8 ms·

Google Is Now Listing SourceForge as a Malicious Site

235 points by irl_zebra 11y ago

davidgerard 11y ago
Not happening for me when I go to that link from Google in Firefox. Can anyone else reproduce this? edit: Now happening for me in Chromium. (Both of these on Xubuntu 14.04, versions from the repos.)
- dantudor 11y ago
  Yes happens for me in Chrome. Welcome news!
- m3Lith 11y ago
  Nope, can freely access the site on both latest versions of Chrome and Chromium. Though the project seems to have moved from that page already.
  - davidgerard 11y ago
    I got the warning in Chromium just now.
- deleted 11y ago
  [deleted]
- s_dev 11y ago
  No warning for me either on Chrome Version 43.0.2357.124 (64-bit) on a Mac running Yosemite and I'm based in Dublin, Ireland. I can reproduce it if I visit exactly: http://sourceforge.net/projects/camstudio/ http://sourceforge.net/projects/camstudio/ but not http://sourceforge.net/ http://sourceforge.net/ on it's own. Perhaps they only apply the warning to malicious projects rather than the site as a whole.
- runarb 11y ago
  Blocked for me when using Chrome Versjon 42.0.2311.90 on Windows 7.
dkns 11y ago
I'm guessing OP took this from reddit thread. If you read that thread you'll see that it's not sourceforge but this one project. So this title is misleading. Edit: Thread: http://www.reddit.com/r/technology/comments/3a9h9x/soureforge_now_listed_as_malicious_when_clicked/ http://www.reddit.com/r/technology/comments/3a9h9x/soureforg... Response from one user that sourceforge is actually whitelisted by google: http://www.reddit.com/r/technology/comments/3a9h9x/soureforge_now_listed_as_malicious_when_clicked/csamu9j http://www.reddit.com/r/technology/comments/3a9h9x/soureforg... http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=sourceforge.net/ http://safebrowsing.clients.google.com/safebrowsing/diagnost... http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=downloads.sourceforge.net/ http://safebrowsing.clients.google.com/safebrowsing/diagnost...
- davidgerard 11y ago
  Looks like the malware-bearing projects need some reporting, then!
  - luso_brazilian 11y ago
    Not really, if you see the Google Safe Browsing diagnostic page for sourceforge.net (emphasis mine) [1]: >> What is the current listing status for sourceforge.net? >> This site is >>>not currently listed as suspicious<<<. >> Part of this site was listed for suspicious activity 333 time(s) over the past 90 days. >> What happened when Google visited this site? >> Of the 205785 pages we tested on the site over the past 90 days, 588 page(s) resulted in >>>malicious software being downloaded and installed without user consent<<<. >> The last time Google visited this site was on 2015-06-18, and the last time suspicious content was found on this site was on >>>2015-06-18<<<. >> Malicious software includes 5877 virus, 4347 trojan(s), 1132 exploit(s). [1] http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=sourceforge.net/ http://safebrowsing.clients.google.com/safebrowsing/diagnost...
- k_roy 11y ago
  UBlock is actually blocking all of SF
rawe 11y ago
The following page lists stats for sourceforge itself: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fsourceforge.net&client=googlechrome&hl=en-US http://safebrowsing.clients.google.com/safebrowsing/diagnost... : > Part of this site was listed for suspicious activity 332 time(s) over the past 90 days.
- csn 11y ago
  I also find it fascinating what Google has to say about itself https://google.com/safebrowsing/diagnostic?site=Google.com https://google.com/safebrowsing/diagnostic?site=Google.com
  - _lce0 11y ago
    [!] Youtube also downloads and installs malware https://google.com/safebrowsing/diagnostic?site=youtube.com https://google.com/safebrowsing/diagnostic?site=youtube.com
  - piyush_soni 11y ago
    Very interesting! Of course Google itself is not hosting any malicious content, but they are acting as a bridge between the user and malicious content which they honestly write about. Interesting that they also include blogspot.com pages in that.
andor 11y ago
Counterexample: http://sourceforge.net/projects/lame/ http://sourceforge.net/projects/lame/
- smhenderson 11y ago
  I get a 404 when I try that link, as well as one from a cousin comment: http://sourceforge.net/projects/cdesktopenv/ http://sourceforge.net/projects/cdesktopenv/ Wonder what's up with that?
  - arbitrage 11y ago
    Both appear to work fine.
    - smhenderson 11y ago
      Interesting. On both Firefox (with default settings) and Seamonky (with paranoid privacy settings) on Slackware I get a 404 on both of those links. On Firefox in Windows they do appear to work fine, as you say. Edit: I'm an idiot, after the last HN article about sourceforge I pointed them to 127... in my hosts file.
- AndrewOMartin 11y ago
  Interestingly (to me) this link is blocked by my ad blocker, rather than Google. > uBlock₀ has prevented the following page from loading: > http://sourceforge.net/projects/lame/ http://sourceforge.net/projects/lame/ > Because of the following filter > ||sourceforge.net^
  - X-Istence 11y ago
    uBlock Origin added a filter to block all of Sourceforge...
