nmap Maintainer Warns He Doesn't Control nmap SourceForge Mirror 145
vivaoporto writes: Gordon Lyon (better known as Fyodor, author of nmap and maintainer of the internet security resource sites insecure.org, nmap.org, seclists.org, and sectools.org) warns on the nmap development mailing list that he does not control the SourceForge nmap project.
According to him the old Nmap project page (located at http://sourceforge.net/projects/nmap/, screenshot) was changed to a blank page and its contents were moved to a new page (http://sourceforge.net/projects/nmap.mirror/, screenshot) which is controlled by sf-editor1 and sf-editor3, in a pattern mirroring the much discussed takeover of the GIMP-Win page discussed last week on Ars Technica, IT World and eventually this week on Slashdot.
On Monday, Sourceforge promised to stop "presenting third party offers for unmaintained SourceForge projects," and to their credit Fyodor states, "So far they seem to be providing just the official Nmap files," but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html." To browse the projects and mirrors currently controlled by SourceForge, you can look at these account pages: sf-editor1, sf-editor2, and sf-editor3.
According to him the old Nmap project page (located at http://sourceforge.net/projects/nmap/, screenshot) was changed to a blank page and its contents were moved to a new page (http://sourceforge.net/projects/nmap.mirror/, screenshot) which is controlled by sf-editor1 and sf-editor3, in a pattern mirroring the much discussed takeover of the GIMP-Win page discussed last week on Ars Technica, IT World and eventually this week on Slashdot.
On Monday, Sourceforge promised to stop "presenting third party offers for unmaintained SourceForge projects," and to their credit Fyodor states, "So far they seem to be providing just the official Nmap files," but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html." To browse the projects and mirrors currently controlled by SourceForge, you can look at these account pages: sf-editor1, sf-editor2, and sf-editor3.
Fuck Sourceforge (Score:5, Insightful)
They are dead to me.
Re: (Score:1)
Re: (Score:2)
Given that it's plug-and-play for my Mac, yes I would still prefer a (real) FTDI chip. Fuck those CH340 ICs.
Re:Fuck Sourceforge (Score:5, Informative)
Some well known projects they've taken:
Your comment has too few characters per line (currently 11.7).
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam. Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta. Mauris massa. Vestibulum lacinia arcu eget nulla. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.
Re: (Score:2)
It looks like they've added a page for 389-DS, unbeknownst to its authors, as well.
Re: (Score:2)
The best way to crack down on this is to use the "Report inappropriate content" on every page that Sourceforge has that provides contaminated content.
Re: (Score:3)
The best way to crack down on this is to use the "Report inappropriate content" on every page that Sourceforge has that provides contaminated content.
Which will help ensure that... the folks at Sourceforge know that they're a bunch of despicable assholes?
Re:Fuck Sourceforge (Score:4, Insightful)
Holy crap. You're not kidding. I'm just about ready to run screaming back to IRC. I'm getting rather sick of this experiment we call the world wide web and all the trappings of advertising that fuel the beast. ...but I also recall running into all sorts of unpalatable crap before the WWW made it big. Mainly, square eyed nerds with small minded evil streaks. "Will this program attempt to burn out my CPU, or will it sort my email?" is a question I haven't had to worry about realistically for years. As much as I dislike the power "clouds" give to businesses, I will say that such models have made it a lot harder for some depressed person to reason that they can be ruinous. And mistakes actually get noticed... a step in the right direction.
I think we just need to be more stringent about policing our own kind, and the type of ownership problem SF has spurred will fix itself. Specifically, I mean growing a pair as an employee to stop poor management internally, insisting on having competent help, etc. I disagree with a comment below saying we should click buttons to report content. All that does is drive participation numbers. Want change? Spend 20 bucks on an old PC, 10 on a domain, and roll your own SVN/git/etc. Then, treat SF as though they never existed. Problem solved... ...or have I missed something crucial & worthy of an ethical crusade??? ;)
Re: (Score:2)
Re: (Score:2)
What are good replacements over SF, download.com, FreshMeat, etc.?
