Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 internet speed test! ×
SourceForge Security

nmap Maintainer Warns He Doesn't Control nmap SourceForge Mirror 145

vivaoporto writes: Gordon Lyon (better known as Fyodor, author of nmap and maintainer of the internet security resource sites insecure.org, nmap.org, seclists.org, and sectools.org) warns on the nmap development mailing list that he does not control the SourceForge nmap project.

According to him the old Nmap project page (located at http://sourceforge.net/projects/nmap/, screenshot) was changed to a blank page and its contents were moved to a new page (http://sourceforge.net/projects/nmap.mirror/, screenshot) which is controlled by sf-editor1 and sf-editor3, in a pattern mirroring the much discussed takeover of the GIMP-Win page discussed last week on Ars Technica, IT World and eventually this week on Slashdot.

On Monday, Sourceforge promised to stop "presenting third party offers for unmaintained SourceForge projects," and to their credit Fyodor states, "So far they seem to be providing just the official Nmap files," but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html."
To browse the projects and mirrors currently controlled by SourceForge, you can look at these account pages: sf-editor1, sf-editor2, and sf-editor3.
This discussion has been archived. No new comments can be posted.

nmap Maintainer Warns He Doesn't Control nmap SourceForge Mirror

Comments Filter:
  • Fuck Sourceforge (Score:5, Insightful)

    by weilawei ( 897823 ) on Wednesday June 03, 2015 @09:12AM (#49829547) Homepage

    They are dead to me.

    • This. Would anyone still use an FTDI chip [zdnet.com]?
      • Given that it's plug-and-play for my Mac, yes I would still prefer a (real) FTDI chip. Fuck those CH340 ICs.

    • Re:Fuck Sourceforge (Score:5, Informative)

      by 0100010001010011 ( 652467 ) on Wednesday June 03, 2015 @10:19AM (#49830079)

      Some well known projects they've taken:

      Your comment has too few characters per line (currently 11.7).

      Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam. Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta. Mauris massa. Vestibulum lacinia arcu eget nulla. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.

      • by MSG ( 12810 )

        It looks like they've added a page for 389-DS, unbeknownst to its authors, as well.

      • by Z00L00K ( 682162 )

        The best way to crack down on this is to use the "Report inappropriate content" on every page that Sourceforge has that provides contaminated content.

        • by gnunick ( 701343 )

          The best way to crack down on this is to use the "Report inappropriate content" on every page that Sourceforge has that provides contaminated content.

          Which will help ensure that... the folks at Sourceforge know that they're a bunch of despicable assholes?

      • by DescX ( 4012275 ) on Wednesday June 03, 2015 @01:31PM (#49832247)

        Holy crap. You're not kidding. I'm just about ready to run screaming back to IRC. I'm getting rather sick of this experiment we call the world wide web and all the trappings of advertising that fuel the beast. ...but I also recall running into all sorts of unpalatable crap before the WWW made it big. Mainly, square eyed nerds with small minded evil streaks. "Will this program attempt to burn out my CPU, or will it sort my email?" is a question I haven't had to worry about realistically for years. As much as I dislike the power "clouds" give to businesses, I will say that such models have made it a lot harder for some depressed person to reason that they can be ruinous. And mistakes actually get noticed... a step in the right direction.

        I think we just need to be more stringent about policing our own kind, and the type of ownership problem SF has spurred will fix itself. Specifically, I mean growing a pair as an employee to stop poor management internally, insisting on having competent help, etc. I disagree with a comment below saying we should click buttons to report content. All that does is drive participation numbers. Want change? Spend 20 bucks on an old PC, 10 on a domain, and roll your own SVN/git/etc. Then, treat SF as though they never existed. Problem solved... ...or have I missed something crucial & worthy of an ethical crusade??? ;)

    • by antdude ( 79039 )

      What are good replacements over SF, download.com, FreshMeat, etc.?

    • by jeek ( 37349 )

      Not saying Sourceforge is or isn't evil, but I've been poking around archive.org and it looks like the "nmap" project never had any files.

      http://web.archive.org/web/201... [archive.org]

  • by Lazere ( 2809091 ) on Wednesday June 03, 2015 @09:12AM (#49829551)

    Honestly, using SorceForge right now is kind of like using Download.com. Sure, you might not get something nasty, but why take the chance?