longsleep 11y ago
U-Block origin is blocking SourceForge as well (||sourceforge.net^$other)
- k-mcgrady 11y ago
  I was just looking into U-Block. What's better to use: U-Block or U-Block Origin?
  - y0ghur7_xxx 11y ago
    https://news.ycombinator.com/item?id=9718625 https://news.ycombinator.com/item?id=9718625 tl;dr: uBlock Origin
  - Osaka 11y ago
    AFAIK: U-Block Origin is a fork of U-Block which hopes to stay in sync with U-Block, but maintain a per-site block/allow feature which was removed from the newer version of U-Block.
    - kuschku 11y ago
      Actually, U-Block is the fork, U-Block origin is the branch of the project maintained by the original dev.
  - deleted 11y ago
    [deleted]
anton_gogolev 11y ago
Where to move from SourceForge: [1]: [1]: http://helb.github.io/goodbye-sourceforge/ http://helb.github.io/goodbye-sourceforge/
rbanffy 11y ago
The important thing (for retrogeeks like me) is that http://sourceforge.net/projects/cdesktopenv/ http://sourceforge.net/projects/cdesktopenv/ is not doing anything particularly evil.
- joss82 11y ago
  ... that you can notice ;)
deleted 11y ago
[deleted]
- upofadown 11y ago
  Not unless Google is bricking the phones on purpose. That is after all the very definition of the word "malicious". In terms of security/privacy a bricked smart phone is much improved...
deleted 11y ago
[deleted]
- manigandham 11y ago
  Compete just guesses at data based off of small panel surveys, that's far from accurate.
- Jgrubb 11y ago
  I find it hard to believe that SF's monthly uniques were growing at 150% YoY until just 2 months ago.
  - deleted 11y ago
    [deleted]
phkahler 11y ago
Let us keep SourceForge in mind as GitHub goes public.
- api 11y ago
  GitHub has a paid business model, so I think they're less likely to be tempted by the dark side. SourceForge is another cautionary tale about how "free is a lie" -- how free leads directly to scummy business models.
  - Grue3 11y ago
    >GitHub has a paid business model, so I think they're less likely to be tempted by the dark side So did Sourceforge. Github has competition in business space (Gitlab Enterprise, Stash) and if it falls out of favor with businesses, anything can happen.
    - merb 11y ago
      Stash is not a competition. GitLab is. Stash just falls more behind every update. Look the release Notes of 3.10 and 3.9. I mean it took from 2.8 to 3.8 that you could use "go get". And still Stash won't implement git protocol in the near future (while gitlab and github enterprise both have this) https://jira.atlassian.com/browse/STASH-2508 https://jira.atlassian.com/browse/STASH-2508 however they released a read-only plugin since stash 3.8 READ ONLY.. and there are even more issue's to come that stash won't support or support in the near future. Gitlab and github enterprise are so far ahead of stash and there is another github like solution coming that is written in go. Also stash is slower than Gitlab, even while gitlab is coded in ruby. Also the CI, way easier to setup (and cheaper) than the stash way of linking their projects.
      - sytse 11y ago
        GitLab CEO here, glad to hear you're happy with our progress. New CI version with .gitlab-ci.yml coming on Monday :)
solomatov 11y ago
I love google for this and many other ways the fight abuse of browser users. First, they removed CA, which produced a bad certificate, and now sf with their bundles.
derekp7 11y ago
I've seen a few differing reports on what SourceForge is doing. From what I gather so far: 1) Originally (a couple years back or so), they started (as an opt in from the project owners) bundling adware with the Windows versions of installers on selected projects. 2) Recently, SourceForge editors have taken over abandoned projects (i.e., projects that no longer use SourceForge as their primary distribution page, and haven't updated the project pages), and have replaced the installers for some of them with their adware-bundled installers. 3) A firestorm erupted over this, SF stated that they would back away from the adware (on taken-over pages -- it would still be present on projects with an agreement from the project owners). 4) They are still taking over abandoned projects and updating them. Now my question -- for point (4), are they just updating the project download pages with the current versions, or are they still bundling their adware with the projects? Everything I've seen so far (after their "apology" post), it appears that they haven't done any new adware bundling, just taking over the projects. Is this the case? And if so, is the concern that they will slip in the adware in the future?
api 11y ago
Because it is.
istvan__ 11y ago
Damn machine learning software. :) Google needs to tune some of the parameters.
tzgur8 11y ago
People always complain about the power that countries hold. Tech superpowers hold a lot more, and yet nobody elects or really regulates them.
- zevyoura 11y ago
  Which "tech super power" has a military and nukes?
- ra1n85 11y ago
  Terrible analogy. Tech superpowers cannot coerce me through (direct) regulation or force.
lectrick 11y ago
Oh how the mighty have fallen

