Slashdot Mirror
SourceForge Tightens Security With Malware Scans (fossforce.com)
Christine Hall at FOSS Force reports: It appears as if the new owners at SourceForge are serious about fixing the mistakes made by the sites previous owners. FOSS Force has just learned that as of today, the software repository used by many free and open source projects is scanning all hosted projects for malware. Projects that don't make the grade will be noticeably flagged with a red warning badge located beside the project's download button. According to a notice posted on the SourceForge website this afternoon, the scans look for "adware, viruses, and any unwanted applications that may be intentionally or inadvertently included in the software package." Account holders with projects flagged as containing malware will be notified by SourceForge. In today's announcement, SourceForge said that a thousand or so of the sites most popular projects [representing 84% of all SourceForge traffic] have so far been scanned, with scans continuing to eventually include "every last project, even dating back years." As the site hosts somewhere around 500,000 projects, this first scanning is expected to take several weeks. The company also says that beginning immediately, all new projects will be scanned during the uploading process. This latest move is in keeping with promises made to the community when the new owners, SourceForge Media, took control of SourceForge and Slashdot on January 28, 2016.
Nicely done guys. Sourceforge had definitely gone down the toilet in my eyes. We'll see how it pans out going forward, but this can't hurt.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
When was this?
I must have missed something. Someone bought slashdot? For how much?
I'm glad to see the positive changes made by SF. I've always hoped they would come back around for the better. Maybe, with some luck, freshmeat.net can come back too.
A lot of people abandoned SourceForge because they started bundling crap with all the installers. Does their scanner catch those as well, or are they going to blame the project owners for what SF did to their binaries?
The problem with a signed build system, is what happens when malware is developed within Sourceforge? Upload the software, build it. Generate signed malware for installation. Sure Filezilla might have a l. But then what about the cert for SF.net/calculator?
Ok, I give up, why you?
What is up with not being able to disable ads on /.? If you are removing this feature, announce it. Don't just break it.
Silence is a state of mime.
Yes he stopped linking to SourceForge Filezilla project page from his own site after we told him he cannot bundle software with the project anymore.
Sorry about that. We only purchased SourceForge on January 28th and started making improvements after that.
Ever wonder how so many backdoors and virus vectors (not to mention zero day exploits) got propagated into OSS code? Wonder whose scanning code they're using? =8-0
Organization? You must be joking..
To be fair, Azureus was great but Vuze is a piece of malware shit.
It might not even be related to Sourceforge.
Does anyone have an example of a Sourceforge project that has malware in it, so we can see the warning notice first-hand?
weird, any more info on this? just checked the download links on the filezilla home page [https://filezilla-project.org/] and everything was pointing to source forge.
Have been using it for years, hope they are not going down the tubes.
Does anyone have any suggestions for a linux based alternative to filezilla?
It may depend on what OS you're using right now. On this Mac I am seeing no link to SourceForge here: https://filezilla-project.org/... . I've checked on Windows as well but not Linux. You can always download it from SourceForge as we do not allow FileZilla to bundle anymore: https://sourceforge.net/projec...
Comment removed based on user account deletion
A decade ago, I wrote a socks server and posted it to Sourceforge. It does exactly what it says it will do, and it was so good and convenient that malware authors found it to be a useful payload to drop on machines to get a backdoor into them. So then virus scanners flagged it as malware, and sourceforge trusts those, and then they deleted the current version of the binary. Now that page has big scary warnings about software that plainly does what it says with all the source there to prove it (see it for yourself - https://sourceforge.net/projec... ).
I know these guys are trying to win back trust, but trust is hard. Trusting heuristic based scanners is optimistic. Making allegations about software and its authors on the basis of a heuristic can be downright offensive.
(Along similar lines, chocolatey is now flagging my directory enumerator because one out of 57 virus scanners heuristically thought crawling a disk is suspicious - https://www.virustotal.com/en/... .)
I was wondering if it because i am on linux, weird it would replace the download links for windows installers on the "additional download options" just because i am on linux.....unless they think i intend to run it via wine and the "value add" software is not compatible.
Thanks for the info, great to see you are trying to turn source forge around.
Just messed with the user agent string, now i see it....sneaky.
You should be able to pull a "clean" version from your distro repos. That's how it works with Fedora.
Comment removed based on user account deletion
So I just got a failure that makes me think that the problem isn't gone. To test out the new measures against Malware, I tried downloading PDFCreator. This is off the SourceForge pages, never visiting the project homepage to receive their malware riddled installer. The SourceForge link is a web-installer, so the thing that SourceForge can scan has no Malware embedded in it. But the .exe that the installer downloads does.
Is there a process for notifying about bad actors? Will repeat offenders be permanently banned?