Slashdot Mirror
SourceForge Responds To nmap Maintainer's Claims
An anonymous reader writes: A few days ago, the maintainer of nmap (an open source network mapping tool) complained that SourceForge had taken over the nmap project page. SourceForge has now responded with a technical analysis of the nmap project history. They said, "We've confirmed conclusively that no changes were made to the project or data, and that all past download delivery by nmap on SourceForge was through our web hosting service where content is project-administered."
They detail the history of services used by the nmap project, and use screenshots from the Internet Archive to show how long the project was empty. SourceForge said, "The last update date in 2013 relates to the migration of the nmap project (along with all other projects on the site) from SourceForge's sfx code base to the new Apache Allura-based code base. This migration was an automated operation conducted for all projects, and this platform change did not augment data in the Project Web service or File Release System. We therefore conclude that no content has been removed from the nmap project page." They also confirmed that nmap downloads were never bundled with ads: "Infosec professionals do not generally wish to install secondary offers." Note: SourceForge and Slashdot share a corporate overlord.
They detail the history of services used by the nmap project, and use screenshots from the Internet Archive to show how long the project was empty. SourceForge said, "The last update date in 2013 relates to the migration of the nmap project (along with all other projects on the site) from SourceForge's sfx code base to the new Apache Allura-based code base. This migration was an automated operation conducted for all projects, and this platform change did not augment data in the Project Web service or File Release System. We therefore conclude that no content has been removed from the nmap project page." They also confirmed that nmap downloads were never bundled with ads: "Infosec professionals do not generally wish to install secondary offers." Note: SourceForge and Slashdot share a corporate overlord.
There's no apologizing for the malware spewing shitfest that SF has become. Do the right thing and close the site.
How long until you guys face trademark lawsuits from the ors and foundations that don't want to be associated with your site?
Because that's the next step. I'm surprised it's not happened already.
Migrate to github. Shut down SF repo.
I am very small, utmostly microscopic.
Must be nice for SourceForge to have their own Public Relations arm now via slashdot. Just post the story you want, say "Nah - It's fine trust us" and then boost it to the front page of /.
I'll await my downvotes
"Infosec professionals do not generally wish to install secondary offers."
WTF? Nobody with a clue wants to install "secondary offers". Otherwise we'd seek that crap out and install it ourselves, dumbasses...
Quo usque tandem abutere, Nimbus, patientia nostra?
Here's your problem, SourceForge. You've abused your trust with the community. Why should the community trust you? Even the evidence you provide requires the community to trust you haven't been doing nefarious things to ensure the evidence looks good later on when you need it. Sure, it's far fetched.
And 15 years ago, I would have said it's far fetched that SourceForge would include malware with their downloads. Today? We're a stepping stone away.
How can SourceForge fix this? I don't know. I simply don't get myself into this sort of situation in the first place, so I don't have to weasel my way out of them.
other than the parts we changed.
Must be nice for Sourceforge. Controlling the message via slashdot. Listen, no one wants malware. You can shine it up and call it "a secondary offer" but it's still junk. I hope as time goes on more people realize what a virusden that site is and more people rely on github
"We" haven't come to anything. You're not part of any major projects and have no say in any of this. You're just a worthless spectator.
Khyber, does that mean you're leaving Slashdot?
They ruined Filezilla
They pissed of GIMP.org
.... now nmap.
Some things need to be said...
Who is this ranting, cross-posting idiot with a "mission"? Why should anyone give a damn about them posting the same drivel over and over to every comment branch on this thread?
I do not fail; I succeed at finding out what does not work.
No more DHI Group anything, ever.
You want to bitch about it- call these people- don't even bother posting here:
http://www.dhigroupinc.com/investors/corporate-governance/default.aspx
quis custodiet ipsos custodes
Just shut every fucking site you've purchased down already. I can't imagine you guys EVER regaining whatever credibility you might have thought you had. Your websites are bleeding to death while you're picking their pockets for every last penny you can find.
You've "won". It's over. Shut them all down.
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with
I'm sure graphics artists and casual users who want a cheap replacement for Photoshop just love them....
At times (at work) when I can't access various project webpages due to overeager web filtering, and I find a sourceforge mirror of a project, that comes in awful handy. If they follow through with their "opt-in" advertising only, so much the better. Of course, i'm generally downloading source to build, so the advertising doesn't come up.
Try looking for good subs on Reddit. If you get rid of the defaults and just use your own, it can be a pretty good place.
quis custodiet ipsos custodes
Am I confused here, or did the summary wording say they basically are claiming no culpability for the site's contents not being live anymore because they didn't literally change the files, they merely replaced the entire server?? How does it then follow that this wasn't their fault because they "automated" it?
