6 ms·

This is the sort of behavior you get from a company that's lost, and is now trying to extract every penny they can from whatever shenanigans they can get away w

This is the sort of behavior you get from a company that's lost, and is now trying to extract every penny they can from whatever shenanigans they can get away with. If they have no future brand value to be concerned about, then, from a game-theoretic approach, it's actually a pretty rational profit seeking move. (As long as they don't incur any downstream liabilities from outright illegal activity for which they might be fined, or successfully sued - if there is any entity left to sue) Of course, the game-theoretic response from the entire internet community is to make sure they never, ever, for any reasons whatsoever, ever click on a link that starts with "sourceforge.net"

robogimp 11y ago
The problem now is raising the alarm all the way out to the endest of end users, that this formerly trusted site cannot be trusted anymore. Perhaps Google could step up and de-list them, but that is a pretty slippery slope.
- anilgulecha 11y ago
  No it isn't. The site was relevant before as it served what people needed, and was ranked high. It no longer is serving folks' interests, so it can be ranked lower, or de-listed. Completely fine.
  - robogimp 11y ago
    I agree with you. To clarify my slippery slope comment, it applies in general to all users of censorship powers. Who is a fit judge to decide what you and I get to see? D-listing from Google is basically being taken off the internet, so wielding that power too often might get Big G into alot of trouble with agencies like the European Commission. On balance I think SourceForge deserves a browser level "here be malware" warning, trusting that most users will make the right choice if informed.
- gadders 11y ago
  Patio11 suggested that in relatoin to Gimp. Also, someone helpfully posted the google link to report websites: https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/ Suggested reason is "embeds malware/adware with downloads".
  - lawl 11y ago
    Could also write mails to the mirror providers listed here: http://sourceforge.net/p/forge/documentation/Mirrors/ http://sourceforge.net/p/forge/documentation/Mirrors/ And ask them to stop mirroring SF because they distribute Malware. I don't know how many of them provide the mirror for free though. I remember quite a few universities provided SF mirrors back in the day.
  - Rudism 11y ago
    I doubt this would ever happen. A large portion of Google's own ad revenue comes from companies distributing adware. I worked for a company that was in the adware distribution business and we funnelled millions to Google--to the point that we had dedicated account reps at Google who helped us to make sure we stayed compliant with Google's adwords policies so we could keep peddling our adware installers.
pjc50 11y ago
You either go bankrupt as a hero or live long enough to become the monetisation villain.
- bad_user 11y ago
  Sounds like a wise saying that I've read on every submission about Sourceforge, problem is that I think it is in general bullshit. If we'll look down in history, I think there are very few villains that have acted as heroes when starting out. The signs that such companies are assholes are in general there, from the start. As an example, I don't remember a time in which Sourceforge was the hero, as much as I try. Since as long as I remember Sourceforge, it was always the "necessary evil", the nuisance you have to deal with because bandwidth was (and still is) very expensive.
  - chillingeffect 11y ago
    > I don't remember a time in which Sourceforge was the hero, as much as I try No offense to you personally, but this is a case where it's about grey hair more than ability. There was certainly a time when Sourceforge was the wham-bam-snickety-snack boom-blam bomb. It was when Slashdot was the Hacker News, when "LAMP" was a new term, when 10Gbps across the U.S. (vs. your living room) was a Big Deal. > If we'll look down in history, I think there are very few villains that have acted as heroes when starting out. This is called playing "I told you so." In reality every organization begins with high ideals then adjusts to reality. The elegance of this transition defines how villainous they've become. Consider McDonalds and Whole Foods. Both seemed delightful at the beginning. We see how McDs is now cancerous (or at least diabetesacious) and Whole Foods is anti-union, but surviving anyway, a "mundane evil." You can't predict which company will become evil or not.
  - pron 11y ago
    > I think there are very few villains that have acted as heroes when starting out. The logical implication in that line flows in the other direction. It's not that every villain started out a hero, but that every hero (that survives long enough) ends up a villain. Of course, it's untestable as there's no limit on "long enough", but then again, it's just a line from a movie...
omegafail 11y ago
Simply add their domain to the hosts file to prevent any accidental downloading.
- zaphar 11y ago
  This is a solution for me. It's not a solution for the hundreds of people I've told about GiMP over the years. Some of whom I no longer have contact with. Those people don't know how to edit their hosts file. I'm not worried for myself I'm worried for them.
mapt 11y ago
Has Archiveteam, Internet Archive or anyone else taken a shot at mirroring Sourceforge, including binaries? Since its founding there have been a hell of a lot of small projects hosted there whose sites have gone down since. 430,000 projects have been hosted on SourceForge at some point. At least a few tens of thousands of them represent the only remaining copy of a program needed to read a certain sort of data. Maintaining that capability in the face of a company circling the drain represents an extreme historical utility. Even if you now need a VM to handle the crapware, that's better than losing the apps entirely. If somebody maintained a time-diffed mirror of SourceForge, they could pinpoint the last version before the bundling event occurred in an automated fashion, as well. EDIT: It seems there's a project to begin this - http://archiveteam.org/index.php?title=SourceForge http://archiveteam.org/index.php?title=SourceForge and an IRC channel, EFNet #coldstorage
- castell 11y ago
  We need a open source community website that manages and links to the download-mirrors (HEANET, etc.). There is no need to backup the downloads, just back up the source code and friendly take over the control over the mirrors.
- TazeTSchnitzel 11y ago
  Archiving SourceForge is indeed important. Just recently I needed it to hook up a printer: http://sourceforge.net/projects/gimp-print/files/usbtb%20-%20Mac%20OS%20X%20ONLY%20usb/ http://sourceforge.net/projects/gimp-print/files/usbtb%20-%2...
ikeboy 11y ago
>Of course, the game-theoretic response from the entire internet community is to make sure they never, ever, for any reasons whatsoever, ever click on a link that starts with "sourceforge.net" That's a nice idealistic response, but what about when you can't find a file anywhere else?
- scuba7183 11y ago
  Depends on how much you need the file
- yellowapple 11y ago
  So that's when we start downloading Sourceforge's files en masse (with ad-blockers enabled so that they're not rewarded for their misbehavior), stripping out the malware, and rehosting them somewhere.
javert 11y ago
It can never be rational to violate other people, because if you have a rational system of values, doing so will make you feel bad. Drag down SourceForge all you want (I applaud that) but don't drag down rationality with it.

