12 ms·

Don't download software from SourceForge if you can help it

161 points by ub 11y ago

icpmacdo 11y ago
Can someone provide a link to filezilla thats not through sourceforge? I just posted an Ask HN about this.
- andyjohnson0 11y ago
  Two trusted packages available at https://chocolatey.org/packages?q=filezilla https://chocolatey.org/packages?q=filezilla Also available from https://ninite.com/ https://ninite.com/
  - wernercd 11y ago
    for the real lazy: https://ninite.com/?select=filezilla https://ninite.com/?select=filezilla I hadn't thought of choco, but good call on that.
  - b101010 11y ago
    Why are the packages from chocolatey trusted? I am not familiar with chocolatey but the powershell script on https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla (click show files) contains the following $url = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win32-setup.exe/download" $url64bit = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win64-setup.exe/download" So its still fetching executables from sourceforge using plain http with no checksums or signatures in sight. On the assumption that executable does include the sourceforge malware, The silent install argument ("/S") passed to the executable by chocolatey seems to be the only reason its not installed along with filezilla. Is there any reason to believe ninite does anything different?
    - swies 11y ago
      We should play this up more on our site, but Ninite (I'm a co-founder and we're YC W08) does this stuff right. All our .exes are signed, app config information comes over https, and downloads are all checked for hashes that match our testing before being automated. We're not just naively adding silent switches either, we'll automate clicks to get through less well-behaved installers when needed. Why can you trust Ninite? Money. Thousands of businesses pay us for Ninite Pro and the free version is our marketing department. We're extremely careful to make sure our updates come out on time and junk free.
- skrowl 11y ago
  If you're on Windows, consider upgrading to WinSCP (http://winscp.net/eng/docs/free_sftp_client_for_windows http://winscp.net/eng/docs/free_sftp_client_for_windows). Not only is it a nicer UI and updated more often, but they have direct downloads with no crapware.
- kpcyrd 11y ago
  http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla_3.5.3-2_amd64.deb http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla... I know, this isn't very helpful, but if you don't like how software is distributed for your system there's still the option to use a system that solved this during the '90s.
- bhayden 11y ago
  I would recommend not using Filezilla at all, honestly. The creator was entirely unapologetic about bundling malware.
gamache 11y ago
In our testing, we’ve found that SourceForge’s downloader behaves more nicely in a virtual machine. If you want to see what it actually does, be sure to test it in a real Windows system on a physical machine, not a virtual machine. This is the same sort of behavior that malicious applications are increasingly using to avoid detection and analysis. Very interesting! I'd be interested to hear the corporate-speak rationale for this. Kind of interested, anyway.
- throwaway498982 11y ago
  this is unbelievably malicious! In our earlier discussion there was some discussion about the installer asking for permission to install crapware. in fact if you're going to do malware stuff like this, why even ask? On a technical level - how come you can detect VM's? with something like BOCHS and if you lie about wall time inside your OS, can't it emulate a PC perfectly? How does crapware know whether it's in a VM or not?
  - stephengillie 11y ago
    Well, there are a couple things - For one, the hypervisor presents different "hardware" than you would get in a standard HP or Dell box. And often the hypervisor has a driver package to install, to facilitate communication between the OS and hypervisor - this is used mostly to manage memory overcommit with things like a memory bubble. As the hypervisor gets low on RAM, it tells its driver in the VM OS to use more RAM, which steals some away from that system. Then the hypervisor swaps that RAM or puts it out of play in another way, and gets to reclaim the underlying physical RAM. At least, this is the VMWare way of doing it, not too sure about MS or Citrix or RH or others.
  - jaysh 11y ago
    This is a nice article on the matter: http://web.archive.org/web/20110929075510/http://invisiblethings.org/papers/redpill.html http://web.archive.org/web/20110929075510/http://invisibleth.... It doesn't appear to work reliably anymore, but the principle is the same. Even if we reached the point where VMs never technically revealed they were VMs, I think the human element might still play a part. When I spin up a VM for a quick test, I might leave it on 512MB or 1GB RAM - but this could be a giveaway that it's a VM (not 100% of the time, granted) given how unlikely a fresh installation of Windows is to have that small amount of memory.
god_bless_texas 11y ago
This makes me so mad and sad at the same time. For years, it would bring me immense pleasure to just browse projects on sourceforge to see what the world was up to. Now this is just another case of corporations ruining a good thing. I'm glad there are links to Filezilla and Gimp - two products I use frequently.
- dare_you 11y ago
  I was just remembering when sourceforge first appeared and how awesome it was. I slowly started browsing projects on there instead of freshmeat. It is just sad, and frankly a little weird.
- whoisthemachine 11y ago
  I kind of view it as a consequence of the market falling out from under their feet - it's cheap enough to host your own files now, and with package managers (even on Windows!) the power users that used to be the target audience of Source Forge have been vanishing.
  - toyg 11y ago
