5 ms·

They don't add malware to the download, geez...

by dimino 11y ago

maxerickson 11y ago
They bundled user hostile software: https://sourceforge.net/blog/advertising-bundling-community-and-criticism/ https://sourceforge.net/blog/advertising-bundling-community-... Therefore, we evaluated a few Installer Partners to help us address end-users’ complaints related to one or more of the following reasons: a) opaque installation flows providing little or no choice about secondary offering installations; b) undocumented and difficult to uninstall procedures for those secondary offerings; c) secondary offerings that are not always safe, trusted and secure applications. We addressed points a) to c), and our approach was highly appreciated by eminent members of different open source communities. Then they figured out that they had made a mistake and started bundling less user hostile software. If they had not bundled stuff people didn't want, they would say that there instead of back peddling.
oneeyedpigeon 11y ago
They have in the past. And, currently, they bundle additional, unrequested software with at least some of their downloads.
- dimino 11y ago
  No, it wasn't malware, that's software intended to damage or disable a computer. SourceForge isn't trying to hurt anyone, please stop pretending like they are.
  - joshstrange 11y ago
    Bullshit. You don't get to play that card. By that logic I can run a botnet and distribute whatever I want over it and it can't be called malware as long as I say I have no ill intent and I keep myself blissfully unaware of what's being installed. NO. SF can and SHOULD be held responsible for bundling crap and malware to unsuspecting users. They don't get a pass just because you THINK there is no "ill intent". Ignorance of the law is not an excuse and neither is ignorance of the shit you are deploy. They don't get to stand back and shirk responsibility, it's on their site it's their problem, plain and simple. It doesn't matter AT ALL what there intent was it matters what they are doing and they are distributing malware. END OF STORY.
    - dimino 11y ago
      I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't think Sourceforce wants to hurt its users, and that, to me, a guy who works in the computer security industry, is a standard for "malware". It just seems to me that the term "malware" is being used here intentionally to antagonize, rather than to accurately classify the software being installed by Sourceforge. Please understand that I am casting no judgement or assessment whatsoever of what Sourceforge is doing -- personally I think they're a dying website that's trying to do whatever they can to make money and stay relevant. It just intuitively feels wrong to classify China in the same category as Sourceforge.
      - oneeyedpigeon 11y ago
        There are certainly different understandings of the term 'malware', even within the technical community, let alone the wider world. The fact that a large number of people use it to describe "software that ended up on my computer that I wasn't expecting", no matter what it's doing, means that companies need to be very careful how they go about using this practice. Even if you have the very best possible intentions in the world, you're probably going to damage your reputation by bundling unrelated software, so why not just offer it as a separate download in the first place?
        dimino 11y ago
        I get where you're coming from, and ultimately I agree that Sourceforge screwed up by doing this whole "bundling" thing, and probably because they're scrambling desperately to make money in a GitHub world. There is, however, a meaningful difference between the kinds of things my antivirus picks up and the software Sourceforge was bundling. Calling the Sourceforge bundles "malware" masks that difference, and I think that's harmful, and maybe a little childish.
        JoshTriplett 11y ago
