SourceForge Appeals To Readers For Help Nixing Bad Ad Actors

Last week, we mentioned that the GIMP project had elected to leave SourceForge as its host, citing SourceForge's advertising policies. SourceForge (which shares a parent company with Slashdot) has released a statement about those policies, addressing in particular both ads that are confusing in themselves and their revenue-sharing system called DevShare, based on the provision of third-party software along with users' downloads. Among other things, the SF team is appealing to users to help them find and block misleading ads, and has this to say about the additional downloads: "The DevShare program has been designed to be fully transparent. The installation flow has no deceptive steps, all offers are fully disclosed, and the clear option to completely decline the offer is always available. All uninstallation procedures are exhaustively documented, and all third party offers go through a comprehensive compliance process to make sure they are virus and malware free."

Comments

Missing the point

[finkployd]

I don't want useless add on application/browser extension/etc being installed when I chose to download something. No matter how much vetting and transparency, this is simply wrong.

Re:Missing the point

[twocows]

This, and I believe this was a big part of why GIMP left. Just because other download sites are doing it doesn't mean it's tolerable. Sourceforge is pretty much completely unusuable without ABP at this point (which, when enabled, makes SF completely bearable; forcing users to use ad blocking software means your advertising model isn't working).

Re:Missing the point

[Desler]

Timmeh is paid to miss the point. Did anyone really expect Dice.com emoyees to speak against this adware?

Re:Missing the point

[TWiTfan]

I couldn't believe it when I installed some software from Sourceforge a while back and ended up with a malware toolbar in my browser (that was a huge PITA to remove, no less). At first I thought it was a mistake, that I *must* have gotten it from somewhere else. Then when I heard similar stories from others and realized it was intentional, just a cheap money grab--I knew the Sourceforge I once knew and trusted could never be trusted by me (or supported) ever again. Sad day.

Re:Missing the point

[Charliemopps]

What's really funny is how they completely failed to understand who their customers were. It'd be like Whole Foods spritzing free Pesticides on your produce as you checked out.

Re:Missing the point

[Anonymous Coward]

Nothing personal but it seems kind of ironic coming from someone named twocows....

Re:Missing the point

[rudy_wayne]

What's really funny is how they completely failed to understand who their customers were. >

No, they know exactly who their customers are. their customers are the people who pay them to display ads and inject extra crap into downloads. That's where SourceForge's revenue comes from. Not from you.

Re:Missing the point

[i kan reed]

And there's the fact that the dumb things Sourceforge was doing was harming Gimp's reputation as a legitimate piece of professional software. That's a reputation they've been working hard to develop for years(name complaints aside).

Re:Missing the point

[cffrost]

I couldn't believe it when I installed some software from Sourceforge a while back and ended up with a malware toolbar in my browser (that was a huge PITA to remove, no less). At first I thought it was a mistake, that I *must* have gotten it from somewhere else. Then when I heard similar stories from others and realized it was intentional, just a cheap money grab--I knew the Sourceforge I once knew and trusted could never be trusted by me (or supported) ever again. Sad day.

Was there a check-box to opt-out of the malware installation, or was the malware installed silently? I've installed several programs from SF recently, and I read all of the dialogs, but I haven't seen any opt-outs or malware.

Re:Missing the point

[amicusNYCL]

I don't even think their statement is very honest. We have this line:

The installation flow has no deceptive steps

So, when I go to a project's download page, and I see a bunch of ads with giant green "DOWNLOAD NOW" buttons, that isn't supposed to be deceptive? Then there's this:

the clear option to completely decline the offer is always available

The "clear option" is a greyed-out "Decline" button on the bottom left of the installer. The green Accept button is on the bottom right of the installer, which is the place that people have been trained to click to go to the next step. While it's true that the decline button is always visible, making it appear greyed-out and away from the Accept button is not exactly clear (and possibly deceptive). Moreover, instead of "Decline" and "Accept", how about "Only Install Filezilla" or "Install Offer And Filezilla". THAT would be clear and non-deceptive.