Re: (Score:2)
Not saying Sourceforge is or isn't evil, but I've been poking around archive.org and it looks like the "nmap" project never had any files.
http://web.archive.org/web/201... [archive.org]
Re:Fuck Sourceforge (Score:4, Insightful)
Re:Fuck Sourceforge (Score:4, Informative)
Changeable from preferences if I am not mistaken.
Re: (Score:2)
Just create yourself a user.css file and change the colors to whatever you want. I've done this for years to change slashdot have light on dark text. Nowadays, you can even download extensions for popular browsers where someone else has done all the hard work for you for many popular sites.
Re: (Score:3)
I like to think that most other websites would censor me for swearing at the top of their comments section about one of their sibling companies. Luckily, Slashdot is better than that. Slashdot is not Sourceforge, despite the relation (unless timothy or soulskill are behind all of this nonsense).
People still use that? (Score:5, Insightful)
Honestly, using SorceForge right now is kind of like using Download.com. Sure, you might not get something nasty, but why take the chance?
Re:People still use that? (Score:5, Insightful)
You know, it probably still shows up in a lot of searches.
There's quite possibly people out there who have known it long enough that they still trust it.
If you're following this stuff, you know about it. But it's surprising how long it can take from when a company starts being shady and when everybody stops trusting them.
From the sounds of it, Sourceforge will be able to coast on their reputation for some time before they go away, if at all.
Re: (Score:3)
Fair (and depressing) point.
Re: (Score:2, Insightful)
Re: (Score:3)
There is a little hope (Score:1)
Their parent Dice holdings should start an internal investigation and find&fire the suits who led to this scandal. They should also hire a person who will oversee such decisions.
They may also suggest a fire&forget, respectable spyware cleaner (malwarebytes, spybot or even ms windows defender) to users.
Or they better backup the site, sudo shutdown -f now
Re: There is a little hope (Score:1)
For a minute I thought "shutdown -f" meant "--f_ckthisweareneverpoweringonagain"
Then I read the freakin man page.
Re: (Score:2)
Re: (Score:2)
Apparently -f is to skip fsck on reboot. Not quite what I expected.
Re: (Score:2)
Re: (Score:2, Insightful)
Why would they do that, this was done by directive, not by some rogue employee.
Ransoms is my captcha.
Re: (Score:1)
They are likely the ones that pushed them to do it (find a way to make money or get axed) and likely gave the final OK before it went live.
In the end, they want to get money out of SF somehow. Obviously more and more people are moving away and they want to milk the cow while they can.
It's their last ditch effort to change direction to become (more) profitable (offering "mirrors" aka becoming Download.com).
The despicable part is that they are using the established trust (used to be maintained by a developer)
Re: (Score:1)
Re: (Score:2)
That's the disappointing thing - when a trusted name gets acquired by shady people, and those shady people milk the name for all it is worth.
I haven't been going to SF nearly as much lately, something just seemed "off" - now I'm glad I almost never go there.
It reminds me of what happened to a fairly popular hosting site for Android development projects, dev-host. d-h used to be a pretty good service, but sometime in the last year, they started replacing downloads with malware/adware.
Re: (Score:1)
About two years back I remember that i found an "open source" project hosted on SF.
It only offered binaries. No source, repository or anything like that could be found anywhere. The binaries were, of course, malware and not what was stated.
Sure, probably not SFs fault directly but it did show that there is no accountability, no interest or resources to maintain a respectable standard.
That was what showed me that something was "off". Since then I only had negative encounters (including the "downloader").
Re:People still use that? (Score:5, Interesting)
You know, it probably still shows up in a lot of searches.
Sounds like a problem with search engines. They should push sites carrying malware down the rankings, or off the list entirely. Has anyone reported Sourceforge to Google and other malware site list maintainers?
Re: (Score:3)
You know, it probably still shows up in a lot of searches.
Sounds like a problem with search engines. They should push sites carrying malware down the rankings, or off the list entirely. Has anyone reported Sourceforge to Google and other malware site list maintainers?
Yeah, and I changed my sig in case other people are too lazy to look up where to do said reporting.
