6 ms·

No, it wasn't malware, that's software intended to damage or disable a computer. SourceForge isn't trying to hurt anyone, please stop pretending like they are.

• joshstrange 11y ago
  Bullshit. You don't get to play that card. By that logic I can run a botnet and distribute whatever I want over it and it can't be called malware as long as I say I have no ill intent and I keep myself blissfully unaware of what's being installed. NO. SF can and SHOULD be held responsible for bundling crap and malware to unsuspecting users. They don't get a pass just because you THINK there is no "ill intent". Ignorance of the law is not an excuse and neither is ignorance of the shit you are deploy. They don't get to stand back and shirk responsibility, it's on their site it's their problem, plain and simple. It doesn't matter AT ALL what there intent was it matters what they are doing and they are distributing malware. END OF STORY.
  • dimino 11y ago
    I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't think Sourceforce wants to hurt its users, and that, to me, a guy who works in the computer security industry, is a standard for "malware". It just seems to me that the term "malware" is being used here intentionally to antagonize, rather than to accurately classify the software being installed by Sourceforge. Please understand that I am casting no judgement or assessment whatsoever of what Sourceforge is doing -- personally I think they're a dying website that's trying to do whatever they can to make money and stay relevant. It just intuitively feels wrong to classify China in the same category as Sourceforge.
    • oneeyedpigeon 11y ago
      There are certainly different understandings of the term 'malware', even within the technical community, let alone the wider world. The fact that a large number of people use it to describe "software that ended up on my computer that I wasn't expecting", no matter what it's doing, means that companies need to be very careful how they go about using this practice. Even if you have the very best possible intentions in the world, you're probably going to damage your reputation by bundling unrelated software, so why not just offer it as a separate download in the first place?
      • dimino 11y ago
        I get where you're coming from, and ultimately I agree that Sourceforge screwed up by doing this whole "bundling" thing, and probably because they're scrambling desperately to make money in a GitHub world. There is, however, a meaningful difference between the kinds of things my antivirus picks up and the software Sourceforge was bundling. Calling the Sourceforge bundles "malware" masks that difference, and I think that's harmful, and maybe a little childish.
        • JoshTriplett 11y ago
          I've seen multiple reports of people's antivirus software blocking downloads of the "installers" provided by SourceForge, or warning about the resulting downloaded executable. And rightfully so. Scrambling to stay in business, or being under new management, is not an excuse to suddenly become user-hostile or otherwise turn to shady activities. Similarly, many companies start throwing around litigation when they begin to fail, since that's the only way the purchasers of the various patents/etc owned by the company into money. Finally, the only "harm" it could do to classify all such software as "malware" is to make it more difficult for vendors of software who would prefer not to be classified in the same bucket as people who maliciously break into computer systems. And I have zero sympathy for any such companies; the sooner they go out of business, and the more they're viewed as universally unacceptable, the better off both users and the computing industry will be.
    • jackmaney 11y ago
      You've been caught acting as a shill for SourceForge. The least you could do is admit it and slither away.
      • dimino 11y ago
        Haha, come on man, let's assume positive intent on my part here, I just want to talk about how we classify bad behavior on the Internet.
        • deleted 11y ago
          [deleted]
        • jackmaney 11y ago
          > Haha, come on man, let's assume positive intent on my part here http://img2.wikia.nocookie.net/__cb20130620000603/walkingdead/images/d/d7/How-about-no-bear-meme.jpg http://img2.wikia.nocookie.net/__cb20130620000603/walkingdea...
      • dang 11y ago
        Accusations of shilling without evidence are not allowed on Hacker News. An opposite opinion is not evidence. The vast majority of the time, people just sincerely disagree with each other. I've written about this frequently [1] if anyone wants more information. > admit it and slither away Totally not ok. Please comment civilly and substantively or not at all. [2] 1. https://hn.algolia.com/?sort=byDate&prefix=true&page=0&dateRange=all&type=comment&query=by:dang%20astroturfing https://hn.algolia.com/?sort=byDate&prefix=true&page=0&dateR... 2. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        • jackmaney 11y ago
          He's accused people who disagree with him of being liars. That, along with his general behavior, is good enough for me. Oh, and don't bother trying to spam my email account. I set up a filter to automatically delete any email from hn@ycombinator.com long, long ago.
    • JoshTriplett 11y ago
      Your response "Why are you lying?" elsewhere in this thread, now deleted, certainly doesn't help make your actions seem genuine. And attempting to trick users into installing software that you know they don't want is definitely ill intent and attempting to hurt users. Sure, some security professionals make distinctions between a variety of different subtypes of bad software, with varying definitions, including adware, malware, badware, ransomware, backdoors, viruses, trojans, and any number of other terms. But outside of the security industry, people trying to make fine-grained distinctions or introduce different terms are often malware vendors themselves, hence why you've "touched a nerve". For instance, when Lenovo started pre-installing the Superfish malware on their systems, they persistently called it "Potentially Unwanted Programs", to obfuscate what they were actually doing. On top of that, as the Superfish case indicates, even software that "just" serves ads tends to escalate, such as by MITMing and utterly breaking HTTPS. And any such software has the potential to introduce bugs. We have quite enough bugs in software that does what its users want it to do, without introducing more software that nobody wants and that can only further reduce user security and privacy.