Here's a hint for SF: if you want to identify bad actors, one indication is that they are an advertiser. The advertiser's goal is to steal attention and make people click on something, even (especially?) if it wasn't what they intended to click on. Advertisers ruin everything about the internet, they're the reason why we needed popup blocking in the first place. Whenever a new technology comes along, advertisers are there to shit all over it. Excuse me, "monetize" it. If you're putting ads on your site, and you have no control over the content of those ads (i.e. fed from a third-party network), then those ads are going to be annoying and deceptive. I fully expect to go to SF one day and see some ad screaming about how "one weird tip" can allow me to download Filezilla.

Re:Missing the point

[mwvdlee]

Atleast they were honest enough to add "which shares a parent company with Slashdot".
This loosely translates to "everything here is lies, and you have been warned".

Re:Missing the point

[icebike]

Mod Parent UP.

Most people probably don't realize SF is owned by the owner of Slashdot.
SF is probably a good indication of what will befall Slashdot.

Re:Missing the point

[PopeRatzo]

I would hope that at the very least, Sourceforge would make these add-on sales pitches to be turned off by default and make them opt-in instead of opt-out.

I've had to sit my wife and daughter down and explain to them how when they update Java or Adobe anything they have to be sure to turn off all the BS programs that those installers will try to slip by them, because of their horrible opt-out malware installers.

Re:Missing the point

[mcgrew]

Agreed, that's one reason people ditch Windows. Windows users are use to that sort of bullshit, open source folks won't stand for it.

SourceForge, this shit needs to stop. Advertising is fine, but damn it, leave the trickery to the corporate... oh, oh... Dice owns SourceForge now, doesn't it?

SourceForge is SO screwed...

Re:Missing the point

[yuhong]

Well the deceptive part IMO is the "bait and switch" part where they showed one filename but in reality download a different file.

Re:Missing the point

[Charliemopps]

I'm tired of this ridiculous argument. It sounds stupid when you say it but you think you're technically correct. Well you're not. They actually have 2 sets of customers. They get something non-monetary from one set, which they trade to the other set for cash. If they lose either customer they are going out of business.

Re:Missing the point

[Desler]

The last sentence is also extraordinarily patronizing and seems to think we're dumb enough to fall for it. "It's okay that we installed this crapware that you didn't want because we document how to uninstall it!" I would like to think Timmeh doesn't actually believe such crap. It's one thing to parrot the company line it's another to actually believe it when it's so obviously absurd.

Re:Missing the point

[TapeCutter]

Exactly, it's so simple even a SF marketer could understand it, users with half a brain do not want crapware and do not trust it no matter how many times you scan it. Sure, plaster as many ads as you like on the project page, you can even make them blink if you must, but leave the fucking installer alone, it is not YOUR software.

SF are also shooting themselves in the foot for a few extra pennies. The hated (and I mean HATED by everybody) crapware is getting a free ride on Gimp's reputation and damaging both SF and Gimp's reputation in the process. That may be legal but it ain't right,

Re:Missing the point

[dalias]

Wouldn't it be better to just uninstall Java and Adobe-anything? Chrome can read PDFs and play Flash purely with the components packaged with it; there's no need to install third-party add-ons. And Java is pretty much 100% useless except in corporate intranets with Java-based in-house software.

Re:Missing the point

[Greyfox]

I nixed the bad actors by putting all my projects on github.

Re:Missing the point

[Luckyo]

Customer is the entity that drives your business by paying for services you provide. Product is the service you provide.

Views by the people who download are the service that is being provided to advertisers who pay. That is the business model. No amount of spindoctoring will change that.

Re:Missing the point

[mysidia]

I couldn't believe it when I installed some software from Sourceforge a while back and ended up with a malware toolbar in my browser

According to This; it is never done without the developer opting in.

In July 2013, we launched a pilot version of an opt-in revenue-sharing program called DevShare. DevShare is a partnership program offered to SourceForge developers to turn downloads into a source of revenue for them, by bundling their applications with third parties’ offers.

...

This is a 100% opt-in program for the developer, and we want to reassure you that we will NEVER bundle offers with any project without the developers consent. The DevShare program has been designed to be fully transparent.