Re: (Score:2)
You know, it probably still shows up in a lot of searches.
Sounds like a problem with search engines. They should push sites carrying malware down the rankings, or off the list entirely. Has anyone reported Sourceforge to Google and other malware site list maintainers?
And how exactly are the search engines supposed to know that sites are pushing malware? What metric should search engines use for defining malware? In the case of the GIMP experience it sounds like Sourceforge put up a version that displays ads. Given that most search engines are funded through the use of ads displayed to users that might not exactly hit their criteria for malware.
Re: (Score:1)
Honestly, using SlashDot right now is kind of like using Facebook.com. Sure, you might not get something nasty, but why take the chance?
FTFY.
Re: (Score:2)
I was gonna post exactly this. Download used to be usable (a very long time ago). Now when I end up there looking for software I simply say "No. NO! HELL NO!" and leave. But hey, they all have to pay the bills and what better way than to install crapware that is nothing short of evil?
Damn, I trusted them (Score:5, Insightful)
Sourceforge was always my go-to place for trusted original non-screwed files, and now I check the list of projects owned by sf-editor1, 2, and 3 and I see a lot of projects that I have used in the past.
Sometimes (particularly for older projects) it is very difficult to find a home-page or source that I can trust...and now it just became a lot harder.
-- Pete.
Re: (Score:2)
I see you don't know what trust is.
Re: (Score:3)
I wonder if the authors can bring a violation against their license if SF doesn't release the source code for an open source project they abscond with for those licenses that require reciprocity such as the GPL? Or a copyright violation for derivative works? Would be interesting to see if it happened.
Re: (Score:2)
If Sourceforge distributes GPLed binaries without the corresponding source, Sourceforge is in violation of the license, and therefore has no valid license to distribute. The authors could indeed bring legal action against Sourceforge, probably not getting damages (or at least not much), but definitely getting an injunction against further distribution.
Comment removed (Score:5, Interesting)
Re: (Score:1)
If the bundled malware is closed source it may be a GPL violation too...
Re: (Score:2)
No, because it's separate software - GPL is only activated when you link (dynamically or statically) other GPL software.
Re: (Score:1)
Mere aggregation is not a GPL violation. Unless the malware somehow interacts with the GPL'd software it is *not* a derived work and the GPL does not apply.
Re: (Score:2, Informative)
Oh jesus christ...
Not only has this been gone over every fucking time this story gets posted, but any one with half a brain who has ever actually *read* the GPL knows it isn't a fucking GPL violation. The license SPECIFICALLY says you can bundle closed source stuff with downloads of GPL software. IT FUCKING CALLS OUT AGGREGATION OF PROGRAMS AS A SPECIFIC EXEMPTION.
Related (Score:2)
More to the point, would it really be that hard for an even more nefarious third-party to change out the Sorceforge shovel-ware for truly dangerous malware? Do they even offer
Re: (Score:2)
Just Remove The Product (Score:5, Insightful)
Re-packaging the product as your own is bad enough, but another bad part is that older projects may have security vulnerabilities as well. It seems like it would be far more ethical to me to simply mark the project as "abandoned", then after a while remove it completely. If the project is alive somewhere else, then contact those folks, let them know what is up, give them a chance to close it all down themselves or revive the proejct on SF.
But taking it over? No, that is not cool.
Vacation ? (Score:1, Troll)
slashdot is still slashdot (Score:5, Interesting)
I really admire slashdot editors freely accepting SF stories no matter how damaging they are.
Did you see a single newspiece/editorial on CNET news.com about the junk download.com bundles?
Re: (Score:2, Informative)
The cat is out of the bag since the Gimp story finally appeared.
They did, however, suppress that story for several days, until Slashdot started becoming associated with the whole fiasco too.
Re: (Score:2)
Every slashdot story is a few days out of date.
Re:slashdot is still slashdot (Score:5, Informative)
To summarize, it was changed from "Fyodor accuses Sourceforge of hijacking nmap account" to "Fyodor warns that he doesn't control Sourceforge nmap mirror", among other things.