    • by gstoddart ( 321705 ) on Wednesday June 03, 2015 @09:18AM (#49829599) Homepage

      You know, it probably still shows up in a lot of searches.

      There's quite possibly people out there who have known it long enough that they still trust it.

      If you're following this stuff, you know about it. But it's surprising how long it can take from when a company starts being shady and when everybody stops trusting them.

      From the sounds of it, Sourceforge will be able to coast on their reputation for some time before they go away, if at all.

      • by Lazere ( 2809091 )

        Fair (and depressing) point.

      • Re: (Score:2, Insightful)

        by Anonymous Coward
        I am one of those people who have used it occasionally in the past and have grown to trust it. I appreciate the effort that /.'ers have made to make the issue public. At first I thought it was some kind of spam or APK or Golden Girls type thing, but then I saw it getting modded up. I easily could have been an unwitting vector in telling other people how great SourceForge is.
        • by aitikin ( 909209 )
          I'm actually with this AC. I haven't been on SF in probably 3-4 years. Back then I never had issues and would actually look for stuff on SF. Now I don't have as much downtime for that sort of work/play, so I haven't been on, but I'm about to have significantly more free time soon and thus this is a timely notification to stay away.
      • Their parent Dice holdings should start an internal investigation and find&fire the suits who led to this scandal. They should also hire a person who will oversee such decisions.

        They may also suggest a fire&forget, respectable spyware cleaner (malwarebytes, spybot or even ms windows defender) to users.

        Or they better backup the site, sudo shutdown -f now

        • For a minute I thought "shutdown -f" meant "--f_ckthisweareneverpoweringonagain"

          Then I read the freakin man page.

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          Why would they do that, this was done by directive, not by some rogue employee.

          Ransoms is my captcha.

        • by Anonymous Coward

          They are likely the ones that pushed them to do it (find a way to make money or get axed) and likely gave the final OK before it went live.

          In the end, they want to get money out of SF somehow. Obviously more and more people are moving away and they want to milk the cow while they can.

          It's their last ditch effort to change direction to become (more) profitable (offering "mirrors" aka becoming Download.com).

          The despicable part is that they are using the established trust (used to be maintained by a developer)

        • Ever use the dice job site? Same thing.
      • by Andy Dodd ( 701 )

        That's the disappointing thing - when a trusted name gets acquired by shady people, and those shady people milk the name for all it is worth.

        I haven't been going to SF nearly as much lately, something just seemed "off" - now I'm glad I almost never go there.

        It reminds me of what happened to a fairly popular hosting site for Android development projects, dev-host. d-h used to be a pretty good service, but sometime in the last year, they started replacing downloads with malware/adware.

        • by Anonymous Coward

          About two years back I remember that i found an "open source" project hosted on SF.

          It only offered binaries. No source, repository or anything like that could be found anywhere. The binaries were, of course, malware and not what was stated.

          Sure, probably not SFs fault directly but it did show that there is no accountability, no interest or resources to maintain a respectable standard.

          That was what showed me that something was "off". Since then I only had negative encounters (including the "downloader").

      • by AmiMoJo ( 196126 ) <<mojo> <at> <world3.net>> on Wednesday June 03, 2015 @09:41AM (#49829773) Homepage

        You know, it probably still shows up in a lot of searches.

        Sounds like a problem with search engines. They should push sites carrying malware down the rankings, or off the list entirely. Has anyone reported Sourceforge to Google and other malware site list maintainers?

        • You know, it probably still shows up in a lot of searches.

          Sounds like a problem with search engines. They should push sites carrying malware down the rankings, or off the list entirely. Has anyone reported Sourceforge to Google and other malware site list maintainers?

          Yeah, and I changed my sig in case other people are too lazy to look up where to do said reporting.

        • by TWX ( 665546 )

          You know, it probably still shows up in a lot of searches.

          Sounds like a problem with search engines. They should push sites carrying malware down the rankings, or off the list entirely. Has anyone reported Sourceforge to Google and other malware site list maintainers?