Re:Missing the point

[schnell]

Advertisers ruin everything about the internet

They are also the reason most websites on the Internet are free. They are the reason Gmail is free, maps, and, hell, even Android are free. Everything on the Internet that isn't a charity needs to get paid for, and if you aren't buying something then an advertiser is paying in order to get to you.

It sucks that some ads are annoying and intrusive. Those should be avoided at all costs along with the sites that allow them. But advertisers don't ruin everything about the Internet ... they actually are responsible for 95% of the Internet being free of charge.

Re:Missing the point

[spmkk]

Here's a hint for SF: if you want to identify bad actors, one indication is that they are an advertiser...Whenever a new technology comes along, advertisers are there to shit all over it. Excuse me, "monetize" it.

The problem here is you (well, us) as consumers. We not only want FOSS, we want delivery to be free, too -- without regard for the fact that the infrastructure to facilitate that delivery actually takes tangible resources (i.e. money, not just developer time) to operate.

So, in effect, we the consumer base are CHOOSING this advertising model. If you were willing to pay $0.25 to Sourceforge every time you downloaded a program or code tree from them, you could make a reasonable demand for SF to do away with the stupid ad shenanigans. But you're not. Even if you personally are, the user base as a whole has gotten accustomed to delivery being "free" and now demands it. And since it's not actually free, sites like SF have to find a way to stay solvent.

The "bad actors" here are consumers of free stuff who get their panties in a bunch whenever the silver platter that their free stuff is served on is even the slightest bit tarnished.

Re:Missing the point

[mindwhip]

The "clear option" is a greyed-out "Decline" button on the bottom left of the installer.

More or less the same reasons I stopped recommending Avast to friends who often ended up malware infected due to pre-installed Mcaffee not doing anything useful... Constant popups prompting to download a version 'upgrade' with the version that costs more button in bright yellow and the free or currently paid for version on a practically invisible 'greyed out' button. Even when I knew they were doing this I found it difficult to avoid ending up on a shop page...

Imagine if every time you got in your car and turned on the engine you had to decline an upgrade to a car that cost twice as much or every single bite of your burger at someone came up to you and tried to sell you another complete meal...

Re:Missing the point

[J'raxis]

Plenty of sites use inoffensive, non-deceptive ads. GMail was mentioned above, for example. The only reason these advertisers are resorting to trickery is because their products suck and no one would actually install them if they knew what they were.

Re:Missing the point

[J'raxis]

But who the hell would opt in to being assaulted by this kind of shit? The only way these kinds of ads even remotely work is to force them on consumers.

Re:Missing the point

[khakipuce]

It's more like ranching or fishing. The cattle and fish are not customers, they are your feedstock or raw materials. Treat them badly, over-fish, poison them and you have no feedstock and hence no revenue. Google gets this fairly well, they actively farm their users giving them plenty to feed on, and doing their best not to pollute the food supply (i.e. search results in google's case) they also add in cool stuff, new toys, etc. and hence Google's customers are happy fat cows who keep coming back for more - I know, I am one!

Don't make users opt-out

[hawguy]

If you don't want complaints then make the DevShare program opt-in instead of opt-out.

You may argue that few people would choose to opt-in, but that's the point, isn't it?

Re:Don't make users opt-out

[Desler]

Which is why it won't be done. Dice.com cares about ad revenue not the users. They've gotta make their money back somehow on these purchases. Squeezing blood from a stone seems to be their tactic.

Re:Don't make users opt-out

[Anonymous Coward]

From the article:

Currently in the Pilot phase, we only have 3 projects participating in the DevShare program all of which explicitly opted-in. This represents 3 out of 300,000+ projects in our entire catalog. This is a 100% opt-in program for the developer, and we want to reassure you that we will NEVER bundle offers with any project without the developers consent

Sounds pretty opt-in to me.

Re:Don't make users opt-out

[mwvdlee]

Of course, with all the ill-will caused by the mere existence of the program...

Does the DevShare program warn about it's inclusion in software before the user requests a download?
Otherwise it's just a case of users being uncertain whether any particular download can be trusted or not.