235 points by irl_zebra 11y ago

Not happening for me when I go to that link from Google in Firefox. Can anyone else reproduce this? edit: Now happening for me in Chromium. (Both of these on Xubuntu 14.04, versions from the repos.)

dantudor 11y ago
Yes happens for me in Chrome. Welcome news!
m3Lith 11y ago
Nope, can freely access the site on both latest versions of Chrome and Chromium. Though the project seems to have moved from that page already.
- davidgerard 11y ago
  I got the warning in Chromium just now.
deleted 11y ago
[deleted]
s_dev 11y ago
No warning for me either on Chrome Version 43.0.2357.124 (64-bit) on a Mac running Yosemite and I'm based in Dublin, Ireland. I can reproduce it if I visit exactly: http://sourceforge.net/projects/camstudio/ http://sourceforge.net/projects/camstudio/ but not http://sourceforge.net/ http://sourceforge.net/ on it's own. Perhaps they only apply the warning to malicious projects rather than the site as a whole.
runarb 11y ago
Blocked for me when using Chrome Versjon 42.0.2311.90 on Windows 7.

dkns 11y ago

I'm guessing OP took this from reddit thread. If you read that thread you'll see that it's not sourceforge but this one project. So this title is misleading. Edit: Thread: http://www.reddit.com/r/technology/comments/3a9h9x/soureforge_now_listed_as_malicious_when_clicked/ http://www.reddit.com/r/technology/comments/3a9h9x/soureforg... Response from one user that sourceforge is actually whitelisted by google: http://www.reddit.com/r/technology/comments/3a9h9x/soureforge_now_listed_as_malicious_when_clicked/csamu9j http://www.reddit.com/r/technology/comments/3a9h9x/soureforg... http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=sourceforge.net/ http://safebrowsing.clients.google.com/safebrowsing/diagnost... http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=downloads.sourceforge.net/ http://safebrowsing.clients.google.com/safebrowsing/diagnost...