          And how exactly are the search engines supposed to know that sites are pushing malware? What metric should search engines use for defining malware? In the case of the GIMP experience it sounds like Sourceforge put up a version that displays ads. Given that most search engines are funded through the use of ads displayed to users that might not exactly hit their criteria for malware.

    • by macraig ( 621737 )

      Honestly, using SlashDot right now is kind of like using Facebook.com. Sure, you might not get something nasty, but why take the chance?

      FTFY.

    • I was gonna post exactly this. Download used to be usable (a very long time ago). Now when I end up there looking for software I simply say "No. NO! HELL NO!" and leave. But hey, they all have to pay the bills and what better way than to install crapware that is nothing short of evil?

  • by Pete (big-pete) ( 253496 ) * <peter_endean@hotmail.com> on Wednesday June 03, 2015 @09:16AM (#49829583)

    Sourceforge was always my go-to place for trusted original non-screwed files, and now I check the list of projects owned by sf-editor1, 2, and 3 and I see a lot of projects that I have used in the past.

    Sometimes (particularly for older projects) it is very difficult to find a home-page or source that I can trust...and now it just became a lot harder.

    -- Pete.

  • It's about time... (Score:5, Interesting)

    by MikeRT ( 947531 ) on Wednesday June 03, 2015 @09:17AM (#49829587)

    To just refer this matter to law enforcement. They're putting together bundles specifically to shove spyware down people's throats. It's being done in such a way as to make uninformed users think they're the official page. I'm not normally one to say stuff like this, but sourceforge needs to have a visit from FBI and/or FTC over this.

    • by johanw ( 1001493 )

      If the bundled malware is closed source it may be a GPL violation too...

      • No, because it's separate software - GPL is only activated when you link (dynamically or statically) other GPL software.

      • by Anonymous Coward

        Mere aggregation is not a GPL violation. Unless the malware somehow interacts with the GPL'd software it is *not* a derived work and the GPL does not apply.

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Oh jesus christ...

        Not only has this been gone over every fucking time this story gets posted, but any one with half a brain who has ever actually *read* the GPL knows it isn't a fucking GPL violation. The license SPECIFICALLY says you can bundle closed source stuff with downloads of GPL software. IT FUCKING CALLS OUT AGGREGATION OF PROGRAMS AS A SPECIFIC EXEMPTION.

        . . . In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume o

    • To just refer this matter to law enforcement. They're putting together bundles specifically to shove spyware down people's throats. It's being done in such a way as to make uninformed users think they're the official page. I'm not normally one to say stuff like this, but sourceforge needs to have a visit from FBI and/or FTC over this.

      More to the point, would it really be that hard for an even more nefarious third-party to change out the Sorceforge shovel-ware for truly dangerous malware? Do they even offer

    • by jdavidb ( 449077 )
      You're going to report the people peddling spyware to the authorities that want to victimize everyone with spyware?
  • by KermodeBear ( 738243 ) on Wednesday June 03, 2015 @09:19AM (#49829603) Homepage

    Re-packaging the product as your own is bad enough, but another bad part is that older projects may have security vulnerabilities as well. It seems like it would be far more ethical to me to simply mark the project as "abandoned", then after a while remove it completely. If the project is alive somewhere else, then contact those folks, let them know what is up, give them a chance to close it all down themselves or revive the proejct on SF.

    But taking it over? No, that is not cool.

  • Vacation ? (Score:1, Troll)

    by darkz0r ( 2779267 )
    Look, the slashdot editor in chief is not on vacation any more and can thus post an anti employer post! *snicker*
  • by Ilgaz ( 86384 ) on Wednesday June 03, 2015 @09:24AM (#49829653) Homepage

    I really admire slashdot editors freely accepting SF stories no matter how damaging they are.

    Did you see a single newspiece/editorial on CNET news.com about the junk download.com bundles?

    • Re: (Score:2, Informative)

      by Anonymous Coward

      The cat is out of the bag since the Gimp story finally appeared.

      They did, however, suppress that story for several days, until Slashdot started becoming associated with the whole fiasco too.