Re: (Score:2)
Good.
Honestly, I'd rather see more stories edited to be less inflammatory. Most of the crap we get on here seems to be pushed to the extremes of "hate these guys" or "love those guys". It's nice to see some small attempt at real journalism, even if it is fueled by corporate politics. I'm hoping it will spread.
Goodbye Sourceforge (Score:5, Insightful)
A good reputation is hard to earn but easily lost.
Re: (Score:2)
Freshmeat? (Score:2)
Is is time for Freshmeat.net to make a return?
Re: (Score:2)
Is is time for Freshmeat.net to make a return?
Why? As far as I recall, Freshmeat never hosted projects (with full support for VCS, mailing lists, website, downloads etc.), just provided an updated directory of interesting projects. It was good for keeping up with changes for the various projects scattered around the web, but it's not a substitute for SourceForge.
Re: (Score:2)
Yep. I had to go to RPMfind.net or to tucows to get the source or SRPMs.
Re: (Score:2)
Depends. Is it any more reliable than SourceForge?
This problem (Score:2)
This business with SF is troubling, and reinforces my concern about someone malicious gaining control over other items, like Linux repositories, updates, etc.
Anyone from "Russian hackers" to the NSA.
Editor accounts (Score:1)
http://sourceforge.net/u/sf-editor1/profile/
http://sourceforge.net/u/sf-editor2/profile/
http://sourceforge.net/u/sf-editor3/profile/
Re: (Score:2)
Sigh. (Score:2)
Rather than continuingly being forced to report on your own humiliations, why don't you just have a word with someone at DICE and show them what kind of response their actions are getting?
Re: (Score:2)
Sourceforge can go White Hat on this (Score:5, Interesting)
All they have to do is:
1) post a prominent disclaimer along with a link to an officially maintained source, if any.
2) only provide true read-only mirrors or, for truly-abandoned projects or projects with "political squabbles" that make it hard to know the "real, official" maintainter, true historical mirrors in an explicitly frozen state along with a stayement explaining why the code is old.
3) prominently display an invitation to "official maintainers" to reclaim control of the repository or have the mirror deactivated once they prove who they are.
They can go one step further by pro-actively reaching out to currently affected projects and to projects they later identify as "abandoned on Sourceforge but still alive elsewhere."
They also need to apologize to affected developers and maintainers.
Why should they even bother?
1) They can still make money on web-site ads.
2) It will help boost their reputation and that of their corporate overlords, which will eventually translate into revenue.
Comment removed (Score:4, Insightful)
Confusion with names and roles in his announcement (Score:4, Informative)
Hi all.
Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.
Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...
Bye,
Simon
Re: (Score:2)
Hi all.
Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.
Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...
Bye,
Simon
Are you sure the Sourceforge CEO didn't co-opt the "abandoned" identity of Michael Schuhmacher?
Re: (Score:2)
I suppose if you're a world famous race car driver and you get paralyzed, you might be driven to maintain the GIMP.
I'm sorry, but that was contractually obligated.
Project Removal? (Score:5, Interesting)
Re:Project Removal? (Score:5, Informative)
You can't [stackexchange.com]. In particular,
Look at the bright side. (Score:5, Insightful)
We slashdotters complain vociferously about the (lack of) quality of the editors here at Slashdot. But it could always be worse. We could have editors like the ones at that other Dice holding, who steal people's contributions and put their own labels on them, and then wrap them in malware.
It'd be like Timothy personally claiming every +1-or-higher comment made in one of the articles he "edited", leaving only Goatse and GNAA trollage for us plebians.
I want my old /. With BlackJack and Hookers. (Score:5, Insightful)
Eh, forget the ./
Dice you've successfully figured out how to run one of the most best 'news' and opensource websites and run them into the ground for profit. /. and Fark were the only 2 places that could handle 9/11 traffic. I rode out that entire day on both sites when CNN was crumbling.
I'm glad I had Slashdot over Reddit when I was an angsty tenager. I took pride in trying to get +5 comments and put effort into doing so. Honestly slashdot made me a better writer. Reddit is nice for short terse communication but sometimes I want to "talk with adults".