      • dimino 11y ago
        I'm trying to be a better actor on this site, I'm sorry for the "Why are you lying?" comment. I deleted it because it completely undermines my argument, you're right to call me out on it. I'm sorry. :( I think you and I are on the same page here. My only additional point I'd like to make is that there is value in differentiating between what Sourceforge did and what will happen if you download a bad torrent from TPB, or click the wrong ad on a porn website. Lumping them all together means my grandfather goes and buys identity protection services because the Ask toolbar on IE is "malware".
        • JoshTriplett 11y ago
          If you'd started out your comments in the way you're presenting them now, I think you'd have gotten a better response. It's still a hot-button topic, not least of which because as mentioned the main people that benefit from such distinctions are the companies writing software that users don't want (e.g. Lenovo's attempt to use the term "Potentially Unwanted Programs"). However, what is HN coming to if you can't argue about nitpicky distinctions? ;) Also, the Ask toolbar is not the only thing SF is installing; they're also installing much worse software. And sure, it's less harmful to change a user's search engine or waste a few dozen vertical pixels on a distracting toolbar than it is to turn a user's system into a botnet node, but "less harmful" is still harmful. For the record, I also think there are some bad actors in the "identity protection" and similar security spaces; not only is it ridiculous to need software or services to protect you from other software and services, but many such services are scamming novice computer users who know enough to be afraid. And the entire consumer antivirus industry is a bit ridiculous as well, not least of which in the sheer amount of resources such software tends to take up. I much prefer the portion of the security industry that's pushing for a sandboxed-by-default, principle-of-least-privilege world. But at the same time, adware, malware, or whatever you want to call it (including the vast majority of IE toolbars and such) are good examples of software that needs to go away and never come back. I'm not interested in shady ways to scam and "monetize" users; as has been said many times elsewhere, "your failing business model is not our problem". And the existence of even worse software doesn't excuse slightly-less-awful-but-still-awful software. The only question is how much damage such companies will do in their death throes before they finally die.
• darklajid 11y ago
  malware as in male, evil/bad. You can try to draw a line between 'optional highly integrated offers that are hard to remove', 'crapware', 'bloatware' and 'malware' if you like, but .. it's really just one bucket. Bad → Malware.
  • dimino 11y ago
    It isn't though, because malware implies ill intent. There is no ill intent on the part of SourceForge. They're not trying to steal anything from you, they're not trying to lock you out of your own device, and they're not trying to exfiltrate company/personal secrets. You dilute the meaning of the word by using it here.
    • mikeash 11y ago
      Why does anybody care about intent? Intent is difficult to discern and has no effect on what actually happens as a consequence of someone's actions. They say the road to Hell is paved with good intentions. Does that mean we should just ignore the fact that it goes to Hell?
• oneeyedpigeon 11y ago
  There are plenty of reports of Sourceforge downloads, in the past, containing malware. I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. Nor am I claiming first-hand evidence of such. However, what's clear right now is that if you download an installer from Sourceforge, it could install software that is totally unrelated, that you didn't request. Yes, they might disclose that it's going to happen and give you the option not to install the unwanted software, but it's still clearly their intent that some people end up with unrequested software on their machines. That's pretty questionable behaviour in my book.
  • JoshTriplett 11y ago
    > I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. They've put out press releases explicitly admitting to such intent: that they hijacked "inactive" projects (which includes projects who intentionally left), and that they bundled "offers" (malware) with them. And if you think there's a useful distinction between malware and what they're distributing, note that one of the bits of software they "offer" to install captures all network traffic and routes it via a third-party service without making that clear to the user.
    • deleted 11y ago
      [deleted]
  • dimino 11y ago
    Everything you say here is totally true. That's not what malware is, though. The term isn't a scientific one, but the intent to harm is a pretty key component, and I am quite certain Sourceforge isn't trying to hurt its users. Does it really bother no one else that the phrase "malware" is being thrown around antagonistically?
    • laumars 11y ago
      I get what you're saying and do agree to an extent. But you have to bare in mind that the bundles are presented in such a way to deliberately trick users into installing software they don't want installed. SF very much intentionally loads adware and other software that they know the vast majority of users wouldn't want; and very much do so in a covert way (eg having the "Install" button labelled "I agree" so users think they're signing a EULA). So one could argue that their installer is a trojan since it's actual behaviour isn't the same as it's presented behavior. Thus even if the software they install isn't malware, their method of deployment is.