robogimp 11y ago

The problem now is raising the alarm all the way out to the endest of end users, that this formerly trusted site cannot be trusted anymore. Perhaps Google could step up and de-list them, but that is a pretty slippery slope.

anilgulecha 11y ago
No it isn't. The site was relevant before as it served what people needed, and was ranked high. It no longer is serving folks' interests, so it can be ranked lower, or de-listed. Completely fine.
- robogimp 11y ago
  I agree with you. To clarify my slippery slope comment, it applies in general to all users of censorship powers. Who is a fit judge to decide what you and I get to see? D-listing from Google is basically being taken off the internet, so wielding that power too often might get Big G into alot of trouble with agencies like the European Commission. On balance I think SourceForge deserves a browser level "here be malware" warning, trusting that most users will make the right choice if informed.
gadders 11y ago
Patio11 suggested that in relatoin to Gimp. Also, someone helpfully posted the google link to report websites: https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/ Suggested reason is "embeds malware/adware with downloads".
- lawl 11y ago
  Could also write mails to the mirror providers listed here: http://sourceforge.net/p/forge/documentation/Mirrors/ http://sourceforge.net/p/forge/documentation/Mirrors/ And ask them to stop mirroring SF because they distribute Malware. I don't know how many of them provide the mirror for free though. I remember quite a few universities provided SF mirrors back in the day.
- Rudism 11y ago
  I doubt this would ever happen. A large portion of Google's own ad revenue comes from companies distributing adware. I worked for a company that was in the adware distribution business and we funnelled millions to Google--to the point that we had dedicated account reps at Google who helped us to make sure we stayed compliant with Google's adwords policies so we could keep peddling our adware installers.

