
> 2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? Well, why not?
- Cthulhu_ 11y ago
  Because using your power to do a hostile takeover of an open source project is just bad taste. They'd be free to make a fork of the project and host it on their site, but taking over someone's account / project without their permission is a case of power abuse.
- dec0dedab0de 11y ago
  if all they did was setup a mirror with ad's on the page nobody would care.
ntakasaki 11y ago
>This makes me even more angry at SourceForge and not less. YCombinator also invested in a company that did this. http://www.istartedsomething.com/20130115/y-combinator-is-funding-the-future-of-spam-in-windows-drive-by-crapware-installers/ http://www.istartedsomething.com/20130115/y-combinator-is-fu... Here's pg's response: >2. The apps that get installed are "crapware." >This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things. https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711
- moron4hire 11y ago
  Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but-not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time. What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.
  - digi_owl 11y ago
    I guess it could happen if one use PPAs or similar, but i don't see it ever getting off the ground within the main repos. I wonder if we will see more of it as distros move to Snappy or similar schemes. I guess it will come down to how "frameworks" gets handled etc.
  - JoshTriplett 11y ago
    > What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies. Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.
jasonlotito 11y ago
> 1) There is nothing clear and open about the project being abandoned by the author Then you say: > 2) The author left SourceForge... Pretty sure if you left SF with the project still up on SF, any reasonable person could consider that abandoning the project. A more responsible thing would have been to remove the project entirely and shut it down. > 3) Is SourceForge just going to maintain any project that leaves them and makes a mirror? I assume you mean the only obvious option is to remove the project entirely (or disable from view) for those that leave. Leaving up old code at the scale of GIMP has the potential for leaving up unpatched code that is still downloaded and used. If your opinion is that nothing should have been done at all, I think that's far worse than what anything SF did.
- SwellJoe 11y ago
  What's interesting is that SF.net seems to not care if you have removed the project. Or, even if the project never existed at SourceForge, at all. In the previous thread about this issue, someone linked to the sf-editor1 account, which has projects for a huge swath of software, including software that has never been hosted at SourceForge. https://sourceforge.net/u/sf-editor1/profile/ https://sourceforge.net/u/sf-editor1/profile/ It is part of their "mirror directory" project, which seems designed merely to get traffic from popular Open Source software, and occasionally inject malware into downloads that they can dupe people into getting from SF.net rather than the authoritative source. And, of course, in this case, the author of Gimp-Win has plainly stated they did not abandon the SF project. They were locked out by SourceForge staff. I'm all for caution before reaching for the pitchforks and the torches, but there's an awful lot of very large, very credible, projects saying, "Yes, SourceForge did this to our project." I sent them an email yesterday asking for clarification, but have not received a reply.
- davidgerard 11y ago
  In this case, the maintainer was still maintaining the page - he found out when he was locked out of his account.
TrevorJ 11y ago
They use the term abandoned when really, it sounds like the more correct description is that the client decided to go with a different service. In that case, it would be akin to G+ reviving your profile page after you moved to Facebook, and populating it with your Facebook posts without your permission. That doesn't seem ok
- Nullabillity 11y ago
  It could (and should) be clearer, of course, but doesn't basically every open source license allow doing what they're doing? Isn't this one of the FSF's four freedoms?
- TheLoneWolfling 11y ago
  More like G+ reviving your profile page after you moved to Facebook, and populating it with your Facebook posts with injected product placement without your permission.

by baldfat 11y ago

jarcane 11y ago

Not to mention that sleazy line about 'helping their users avoid malware'. The search hijacker that came with my copy of FileZilla Server was the first such infection I've had in a decade.