    IMHO it's more a function of their inability to compete with Github and Bitbucket. They were slow to react to the rise of distributed VCS, failed to exploit their social network features, and probably had already accumulated too much technical debt to effectively change course by the time overall trends became clear. Once developers shifted, power users had to follow suit.
zamalek 11y ago
Just today I had to get Boost for the first time since the whole gimp-win debacle - their tars and zips are hosted on SourceForge. Guess I'll be building from Git until they fix it :/
- userbinator 11y ago
  It's only .exe installers that are affected, and probably only ones that they can easily wrap; I doubt they're actually modifying any source code.
brokentone 11y ago
At least for Mac, there is a TINY "direct download" link next to the SF Installer button. Using this link will provide the non-junkware, original install files.
dimino 11y ago
This is why we need some kind of trade organization -- the developers who wrote this stuff need to be kicked out, or disciplined in some way...
- bargl 11y ago
  This has been brought up multiple times and I couldn't agree more. It'd be great to have a trade organization for software developers where they can be evaluated by a board and loose their "license" to write code. There are some SERIOUS down sides to that, but that'd have to be flushed out in another forum.
- noarchy 11y ago
  There would have to be a lot of careful discussion about such an organization. I would hate to see it end up being little more than a vector for rent-seeking, and shutting people out of our industry for a host of arbitrary reasons (immigrants, people with the "wrong" education, etc).
  - dimino 11y ago
    Yeah, I'm just saying that fields like engineering and law have recourse for bad industry behavior. I wish software had the same or a similar path.
toyg 11y ago
I've tweeted someone close to the Pywin32 project (hosted on SF) asking to move it, but didn't get a reply. For long-established projects, it's not an easy migration. Please keep prodding any critical project you know of.
- WorldWideWayne 11y ago
  Some people just don't care or they're profiting from it like Tim Kosse of Filezilla - https://forum.filezilla-project.org/viewtopic.php?t=35221 https://forum.filezilla-project.org/viewtopic.php?t=35221 and https://forum.filezilla-project.org/viewtopic.php?t=30240 https://forum.filezilla-project.org/viewtopic.php?t=30240
jimrandomh 11y ago
> Click through to a project’s official website and you’ll find actual download links. For example, Audacity’s homepage redirects you to FOSSHUB to download Audacity, not SourceForge. But searching for “Audacity” on Google still brings up the SourceForge page as the top result. This is an error on Google's part. For everyone's sake, they need to apply some serious ranking penalties to malware distributing sites like SourceForge, as well as click-through warnings that you are going to a site other than the original authors'.
prajjwal 11y ago
"In truth, the man was an oathbreaker, a deserter from the Night’s Watch. No man is more dangerous. The deserter knows his life is forfeit if he is taken, so he will not flinch from any crime, no matter how vile." ~ Ned Stark, A Game of Thrones. I think that pathetic blog post where they tried to justify their actions made one thing clear - SourceForge knows how dead they are. No amount of internet outrage is going to help, they don't think they've got anything to lose at this point. The best thing to do at this point would be to speed up their demise. If you're a developer that still hosts with them, delete your project and move to Github or Bitbucket. Also, start reporting these malicious pages to Google so they don't show up in search results. https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/
- M2Ys4U 11y ago
  Also contact the people who provide mirroring services for them. Take away their free bandwidth and they'll collapse even quicker.
  - ytdht 11y ago
    perhaps someone should mirror sourceforge and rebuild binaries and take sourceforge out of the equation?
oblio 11y ago
So sad. Especially for Windows tons of valuable stuff is there, especially smaller utilities like DDMM and similar :(
khaki54 11y ago
If you download from Sourceforge try unzipping the installer which will usually defeat the spyware installer that they have been bundling with it.
jarnix 11y ago
I never use the "downloader", either from Akamai, Sourceforge, etc. I downloaded a few programs recently on sourceforge and never had to use their software.
bramgg 11y ago
I wonder how many people outraged here know YC funded a company that bundles malware with installers and continues to justify it publically on HN.
- withinrafael 11y ago
  InstallMonetizer?
  - bramgg 11y ago
    Yes
clean88clean88 11y ago
ARE BOTH Sourceforge and Github other-verted or perverted-like? What are the alternatives? Thank you. Thank you. the attack on code repo and the infiltration of the clean database continues, perhaps.
clean88clean88 11y ago
Is BOTH Sourceforge and Github -other-verted or per-verted? or sub-verted? The attack on the clean code-base continues. Advice. Unix Linux - separate user. low privilege. configure, make, but make install with ROOT PRIVILEGE. check files. all source code should have search engine keywords for vulnerabilies, updates, etc. for even BSD is somewhat broken, IMHO. make it easier for the NOT C expert and ASM expert to install reasonably clean software, PLEASE. Thank U. Thank U. Thank U. ... 1000 times
Negative1 11y ago
tldr; don't download from SourceForge it uses its own installer bundled with garbage. Do download using ninite.com (https://ninite.com/ https://ninite.com/), the "only trusted" downloader according to these guys.
lioeters 11y ago
Just realized the double meaning of "forge" in SourceForge: 1) to form or make by concentrated effort 2) to imitate fraudulently; fabricate a forgery They're certainly living up to definition #2..