Some other projects SourceForge has taken:
Those authors haven't gotten up in arms yet but they could (Especially with Firefox's defense of its logo/name for anyone not them)
Your comment has too few characters per line (currently 11.7).
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam. Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta. Mauris massa. Vestibulum lacinia arcu eget nulla. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.
Honestly, who the fuck does?
I get the sense they didn't do this because they knew Infosec professionals would pillory them, but they're more than willing to embed shit in everything else.
Too little, too late there Sourceforge.
Lost at C:>. Found at C.
The "nmap" project really is just a "placeholder". The FRS part is completely empty. If Fyodor doesn't want to put the current release there because of staleness concerns, fine, but it would be polite to at least put a "README.txt" there with a link to the real distribution-site and an explanation of why he chooses not to host the files on SourceForge.
And I'm not happy about all the recent changes (dropping OpenID authentication, for example), but other changes in the last year or so have been positive, SF is still a reasonable place to host a project, and it's good to not have all eggs in the one basket of GitHub. The field of core-technology-agnostic open-source hosting is shrinking, note last week's termination of CodeHaus and the in-process termination of Google Code (which offers a migrate-to-GitHub service, but also provides a link to SF's migrate-from-Google-Code service).
note: I have at least one, possibly two other, Slashdot accounts because OpenID creds can't be merged with an older acco
My god, what the fuck SourceForge. You used to be so good! Now you're packing in shitware with popular open source projects? Filezilla, now nmap, seriously?
Github is the obvious choice, but will no one stand up and create a front end to make it a little more end user friendly, or create a SF clone that doesn't ever mess with the projects they host? I realize this is a costly endeavour, but SF must be stopped :/
640k ought to be enough for anyone.
If Sourceforge is to be believed -- that all they did was create a mirror, without touching the owner's page -- then that's not in itself a bad thing to do. Providing mirrors of open-source software would be perfectly acceptable for another organization.
But this isn't another organization, this is Sourceforge. They've already demonstrated that they have no qualms about using their "mirrors" to distribute malware by misrepresenting the content of the downloads. Therefore, they have no credibility to be running a mirror, and nobody should trust anything that comes from their download pages.
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
They performed what is essentially IDENTITY THEFT.
When someone downloads something from SourceForge and gets infected, it's the project people, those that made the software, that are going to take the blame.
Sourceforge keeps their name neatly out of it all. Meanwhile, the project devs get to deal with the flak caused by SourceForge.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I don't think you'll find a single site to replace /., except reddit with specific subreddits.
But let's be honest, its never really been that great a site. It was good enough back in the day when it didn't have much competition, but that time has long since past.
--jcbender
That's the problem: you can't shut down a SourceForge project. If you try - if your project is popular enough - they will "provide a service to the community" by mirroring your new project page. With ads. And malware.
They've found a way to abuse open source. Precisely because it is open source, they can create a mirror. The only thing that will stop them is publicity - like this has been receiving. I assume that most techies stopped going to SF a year or two ago, when they started with the malware wrappers. Anyone who wasn't put off by that, will surely now be put off.
I would actually prefer that people not all go to GitHub - it's already getting too big and too influential. Bigness seems to inevitably lead to evilness, sooner or later. It would be better to spread hosting around on many different services. We then just need a couple of central directories that say where a particular project's homepage is. If a directory turns evil, that's easier to replace than a whole hosting service.
Enjoy life! This is not a dress rehearsal.
As a result of this, I've been looking for a slashdot alternative, since I expect Dice to wreck this site as well in the not to terribly distant future. Sad, because I've been here for years.
Anyway, Soylent News looks promising:
https://soylentnews.org/ ... anyone have any other suggestions? Kiro5hin looked good at one time, but went full-bore political.
The Future of Human Evolution: Autonomy
I know that people posting "I'm done here" is usually a sign over short term anger -- but I am feeling utterly compelled to abandon this site. After the years of general decline and now these actions by Dice Network I really don't see any other option.
Seeing the abuse of SourceForge by Dice was cause for concern
Seeing that they were actively denying the acceptance of stories reporting this was distasteful
Seeing the earlier Slashdot "story" that essentially put words in the complaining code maintainers mouth while downplaying everything was alarming
Being fed this one sided propaganda piece by Dice/Sourceforge/Slashdot is simply taking things too far.
Fact of the matter is people put their trust into SourceForge to host their code repos -- SourceForge decided to no longer act as a trusted partner and started hijacking popular software to repackage it with adware for their own profit -- profits not share with the creators or maintainers of the software nor done with their consent.
Such behavior is exploitative to those who have labored to create those OSS Projects and SourceForge's actions not only damage their relationship with the Developers of those projects, but is an affront to the entire OSS Community world wide.