        I've seen multiple reports of people's antivirus software blocking downloads of the "installers" provided by SourceForge, or warning about the resulting downloaded executable. And rightfully so. Scrambling to stay in business, or being under new management, is not an excuse to suddenly become user-hostile or otherwise turn to shady activities. Similarly, many companies start throwing around litigation when they begin to fail, since that's the only way the purchasers of the various patents/etc owned by the company into money. Finally, the only "harm" it could do to classify all such software as "malware" is to make it more difficult for vendors of software who would prefer not to be classified in the same bucket as people who maliciously break into computer systems. And I have zero sympathy for any such companies; the sooner they go out of business, and the more they're viewed as universally unacceptable, the better off both users and the computing industry will be.
  - darklajid 11y ago
    malware as in male, evil/bad. You can try to draw a line between 'optional highly integrated offers that are hard to remove', 'crapware', 'bloatware' and 'malware' if you like, but .. it's really just one bucket. Bad → Malware.
    - dimino 11y ago
      It isn't though, because malware implies ill intent. There is no ill intent on the part of SourceForge. They're not trying to steal anything from you, they're not trying to lock you out of your own device, and they're not trying to exfiltrate company/personal secrets. You dilute the meaning of the word by using it here.
      - mikeash 11y ago
        Why does anybody care about intent? Intent is difficult to discern and has no effect on what actually happens as a consequence of someone's actions. They say the road to Hell is paved with good intentions. Does that mean we should just ignore the fact that it goes to Hell?
  - oneeyedpigeon 11y ago
    There are plenty of reports of Sourceforge downloads, in the past, containing malware. I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. Nor am I claiming first-hand evidence of such. However, what's clear right now is that if you download an installer from Sourceforge, it could install software that is totally unrelated, that you didn't request. Yes, they might disclose that it's going to happen and give you the option not to install the unwanted software, but it's still clearly their intent that some people end up with unrequested software on their machines. That's pretty questionable behaviour in my book.
    - JoshTriplett 11y ago
      > I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. They've put out press releases explicitly admitting to such intent: that they hijacked "inactive" projects (which includes projects who intentionally left), and that they bundled "offers" (malware) with them. And if you think there's a useful distinction between malware and what they're distributing, note that one of the bits of software they "offer" to install captures all network traffic and routes it via a third-party service without making that clear to the user.
      - deleted 11y ago
        [deleted]
    - dimino 11y ago
      Everything you say here is totally true. That's not what malware is, though. The term isn't a scientific one, but the intent to harm is a pretty key component, and I am quite certain Sourceforge isn't trying to hurt its users. Does it really bother no one else that the phrase "malware" is being thrown around antagonistically?
      - laumars 11y ago
        I get what you're saying and do agree to an extent. But you have to bare in mind that the bundles are presented in such a way to deliberately trick users into installing software they don't want installed. SF very much intentionally loads adware and other software that they know the vast majority of users wouldn't want; and very much do so in a covert way (eg having the "Install" button labelled "I agree" so users think they're signing a EULA). So one could argue that their installer is a trojan since it's actual behaviour isn't the same as it's presented behavior. Thus even if the software they install isn't malware, their method of deployment is.

