Slashdot Mirror
SourceForge and GIMP [Updated]
New submitter tresf writes: In response to a Google+ post from the Gimp project claiming that "[Sourceforge] is now distributing an ads-enabled installer of GIMP," Sourceforge had this response: "In cases where a project is no longer actively being maintained, SourceForge has in some cases established a mirror of releases that are hosted elsewhere. This was done for GIMP-Win.
Submitter's note: Gimp is actively being maintained and the definition of "mirror" is quite misleading here as a modified binary is no longer a verbatim copy. Download statistics for Gimp on Windows show SourceForge as offering over 1,000 downloads per day of the Gimp software.
In an official response to this incident, the official Gimp project team reminds users to use official download methods. Slashdotters may remember the last time news like this surfaced (2013) when the Gimp team decided to move downloads from SourceForge to their own FTP service. "Therefore, we remind you again that GIMP only provides builds for Windows via its official Downloads page." Note: SourceForge and Slashdot share a corporate parent. Editor's note: I just got back from a busy weekend to see that a bunch of people are freaking out that we're "burying" this story, so here it is. Go hog wild. Sorry it took so long. (And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)
Update: 06/01 22:37 GMT by T : The SourceForge blog has a welcome update; SourceForge, it says, has effective today "stopped presenting third party offers for unmaintained SourceForge projects. ... At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers."
Submitter's note: Gimp is actively being maintained and the definition of "mirror" is quite misleading here as a modified binary is no longer a verbatim copy. Download statistics for Gimp on Windows show SourceForge as offering over 1,000 downloads per day of the Gimp software.
In an official response to this incident, the official Gimp project team reminds users to use official download methods. Slashdotters may remember the last time news like this surfaced (2013) when the Gimp team decided to move downloads from SourceForge to their own FTP service. "Therefore, we remind you again that GIMP only provides builds for Windows via its official Downloads page." Note: SourceForge and Slashdot share a corporate parent. Editor's note: I just got back from a busy weekend to see that a bunch of people are freaking out that we're "burying" this story, so here it is. Go hog wild. Sorry it took so long. (And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)
Update: 06/01 22:37 GMT by T : The SourceForge blog has a welcome update; SourceForge, it says, has effective today "stopped presenting third party offers for unmaintained SourceForge projects. ... At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers."
I remember seeing a submission on this early last week.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
*** BUY ACME SPEARMINT ***
Interfere with slashdot posts?
*** BUY ACME SPEARMINT ***
Issuing an opinion on something the umbrella corporation did that you may have no control over would be a solid follow up.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
This behavior should get SourceForge blacklisted as both cyber-squatters and adware, possibly malware vendor.
Aren't we all smart enough to turn off the adware during install? I even know some old people who turn off "add-ons" that they don't need.
Well, given that adware 'offers' still get injected into installers, I'm going to use my incredible mental thinking skills to hypothesize "no, we aren't".
Aside from that, even if you don't get hit by the adware, having to defang an installer just to use a program leaves the indistinguishable taste of pure sleaze in your mouth for the rest of the process(looking at you, Oracle and the Ask.com toolbar...)
Sourceforge is dragging the GIMP project's name through the mud by bundling this shit, even if they don't hit anyone. That alone is more than enough to be displeased by.
If it hadn't been for that moron, today's /. submission would've probably not been posted.
I don't buy the /. editors' explanation.
This story has been repeatedly submitted since at least late Wednesday and has been voted to red multiple times in the firehose.
Meanwhile, most other red stories have already appeared on the front page, so clearly some editors were still around...
Anyone buying the "busy weekend" excuse? Can't say I am, since the story broke near the middle of last week, and we've seen /. willfully ignore the community so many times. Look at the amount of pushback it took to defeat Beta and Bennet Hasselton.
Wonder if they'll ever drop the anti-Gamergate narrative too (probably not, since they have most of the tech media circling wagons with them on the pro-corruption side)?