    • by vivaoporto ( 1064484 ) on Wednesday June 03, 2015 @10:17AM (#49830059)
      No, it's not. See the difference between the original submission and how it was changed below [slashdot.org].

      To summarize, it was changed from "Fyodor accuses Sourceforge of hijacking nmap account" to "Fyodor warns that he doesn't control Sourceforge nmap mirror", among other things.
      • Good.

        Honestly, I'd rather see more stories edited to be less inflammatory. Most of the crap we get on here seems to be pushed to the extremes of "hate these guys" or "love those guys". It's nice to see some small attempt at real journalism, even if it is fueled by corporate politics. I'm hoping it will spread.

  • by Stephen Chadfield ( 7971 ) on Wednesday June 03, 2015 @09:25AM (#49829657) Homepage

    A good reputation is hard to earn but easily lost.

    • It's actually hard to lose too, or at least it might take as long to lose it as to build it. If I, for example, didn't read Slashdot today and didn't regularly visit a tech forum, I would have no idea that Sourceforge was getting sketchy. I would just remember the dozen mentions of Sourceforge as a reliable place to download, and the years of clean downloads I'd got from them. So, it's critical that we as knowledgeable people don't just stop using Sourceforge but make an effort to spread the word. "If you s
  • Is is time for Freshmeat.net to make a return?

    • Is is time for Freshmeat.net to make a return?

      Why? As far as I recall, Freshmeat never hosted projects (with full support for VCS, mailing lists, website, downloads etc.), just provided an updated directory of interesting projects. It was good for keeping up with changes for the various projects scattered around the web, but it's not a substitute for SourceForge.

      • It was good for keeping up with changes for the various projects scattered around the web, but it's not a substitute for SourceForge.

        Yep. I had to go to RPMfind.net or to tucows to get the source or SRPMs.

    • Depends. Is it any more reliable than SourceForge?

  • This business with SF is troubling, and reinforces my concern about someone malicious gaining control over other items, like Linux repositories, updates, etc.

    Anyone from "Russian hackers" to the NSA.

  • by Anonymous Coward

    http://sourceforge.net/u/sf-editor1/profile/
    http://sourceforge.net/u/sf-editor2/profile/
    http://sourceforge.net/u/sf-editor3/profile/

    • Those who are very observant might be able to detect a pattern to these URLs. Advanced leet sooper skilled hax4rs may be able to develop a way to predict or deduce what the next items in the sequence might be.
  • by ledow ( 319597 )

    Rather than continuingly being forced to report on your own humiliations, why don't you just have a word with someone at DICE and show them what kind of response their actions are getting?

    • That goes against everything taught at MBA school. It should be obvious to the most simple minded simpleton that the best course of action is to have a word with the EDITORS and get them to IMMEDIATELY SUPPRESS all stories about that. That will prevent the reporting of their humiliations. Problem solved. Everyone happy.
  • by davidwr ( 791652 ) on Wednesday June 03, 2015 @09:50AM (#49829839) Homepage Journal

    All they have to do is:

    1) post a prominent disclaimer along with a link to an officially maintained source, if any.

    2) only provide true read-only mirrors or, for truly-abandoned projects or projects with "political squabbles" that make it hard to know the "real, official" maintainter, true historical mirrors in an explicitly frozen state along with a stayement explaining why the code is old.

    3) prominently display an invitation to "official maintainers" to reclaim control of the repository or have the mirror deactivated once they prove who they are.

    They can go one step further by pro-actively reaching out to currently affected projects and to projects they later identify as "abandoned on Sourceforge but still alive elsewhere."

    They also need to apologize to affected developers and maintainers.

    Why should they even bother?
    1) They can still make money on web-site ads.

    2) It will help boost their reputation and that of their corporate overlords, which will eventually translate into revenue.

  • by Simon Budig ( 1423 ) on Wednesday June 03, 2015 @09:52AM (#49829847) Homepage

    Hi all.

    Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.

    Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...

    Bye,
                  Simon

    • Hi all.

      Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.

      Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...

      Bye,
      Simon

      Are you sure the Sourceforge CEO didn't co-opt the "abandoned" identity of Michael Schuhmacher?