adam12 11y ago
Same here. I'm done with Sourceforge.
tomswartz07 11y ago
I'm sure you're probably aware, but just in case: Ninite.com is a great resource for getting tools like this (and things like Chrome, Firefox, etc) without all of the packaged adware. I use it almost exclusively to get all of my dev tools on a Windows machine.
- piyush_soni 11y ago
  Wow. I didn't know about it, thanks!
- junto 11y ago
  If you already have some of those app installed, do you still need to select them on the install page or not?
  - mdekkers 11y ago
    yeah you get a custom installer
  - jlgaddis 11y ago
    Not really. I typically use the Ninite installer on a clean, freshly installed Windows machine because the installer can be ran again in the future to update those same apps. Chrome/Firefox/etc. will auto-update themselves but for those apps that don't, they will be updated to the latest version if/when you re-run the same installer that you originally downloaded.
  - tomswartz07 11y ago
    If you already have them installed, Ninite will detect that and update them (if needed). It makes it handy to keep the 'installer' that you download, as it will go through and update all of the listed apps later on.
  - squeaky-clean 11y ago
    If you already have them installed, you do not have to select them, but Ninite will update them to their latest versions if you do. You can also keep the installer it gives you and re-run it later to update the programs.
- mdekkers 11y ago
  ninite are awesome, and the paid service is well worth it. Disclaimer and full disclosure: I am not affiliated with them, just a happy user for many years
shortstuffsushi 11y ago
It had been over a year since I installed FileZilla, but I re-imaged one of my machines and needed it. Hopped out to SourceForge not thinking too much of it (not a fan of the UI and ads within, but I know my way around to avoid them at least). Started the install and it wants to install MacKeeper. Can't begin to describe how disgusted I was. I wasn't sure if that was caused by SF or FZ, though.

ww520 11y ago

Google should demote the GIMP search term leading to SourceForge's download page, or mark the page as infested with malware.

detaro 11y ago
I guess you are looking for https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/ ?
- higherpurpose 11y ago
  The link that needs to be reported: http://sourceforge.net/projects/gimp-win/ http://sourceforge.net/projects/gimp-win/
  - _lce0 11y ago
    > The link that needs to be reported: http://sourceforge.net/ http://sourceforge.net/

zamalek 11y ago

4) The reason why they did it is actually completely irrelevant. "I killed him because he slept with my wife" doesn't change the fact that you committed murder. Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced? Edit: The difference between murder and manslaughter has now been explained, multiple, multiple times. Manslaughter is still a crime and in that way it is still the same. The comparison was used as a device to elaborate why the reasoning was unimportant, the difference between murder and manslaughter isn't important within that context. Suffice to say, now that I have been corrected repeatedly over this nonsense, this would have been a better anecdote: > "I killed him because he slept with my wife" doesn't change the fact that you killed someone.

striking 11y ago
(not totally relevant but) technically that would be a crime of passion murder, and in some cases would result in a charge of "Voluntary Manslaughter" rather than "First Degree Murder". [1] Reason does matter, sometimes. Although in this case, Sourceforge just needs to stop. [1]: https://en.wikipedia.org/wiki/Murder_(United_States_law)#Degrees_of_murder_in_the_United_States https://en.wikipedia.org/wiki/Murder_(United_States_law)#Deg...
- zamalek 11y ago
  Yeah the main point was that the justification doesn't change what was done.
userbinator 11y ago
Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced? No. The adware is part of the installer, and is considered separate by the GPL: http://www.gnu.org/licenses/gpl-faq.en.html#GPLCompatInstaller http://www.gnu.org/licenses/gpl-faq.en.html#GPLCompatInstall...
dalke 11y ago
The adware is not part of the GPL'ed code. It almost certainly counts as "mere aggregation". See http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#MereAggregation http://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html#Me... or http://www.gnu.org/licenses/gpl-faq.html#MereAggregation http://www.gnu.org/licenses/gpl-faq.html#MereAggregation .

jrochkind1 11y ago

> The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? That it is open source does generally allow anyone to do this, right? But yeah, Sourceforge sucks.

