Slashdot Mirror
nmap Maintainer Warns He Doesn't Control nmap SourceForge Mirror
vivaoporto writes: Gordon Lyon (better known as Fyodor, author of nmap and maintainer of the internet security resource sites insecure.org, nmap.org, seclists.org, and sectools.org) warns on the nmap development mailing list that he does not control the SourceForge nmap project.
According to him the old Nmap project page (located at http://sourceforge.net/projects/nmap/, screenshot) was changed to a blank page and its contents were moved to a new page (http://sourceforge.net/projects/nmap.mirror/, screenshot) which is controlled by sf-editor1 and sf-editor3, in a pattern mirroring the much discussed takeover of the GIMP-Win page discussed last week on Ars Technica, IT World and eventually this week on Slashdot.
On Monday, Sourceforge promised to stop "presenting third party offers for unmaintained SourceForge projects," and to their credit Fyodor states, "So far they seem to be providing just the official Nmap files," but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html." To browse the projects and mirrors currently controlled by SourceForge, you can look at these account pages: sf-editor1, sf-editor2, and sf-editor3.
According to him the old Nmap project page (located at http://sourceforge.net/projects/nmap/, screenshot) was changed to a blank page and its contents were moved to a new page (http://sourceforge.net/projects/nmap.mirror/, screenshot) which is controlled by sf-editor1 and sf-editor3, in a pattern mirroring the much discussed takeover of the GIMP-Win page discussed last week on Ars Technica, IT World and eventually this week on Slashdot.
On Monday, Sourceforge promised to stop "presenting third party offers for unmaintained SourceForge projects," and to their credit Fyodor states, "So far they seem to be providing just the official Nmap files," but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html." To browse the projects and mirrors currently controlled by SourceForge, you can look at these account pages: sf-editor1, sf-editor2, and sf-editor3.
They are dead to me.
Honestly, using SorceForge right now is kind of like using Download.com. Sure, you might not get something nasty, but why take the chance?
Sourceforge was always my go-to place for trusted original non-screwed files, and now I check the list of projects owned by sf-editor1, 2, and 3 and I see a lot of projects that I have used in the past.
Sometimes (particularly for older projects) it is very difficult to find a home-page or source that I can trust...and now it just became a lot harder.
-- Pete.
Monochrome - Probably the UK's largest internet BBS
To just refer this matter to law enforcement. They're putting together bundles specifically to shove spyware down people's throats. It's being done in such a way as to make uninformed users think they're the official page. I'm not normally one to say stuff like this, but sourceforge needs to have a visit from FBI and/or FTC over this.
Re-packaging the product as your own is bad enough, but another bad part is that older projects may have security vulnerabilities as well. It seems like it would be far more ethical to me to simply mark the project as "abandoned", then after a while remove it completely. If the project is alive somewhere else, then contact those folks, let them know what is up, give them a chance to close it all down themselves or revive the proejct on SF.
But taking it over? No, that is not cool.
Love sees no species.
Look, the slashdot editor in chief is not on vacation any more and can thus post an anti employer post! *snicker*
I really admire slashdot editors freely accepting SF stories no matter how damaging they are.
Did you see a single newspiece/editorial on CNET news.com about the junk download.com bundles?
A good reputation is hard to earn but easily lost.
Is is time for Freshmeat.net to make a return?
Only the State obtains its revenue by coercion. - Murray Rothbard
Their parent Dice holdings should start an internal investigation and find&fire the suits who led to this scandal. They should also hire a person who will oversee such decisions.
They may also suggest a fire&forget, respectable spyware cleaner (malwarebytes, spybot or even ms windows defender) to users.
Or they better backup the site, sudo shutdown -f now
If maintainers are no longer using Sourceforge to host or mirror their project files, can they not just delete them from Sourceforge? Why allow old versions to bandy about the internet? Is it just laziness on the part of the developer to remove old files, or does Sourceforge prevent it?
This business with SF is troubling, and reinforces my concern about someone malicious gaining control over other items, like Linux repositories, updates, etc.
Anyone from "Russian hackers" to the NSA.
