6 ms·

So, this is Sourceforge mirroring a popular open source project that's hosted elsewhere in order to garner more traffic? Is that what's going on here?

imglorp 11y ago
Yeah. I'm okay with it because it says right there, Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information. plus the url also clearly says ".mirror", so they're not pretending to be the authoritative page on the product. It's no more creepy than Tucows or C-Net at this point. Just a regular spam laden download site.
- JoshTriplett 11y ago
  Except for the part where they add malware to the download. Mozilla has gone after various shady sites distributing "Firefox" with malware, and I hope they do so in this case too.
  - dimino 11y ago
    They don't add malware to the download, geez...
    - maxerickson 11y ago
      They bundled user hostile software: https://sourceforge.net/blog/advertising-bundling-community-and-criticism/ https://sourceforge.net/blog/advertising-bundling-community-... Therefore, we evaluated a few Installer Partners to help us address end-users’ complaints related to one or more of the following reasons: a) opaque installation flows providing little or no choice about secondary offering installations; b) undocumented and difficult to uninstall procedures for those secondary offerings; c) secondary offerings that are not always safe, trusted and secure applications. We addressed points a) to c), and our approach was highly appreciated by eminent members of different open source communities. Then they figured out that they had made a mistake and started bundling less user hostile software. If they had not bundled stuff people didn't want, they would say that there instead of back peddling.
    - oneeyedpigeon 11y ago
      They have in the past. And, currently, they bundle additional, unrequested software with at least some of their downloads.
      - dimino 11y ago
        No, it wasn't malware, that's software intended to damage or disable a computer. SourceForge isn't trying to hurt anyone, please stop pretending like they are.
        joshstrange 11y ago
        Bullshit. You don't get to play that card. By that logic I can run a botnet and distribute whatever I want over it and it can't be called malware as long as I say I have no ill intent and I keep myself blissfully unaware of what's being installed. NO. SF can and SHOULD be held responsible for bundling crap and malware to unsuspecting users. They don't get a pass just because you THINK there is no "ill intent". Ignorance of the law is not an excuse and neither is ignorance of the shit you are deploy. They don't get to stand back and shirk responsibility, it's on their site it's their problem, plain and simple. It doesn't matter AT ALL what there intent was it matters what they are doing and they are distributing malware. END OF STORY.
        dimino 11y ago
        I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't think Sourceforce wants to hurt its users, and that, to me, a guy who works in the computer security industry, is a standard for "malware". It just seems to me that the term "malware" is being used here intentionally to antagonize, rather than to accurately classify the software being installed by Sourceforge. Please understand that I am casting no judgement or assessment whatsoever of what Sourceforge is doing -- personally I think they're a dying website that's trying to do whatever they can to make money and stay relevant. It just intuitively feels wrong to classify China in the same category as Sourceforge.

imglorp 11y ago

Yeah. I'm okay with it because it says right there, Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information. plus the url also clearly says ".mirror", so they're not pretending to be the authoritative page on the product. It's no more creepy than Tucows or C-Net at this point. Just a regular spam laden download site.

JoshTriplett 11y ago
Except for the part where they add malware to the download. Mozilla has gone after various shady sites distributing "Firefox" with malware, and I hope they do so in this case too.
- dimino 11y ago
  They don't add malware to the download, geez...
  - maxerickson 11y ago
    They bundled user hostile software: https://sourceforge.net/blog/advertising-bundling-community-and-criticism/ https://sourceforge.net/blog/advertising-bundling-community-... Therefore, we evaluated a few Installer Partners to help us address end-users’ complaints related to one or more of the following reasons: a) opaque installation flows providing little or no choice about secondary offering installations; b) undocumented and difficult to uninstall procedures for those secondary offerings; c) secondary offerings that are not always safe, trusted and secure applications. We addressed points a) to c), and our approach was highly appreciated by eminent members of different open source communities. Then they figured out that they had made a mistake and started bundling less user hostile software. If they had not bundled stuff people didn't want, they would say that there instead of back peddling.
  - oneeyedpigeon 11y ago
    They have in the past. And, currently, they bundle additional, unrequested software with at least some of their downloads.
    - dimino 11y ago
      No, it wasn't malware, that's software intended to damage or disable a computer. SourceForge isn't trying to hurt anyone, please stop pretending like they are.
      - joshstrange 11y ago
        Bullshit. You don't get to play that card. By that logic I can run a botnet and distribute whatever I want over it and it can't be called malware as long as I say I have no ill intent and I keep myself blissfully unaware of what's being installed. NO. SF can and SHOULD be held responsible for bundling crap and malware to unsuspecting users. They don't get a pass just because you THINK there is no "ill intent". Ignorance of the law is not an excuse and neither is ignorance of the shit you are deploy. They don't get to stand back and shirk responsibility, it's on their site it's their problem, plain and simple. It doesn't matter AT ALL what there intent was it matters what they are doing and they are distributing malware. END OF STORY.
        dimino 11y ago
        I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't think Sourceforce wants to hurt its users, and that, to me, a guy who works in the computer security industry, is a standard for "malware". It just seems to me that the term "malware" is being used here intentionally to antagonize, rather than to accurately classify the software being installed by Sourceforge. Please understand that I am casting no judgement or assessment whatsoever of what Sourceforge is doing -- personally I think they're a dying website that's trying to do whatever they can to make money and stay relevant. It just intuitively feels wrong to classify China in the same category as Sourceforge.