161 points by ub 11y ago

icpmacdo 11y ago

Can someone provide a link to filezilla thats not through sourceforge? I just posted an Ask HN about this.

andyjohnson0 11y ago
Two trusted packages available at https://chocolatey.org/packages?q=filezilla https://chocolatey.org/packages?q=filezilla Also available from https://ninite.com/ https://ninite.com/
- wernercd 11y ago
  for the real lazy: https://ninite.com/?select=filezilla https://ninite.com/?select=filezilla I hadn't thought of choco, but good call on that.
- b101010 11y ago
  Why are the packages from chocolatey trusted? I am not familiar with chocolatey but the powershell script on https://chocolatey.org/packages/filezilla https://chocolatey.org/packages/filezilla (click show files) contains the following $url = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win32-setup.exe/download" $url64bit = "http://sourceforge.net/projects/filezilla/files/FileZilla_Client/${version}/FileZilla_${version}_win64-setup.exe/download" So its still fetching executables from sourceforge using plain http with no checksums or signatures in sight. On the assumption that executable does include the sourceforge malware, The silent install argument ("/S") passed to the executable by chocolatey seems to be the only reason its not installed along with filezilla. Is there any reason to believe ninite does anything different?
  - swies 11y ago
    We should play this up more on our site, but Ninite (I'm a co-founder and we're YC W08) does this stuff right. All our .exes are signed, app config information comes over https, and downloads are all checked for hashes that match our testing before being automated. We're not just naively adding silent switches either, we'll automate clicks to get through less well-behaved installers when needed. Why can you trust Ninite? Money. Thousands of businesses pay us for Ninite Pro and the free version is our marketing department. We're extremely careful to make sure our updates come out on time and junk free.
skrowl 11y ago
If you're on Windows, consider upgrading to WinSCP (http://winscp.net/eng/docs/free_sftp_client_for_windows http://winscp.net/eng/docs/free_sftp_client_for_windows). Not only is it a nicer UI and updated more often, but they have direct downloads with no crapware.
kpcyrd 11y ago
http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla_3.5.3-2_amd64.deb http://ftp.debian.org/debian/pool/main/f/filezilla/filezilla... I know, this isn't very helpful, but if you don't like how software is distributed for your system there's still the option to use a system that solved this during the '90s.
bhayden 11y ago
I would recommend not using Filezilla at all, honestly. The creator was entirely unapologetic about bundling malware.