Slashdot didn't need much. Unicode support. Newer HTML5 support. CSS3. Make a decent mobile app, move away from HTML for Markdown. Moderation made sense and was much better than a simple +- system. Voting was randomly enabled and you couldn't both vote and comment on the same article. -2 to 5 also limited band wagoning. It's easier to recover from a bunch of early 'down votes'. Instead you drove everyone away to other sites (which still don't quite scratch the /. itch). You shoe horn in what ever fucking agenda is "big in IT". Looking back at all the news I got from /. I can't ever remember thinking "I wonder if a woman did this" or "Too bad a woman didn't do this" because I didn't care. It was about the tech and news for nerds.
On 'Gamergate', 'sexual equality', 'gender issues', we don't care "Trans-gendered" is a big thing in the news these days (and especially around tech) but a long, long time ago I remember a Mac developer made the transition. (This was in the late '90s.) I read her bio. Shrugged my shoulders went "Neat" and moved on. Why? Because she made some awesome Mac games. Most other person I know in IT or engineering think the same way. None of us care what you do with your body or who you take to the bedroom. I do care if you can cut it and get your work done or contribute to society.
On the other side of that is Randi Harper (FreeBSD Girl) [twitter.com] who actually write decent code. I've dug through some of her BSD commits, major props to her for doing that. But it can all be done without photoshopping traffic tickets to make it look like you got swatted, begging for money to move on twitter [youcaring.com], (When you already earn $3k/month from Patreon [patreon.com]), grandstanding on Twitter for no reason and bandwagoning users against anyone that disagrees isn't the way to do it.
You had the same opportunity to fix Sourceforge all of its' convoluted download mirrors (just use a proper CDN), update to Git, and everything else that Sourceforge isn't and GitHub is. Instead you rested on your laurels and are now trying to use this as one last cash grab before the Titanic goes down.
I don't know where I was going with this either. Just thought someone up top should know why your traffic is tanking and a lot of us are pissed off at you for what you've done.
I still won't forget the time you broke the capslock filter [slashdot.org], I remember BitTorrent being announced and people thinking it was useless, the iPod's lack of wifi and space compared to a Nomad, et al.
Thanks for the fish?
"News For Nerds" (Score:2)
On 'Gamergate', 'sexual equality', 'gender issues', we don't care
Until the back pressure from coverage by mainstream news sites and other geek forums like Arts Technica can't be resisted any longer.
Re: (Score:2)
Who's we white man?
Now I'm white and a man?
"We" is the people that actually do work in the tech industry & engineering. When I go to work in the morning I don't care if you're white, black, purple, gay, straight, trans-gendered, female, pierced, tattooed, et al. All I care about (those that I work about care about) is if you get your work done and if it's quality work. It's been that way for a while and it's been that way with most people I work with and know.
It's why a lot of similar industries don't care about your atti
Re: (Score:2)
Who's we white man?
Now I'm white and a man?
I really hope that you were joking too. I don't know you, so just in case - here's the joke that I was referencing. [google.com] :)
"We" is the people that actually do work in the tech industry & engineering. When I go to work in the morning I don't care if you're white, black, purple, gay, straight, trans-gendered, female, pierced, tattooed, et al. All I care about (those that I work about care about) is if you get your work done and if it's quality work. It's been that way for a while and it's been that way with most people I work with and know.
It's why a lot of similar industries don't care about your attire and you can get away with piercings, colored hair and tattoos
It's great that all you care about is results. I wish that there were more people like you. However, it doesn't mean that the tech industry is immune from the wage gap (or position gap) between men and women. It has and it continues to happen. There are some companies who are pioneers in this sense, too. However, these are not the norm. While I am optimistic about progress, we have
Changes from the original submission (Score:5, Informative)
The original title was "Sourceforge Hijacks the Nmap Sourceforge Account" and it was the same title Fyodor used on its post to the maillist. Losing the original Sourceforge original nmap account (created by nmap developers themselves) is not the same news as him not controlling "nmap SourceForge Mirror". The same expression was also changed in the submission body.