      • I suppose if you're a world famous race car driver and you get paralyzed, you might be driven to maintain the GIMP.

        I'm sorry, but that was contractually obligated.

  • Project Removal? (Score:5, Interesting)

    by Rob Riggs ( 6418 ) on Wednesday June 03, 2015 @09:52AM (#49829849) Homepage Journal
    How does one permanently remove a project from SourceForge that has been transferred elsewhere so this does not occur?
    • Re:Project Removal? (Score:5, Informative)

      by David Lee Lambert ( 2823693 ) <davidleelambert@gmail.com> on Wednesday June 03, 2015 @02:38PM (#49833077)

      You can't [stackexchange.com]. In particular,

      • "Has the project released files? If not, we will honor the removal request."
      • "Projects which have moved to another hosting provider are typically retained at SourceForge.net (though you can make a note on the project web site and project summary page directing users to the new home) for sake of retaining materials of historical value."
      • "Projects that are moving to closed source do not qualify for removal."
  • by idontgno ( 624372 ) on Wednesday June 03, 2015 @09:53AM (#49829855) Journal

    We slashdotters complain vociferously about the (lack of) quality of the editors here at Slashdot. But it could always be worse. We could have editors like the ones at that other Dice holding, who steal people's contributions and put their own labels on them, and then wrap them in malware.

    It'd be like Timothy personally claiming every +1-or-higher comment made in one of the articles he "edited", leaving only Goatse and GNAA trollage for us plebians.

  • by 0100010001010011 ( 652467 ) on Wednesday June 03, 2015 @10:03AM (#49829955)

    Eh, forget the ./

    Dice you've successfully figured out how to run one of the most best 'news' and opensource websites and run them into the ground for profit. /. and Fark were the only 2 places that could handle 9/11 traffic. I rode out that entire day on both sites when CNN was crumbling.

    I'm glad I had Slashdot over Reddit when I was an angsty tenager. I took pride in trying to get +5 comments and put effort into doing so. Honestly slashdot made me a better writer. Reddit is nice for short terse communication but sometimes I want to "talk with adults".

    Slashdot didn't need much. Unicode support. Newer HTML5 support. CSS3. Make a decent mobile app, move away from HTML for Markdown. Moderation made sense and was much better than a simple +- system. Voting was randomly enabled and you couldn't both vote and comment on the same article. -2 to 5 also limited band wagoning. It's easier to recover from a bunch of early 'down votes'. Instead you drove everyone away to other sites (which still don't quite scratch the /. itch). You shoe horn in what ever fucking agenda is "big in IT". Looking back at all the news I got from /. I can't ever remember thinking "I wonder if a woman did this" or "Too bad a woman didn't do this" because I didn't care. It was about the tech and news for nerds.

    On 'Gamergate', 'sexual equality', 'gender issues', we don't care "Trans-gendered" is a big thing in the news these days (and especially around tech) but a long, long time ago I remember a Mac developer made the transition. (This was in the late '90s.) I read her bio. Shrugged my shoulders went "Neat" and moved on. Why? Because she made some awesome Mac games. Most other person I know in IT or engineering think the same way. None of us care what you do with your body or who you take to the bedroom. I do care if you can cut it and get your work done or contribute to society.

    On the other side of that is Randi Harper (FreeBSD Girl) [twitter.com] who actually write decent code. I've dug through some of her BSD commits, major props to her for doing that. But it can all be done without photoshopping traffic tickets to make it look like you got swatted, begging for money to move on twitter [youcaring.com], (When you already earn $3k/month from Patreon [patreon.com]), grandstanding on Twitter for no reason and bandwagoning users against anyone that disagrees isn't the way to do it.

    You had the same opportunity to fix Sourceforge all of its' convoluted download mirrors (just use a proper CDN), update to Git, and everything else that Sourceforge isn't and GitHub is. Instead you rested on your laurels and are now trying to use this as one last cash grab before the Titanic goes down.

    I don't know where I was going with this either. Just thought someone up top should know why your traffic is tanking and a lot of us are pissed off at you for what you've done.

    I still won't forget the time you broke the capslock filter [slashdot.org], I remember BitTorrent being announced and people thinking it was useless, the iPod's lack of wifi and space compared to a Nomad, et al.