gamache 11y ago

In our testing, we’ve found that SourceForge’s downloader behaves more nicely in a virtual machine. If you want to see what it actually does, be sure to test it in a real Windows system on a physical machine, not a virtual machine. This is the same sort of behavior that malicious applications are increasingly using to avoid detection and analysis. Very interesting! I'd be interested to hear the corporate-speak rationale for this. Kind of interested, anyway.

throwaway498982 11y ago
this is unbelievably malicious! In our earlier discussion there was some discussion about the installer asking for permission to install crapware. in fact if you're going to do malware stuff like this, why even ask? On a technical level - how come you can detect VM's? with something like BOCHS and if you lie about wall time inside your OS, can't it emulate a PC perfectly? How does crapware know whether it's in a VM or not?
- stephengillie 11y ago
  Well, there are a couple things - For one, the hypervisor presents different "hardware" than you would get in a standard HP or Dell box. And often the hypervisor has a driver package to install, to facilitate communication between the OS and hypervisor - this is used mostly to manage memory overcommit with things like a memory bubble. As the hypervisor gets low on RAM, it tells its driver in the VM OS to use more RAM, which steals some away from that system. Then the hypervisor swaps that RAM or puts it out of play in another way, and gets to reclaim the underlying physical RAM. At least, this is the VMWare way of doing it, not too sure about MS or Citrix or RH or others.
- jaysh 11y ago
  This is a nice article on the matter: http://web.archive.org/web/20110929075510/http://invisiblethings.org/papers/redpill.html http://web.archive.org/web/20110929075510/http://invisibleth.... It doesn't appear to work reliably anymore, but the principle is the same. Even if we reached the point where VMs never technically revealed they were VMs, I think the human element might still play a part. When I spin up a VM for a quick test, I might leave it on 512MB or 1GB RAM - but this could be a giveaway that it's a VM (not 100% of the time, granted) given how unlikely a fresh installation of Windows is to have that small amount of memory.

god_bless_texas 11y ago

This makes me so mad and sad at the same time. For years, it would bring me immense pleasure to just browse projects on sourceforge to see what the world was up to. Now this is just another case of corporations ruining a good thing. I'm glad there are links to Filezilla and Gimp - two products I use frequently.

dare_you 11y ago
I was just remembering when sourceforge first appeared and how awesome it was. I slowly started browsing projects on there instead of freshmeat. It is just sad, and frankly a little weird.
whoisthemachine 11y ago
I kind of view it as a consequence of the market falling out from under their feet - it's cheap enough to host your own files now, and with package managers (even on Windows!) the power users that used to be the target audience of Source Forge have been vanishing.
- toyg 11y ago
  IMHO it's more a function of their inability to compete with Github and Bitbucket. They were slow to react to the rise of distributed VCS, failed to exploit their social network features, and probably had already accumulated too much technical debt to effectively change course by the time overall trends became clear. Once developers shifted, power users had to follow suit.

zamalek 11y ago

Just today I had to get Boost for the first time since the whole gimp-win debacle - their tars and zips are hosted on SourceForge. Guess I'll be building from Git until they fix it :/

userbinator 11y ago
It's only .exe installers that are affected, and probably only ones that they can easily wrap; I doubt they're actually modifying any source code.

brokentone 11y ago

At least for Mac, there is a TINY "direct download" link next to the SF Installer button. Using this link will provide the non-junkware, original install files.

dimino 11y ago

This is why we need some kind of trade organization -- the developers who wrote this stuff need to be kicked out, or disciplined in some way...

bargl 11y ago
This has been brought up multiple times and I couldn't agree more. It'd be great to have a trade organization for software developers where they can be evaluated by a board and loose their "license" to write code. There are some SERIOUS down sides to that, but that'd have to be flushed out in another forum.
noarchy 11y ago
There would have to be a lot of careful discussion about such an organization. I would hate to see it end up being little more than a vector for rent-seeking, and shutting people out of our industry for a host of arbitrary reasons (immigrants, people with the "wrong" education, etc).
- dimino 11y ago
  Yeah, I'm just saying that fields like engineering and law have recourse for bad industry behavior. I wish software had the same or a similar path.

toyg 11y ago

I've tweeted someone close to the Pywin32 project (hosted on SF) asking to move it, but didn't get a reply. For long-established projects, it's not an easy migration. Please keep prodding any critical project you know of.