Re:Don't make users opt-out

[SFnetTeam]

If you don't want complaints then make the DevShare program opt-in instead of opt-out.

You may argue that few people would choose to opt-in, but that's the point, isn't it?

The DevShare program is opt in by projects; meaning that if they want to participate, they indicate as such when we inquire if this is something in which they may be interested to help fund their development. For users, it's the same. Clicking the decline button through the offers will download the software they were seeking. - Daniel Hinojosa, SourceForge Community Manager

Re:Don't make users opt-out

[Luckyo]

Opt in for DEVELOPER. People who download get boned and don't get asked if they want a condom or not.

how about...

[Anonymous Coward]

just not doing the installation share thing AT ALL. I don't care how well it gets documented, it's a tactic that is built to take advantage of the large group of people that will do nothing but hit "next" 7 or 8 times and not look at anything.

Re:how about...

[icebike]

Exactly.

I just checked yesterday, and the thing is still loaded with malware Download buttons.
This morning, it looks slightly different, but on four different projects the biggest button
on the page was MALWARE download button. (Adblock switched off).

Why can't they just put them all in a separate box labeled MALWARE - DON'T CLICK!.
Or header the column they are in with a ADVERTISEMENT - Not the software you were looking for" banner.

SourceForge has definitely suffered since being picked up by Dice Holdings, and it is probably
an indication of what will happen to Slashdot over time.

Horse, Stable, Bolted

[OzPeter]

All they are doing now is stepping up their tap dancing in the hopes that people will fail to see the obvious about their bundled downloads.

Re:Horse, Stable, Bolted

[TWiTfan]

Nothing they could ever say or do will ever win me back. When you install malware on my system, we're done--for good.

Re:Horse, Stable, Bolted

[i kan reed]

When you try to install things of any sort I don't ask for, it's malware, by the way. It doesn't matter if you're screening for things you consider malware, it's my system, and configuring it in ways I don't intuitively intend to configure it is abusing your power as an installer, thus is malicious.

Unfortunately...

[fuzzyfuzzyfungus]

With rare, mutually beneficial, exceptions, it seems to generally be the case that if I can get paid for putting an 'offer' in front of a user, no matter how transparent and not-spyware and whatnot, that's a good sign that the value to the user is negative.

Gosh, yes, I'd love to receive offers from your carefully selected content partners!

Obviously, a continuum exists, from pure drive-by malware to the-box-isn't-even-checked-by-default opt-in stuff; with various levels of 'all the boxes start checked; but you can uncheck them if you can find them' and 'sure, just go down the stairs, take a left at the sign that says "beware of the leopard", pick the lock on the third door on your right, and choose the 'advanced install' package from the bottom drawer of the filing cabinet'; but just because sleaze occupies a continuum doesn't mean you want to get any on you...

Re:Unfortunately...

[mwvdlee]

Even if unchecked by default, it's easy to encourage mistakes...

[ ] Install for all users
[ ] Install shell extensions
[ ] Include common file format plug-ins
[ ] Include third party informational tools
[ ] Enable automatic updates
[ ] Disable anonymous usage statistics

Yeap Dont want it at all

[ghinckley68]

dont mind ads and most people that use Sf are smart enough to see around them.

But SF had a reputation for be clean installs that could be trusted. That is no longer the case.
SF you blew your done and gone.

People still use Sourceforge?

[Anonymous Coward]

SVN is lame; Gimp is where it's at, baby.

Github is 6th Street. Sourceforge is the old Main Street, with mostly boarded-up buildings.

the whole concept is messed up

[Chirs]

When I want to download software, I want that software, not other piece of software that's going to install itself in my browsers and mine my information.

As others have said, make it purely opt-in and I can live with it. The opt-out stuff just pisses me off because it is so transparently trying to profit off people that aren't paying attention.

SourceForge has shown it can't be trusted.

[Animats]

SourceForge has shown it can't be trusted. The only way they could regain trust at this point is by legally committing themselves to never bundling anything with an installer, and using an open source installer. Instead, their terms still read "We reserve the right at our sole discretion and at any time to ... change the terms and conditions of this Agreement."