Due to the actions of Sourceforge and The Dice Network's use of Slashdot as a propaganda tool to first quash all discussion of their actions then disseminating these ridiculously slanted "stories", has caused Slashdot to lose all credibility. I now see Slashdot as a news source to be on the level I view FOX News and will for now on hold them in the same regard
*logging out*
Slashdot should get in on this game - take over "unused" user IDs for the purpose of posting comments ("secondary" opinions) to articles such as this. They could even monetize it by putting in endorsements and links to product.
I jest, I jest - Slashdot is easily my favorite website. Hoping they keep it that way.
The company that owns+runs reddit is about as good as the one that owns+runs slashdot.
Remembered my login details so that I could say my last goodbye.
I feel fantastic, and I'm still alive.
Note: SourceForge and Slashdot share a corporate overlord.
Is it the Chinese or Russians. "All this base belong to us!"
It all starts at 0
It's worse. Their CEO is married to a guy that ran a ponzi scheme. They try to shoehorn SJW into everything. Some of us just want a place to talk the merits of tech.
That's what you call malware? Because slipping adware into a package is fucking malware. NOBODY wants it, and SourceForge are being whores by including it.
SF are preying on the unsuspecting and they should fucking stop, any Slashdot spin notwithstanding.
-B
Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.
Thanks to all of the SF misbehavior, my corporate overloads have blocked SF entirely.
Great job guys.
All the posturing isn't going to change the fact that projects whose only public repository are SF are now off limits to many.
*sigh*
This is the crux of the issue.
When SF takes over a page and replaces an installer from the project with an SF program; it's deceptive and fraudulent.
If that SF program is a modified binary, a modified installer, or even a "download helper" or a wrapper around the original installer which prompts for crapware; SF is misrepresenting the download as coming from the project rather than SF unless stated clearly otherwise.
When a user downloads this fraudulent download, they blame the crapware on the project authors and not SF. This isn't simply a theory - the feedback on many projects includes numerous negative reviews due to this crapware which they falsely attribute to the project creators. This negatively impacts the projects and their reputations with their users. Real financial harm could be done if fewer donations are made due to the harmed reputations - or support contracts not renewed due to suspicions.
I believe SF's recent assertion that they will no longer do this is, at least in part, because they know this sort of activity will not stand up in a court of law and it is detrimental not only the projects they've vandalized, but to themselves in showing their poor character and lack of trustworthiness in choosing to implement such a scheme to begin with. Stopping the harmful practice does not undo the harm already done, so it would be nice to see some legal recourse to inspire fear in those who would dare to do this sort of thing in the future.
Even when an author approves such nefarious wrappers and crapware through an agreement, SF is using deceptive practices towards users by not clearly distinguishing their regular binary downloads from crapware downloads. The same green "download" button appears in either case, but with crapware there is sometimes a small print of "installer enabled" and an "i" in a circle one can hover over which will display that there may be crapware in the installer. In filezilla's case, it warns of an ad-supported installer.
http://sourceforge.net/project...
IMHO, there should be clear distinctions between binaries offered by (or approved by) the project author and those offered or modified by SF as well as clear indications of when one is downloading a "download helper" or advertisement supported downloader or installer.
Granted, the guy you are responding to is a total idiot but "cyber terrorism"? When did that become a thing?
How is blacklisting addresses terrorism?
How is DDOS'ing terrorism?
By using that word frivolously, you diminish its meaning to almost nothing.
Anything and everything is terrorism these days, including all negative behaviour that neither inspires fear nor intends to spread fear.
Nmap violates GPLv2.
He is actively abusing the license by adding conditions that remove provisions of the GPL such as the "arms length" exception.
He can do that if he stops using the GPL preamble and rename it to something else, but he hasn't and therefore is as bad as sourceforge.
They kind of deserve each other.
He is no better than the jackass running Filezilla.
If you copyright your project's name and logo, shouldn't you be able to demand that it be re-branded? See: Icecat/Ice Weasel, CentOS, etc. The code stays open source, but SF would have to rename it and give it a different icon and that should hopefully alert anyone who has half a clue.
The Nmap project at https://sourceforge.net/projec... appears empty and run by Fyodor. However, there's another Nmap project at https://sourceforge.net/projec... that says clearly "Brought to you by: sf-editor1, sf-editor3".
FTFY.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
What good did Slashdot editors think it would do to post SourceForge's response in a story like this?
Nobody here is going to believe the corporate spin from Dice, so why bother posting it at all? I know that Slashdot likes to drive traffic and commentary to their stories by posting inflammatory articles or misleading summaries. However, when the topic actually involves Dice/DHI, getting the user base riled up about it is pretty self-defeating.
Also, rather than being from the "before-the-weekend" department, shouldn't this be from the "before-the-5-day-weekend-where-we-pretend-not-to-see-user-submissions-about-sourceforge" department?