pjc50 11y ago

You either go bankrupt as a hero or live long enough to become the monetisation villain.

bad_user 11y ago
Sounds like a wise saying that I've read on every submission about Sourceforge, problem is that I think it is in general bullshit. If we'll look down in history, I think there are very few villains that have acted as heroes when starting out. The signs that such companies are assholes are in general there, from the start. As an example, I don't remember a time in which Sourceforge was the hero, as much as I try. Since as long as I remember Sourceforge, it was always the "necessary evil", the nuisance you have to deal with because bandwidth was (and still is) very expensive.
- chillingeffect 11y ago
  > I don't remember a time in which Sourceforge was the hero, as much as I try No offense to you personally, but this is a case where it's about grey hair more than ability. There was certainly a time when Sourceforge was the wham-bam-snickety-snack boom-blam bomb. It was when Slashdot was the Hacker News, when "LAMP" was a new term, when 10Gbps across the U.S. (vs. your living room) was a Big Deal. > If we'll look down in history, I think there are very few villains that have acted as heroes when starting out. This is called playing "I told you so." In reality every organization begins with high ideals then adjusts to reality. The elegance of this transition defines how villainous they've become. Consider McDonalds and Whole Foods. Both seemed delightful at the beginning. We see how McDs is now cancerous (or at least diabetesacious) and Whole Foods is anti-union, but surviving anyway, a "mundane evil." You can't predict which company will become evil or not.
- pron 11y ago
  > I think there are very few villains that have acted as heroes when starting out. The logical implication in that line flows in the other direction. It's not that every villain started out a hero, but that every hero (that survives long enough) ends up a villain. Of course, it's untestable as there's no limit on "long enough", but then again, it's just a line from a movie...

omegafail 11y ago

Simply add their domain to the hosts file to prevent any accidental downloading.

zaphar 11y ago
This is a solution for me. It's not a solution for the hundreds of people I've told about GiMP over the years. Some of whom I no longer have contact with. Those people don't know how to edit their hosts file. I'm not worried for myself I'm worried for them.

mapt 11y ago

Has Archiveteam, Internet Archive or anyone else taken a shot at mirroring Sourceforge, including binaries? Since its founding there have been a hell of a lot of small projects hosted there whose sites have gone down since. 430,000 projects have been hosted on SourceForge at some point. At least a few tens of thousands of them represent the only remaining copy of a program needed to read a certain sort of data. Maintaining that capability in the face of a company circling the drain represents an extreme historical utility. Even if you now need a VM to handle the crapware, that's better than losing the apps entirely. If somebody maintained a time-diffed mirror of SourceForge, they could pinpoint the last version before the bundling event occurred in an automated fashion, as well. EDIT: It seems there's a project to begin this - http://archiveteam.org/index.php?title=SourceForge http://archiveteam.org/index.php?title=SourceForge and an IRC channel, EFNet #coldstorage

castell 11y ago
We need a open source community website that manages and links to the download-mirrors (HEANET, etc.). There is no need to backup the downloads, just back up the source code and friendly take over the control over the mirrors.
TazeTSchnitzel 11y ago
Archiving SourceForge is indeed important. Just recently I needed it to hook up a printer: http://sourceforge.net/projects/gimp-print/files/usbtb%20-%20Mac%20OS%20X%20ONLY%20usb/ http://sourceforge.net/projects/gimp-print/files/usbtb%20-%2...

ikeboy 11y ago

>Of course, the game-theoretic response from the entire internet community is to make sure they never, ever, for any reasons whatsoever, ever click on a link that starts with "sourceforge.net" That's a nice idealistic response, but what about when you can't find a file anywhere else?

scuba7183 11y ago
Depends on how much you need the file
yellowapple 11y ago
So that's when we start downloading Sourceforge's files en masse (with ad-blockers enabled so that they're not rewarded for their misbehavior), stripping out the malware, and rehosting them somewhere.

javert 11y ago

It can never be rational to violate other people, because if you have a rational system of values, doing so will make you feel bad. Drag down SourceForge all you want (I applaud that) but don't drag down rationality with it.