"If any question why we died, Tell them because our fathers lied."
http://sourceforge.net/u/sf-editor1/profile/
http://sourceforge.net/u/sf-editor2/profile/
http://sourceforge.net/u/sf-editor3/profile/
Rather than continuingly being forced to report on your own humiliations, why don't you just have a word with someone at DICE and show them what kind of response their actions are getting?
While downloading pre-built binaries is often a necessity on Windows you don't have to trust the installer packages you download. At a minimum use a tool like 7-Zip to look inside the package to see what is lurking there. Its pretty obvious when a self-extracting executable contains extra crap and when you find that you can either look for a different download source or manually extract only the content you intended to download.
All they have to do is:
1) post a prominent disclaimer along with a link to an officially maintained source, if any.
2) only provide true read-only mirrors or, for truly-abandoned projects or projects with "political squabbles" that make it hard to know the "real, official" maintainter, true historical mirrors in an explicitly frozen state along with a stayement explaining why the code is old.
3) prominently display an invitation to "official maintainers" to reclaim control of the repository or have the mirror deactivated once they prove who they are.
They can go one step further by pro-actively reaching out to currently affected projects and to projects they later identify as "abandoned on Sourceforge but still alive elsewhere."
They also need to apologize to affected developers and maintainers.
Why should they even bother?
1) They can still make money on web-site ads.
2) It will help boost their reputation and that of their corporate overlords, which will eventually translate into revenue.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Hi all.
Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.
Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...
Bye,
Simon
How does one permanently remove a project from SourceForge that has been transferred elsewhere so this does not occur?
the growth in cynicism and rebellion has not been without cause
We slashdotters complain vociferously about the (lack of) quality of the editors here at Slashdot. But it could always be worse. We could have editors like the ones at that other Dice holding, who steal people's contributions and put their own labels on them, and then wrap them in malware.
It'd be like Timothy personally claiming every +1-or-higher comment made in one of the articles he "edited", leaving only Goatse and GNAA trollage for us plebians.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Eh, forget the ./
Dice you've successfully figured out how to run one of the most best 'news' and opensource websites and run them into the ground for profit. /. and Fark were the only 2 places that could handle 9/11 traffic. I rode out that entire day on both sites when CNN was crumbling.
I'm glad I had Slashdot over Reddit when I was an angsty tenager. I took pride in trying to get +5 comments and put effort into doing so. Honestly slashdot made me a better writer. Reddit is nice for short terse communication but sometimes I want to "talk with adults".
Slashdot didn't need much. Unicode support. Newer HTML5 support. CSS3. Make a decent mobile app, move away from HTML for Markdown. Moderation made sense and was much better than a simple +- system. Voting was randomly enabled and you couldn't both vote and comment on the same article. -2 to 5 also limited band wagoning. It's easier to recover from a bunch of early 'down votes'. Instead you drove everyone away to other sites (which still don't quite scratch the /. itch). You shoe horn in what ever fucking agenda is "big in IT". Looking back at all the news I got from /. I can't ever remember thinking "I wonder if a woman did this" or "Too bad a woman didn't do this" because I didn't care. It was about the tech and news for nerds.
On 'Gamergate', 'sexual equality', 'gender issues', we don't care "Trans-gendered" is a big thing in the news these days (and especially around tech) but a long, long time ago I remember a Mac developer made the transition. (This was in the late '90s.) I read her bio. Shrugged my shoulders went "Neat" and moved on. Why? Because she made some awesome Mac games. Most other person I know in IT or engineering think the same way. None of us care what you do with your body or who you take to the bedroom. I do care if you can cut it and get your work done or contribute to society.
On the other side of that is Randi Harper (FreeBSD Girl) who actually write decent code. I've dug through some of her BSD commits, major props to her for doing that. But it can all be done without photoshopping traffic tickets to make it look like you got swatted, begging for money to move on twitter, (When you already earn $3k/month from Patreon), grandstanding on Twitter for no reason and bandwagoning users against anyone that disagrees isn't the way to do it.
You had the same opportunity to fix Sourceforge all of its' convoluted download mirrors (just use a proper CDN), update to Git, and everything else that Sourceforge isn't and GitHub is. Instead you rested on your laurels and are now trying to use this as one last cash grab before the Titanic goes down.
I don't know where I was going with this either. Just thought someone up top should know why your traffic is tanking and a lot of us are pissed off at you for what you've done.