(And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)
Just curious here. Does voting a submission up or down have any effect on whether it's accepted? It seems some stories appear on the front page as soon as they're submitted, others languish for days. Gives the impression the editors are selecting stories based on some agenda other than what slashdot readers want to see.
This is news because Sourceforge used to be trustworthy.
It used to be a respected site where open-source developers could host their binaries without fear of someone tampering with it.
Aren't we all smart enough to turn off the adware during install?
No -- most people just keep clicking "OK" until the install is finished. Just like most people keep signing pages or initialing forms when presented with a bunch of paperwork... they stop reading the details.
The number of people who actually stop and read everything they sign is similar to the number that consider all the options during install scripts -- and that number is VERY SMALL.
(Small anecdote -- quite a few years ago I signed the rental agreement for my first apartment. I was told to initial each of the 10 pages or so and sign the final page. I stopped and read the thing before doing so. My landlord -- who managed something like 40 apartments and had been doing so for a couple decades -- said he could only recall one other person who read the whole rental agreement before signing. And I actually discovered some really interesting rental policies while doing so.)
Also, more on point -- there's the rather obvious evidence that companies wouldn't bother bundling adware if no one ever installed it.
I even know some old people who turn off "add-ons" that they don't need.
And I even know many young people who don't seem to pay any attention while installing and end up with all sorts of weird "add-ons" and don't know how they got there. What's your point?
If they are modifying the binary, would that not make it a derivative work? And so by the license, would that not make it a violation to call it "Gimp?" I know that would be the case on my FOSS project.
Hard to believe that Sourceforge was once a fairly reputable place to download software from. Seems like a millions years ago now.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Any at all for being so closely affiliated with a company distributing adware and using deceptive practices riding on the backs of open source?
Not only do they bundle it with adware, but they've apparently sabotaged GIMP too - for example, they apparently changed the save dialog so that you can only save XCF files and have to click through a "you have unsaved changes" warning when you export to a different format. They added an very difficult to precisely adjust sliders to things like brush size. They took out 16 bit color support. Basically, sourceforge has really totalled GIMP. ;)
"Who the **** put an emergency exit in the interrogation room?!" -- Police chief, "Jesus Christ Supercop"
Do you even have an experience with such malware ridden installers?
The creators abuse every possible linguistic trick on the book to confuse the user about what s/he had selected and what is going to be installed. Sometimes even blatantly lying and claiming that something will not work properly if you choose not to install the optional "performance enhancer".
I had to deal once with such installer for a freebie game, which was bundled with 5(?) pieces of malware. Luckily for me it was an InstallShield which was showing a summary screen of what is going to be installed before doing anything. I had to go through the install wizard three times before the summary screen was showing that only the game itself would be installed. The last one was the trickiest: in description they used effectively triple negative and user had to actually check the box to not to install the malware.
All hope abandon ye who enter here.
The GIMP is GPL'd so they can make derivative works all they like so long as they're also GPL'd. Mere aggregation (i.e. putting some other crap plus gimp in the same installer) doesn't make the other aggregated things have to fall under the GPL, as is specified in the license.
SJW n. One who posts facts.
For those who still use Windows and want GIMP (and a LOT of other opensource and freeware Windows programs) you can't beat Ninite.. https://ninite.com/ Ninite does all of the work to make sure you only get the desired opensource program and NONE of the crapware/malware garbage that so many installers are adding on today.. (Yes, I'm looking at YOU, Oracle... You and your fuckin' Ask toolbar on Java installs)... Thankfully I've switched completely to Linux and don't have to worry about that crap...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
(cough) Ninite (cough) .... The ONLY way to get GIMP and a LOT of other good stuff freeware/opensource programs for Windows.. Back when I still used Windows, I wouldn't be without it...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
GPL covers the rights to use and distribute code. I was not aware that it also included the right to use of trademarks. (Assuming GIMP was even properly trademarked.) See also "Iceweasel".