    Thanks for the fish?

    • On 'Gamergate', 'sexual equality', 'gender issues', we don't care

      Until the back pressure from coverage by mainstream news sites and other geek forums like Arts Technica can't be resisted any longer.

  • by vivaoporto ( 1064484 ) on Wednesday June 03, 2015 @10:03AM (#49829957)
    The edits made by Slashdot editors on my original submission (that can be read here [slashdot.org]) are very telling. Fyodor isn't warning that he doesn't control Sourceforge nmap mirror, he is accusing them of hijacking his Sourceforge nmap account, removing the content and creating a mirror that he doesn't control.

    The original title was "Sourceforge Hijacks the Nmap Sourceforge Account" and it was the same title Fyodor used on its post to the maillist. Losing the original Sourceforge original nmap account (created by nmap developers themselves) is not the same news as him not controlling "nmap SourceForge Mirror". The same expression was also changed in the submission body.

    Two other important parts from the the original submission removed by the editor:

    1. The statement by SourceForge themselves that (emphasis mine):

    At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers.

    2. The reference by Fyodor that even if Sourceforge still isn't bundling anything on nmap, the page is designed to mislead the users with fake download buttons:

    "So far they seem to be providing just the official Nmap files (as long as you don't click on the fake download buttons) (...)

    Below I repost the original submission so you can compare:

    Sourceforge Hijacks the Nmap Sourceforge Account [slashdot.org]

    Gordon Lyon (better known as Fyodor, author of nmap and maintainer of the internet security resource sites insecure.org, nmap.org, seclists.org, and sectools.org) warns on the nmap development mailing list that the Sourceforge Nmap account was hijacked from him [seclists.org].

    According to him the old Nmap project page (located at http://sourceforge.net/project... [sourceforge.net], screenshot [postimg.org]) was changed to a blank page and its contents were moved to a new page [sourceforge.net] (http://sourceforge.net/projects/nmap.mirror/, screenshot [postimg.org]) which controlled by sf-editor1 and sf-editor3, in pattern mirroring the much discussed the takeover of GIMP-Win page discussed last week on Ars Technica [arstechnica.com], IT World [itworld.com] and eventually this week Slashdot [slashdot.org].

    That happens after Sourceforge promises to stop "presenting third party offers for unmaintained SourceForge projects. [sourceforge.net] At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers."

    To their credit Fyodor states that "So far they seem to be providing just the official Nmap files (as long as you don't click on the fake download buttons) and we haven't caught them trojaning Nmap the way they did with GIMP" but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html [nmap.org]"

    • by Soulskill ( 1459 ) Works for Slashdot on Wednesday June 03, 2015 @10:46AM (#49830325)

      Hi. Thanks for the submission.

      In addition to editing your submission for brevity and minor grammatical issues, I edited it for factual accuracy as well. I'll first address your two main points.

      1) The rest of the quote from SourceForge was trimmed because it wasn't relevant to the content of the submission. SF has been bundling their "third-party offers" with projects who explicitly opt into it for a long time — it's a known thing, and has been discussed at length. Second, according to Fyodor's own post, they weren't bundling anything with nmap.

      2) The rest of the Fyodor quote was trimmed for a similar reason. It makes reference fake download buttons and catching SF "trojaning" nmap. It's fine for Fyodor to editorialize as he pleases, but the first is a separate issue and the second is a non-event, so neither really have a place on this story.

      The headline was changed for two reasons: First, Fyodor's account seems to still be under his control, and the nmap project seems to have been cloned/mirrored, so the references to hijacking the account lack clarity. Second, this is not actually new news. When the GIMP story broke, anyone with an interest could see what projects SF had taken over. Nothing actually changed for the project page Fyodor is posting about since the GIMP story broke — thus, the new information is simply that he's complaining about it. (Which is his right, of course.) I went ahead and posted the story for transparency's sake, and I added links at the bottom of the summary to the SF editor accounts, so people could easily see the full list of affected projects.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        Change job, dude. This isn't worth it.