I still won't forget the time you broke the capslock filter, I remember BitTorrent being announced and people thinking it was useless, the iPod's lack of wifi and space compared to a Nomad, et al.
Thanks for the fish?
The original title was "Sourceforge Hijacks the Nmap Sourceforge Account" and it was the same title Fyodor used on its post to the maillist. Losing the original Sourceforge original nmap account (created by nmap developers themselves) is not the same news as him not controlling "nmap SourceForge Mirror". The same expression was also changed in the submission body.
Two other important parts from the the original submission removed by the editor:
1. The statement by SourceForge themselves that (emphasis mine):
2. The reference by Fyodor that even if Sourceforge still isn't bundling anything on nmap, the page is designed to mislead the users with fake download buttons:
Below I repost the original submission so you can compare:
While looking at other open source project hosting, the one thing that I couldn't see was a good alternative to sourceforge's file release system.
They basically provide a yum/apt friendly structure that can be rsynced to. Since it allows pretty much arbitrary structure and it gets mirrored, it works out ok.
Even before this, was interested in replacing everything on sourceforge, but now really interested in killing it off. Anyone know a good free CDN to cram yum/apt repositories into?
XML is like violence. If it doesn't solve the problem, use more.
This is the internet -- Sourceforge doesn't control content they don't own any more than anyone else does on the internet. And their audience being geeks rather than Fred and Ethyl Consumer, who would be better connected into threads like these and would know to go to the "official" sites... I just don't see this strategy working.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
The project's being 'mirrored' should just use trademark defense and force SF to not use the same trademark/project name for the altered binaries they are peddling. SF actions are obviously harming the brand that those projects have worked hard to establish.
On 'Gamergate', 'sexual equality', 'gender issues', we don't care
Until the back pressure from coverage by mainstream news sites and other geek forums like Arts Technica can't be resisted any longer.
Yeah... it's sad but true. I'm also looking for alternatives.
Hi all.
Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.
Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...
Bye,
Simon
Are you sure the Sourceforge CEO didn't co-opt the "abandoned" identity of Michael Schuhmacher?
NSA, please go away.
Have gnu, will travel.
Bitbucket.
wasn't this issue discussed two days ago, along with an official response? were you mnapping at the time? do you want a new story for every project affected, along with critiques of their website and false allegations of trojans? maybe you dislike their fashion sense or cooking, too? are you that bored? need another mnap?
Slashdot editors are now actually editing.
Seriously, WTF?
Are the SF editors just retarded or are they intentionally just trying to shoot themselves in the head?
What were they thinking:
"Wow, taking control of GIMP and adding adware to it certainly stirred up some controversy....let's see what happens if we hijack NMap! No such thing as bad publicity, right?"
Someone needs to hit these people upside the head with a clue-bat and let them know that yes, there IS such a thing as bad publicity.
PS
Guess we can talk about this in a couple of weeks on main when the Slashdot editors finally get the go-ahead from their corporate overlords.
More to the point, would it really be that hard for an even more nefarious third-party to change out the Sorceforge shovel-ware for truly dangerous malware? Do they even offer hashes to check the installers they've 'improved'?
This is why we can't have nice things!
https://www.eff.org/https-everywhere
I suppose if you're a world famous race car driver and you get paralyzed, you might be driven to maintain the GIMP.
I'm sorry, but that was contractually obligated.
Hi all.
Just a quick service announcement since Fyodor erred with regard of the role of Michael Schuhmacher.
Michael is *not* the CEO of Sourceforge. He is Office Wrangler for the GIMP project and very much on the other side of the dispute...
I believe he was referring to Michael Schuhmacher Mirror, who was created and promoted to CEO, after the real Michael Schuhmacher was observed to be inactive for a period of time.
Not sure, but please post one here if you find one.
This is why my policy has always been to obtain downloads only from the author's or package's official site or an official download named on the official site. Apparently that policy's saved me from a lot of malware/crapware.
Is this the owner of slashdot.org or something else. If they are the same then WTF ARE YOU GUYS DOING taking over people's projects and locking them out?
> I had enough from them. I'm going somewhere else.
Yet you come back, every other story, to post this or a similar comment.....