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
2) I call bullshit on SourceForge's assertion that their adware only comes with projects that aren't actively maintained. There have been a lot of complaints about FileZilla downloads (see, for example, https://forum.filezilla-projec...), and it is definitely a very active project.
It is particularly an issue with The GIMP because it is an open-source gateway program. GIMP is the first open-source software that some people directly experience. I know artists who use it and it's their first contact with the open source community. Sure, they use a lot of OS software without knowing, but this is a highly visible individual program.
Lots of geeks suggest The GIMP to their friends who are otherwise pirating Photoshop or languishing in MS Paint. It's just not a good thing for them to end up downloading malware laden crap because they went to a page Google found for them and not the real download site.
OzPeter,
Soulskill has apologized. Repeatedly, and professionally. Accept it and move on.
I've classified Sourceforge as a malicious site for a long time now. Is there some reason other than their early history with the open source movement that they're still around? It seems like they've been trading on and abusing that good will for a VERY long time.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
The original announcement for when Sourceforge added the "feature" of injecting malware into installers said that the money earned would be shared with the developers. So I have to wonder: did they send the GIMP a check? Have the GIMP developers demanded that Sourceforge do so?
On the assumption that Sourceforge did not, it seems like they've just burned a bridge that they shouldn't have. They killed any trust that users would have had for SF projects a long time ago, but developers who were willing to sell out have stuck around. But now that developers know that SF is willing to just assume control of a project (and the associated profits), why would any developer continue to use SF.
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
How is it possible that you got blind-sided by this story? For a company with media holdings Dice sure does a lousy job of handling public relations. It's not like slashdot is the first publisher to have a conflict of interest involving it's parent company. The smart thing would have been to simply disclose up front the fact that slashdot's parent company owns sourceforge.
I do not block ads. I do block third party scripts.
You mean they've gimped GIMP?
Faster! Faster! Faster would be better!
I blanked my Mac a few weeks ago and when I started reinstalling software I got some survey crap popping up on my screen asking for my details. Turns out it was the SourceForge installer for FileZilla that had sneaked it through. Googling it threw up enough horror stories to make me just blank the Mac again and start over. I'll never download anything from SourceForge again. A decade of trust destroyed in one stupid move.
It never posted to the front page, but several people made postings about this to the Firehose and when it was seemingly ignored for several days after many up-votes, /. users started hijacking threads (in many cases thwarting the "first post" trolls) as their method of recourse to bring attention to the general user-base that there was an FOSS story of relative importance that was not being put on the front page. This didn't look too good on the eds since it was a negative piece about SourceForge which led to the hijackers making claims of conspiracy and censorship on the part of /. and Dice. I have to admit, Soulskill may have been on vacation, but someone was running the wheels of /. since Wednesday and making a popular post in the Firehose disappear...multiple times.
This one is voluntary though. I even got the crapwere when I denied the install.
https://forum.filezilla-projec...
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
What was the problem? Was it the bandwidth costs? AFAIK most of the files you can download from SourceForge are actually not served by SourceForge itself but by mirrors. So those guys are shouldering the brunt of the costs not you. By doing something like this I would not be surprised if some of the mirrors decided they do not want to work with you anymore.
If you wanted the extra revenue by bundling ads with applications you should have done this explicitly with a prior public notification of this being done. For example News.com for a couple of years now bundles their own installer with the downloads they provide. I've seen other places do the same thing. But you should always be able, as a user, to disable the adware installation. Also the user should know before downloading a binary that it has adware in it. Not stealth adding it without people knowing about it. Last but not least hijacking someone else's account for these shenanigans was quite pathetic and fail. This was all handled quite poorly.
A lot of people have been leaving SourceForge as is because it has worse Git integration than other more recent sites and this is just another nail in the coffin.
they've been doing stuff like this since 2013. I remember telling it to everyone back then, but was only met with dismissal. Why is everyone so outraged now?
Because back then they were doing it only for projects whose maintainers consented to it. (as a kind of twisted revenue-sharing program)
Now they are hijacking the installers of so-called "abandoned" projects, and locking out the owners too.