Two other important parts from the the original submission removed by the editor:
1. The statement by SourceForge themselves that (emphasis mine):
2. The reference by Fyodor that even if Sourceforge still isn't bundling anything on nmap, the page is designed to mislead the users with fake download buttons:
Below I repost the original submission so you can compare:
Re:Changes from the original submission (Score:4, Interesting)
Hi. Thanks for the submission.
In addition to editing your submission for brevity and minor grammatical issues, I edited it for factual accuracy as well. I'll first address your two main points.
1) The rest of the quote from SourceForge was trimmed because it wasn't relevant to the content of the submission. SF has been bundling their "third-party offers" with projects who explicitly opt into it for a long time — it's a known thing, and has been discussed at length. Second, according to Fyodor's own post, they weren't bundling anything with nmap.
2) The rest of the Fyodor quote was trimmed for a similar reason. It makes reference fake download buttons and catching SF "trojaning" nmap. It's fine for Fyodor to editorialize as he pleases, but the first is a separate issue and the second is a non-event, so neither really have a place on this story.
The headline was changed for two reasons: First, Fyodor's account seems to still be under his control, and the nmap project seems to have been cloned/mirrored, so the references to hijacking the account lack clarity. Second, this is not actually new news. When the GIMP story broke, anyone with an interest could see what projects SF had taken over. Nothing actually changed for the project page Fyodor is posting about since the GIMP story broke — thus, the new information is simply that he's complaining about it. (Which is his right, of course.) I went ahead and posted the story for transparency's sake, and I added links at the bottom of the summary to the SF editor accounts, so people could easily see the full list of affected projects.
Re: (Score:2, Funny)
Change job, dude. This isn't worth it.
Re:Changes from the original submission (Score:5, Informative)
Concerning to the main point:
1. The original title stated that he lost control of "Nmap Sourceforge Account" and not his own
and it was very clear that by having the project page erased outside his control meant that he lost control of it.
2. The submission was not about SourceForge (as they were, as you say, pretty much similar to the what was discussed in the previous story) but about the reaction of a prominent figure of the IT world. By editing it for factual accuracy the point of the submission was lost (as what was kept after the edit was not Fyodor's reaction anymore).
I don't agree that those other two points were satisfactorily addressed either and here is for what reason.
1. The entire quote was copied verbatim from the update made by T on the SourceForge and GIMP [slashdot.org] article. Assuming it was relevant enough to be included there by the Slashdot staff itself I don't see why it is not relevant to be included in a similar article referring to the same subject.
2. The rest of Fyodor quote served to illustrate his opinion that, despite not bundling the installation files with "easy to decline third party offers" (to borrow an eufemism sometimes used by the industry, referred by Fyodor as "trojaned"), it is still risky to download nmap from SourceForge mirror. There are very confusing download buttons on that page that link to those same kind of third party offers instead of to the unmodified installer (referred as "fake download buttons").
it is very misleading to have a submission accepted, altered for factual accuracy but to kept as if it were submitted as is by the original submiter:
It would be better to either accept the submission as is (with the minor gramatical mistakes corrected) with a "Note of the Editor (NE)" appended or to reject the submission as factually incorrect.
Re:Changes from the original submission (Score:5, Insightful)
Between /. screwing around with this SF story and them screwing around with the poll, I am about to give up.
After nearly two decades reading /. nearly daily they are pushing me over the edge.
Re:Changes from the original submission (Score:5, Informative)
And the stupid video stuff. Looks like we can't turn that garbage off either. Thanks /. !!
Re: (Score:2)
I remember when /. was so hard up for bandwidth I ended up hosting images.slashdot.org at the ISP I was working for. That's back when it was just Malda, a T1 line, and the community. I was so much better then.
Re:Changes from the original submission (Score:4, Funny)
Uhg! It was so much better then. Almost 20 years and I still haven't learned to preview posts!
