4 ms·

There are plenty of reports of Sourceforge downloads, in the past, containing malware. I'm not saying they haven't removed those, or claiming - for a second - t

There are plenty of reports of Sourceforge downloads, in the past, containing malware. I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. Nor am I claiming first-hand evidence of such. However, what's clear right now is that if you download an installer from Sourceforge, it could install software that is totally unrelated, that you didn't request. Yes, they might disclose that it's going to happen and give you the option not to install the unwanted software, but it's still clearly their intent that some people end up with unrequested software on their machines. That's pretty questionable behaviour in my book.

JoshTriplett 11y ago
> I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. They've put out press releases explicitly admitting to such intent: that they hijacked "inactive" projects (which includes projects who intentionally left), and that they bundled "offers" (malware) with them. And if you think there's a useful distinction between malware and what they're distributing, note that one of the bits of software they "offer" to install captures all network traffic and routes it via a third-party service without making that clear to the user.
- deleted 11y ago
  [deleted]
dimino 11y ago
Everything you say here is totally true. That's not what malware is, though. The term isn't a scientific one, but the intent to harm is a pretty key component, and I am quite certain Sourceforge isn't trying to hurt its users. Does it really bother no one else that the phrase "malware" is being thrown around antagonistically?
- laumars 11y ago
  I get what you're saying and do agree to an extent. But you have to bare in mind that the bundles are presented in such a way to deliberately trick users into installing software they don't want installed. SF very much intentionally loads adware and other software that they know the vast majority of users wouldn't want; and very much do so in a covert way (eg having the "Install" button labelled "I agree" so users think they're signing a EULA). So one could argue that their installer is a trojan since it's actual behaviour isn't the same as it's presented behavior. Thus even if the software they install isn't malware, their method of deployment is.

JoshTriplett 11y ago

> I'm not saying they haven't removed those, or claiming - for a second - that they intentionally distributed them. They've put out press releases explicitly admitting to such intent: that they hijacked "inactive" projects (which includes projects who intentionally left), and that they bundled "offers" (malware) with them. And if you think there's a useful distinction between malware and what they're distributing, note that one of the bits of software they "offer" to install captures all network traffic and routes it via a third-party service without making that clear to the user.

deleted 11y ago
[deleted]

dimino 11y ago

Everything you say here is totally true. That's not what malware is, though. The term isn't a scientific one, but the intent to harm is a pretty key component, and I am quite certain Sourceforge isn't trying to hurt its users. Does it really bother no one else that the phrase "malware" is being thrown around antagonistically?

laumars 11y ago
I get what you're saying and do agree to an extent. But you have to bare in mind that the bundles are presented in such a way to deliberately trick users into installing software they don't want installed. SF very much intentionally loads adware and other software that they know the vast majority of users wouldn't want; and very much do so in a covert way (eg having the "Install" button labelled "I agree" so users think they're signing a EULA). So one could argue that their installer is a trojan since it's actual behaviour isn't the same as it's presented behavior. Thus even if the software they install isn't malware, their method of deployment is.