Sorry, SourceForge. You got caught. Promising you won't do it again isn't good enough. That's just PR spin.

download.com did it...

[Anonymous Coward]

... and I left them too, almost a decade ago. it cost me downloads, but saved my customers from their intrusive bundled downloads.

"Advertising policies"? Try borderline malware.

[Alphanos]

The bottom line is that GIMP didn't want to be associated with tricking its users into installing borderline malware. If a program's installer is filled with traps that you have to carefully watch for to avoid - that sets off huge blaring alarms in the heads of most experienced users.

This is especially a problem for the open-source community, which still struggles to get a fair comparison with commercial software in the corporate IT world. If even major software gets saddled with nonsense like SourceForge is trying to pull, it could set back progress by years.

SourceForge had better smarten up before it becomes a ghost town. GIMP is certainly not going to be the last high-profile departure if things don't change.

While we're at it, the summary of this story was blatantly whitewashed. Mentioning the parent company link should be a bare minimum, not an excuse to abandon all pretense of impartiality.

Just another download site now

[symbolset]

I hope they don't mess up /. too.

Re:Just another download site now

[i kan reed]

Have you been to beta.slashdot.org? It's only a matter of time until they deploy it and I'm gone.

Re:Just another download site now

[cas2000]

too bad the site doesn't work properly - for example, click on an article, you'll get the article page and a dozen or so comments plus a "load more comments" button. clicking that button returns you to the index page.

the current slashdot site works just fine with noscript. beta.slashdot does not. fuck that shit, slashdot's stories and comments just aren't worth the risk of letting them and their corportate parents and their advertisers and whoever else run arbitrary code on my computer.

if slashdot becomes just another site that requires javascript for basic functionality then it'll be just another site that I ignore.

Shove your crapware up your ass

[Desler]

All uninstallation procedures are exhaustively documented, and all third party offers go through a comprehensive compliance process to make sure they are virus and malware free.

Except that you and the Sourceforge people know damn well that next to no one actually wants that crapware. 99% of cases it will be installef by someone merely clicking through not expecting crapware in the installer.

Wait, what?

[d18c7db]

They are putting these ads on their site and they are getting the revenue from the ads and they want me to to tell them which ads are appropriate and which are not. For free! Screw you, I already have a paying job, I don't need to do your job for you as well.

SourceForge also shown it's hard to use

[Chemisor]

In the wake of the scandal I have just finished moving all my projects to GitHub, and man, it's been worth it. I mean, have you noticed how incredibly slow SourceForge is lately? I've been using it for over ten years now, and it's been getting slower and slower. I got used to it, but now on GitHub I'm constantly amazed that I don't have to wait a few minutes for the project page to load. Or the fact that I don't even have to go there any more because I can make releases by creating a tag and project web page is just another git branch. How do you update a SourceForge web page again? I'll have to look it up, 'cause I don't remember at all. I only remember that ssh, scp, and lots of manual copying was involved. SourceForge's release system is a pain, and really, the only feature SourceForge has that GitHub does not is access statistics, but this feature hasn't worked properly ever since the big UI overhaul a few years back. Frankly, I don't see any reason to ever go back to SourceForge.

Don't be evil

[onyxruby]

Don't bundle /anything/ other than what the user wanted with the download. Don't bundle toolbars, helper programs, utilities, assistants, or anything else you choose to call your advertising product.

Trust that is lost can't ever really be regained, especially on the Internet. The quick dollars gained came at the expense of the dollars in the long run. You need to start with an apology that acknowledges what was wrong along with a promise in plain English never to do it again.

Now, I didn't say anything about not running advertising on the pages. Advertising is what makes sites run, and anyone with any length of time in the industry understands their importance. Google style ads that aren't disruptive are generally respected and static graphical ads from companies like Microsoft and IBM must work as they have advertised here for years. The problem is if things get pushed too far and the content can't be read without irritation.

If the website isn't functional (loads within 1 second without distractions or intermission ads) than you site has gone over too far and the next visit and every visit thereafter will be filtered. We also understand how these things work on the back-end, know how to implement ABP, No Script, Ghostery and other things with advertising gets overbearing.

