4 ms·

If your old account is listed here, you getting fuxxored: http://sourceforge.net/u/sf-editor1/profile/ http://sourceforge.net/u/sf-editor1/profile/ http://sou

• heyalexej 11y ago
  Plenty popular names on there. That's shocking.
  • ghshephard 11y ago
    To be clear - there is a difference between mirroring (which is good netizen behavior, and to be complimented), and trojaning (which is modifying the upstream sources before delivering them to users - which is decidedly not good netizen behavior). It's important to understand which is which for those accounts.
    • dagw 11y ago
      As long as one of those accounts is trojaning (or even just suspected of possibly having been trojaning once) it instantly poisons all the mirrors. Even if they are perfect netizens 99% of the time, that 1% makes all their other efforts useless.
      • DaFranker 11y ago
        Whoa what. Are you suggesting that suspicion of possibly maybe having put a trojan in someone else's files somewhere is grounds to make all one's efforts useless and poisons everything else you do? Geeze, I guess we should stop using Google. They've been accused and suspected of much worse by a lot of people. I hope that's not what you meant.
        • dagw 11y ago
          Are you suggesting that suspicion of possibly maybe having put a trojan in someone else's files somewhere is grounds to make all one's efforts useless and poisons everything else you do? Short answer: Yes. Downloading and running arbitrary binaries from the web inherently a quite dangerous thing do to, and I only feel comfortable taking such a risk with sites I trust. I no longer trust Sourceforge and there is very little they can promise me to make me start wanting to download from them again.
          • DaFranker 11y ago
            Er, okay. Well, I don't agree¹ with your method of evaluating trustworthiness (which seems to me rather too quantized and "chastity"-minded), but at least you know exactly what you're doing and who you're trusting. [1] Read as "I believe it's sub-optimal for a given cost-benefit formula, after some assumptions about certain variables and certain opportunity costs, and other methods would likely be more useful in context."
        • dec0dedab0de 11y ago
          suspicion of possibly maybe having put a trojan in someone else's files Isn't it a hard fact at this point?
          • DaFranker 11y ago
            For Sourceforge specifically? Sure. In general, the way the comment was worded? No, suspicion does not equal hard fact. We were talking about the latter.
    • beagle3 11y ago
      No, it is not important at all - because today's mirror will silently be replaced with tomorrow's trojan. It is important to expose this behavior for what it is. And in the process, remind everyone that abuse of power is a question of WHEN, not IF, whether it's a government entity or a corporate one.
    • rythie 11y ago
      Sourceforge's mirrors are a complete miss-use of the term mirror. A mirror should be an exact copy of the source and should be approved by the original project, which I doubt any of these 'mirrors' are.
    • hodefoting 11y ago
      Interesting weaseling of SourceForge is to add a "downloader" which fetches either the actual unmodified installer/sources. The "downloader" installs adware while fetching the real installer for the software. In the case of GIMP the filename of the downloader was made to be the same as the filename expected of the installer for a given version. This dirty approach might be thwarting ways of protecting with cryptographic signatures, or even trademarks/copyleft.
• simias 11y ago
  I didn't know they did this at this scale. I'm suprised by all the big names in the projects they've highjacked: I see apache, drupal, firefox, libreoffice, mysql, postgresql, redmine, sqlite, thunderbird, vlc, virtualbox and many, many others. They're really going all in with that.
  • DanBC 11y ago
    But go look at the actual firefox they list. http://sourceforge.net/projects/firefox http://sourceforge.net/projects/firefox points to some personal build of firefox. http://sourceforge.net/projects/firefox.mirror http://sourceforge.net/projects/firefox.mirror seems a lot more official. I have no idea what binary you get from either of them.
  • deleted 11y ago
    [deleted]
  • bad_user 11y ago
    From what I remember, even though Firefox is open-source, you can't use the Firefox name on distributing it without getting approval from Mozilla. This is why Debian went at some point with the Iceweasel name. So Mozilla controls what gets distributed with the Firefox name and they could sue for trademark violations if they want to. IMHO, all open-source projects should protect their name. For example last time I tried, VLC for iOS was banned from the iTunes Store, yet there were dozens of obscure apps using VLC's name or logo on iTunes Store (this was happening in January). Especially given that there is such a thing as an unregistered trademark, that is valid through usage. Even if you fork it, then authors should have the courtesy to use a different name.
    • robin_reala 11y ago
      (VLC is back: https://itunes.apple.com/us/app/vlc-for-ios/id650377962 https://itunes.apple.com/us/app/vlc-for-ios/id650377962)
    • math0ne 11y ago
      If you have ever uploaded something to sourceforge you have given them the right to use your trademark in perpetuity, something to think about when posting on public sites like this.
• runn1ng 11y ago
  Damn, that's a lot of projects. OpenOffice, Apache server, hadoop, Audacity, CDex, Colloquy, that's all projects I have at one at my computers, and I haven't gotten to "D" yet. This is depressing
  • philjackson 11y ago
    Seems weird that I could install Hadoop and get some shitty toolbar as a result.
    • mauricemir 11y ago
      Looks like an opportunity for cloudera
      • philjackson 11y ago
        I'd love to see that board meeting.