davidgerard 11y ago
Looks like the malware-bearing projects need some reporting, then!
- luso_brazilian 11y ago
  Not really, if you see the Google Safe Browsing diagnostic page for sourceforge.net (emphasis mine) [1]: >> What is the current listing status for sourceforge.net? >> This site is >>>not currently listed as suspicious<<<. >> Part of this site was listed for suspicious activity 333 time(s) over the past 90 days. >> What happened when Google visited this site? >> Of the 205785 pages we tested on the site over the past 90 days, 588 page(s) resulted in >>>malicious software being downloaded and installed without user consent<<<. >> The last time Google visited this site was on 2015-06-18, and the last time suspicious content was found on this site was on >>>2015-06-18<<<. >> Malicious software includes 5877 virus, 4347 trojan(s), 1132 exploit(s). [1] http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=sourceforge.net/ http://safebrowsing.clients.google.com/safebrowsing/diagnost...
k_roy 11y ago
UBlock is actually blocking all of SF

rawe 11y ago

The following page lists stats for sourceforge itself: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Fsourceforge.net&client=googlechrome&hl=en-US http://safebrowsing.clients.google.com/safebrowsing/diagnost... : > Part of this site was listed for suspicious activity 332 time(s) over the past 90 days.

csn 11y ago
I also find it fascinating what Google has to say about itself https://google.com/safebrowsing/diagnostic?site=Google.com https://google.com/safebrowsing/diagnostic?site=Google.com
- _lce0 11y ago
  [!] Youtube also downloads and installs malware https://google.com/safebrowsing/diagnostic?site=youtube.com https://google.com/safebrowsing/diagnostic?site=youtube.com
- piyush_soni 11y ago
  Very interesting! Of course Google itself is not hosting any malicious content, but they are acting as a bridge between the user and malicious content which they honestly write about. Interesting that they also include blogspot.com pages in that.

andor 11y ago

Counterexample: http://sourceforge.net/projects/lame/ http://sourceforge.net/projects/lame/

smhenderson 11y ago
I get a 404 when I try that link, as well as one from a cousin comment: http://sourceforge.net/projects/cdesktopenv/ http://sourceforge.net/projects/cdesktopenv/ Wonder what's up with that?
- arbitrage 11y ago
  Both appear to work fine.
  - smhenderson 11y ago
    Interesting. On both Firefox (with default settings) and Seamonky (with paranoid privacy settings) on Slackware I get a 404 on both of those links. On Firefox in Windows they do appear to work fine, as you say. Edit: I'm an idiot, after the last HN article about sourceforge I pointed them to 127... in my hosts file.
AndrewOMartin 11y ago
Interestingly (to me) this link is blocked by my ad blocker, rather than Google. > uBlock₀ has prevented the following page from loading: > http://sourceforge.net/projects/lame/ http://sourceforge.net/projects/lame/ > Because of the following filter > ||sourceforge.net^
- X-Istence 11y ago
  uBlock Origin added a filter to block all of Sourceforge...

longsleep 11y ago

U-Block origin is blocking SourceForge as well (||sourceforge.net^$other)

k-mcgrady 11y ago
I was just looking into U-Block. What's better to use: U-Block or U-Block Origin?
- y0ghur7_xxx 11y ago
  https://news.ycombinator.com/item?id=9718625 https://news.ycombinator.com/item?id=9718625 tl;dr: uBlock Origin
- Osaka 11y ago
  AFAIK: U-Block Origin is a fork of U-Block which hopes to stay in sync with U-Block, but maintain a per-site block/allow feature which was removed from the newer version of U-Block.
  - kuschku 11y ago
    Actually, U-Block is the fork, U-Block origin is the branch of the project maintained by the original dev.
- deleted 11y ago
  [deleted]

anton_gogolev 11y ago

Where to move from SourceForge: [1]: [1]: http://helb.github.io/goodbye-sourceforge/ http://helb.github.io/goodbye-sourceforge/

rbanffy 11y ago

The important thing (for retrogeeks like me) is that http://sourceforge.net/projects/cdesktopenv/ http://sourceforge.net/projects/cdesktopenv/ is not doing anything particularly evil.