Re: (Score:2)
If you use a plugin like Stylish (available for Chrome & Firefox) you can add a stylesheet for slashdot.org with the following rule:
article#firehose-000 {
display: none;
}
This will collapse the element containing the videos. I've also heard of people using their Adblock plugins to do the same thing by telling it to treat that element as an ad and collapse it.
An (untested) rule to hide the polls would be:
article.fhitem-poll {
display: none;
}
Replacement for sourceforge File Release System? (Score:2)
While looking at other open source project hosting, the one thing that I couldn't see was a good alternative to sourceforge's file release system.
They basically provide a yum/apt friendly structure that can be rsynced to. Since it allows pretty much arbitrary structure and it gets mirrored, it works out ok.
Even before this, was interested in replacing everything on sourceforge, but now really interested in killing it off. Anyone know a good free CDN to cram yum/apt repositories into?
It seems like sourceforge is committing suicide. (Score:2)
This is the internet -- Sourceforge doesn't control content they don't own any more than anyone else does on the internet. And their audience being geeks rather than Fred and Ethyl Consumer, who would be better connected into threads like these and would know to go to the "official" sites... I just don't see this strategy working.
Is SourceForge ... (Score:3)
NSA, please go away.
On the bright side... (Score:2)
Slashdot editors are now actually editing.
WTF Sourceforge?! (Score:2)
Seriously, WTF?
Are the SF editors just retarded or are they intentionally just trying to shoot themselves in the head?
What were they thinking:
"Wow, taking control of GIMP and adding adware to it certainly stirred up some controversy....let's see what happens if we hijack NMap! No such thing as bad publicity, right?"
Someone needs to hit these people upside the head with a clue-bat and let them know that yes, there IS such a thing as bad publicity.
PS
Guess we can talk about this in a couple of weeks on main w
God Damnit, Sourceforge (Score:2)
This is why we can't have nice things!
SOP for me (Score:2)
This is why my policy has always been to obtain downloads only from the author's or package's official site or an official download named on the official site. Apparently that policy's saved me from a lot of malware/crapware.
owend by Slashdot Media (Score:2)
Is this the owner of slashdot.org or something else. If they are the same then WTF ARE YOU GUYS DOING taking over people's projects and locking them out?
Re: (Score:2)
It's like old email addresses or other internet accounts that you don't even remember you have anymore, I would guess.
Re: (Score:2)
wonder how many dropped emails happen for people who had 'my-deja.com' accounts, etc etc ?
wow, dejanews. been ages since I even thought about that.
Re: (Score:2)
wonder how many dropped emails happen for people who had 'my-deja.com' accounts, etc etc ?
Gods knows how many accounts like that existed. Seemed like every free website host, webchat, or message board community handed out e-mail addresses. You just reminded me of one I was a member of, Talkcity, which merged with Yet another old-time relic of the internet, the DelphiForums. Wonder if my account is still there, yep, turns out they were sending messages to an older non-existing address.
wow, dejanews. been ages since I even thought about that.
Now that brings back some memories. Let me tell you, that I wish google groups would go back to the Deja styl
Re: (Score:2)
Sourceforge prevents it.
http://webapps.stackexchange.c... [stackexchange.com]
Re: (Score:2)
Since that's not an option, maybe the smart thing to do (now that we know the problem) would be to keep your Sourceforge account current and periodically upload a "special" version that pops up a warning, "This software has been downloaded from an untrusted site. Please go to...."
If you renew this version every six months or so they'll have to find a new excuse beyond, "Hey, it was abandoned."
That may not help projects that have already been hijacked.
Re: (Score:2)
If you have a SF project and have registered the name as a trademark, you could tell SF that they may not distribute modified files under that name. (Or maybe if the name is unregistered. Ask a real lawyer if you're interested; I'm just a guy who sometimes talks about legalities on the net.)
Re: (Score:2)
The project's being 'mirrored' should just use trademark defense and force SF to not use the same trademark/project name for the altered binaries they are peddling. SF actions are obviously harming the brand that those projects have worked hard to establish.
This. Trademark GIMP, NMAP or whatever. Take it with you. SF can fork the code, but they need to put a different name on it so users are led into thinking the code has a provenance other that what it actually has.