They don't add malware to the download, geez...

by dimino 11y ago

They don't add malware to the download, geez...

They bundled user hostile software: https://sourceforge.net/blog/advertising-bundling-community-and-criticism/ https://sourceforge.net/blog/advertising-bundling-community-... Therefore, we evaluated a few Installer Partners to help us address end-users’ complaints related to one or more of the following reasons: a) opaque installation flows providing little or no choice about secondary offering installations; b) undocumented and difficult to uninstall procedures for those secondary offerings; c) secondary offerings that are not always safe, trusted and secure applications. We addressed points a) to c), and our approach was highly appreciated by eminent members of different open source communities. Then they figured out that they had made a mistake and started bundling less user hostile software. If they had not bundled stuff people didn't want, they would say that there instead of back peddling.

oneeyedpigeon 11y ago

They have in the past. And, currently, they bundle additional, unrequested software with at least some of their downloads.

dimino 11y ago
No, it wasn't malware, that's software intended to damage or disable a computer. SourceForge isn't trying to hurt anyone, please stop pretending like they are.
- joshstrange 11y ago
  Bullshit. You don't get to play that card. By that logic I can run a botnet and distribute whatever I want over it and it can't be called malware as long as I say I have no ill intent and I keep myself blissfully unaware of what's being installed. NO. SF can and SHOULD be held responsible for bundling crap and malware to unsuspecting users. They don't get a pass just because you THINK there is no "ill intent". Ignorance of the law is not an excuse and neither is ignorance of the shit you are deploy. They don't get to stand back and shirk responsibility, it's on their site it's their problem, plain and simple. It doesn't matter AT ALL what there intent was it matters what they are doing and they are distributing malware. END OF STORY.
  - dimino 11y ago
    I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't think Sourceforce wants to hurt its users, and that, to me, a guy who works in the computer security industry, is a standard for "malware". It just seems to me that the term "malware" is being used here intentionally to antagonize, rather than to accurately classify the software being installed by Sourceforge. Please understand that I am casting no judgement or assessment whatsoever of what Sourceforge is doing -- personally I think they're a dying website that's trying to do whatever they can to make money and stay relevant. It just intuitively feels wrong to classify China in the same category as Sourceforge.
    - oneeyedpigeon 11y ago
      There are certainly different understandings of the term 'malware', even within the technical community, let alone the wider world. The fact that a large number of people use it to describe "software that ended up on my computer that I wasn't expecting", no matter what it's doing, means that companies need to be very careful how they go about using this practice. Even if you have the very best possible intentions in the world, you're probably going to damage your reputation by bundling unrelated software, so why not just offer it as a separate download in the first place?
      - dimino 11y ago
        I get where you're coming from, and ultimately I agree that Sourceforge screwed up by doing this whole "bundling" thing, and probably because they're scrambling desperately to make money in a GitHub world. There is, however, a meaningful difference between the kinds of things my antivirus picks up and the software Sourceforge was bundling. Calling the Sourceforge bundles "malware" masks that difference, and I think that's harmful, and maybe a little childish.
        JoshTriplett 11y ago
        I've seen multiple reports of people's antivirus software blocking downloads of the "installers" provided by SourceForge, or warning about the resulting downloaded executable. And rightfully so. Scrambling to stay in business, or being under new management, is not an excuse to suddenly become user-hostile or otherwise turn to shady activities. Similarly, many companies start throwing around litigation when they begin to fail, since that's the only way the purchasers of the various patents/etc owned by the company into money. Finally, the only "harm" it could do to classify all such software as "malware" is to make it more difficult for vendors of software who would prefer not to be classified in the same bucket as people who maliciously break into computer systems. And I have zero sympathy for any such companies; the sooner they go out of business, and the more they're viewed as universally unacceptable, the better off both users and the computing industry will be.
- darklajid 11y ago
  malware as in male, evil/bad. You can try to draw a line between 'optional highly integrated offers that are hard to remove', 'crapware', 'bloatware' and 'malware' if you like, but .. it's really just one bucket. Bad → Malware.
  - dimino 11y ago
    It isn't though, because malware implies ill intent. There is no ill intent on the part of SourceForge. They're not trying to steal anything from you, they're not trying to lock you out of your own device, and they're not trying to exfiltrate company/personal secrets. You dilute the meaning of the word by using it here.
    - mikeash 11y ago
      Why does anybody care about intent? Intent is difficult to discern and has no effect on what actually happens as a consequence of someone's actions. They say the road to Hell is paved with good intentions. Does that mean we should just ignore the fact that it goes to Hell?
- oneeyedpigeon 11y ago
  There are plenty of reports of Sourceforge downloads, in the past, containing malware. I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. Nor am I claiming first-hand evidence of such. However, what's clear right now is that if you download an installer from Sourceforge, it could install software that is totally unrelated, that you didn't request. Yes, they might disclose that it's going to happen and give you the option not to install the unwanted software, but it's still clearly their intent that some people end up with unrequested software on their machines. That's pretty questionable behaviour in my book.
  - JoshTriplett 11y ago
    > I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. They've put out press releases explicitly admitting to such intent: that they hijacked "inactive" projects (which includes projects who intentionally left), and that they bundled "offers" (malware) with them. And if you think there's a useful distinction between malware and what they're distributing, note that one of the bits of software they "offer" to install captures all network traffic and routes it via a third-party service without making that clear to the user.
    - deleted 11y ago
      [deleted]
  - dimino 11y ago
    Everything you say here is totally true. That's not what malware is, though. The term isn't a scientific one, but the intent to harm is a pretty key component, and I am quite certain Sourceforge isn't trying to hurt its users. Does it really bother no one else that the phrase "malware" is being thrown around antagonistically?
    - laumars 11y ago
      I get what you're saying and do agree to an extent. But you have to bare in mind that the bundles are presented in such a way to deliberately trick users into installing software they don't want installed. SF very much intentionally loads adware and other software that they know the vast majority of users wouldn't want; and very much do so in a covert way (eg having the "Install" button labelled "I agree" so users think they're signing a EULA). So one could argue that their installer is a trojan since it's actual behaviour isn't the same as it's presented behavior. Thus even if the software they install isn't malware, their method of deployment is.