joss82 11y ago
... that you can notice ;)

deleted 11y ago

[deleted]

upofadown 11y ago
Not unless Google is bricking the phones on purpose. That is after all the very definition of the word "malicious". In terms of security/privacy a bricked smart phone is much improved...

deleted 11y ago

[deleted]

manigandham 11y ago
Compete just guesses at data based off of small panel surveys, that's far from accurate.
Jgrubb 11y ago
I find it hard to believe that SF's monthly uniques were growing at 150% YoY until just 2 months ago.
- deleted 11y ago
  [deleted]

phkahler 11y ago

Let us keep SourceForge in mind as GitHub goes public.

api 11y ago
GitHub has a paid business model, so I think they're less likely to be tempted by the dark side. SourceForge is another cautionary tale about how "free is a lie" -- how free leads directly to scummy business models.
- Grue3 11y ago
  >GitHub has a paid business model, so I think they're less likely to be tempted by the dark side So did Sourceforge. Github has competition in business space (Gitlab Enterprise, Stash) and if it falls out of favor with businesses, anything can happen.
  - merb 11y ago
    Stash is not a competition. GitLab is. Stash just falls more behind every update. Look the release Notes of 3.10 and 3.9. I mean it took from 2.8 to 3.8 that you could use "go get". And still Stash won't implement git protocol in the near future (while gitlab and github enterprise both have this) https://jira.atlassian.com/browse/STASH-2508 https://jira.atlassian.com/browse/STASH-2508 however they released a read-only plugin since stash 3.8 READ ONLY.. and there are even more issue's to come that stash won't support or support in the near future. Gitlab and github enterprise are so far ahead of stash and there is another github like solution coming that is written in go. Also stash is slower than Gitlab, even while gitlab is coded in ruby. Also the CI, way easier to setup (and cheaper) than the stash way of linking their projects.
    - sytse 11y ago
      GitLab CEO here, glad to hear you're happy with our progress. New CI version with .gitlab-ci.yml coming on Monday :)

solomatov 11y ago

I love google for this and many other ways the fight abuse of browser users. First, they removed CA, which produced a bad certificate, and now sf with their bundles.

derekp7 11y ago

I've seen a few differing reports on what SourceForge is doing. From what I gather so far: 1) Originally (a couple years back or so), they started (as an opt in from the project owners) bundling adware with the Windows versions of installers on selected projects. 2) Recently, SourceForge editors have taken over abandoned projects (i.e., projects that no longer use SourceForge as their primary distribution page, and haven't updated the project pages), and have replaced the installers for some of them with their adware-bundled installers. 3) A firestorm erupted over this, SF stated that they would back away from the adware (on taken-over pages -- it would still be present on projects with an agreement from the project owners). 4) They are still taking over abandoned projects and updating them. Now my question -- for point (4), are they just updating the project download pages with the current versions, or are they still bundling their adware with the projects? Everything I've seen so far (after their "apology" post), it appears that they haven't done any new adware bundling, just taking over the projects. Is this the case? And if so, is the concern that they will slip in the adware in the future?

api 11y ago

Because it is.

istvan__ 11y ago

Damn machine learning software. :) Google needs to tune some of the parameters.

tzgur8 11y ago

People always complain about the power that countries hold. Tech superpowers hold a lot more, and yet nobody elects or really regulates them.

zevyoura 11y ago
Which "tech super power" has a military and nukes?
ra1n85 11y ago
Terrible analogy. Tech superpowers cannot coerce me through (direct) regulation or force.

lectrick 11y ago

Oh how the mighty have fallen