WorldWideWayne 11y ago
Some people just don't care or they're profiting from it like Tim Kosse of Filezilla - https://forum.filezilla-project.org/viewtopic.php?t=35221 https://forum.filezilla-project.org/viewtopic.php?t=35221 and https://forum.filezilla-project.org/viewtopic.php?t=30240 https://forum.filezilla-project.org/viewtopic.php?t=30240

jimrandomh 11y ago

> Click through to a project’s official website and you’ll find actual download links. For example, Audacity’s homepage redirects you to FOSSHUB to download Audacity, not SourceForge. But searching for “Audacity” on Google still brings up the SourceForge page as the top result. This is an error on Google's part. For everyone's sake, they need to apply some serious ranking penalties to malware distributing sites like SourceForge, as well as click-through warnings that you are going to a site other than the original authors'.

prajjwal 11y ago

"In truth, the man was an oathbreaker, a deserter from the Night’s Watch. No man is more dangerous. The deserter knows his life is forfeit if he is taken, so he will not flinch from any crime, no matter how vile." ~ Ned Stark, A Game of Thrones. I think that pathetic blog post where they tried to justify their actions made one thing clear - SourceForge knows how dead they are. No amount of internet outrage is going to help, they don't think they've got anything to lose at this point. The best thing to do at this point would be to speed up their demise. If you're a developer that still hosts with them, delete your project and move to Github or Bitbucket. Also, start reporting these malicious pages to Google so they don't show up in search results. https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/

M2Ys4U 11y ago
Also contact the people who provide mirroring services for them. Take away their free bandwidth and they'll collapse even quicker.
- ytdht 11y ago
  perhaps someone should mirror sourceforge and rebuild binaries and take sourceforge out of the equation?

oblio 11y ago

So sad. Especially for Windows tons of valuable stuff is there, especially smaller utilities like DDMM and similar :(

khaki54 11y ago

If you download from Sourceforge try unzipping the installer which will usually defeat the spyware installer that they have been bundling with it.

jarnix 11y ago

I never use the "downloader", either from Akamai, Sourceforge, etc. I downloaded a few programs recently on sourceforge and never had to use their software.

bramgg 11y ago

I wonder how many people outraged here know YC funded a company that bundles malware with installers and continues to justify it publically on HN.

withinrafael 11y ago
InstallMonetizer?
- bramgg 11y ago
  Yes

clean88clean88 11y ago

ARE BOTH Sourceforge and Github other-verted or perverted-like? What are the alternatives? Thank you. Thank you. the attack on code repo and the infiltration of the clean database continues, perhaps.

clean88clean88 11y ago

Is BOTH Sourceforge and Github -other-verted or per-verted? or sub-verted? The attack on the clean code-base continues. Advice. Unix Linux - separate user. low privilege. configure, make, but make install with ROOT PRIVILEGE. check files. all source code should have search engine keywords for vulnerabilies, updates, etc. for even BSD is somewhat broken, IMHO. make it easier for the NOT C expert and ASM expert to install reasonably clean software, PLEASE. Thank U. Thank U. Thank U. ... 1000 times

Negative1 11y ago

tldr; don't download from SourceForge it uses its own installer bundled with garbage. Do download using ninite.com (https://ninite.com/ https://ninite.com/), the "only trusted" downloader according to these guys.

lioeters 11y ago

Just realized the double meaning of "forge" in SourceForge: 1) to form or make by concentrated effort 2) to imitate fraudulently; fabricate a forgery They're certainly living up to definition #2..