ExpiredLink 11y ago
> That it is open source does generally allow anyone to do this, right? Their malware is open source?
ninkendo 11y ago
I'm not sure the GPL allows you to fork something under the same name though, right? Copyright law still lets you own the name of your project? That's why the typical workflow is to say in the header of your GPL license "Foo is copyright John Doe... Permission to modify is provided ..." Sourceforge may be allowed to redistribute software with malware but as far as I can tell, copyright law should stop them from calling the software by the same name, right? Does the author have a copyright on the gimp-win name? Maybe I don't understand the law correctly though, IANAL, etc.
- dec0dedab0de 11y ago
  I'm not sure the GPL allows you to fork something under the same name though, right? Copyright law still lets you own the name of your project? That's trademark, not copyright. Though I believe some free/copyleft licenses allow you to require a name change if they make changes.
- wongarsu 11y ago
  > Copyright law still lets you own the name of your project? Copyright doesn't apply to names. That's trademark laws. Contrary to copyright, trademarks have to be registered and cost money. There is no registered trademark for Gimp or gimp-win in the US or Europe.
- caf 11y ago
  You can't copyright a name. You can trademark it, but unlike copyrights, trademarks have to be applied for and registered, and have to be actively defended.

mahouse 11y ago

> 2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money? Well, why not?

Cthulhu_ 11y ago
Because using your power to do a hostile takeover of an open source project is just bad taste. They'd be free to make a fork of the project and host it on their site, but taking over someone's account / project without their permission is a case of power abuse.
dec0dedab0de 11y ago
if all they did was setup a mirror with ad's on the page nobody would care.

ntakasaki 11y ago

>This makes me even more angry at SourceForge and not less. YCombinator also invested in a company that did this. http://www.istartedsomething.com/20130115/y-combinator-is-funding-the-future-of-spam-in-windows-drive-by-crapware-installers/ http://www.istartedsomething.com/20130115/y-combinator-is-fu... Here's pg's response: >2. The apps that get installed are "crapware." >This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things. https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711

moron4hire 11y ago
Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but-not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time. What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.
- digi_owl 11y ago
  I guess it could happen if one use PPAs or similar, but i don't see it ever getting off the ground within the main repos. I wonder if we will see more of it as distros move to Snappy or similar schemes. I guess it will come down to how "frameworks" gets handled etc.
- JoshTriplett 11y ago
  > What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies. Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.

jasonlotito 11y ago

> 1) There is nothing clear and open about the project being abandoned by the author Then you say: > 2) The author left SourceForge... Pretty sure if you left SF with the project still up on SF, any reasonable person could consider that abandoning the project. A more responsible thing would have been to remove the project entirely and shut it down. > 3) Is SourceForge just going to maintain any project that leaves them and makes a mirror? I assume you mean the only obvious option is to remove the project entirely (or disable from view) for those that leave. Leaving up old code at the scale of GIMP has the potential for leaving up unpatched code that is still downloaded and used. If your opinion is that nothing should have been done at all, I think that's far worse than what anything SF did.

SwellJoe 11y ago
What's interesting is that SF.net seems to not care if you have removed the project. Or, even if the project never existed at SourceForge, at all. In the previous thread about this issue, someone linked to the sf-editor1 account, which has projects for a huge swath of software, including software that has never been hosted at SourceForge. https://sourceforge.net/u/sf-editor1/profile/ https://sourceforge.net/u/sf-editor1/profile/ It is part of their "mirror directory" project, which seems designed merely to get traffic from popular Open Source software, and occasionally inject malware into downloads that they can dupe people into getting from SF.net rather than the authoritative source. And, of course, in this case, the author of Gimp-Win has plainly stated they did not abandon the SF project. They were locked out by SourceForge staff. I'm all for caution before reaching for the pitchforks and the torches, but there's an awful lot of very large, very credible, projects saying, "Yes, SourceForge did this to our project." I sent them an email yesterday asking for clarification, but have not received a reply.
davidgerard 11y ago
In this case, the maintainer was still maintaining the page - he found out when he was locked out of his account.

TrevorJ 11y ago

They use the term abandoned when really, it sounds like the more correct description is that the client decided to go with a different service. In that case, it would be akin to G+ reviving your profile page after you moved to Facebook, and populating it with your Facebook posts without your permission. That doesn't seem ok

Nullabillity 11y ago
It could (and should) be clearer, of course, but doesn't basically every open source license allow doing what they're doing? Isn't this one of the FSF's four freedoms?
TheLoneWolfling 11y ago
More like G+ reviving your profile page after you moved to Facebook, and populating it with your Facebook posts with injected product placement without your permission.