This behavior should get SourceForge blacklisted as both cyber-squatters and adware, possibly malware vendor.
I agree 100%. 10 years ago sourceforge was a great site. Now it's basically a malware haven. Unfortunately, plugins like Web of Trust (WoT) seem to have been slow to catch up ... WoT is still marking sourceforge as green ("trusted"). Perhaps blackholing the site in DNS really is the best answer...
The Future of Human Evolution: Autonomy
http://danluu.com/slashdot-sou...
SF claims the project was abandoned in 2013.
To quote another user from Ars:
"the files page has the folder GIMP + GTK+ (stable release) with a last modified time of 2014-11-18. In that, GIMP 2.8.14 is the latest with the 2014-11-18 modification date. The previous file, GIMP 2.8.10 has a modification date of 2014-05-29. (This is just shy of 6 months.) The one before that, GIMP 2.8.8 is also last modified 2014-05-29, and the one before that is GIMP 2.8.6 last modified on 2013-06-24. (This one is just shy of 11 months back.)
So the project was abandoned, but a year later, it's still updating files. And it had three releases in the year after it was supposedly abandoned. The last release was just a few days over 6 months ago, and the project has a history of up to 11 months between releases. How does that qualify as "abandoned"?
No, this is a bullshit excuse Sourceforge was hoping no one would delve into the details to call their bullshit on. There is no other way to put it than they flat-out lied about the abandonment."
Oh, and to boot - According to the gimp-win developer, they locked him out of his account.
That's right, SourceForge STOLE THE ACCOUNT using an account called SF-editor1 in order to wrap one of the most popular FOSS projects with a malware installer.
So here's what we do, guys. I've got a really good attorney. Same one that helped me kick EA's ass back in the Spore lawsuit days.
We band together, we find every person that has had this malware pushed on them, and we sue the ever-living shit out of SourceForge in a class-action suit where accepting a settlement is NOT AN OPTION. Knowingly distributing malware, using misleading language to get the malware to install, and the damage the malware does to the user's computer are all entirely actionable in court and we need to band together to put a legal end to this crap once and for all. We now have the evidence in the testimony of the former account holder, we have copies of the malware, we have copies of the installer, we have screencapped evidence of the lies SourceForge has posted. SourceForge is DEAD IN COURT.
Look up Mark Punzalan Law. Let him know Alex from the Spore/EA case sent you.
If you want, I can come forth as class representative again. I will be more than happy to be the headman ripping these people apart in court.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
they've apparently sabotaged GIMP too - for example, they apparently changed the save dialog so that you can only save XCF files and have to click through a "you have unsaved changes" warning when you export to a different format.
Is that any different from how Microsoft Excel, LibreOffice Calc, or Gnumeric prompts to save a spreadsheet in native format even if you've already exported it to CSV? Or how Microsoft Word, LibreOffice Writer, or AbiWord prompts to save a document in native format even if you've already exported it to plain text or RTF? Most formats other than XCF do not support layers, and if your document has layers, flattening them to save would lose data.
Actually, it was the GIMP team themselves broke saving in 2.8. (If they've since fixed it, then sourceforge probably just doesn't have the updates).
Their GNOME-like "reasoning" was that "professional" users wanted to save in XCF, and that amateurs should just use something else. It rang pretty hollow when the gold-standard Photoshop didn't behave the same way.
this seems to the takeaway - NEWS is found in the firehose - slashdot per se is more the DICE magazine section.
Saying you had a "very busy weekend", to my eyes, feels just like a euphemism for "management argued a lot before this got posted, and when it did get posted, the expression modified binary had to replace bundled with malware".
Personal Note: "bundled with malware" is what every other place I read the article used to define it.
Personal Note 2: If I happened to stumble on some facts, I want to stress I understand them completely as I also happen to have a very policy-centered full time job. I'm just letting my thoughts fly in a comment, because, well, comment section is still community moderated in full that I know, thus still being free (in the extreme, FSF-like sense of the word "free").