At this point it is up to the WebMasters to show that they understand "don't be evil". You can't do it with fine print though, for this audience, reads the fine print.

Nothing but excuses. It's still wrong.

[FSWKU]

All uninstallation procedures are exhaustively documented, and all third party offers go through a comprehensive compliance process to make sure they are virus and malware free.

You clowns at SourceForge/Dice are missing the point. Users DON'T WANT this garbage on their system. You are deliberately trying to get them to install it, even if it's by mistake.

And what about all the institutions providing you with mirroring? Are they getting a cut of this revenue now? If they're not, then you are DELIBERATELY attempting to profit from their charity and generosity. Personally, I hope every single mirror deletes any SourceForge related material from their servers and tells you to go die in a fire. You are attempting to profit from the work and resources of others who believed they were contributing to the free software community. For that, you are to be shamed, shunned, and written off as yet another group of clueless MBA's out to monitize the entire fucking world at the expense of others. Go fuck yourselves and look for a real job where you have to WORK instead of ruining other people's reputations by bundling useless shit with their software.

Hey Dice!

[tunapez]

I haven't posted much since the takeover but I wanted to log in one last time to say:
 
1) Thanks for ruining SF, that was remarkably fast.
 
and

2) FUCK OFF!
 
All /. feeds will be deleted now, no more clicks to read comments for you parasites.

Too late, Adforge

[fluor2]

You ate too much of your own cake.
The migration to other services has begun.
You might never recover from this.
May it be a lesson for all other "free" services trying to make hasty profit.

What?

[ledow]

"Find and block misleading ads"

Why is this our job?

Why do you not know what's being advertised on your own website?

Why do you run a business based on something you can't control?

Why don't YOU go through your ads and start removing the misleading crap?

SourceForge double talk: fully transparent != OSS

[fluke11]

A key point made by the GIMP project was:

[they] strongly encourage the top projects to use a new (closed source only) installer

SourceForge not only seems to have missed this key point but has completely reversed it's previous position on Open Source being a key component to transparency. Instead, SourceForge claims:

The DevShare program has been designed to be fully transparent. The installation flow has no deceptive steps...

Who says it has no deceptive steps? How do I audit the source code to the installation flow?

For anyone that reads the SourceForge blog, this seems to be a very jarring change in prospective on the part of SourceForge. Several previous SourceForge blog posts bring up transparency, but always in the context Open Source Software. Before November 2013, I can't find any SourceForge blog posts that refer to close source as "fully transparent." I also can't find any other SourceForge blog post that tries to claim close source software contain no deceptive steps. Once SourceForge is able to make the leap that a close source installer is fully transparent, there really is no common ground to continue a discussion on. It isn't a matter of a third party being a bad actor, SourceForge itself is the bad actor. This SourceForge blog post is proof of erosion taking place on fundamental ideal which where the foundation of SourceForge.

Is this supposed to be hard?

[slashmydots]

Are they even seriously asking right now? All of them. 100% of them. Fucking pick one at random. They ALL have undesireable, misleading, coinstalled crapware. None of them don't have it. How else can I phrase it so these dishonest scam artists?

Too little, too late.

[Insomnium]

For the record, I haven't used sourceforge for a long time. On the other hand... Last few weeks I had several autoplaying video adds on /. front page. I often leave slashdot open when I do something else. For a few days straight I went gaming with a couple of friends using skype. In the middle of the game a frigging add starts playing... yeah. ,,,on /. main page... I do understand having adds on main page... BUT GODDAMN AUTOPLAYING VIDEO ADDS ON /. FRONT PAGE THAT REFRESH WITHOUT ASKING: Contemplating on finding a better source for my nerd news.

What happened to it being an OPT-IN Program?

[mysidia]

Per the Sourceforge blog article:

Last but not least, we will only include projects that have opted into our program. Our compliance processes are very strict and, as such, our beta program is going to be invitation-only during this first phase. If you would like to participate in this revenue-sharing program, just drop us an email, we’ll be back to you as soon as possible.