Slashdot Mirror
SourceForge Tightens Security With Malware Scans (fossforce.com)
Christine Hall at FOSS Force reports: It appears as if the new owners at SourceForge are serious about fixing the mistakes made by the sites previous owners. FOSS Force has just learned that as of today, the software repository used by many free and open source projects is scanning all hosted projects for malware. Projects that don't make the grade will be noticeably flagged with a red warning badge located beside the project's download button. According to a notice posted on the SourceForge website this afternoon, the scans look for "adware, viruses, and any unwanted applications that may be intentionally or inadvertently included in the software package." Account holders with projects flagged as containing malware will be notified by SourceForge. In today's announcement, SourceForge said that a thousand or so of the sites most popular projects [representing 84% of all SourceForge traffic] have so far been scanned, with scans continuing to eventually include "every last project, even dating back years." As the site hosts somewhere around 500,000 projects, this first scanning is expected to take several weeks. The company also says that beginning immediately, all new projects will be scanned during the uploading process. This latest move is in keeping with promises made to the community when the new owners, SourceForge Media, took control of SourceForge and Slashdot on January 28, 2016.
Nicely done guys. Sourceforge had definitely gone down the toilet in my eyes. We'll see how it pans out going forward, but this can't hurt.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
Followed a link off slashdot to sourceforges "top downloads" and it was riddled with so much malware I had to use a backup and reinstall. Since they I block all advertising from slashdot and EVERYTHING from sourceforge.
BLACK LISTED
This is a great step to keep people from bundling stuff in their installers. However, I can't help but think that what SF or some FLOSS hub needs is a build system built right in for releases. That would help prevent many problems (like Windows balking at unsigned installers and the like) and help restore trust in the final product. It would also set them apart from the competitors and make the software easier to use on Windows, the majority of the market. Finally, accountability could be set up by having the certificates trace back to the project name (see filezilla installed by a cert not for SF.net/p/filezilla then you know there is trouble).
and Botg can go suck rotten eggs for eternity. https://forum.filezilla-project.org/viewtopic.php?f=1&t=36762
I've moved to WinSCP and never looked back.
I must have missed something. Someone bought slashdot? For how much?
I'm glad to see the positive changes made by SF. I've always hoped they would come back around for the better. Maybe, with some luck, freshmeat.net can come back too.
A lot of people abandoned SourceForge because they started bundling crap with all the installers. Does their scanner catch those as well, or are they going to blame the project owners for what SF did to their binaries?
The problem with a signed build system, is what happens when malware is developed within Sourceforge? Upload the software, build it. Generate signed malware for installation. Sure Filezilla might have a l. But then what about the cert for SF.net/calculator?
Ok, I give up, why you?
Last time I came across it, Slashdot was still flagged by uBlock Origin. With github providing an arguably more modern experience, it seems that bringing users back would be a tall order.
What is up with not being able to disable ads on /.? If you are removing this feature, announce it. Don't just break it.
Silence is a state of mime.
FileZilla from the old SourceForge got me a couple times with it's bundled software which caused me to abandon SF after rebuilding affected machines -- while I'm happy the corrections that SF is making, it looks like the maintainer of FileZilla isn't ready to give up bundled software (mouse over the 64 bit Windows FileZilla download link on the official site)
Can someone please take over or branch this open source software?
Ever wonder how so many backdoors and virus vectors (not to mention zero day exploits) got propagated into OSS code? Wonder whose scanning code they're using? =8-0
Organization? You must be joking..
Nobody is planning for it because they think hip startups are immune to this kind of thing, but believe it -- GitHub will slowly go down the SourceForge path as well. They're already wedged firmly into the software ecosystem to the point that some people can't even build their own software without live access to GitHub. Once their position is fully consolidated they're going to monetize the shit out of you just like SF did, and you'll most likely bend over and take it.
Learn from history, or repeat it.
Does anyone have an example of a Sourceforge project that has malware in it, so we can see the warning notice first-hand?
I wonder whether the use of proprietary client-side script is a "serious repair" under consideration. Reliance on proprietary client-side script gives SourceForge an F rating among free software project hosts that FSF reviewed, the same as that of GitHub.
Comment removed based on user account deletion
A decade ago, I wrote a socks server and posted it to Sourceforge. It does exactly what it says it will do, and it was so good and convenient that malware authors found it to be a useful payload to drop on machines to get a backdoor into them. So then virus scanners flagged it as malware, and sourceforge trusts those, and then they deleted the current version of the binary. Now that page has big scary warnings about software that plainly does what it says with all the source there to prove it (see it for yourself - https://sourceforge.net/projec... ).
I know these guys are trying to win back trust, but trust is hard. Trusting heuristic based scanners is optimistic. Making allegations about software and its authors on the basis of a heuristic can be downright offensive.
(Along similar lines, chocolatey is now flagging my directory enumerator because one out of 57 virus scanners heuristically thought crawling a disk is suspicious - https://www.virustotal.com/en/... .)
It's no more of a problem than any other build system. Plus, you can get code-signing private keys now, either legitimately or stolen. The benefits would be the ability to trace the software to a specific open source project and, unlike most other code signing CAs, the incentive for such certificates to be policed.
I hope you can enable SSL/TLS on project-web soon. Probably by using SSL-SNI and allowing us to upload our certs. We need to guarantee that the served site(with download links) is the real deal and not a compromised one.
Comment removed based on user account deletion
So I just got a failure that makes me think that the problem isn't gone. To test out the new measures against Malware, I tried downloading PDFCreator. This is off the SourceForge pages, never visiting the project homepage to receive their malware riddled installer. The SourceForge link is a web-installer, so the thing that SourceForge can scan has no Malware embedded in it. But the .exe that the installer downloads does.
Is there a process for notifying about bad actors? Will repeat offenders be permanently banned?