      • by vivaoporto ( 1064484 ) on Wednesday June 03, 2015 @11:34AM (#49830791)
        Hi, and thanks for taking the time to address those points, altought they were not the main points. They were merely "other important parts (...) removed", the main point being that "Fyodor isn't warning that he doesn't control Sourceforge nmap mirror" but "is accusing them of hijacking his Sourceforge nmap account".

        Concerning to the main point:

        1. The original title stated that he lost control of "Nmap Sourceforge Account" and not his own
        and it was very clear that by having the project page erased outside his control meant that he lost control of it.

        2. The submission was not about SourceForge (as they were, as you say, pretty much similar to the what was discussed in the previous story) but about the reaction of a prominent figure of the IT world. By editing it for factual accuracy the point of the submission was lost (as what was kept after the edit was not Fyodor's reaction anymore).

        I don't agree that those other two points were satisfactorily addressed either and here is for what reason.

        1. The entire quote was copied verbatim from the update made by T on the SourceForge and GIMP [slashdot.org] article. Assuming it was relevant enough to be included there by the Slashdot staff itself I don't see why it is not relevant to be included in a similar article referring to the same subject.

        2. The rest of Fyodor quote served to illustrate his opinion that, despite not bundling the installation files with "easy to decline third party offers" (to borrow an eufemism sometimes used by the industry, referred by Fyodor as "trojaned"), it is still risky to download nmap from SourceForge mirror. There are very confusing download buttons on that page that link to those same kind of third party offers instead of to the unmodified installer (referred as "fake download buttons").

        it is very misleading to have a submission accepted, altered for factual accuracy but to kept as if it were submitted as is by the original submiter:

        vivaoporto writes:

        an edited version of what vivaoporto wrote, without any indication of what was changed, who changed and why.

        It would be better to either accept the submission as is (with the minor gramatical mistakes corrected) with a "Note of the Editor (NE)" appended or to reject the submission as factually incorrect.

    • by gatzke ( 2977 ) on Wednesday June 03, 2015 @11:14AM (#49830605) Homepage Journal

      Between /. screwing around with this SF story and them screwing around with the poll, I am about to give up.

      After nearly two decades reading /. nearly daily they are pushing me over the edge.

  • While looking at other open source project hosting, the one thing that I couldn't see was a good alternative to sourceforge's file release system.

    They basically provide a yum/apt friendly structure that can be rsynced to. Since it allows pretty much arbitrary structure and it gets mirrored, it works out ok.

    Even before this, was interested in replacing everything on sourceforge, but now really interested in killing it off. Anyone know a good free CDN to cram yum/apt repositories into?

  • This is the internet -- Sourceforge doesn't control content they don't own any more than anyone else does on the internet. And their audience being geeks rather than Fred and Ethyl Consumer, who would be better connected into threads like these and would know to go to the "official" sites... I just don't see this strategy working.

  • by PPH ( 736903 ) on Wednesday June 03, 2015 @11:11AM (#49830573)

    ... working its way up to replacing legitimate content with alternative and possibly corrupt stuff? In the case of GIMP for Windows, it has been sold off to an advertising provider. For nmap, the motivation could be more nefarious. As an important tool for performing network and security diagnostics, the implications of a crippled copy could be far more nefarious.

    NSA, please go away.

  • Slashdot editors are now actually editing.

  • Seriously, WTF?

    Are the SF editors just retarded or are they intentionally just trying to shoot themselves in the head?

    What were they thinking:
    "Wow, taking control of GIMP and adding adware to it certainly stirred up some controversy....let's see what happens if we hijack NMap! No such thing as bad publicity, right?"

    Someone needs to hit these people upside the head with a clue-bat and let them know that yes, there IS such a thing as bad publicity.

    PS
    Guess we can talk about this in a couple of weeks on main w

  • This is why we can't have nice things!

  • This is why my policy has always been to obtain downloads only from the author's or package's official site or an official download named on the official site. Apparently that policy's saved me from a lot of malware/crapware.

  • Is this the owner of slashdot.org or something else. If they are the same then WTF ARE YOU GUYS DOING taking over people's projects and locking them out?

We can defeat gravity. The problem is the paperwork involved.

Working...