Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
SourceForge Advertising Open Source Security

SourceForge Responds To nmap Maintainer's Claims 172

An anonymous reader writes: A few days ago, the maintainer of nmap (an open source network mapping tool) complained that SourceForge had taken over the nmap project page. SourceForge has now responded with a technical analysis of the nmap project history. They said, "We've confirmed conclusively that no changes were made to the project or data, and that all past download delivery by nmap on SourceForge was through our web hosting service where content is project-administered."

They detail the history of services used by the nmap project, and use screenshots from the Internet Archive to show how long the project was empty. SourceForge said, "The last update date in 2013 relates to the migration of the nmap project (along with all other projects on the site) from SourceForge's sfx code base to the new Apache Allura-based code base. This migration was an automated operation conducted for all projects, and this platform change did not augment data in the Project Web service or File Release System. We therefore conclude that no content has been removed from the nmap project page." They also confirmed that nmap downloads were never bundled with ads: "Infosec professionals do not generally wish to install secondary offers."
Note: SourceForge and Slashdot share a corporate overlord.
This discussion has been archived. No new comments can be posted.

SourceForge Responds To nmap Maintainer's Claims

Comments Filter:
  • Nice phrasing dice (Score:4, Insightful)

    by Anonymous Coward on Friday June 05, 2015 @10:10AM (#49848347)

    There's no apologizing for the malware spewing shitfest that SF has become. Do the right thing and close the site.

    How long until you guys face trademark lawsuits from the ors and foundations that don't want to be associated with your site?

    Because that's the next step. I'm surprised it's not happened already.

    • SourceForge din du nuffin, was a nice repository trying to help the community by giving back some free stuff - i blame those bigoted developers...

      offtopic: i thought Soulskill's weekends started at Tuesday or Wednesday!

    • by WCMI92 ( 592436 )

      Sourceforge might as well be The SCO Group now with what it's done with it's reputation. And I don't see how bundling spyware with GPL'ed code isn't a GPL violation.

      I know I'll never download anything there again.

  • Obvious solution (Score:5, Insightful)

    by gatkinso ( 15975 ) on Friday June 05, 2015 @10:12AM (#49848373)

    Migrate to github. Shut down SF repo.

    • by Anonymous Coward on Friday June 05, 2015 @10:20AM (#49848443)

      You can't. As in the case of GIMP, they took control from the guy who owned the actual dev account for the project, took new binaries from the official GIMP site, put their malware in and called it a day.

      Shut down if you like, watch as they reopen a "mirror" of your project.

      • They can open a mirror of any OSS project, no matter if it lived on SF to begin with. That does not invalidate the point of the parent poster...
      • Okay, so you can't shut down a SourceForge project page. How about simply uploading a final "release" that is essentially completely blank, and editing all the project information to make sure people know this? Can SF really reach out and pull back in external versions to replace the owner's edits?

        There's more than one way to "shut down" an account, even if the website won't really delete it.

        • This is what TrueCrypt did. However, as the GP pointed out, it will do nothing. SF will shut down the repo, and replace the product offering with their own bundled version taken from github or wherever the live source is located.

          I find this sad, because I used SF a lot pre-Dice to host small projects.

        • by PRMan ( 959735 )
          It's open source, so of course they can put any version they want.
      • They can reuse code all they want, within the confines of the license, but they can't do the same with trademarks. I think we need to think harder about them.

    • by coofercat ( 719737 ) on Friday June 05, 2015 @10:32AM (#49848547) Homepage Journal

      +1 for this, and a strong caution about using someone else's server to host your stuff. One day, Github might well end up doing the same thing (yeah, I know it seems unthinkable now, but SF looked pretty cool and was never going to do something like this just a few years ago too).

      PS. This post noticed that you have a virus on your PC. Please download AwesomeSuperWhizzoCrap and run it to fix the problem.

    • Re:Obvious solution (Score:5, Interesting)

      by mwvdlee ( 775178 ) on Friday June 05, 2015 @10:45AM (#49848665) Homepage

      That's what I'm doing.

      Hope to have my SF projects migrated after the weekend.
      My actively developed projects are already on GitHub.

      But just because a project isn't active doesn't mean it's dead; it just means there has been no need (or requests) for changes.

      Luckily none are big enough to be near the top of SF's "loot-&-pillage" list.
      But even then, this seems to me to be the last dying breaths of SourceForge.
      I don't expect them to exist in any recognizable form this time next year.

    • by bradley13 ( 1118935 ) on Friday June 05, 2015 @11:19AM (#49848957) Homepage

      That's the problem: you can't shut down a SourceForge project. If you try - if your project is popular enough - they will "provide a service to the community" by mirroring your new project page. With ads. And malware.

      They've found a way to abuse open source. Precisely because it is open source, they can create a mirror. The only thing that will stop them is publicity - like this has been receiving. I assume that most techies stopped going to SF a year or two ago, when they started with the malware wrappers. Anyone who wasn't put off by that, will surely now be put off.

      I would actually prefer that people not all go to GitHub - it's already getting too big and too influential. Bigness seems to inevitably lead to evilness, sooner or later. It would be better to spread hosting around on many different services. We then just need a couple of central directories that say where a particular project's homepage is. If a directory turns evil, that's easier to replace than a whole hosting service.

      • convenient mirroring could be blocked; wall off all the netblocks owned by SF and affiliates
      • Did you forgot that Git is open source?

        Don't like github.com? Spin up your own.

        • Granted, I absolutely hate all things about Gitlab's "omni-installer".

          That thing is a PITA if I've ever experienced one.

          But once you find a way to not use their omni-installer, it's really nice having your own "github"

        • And SVN (that Sourceforge used for revision tracking) is also open source. The Sourceforge platform also used to be open source but fairly early they started making new versions closed source.

      • If you copyright your project's name and logo, shouldn't you be able to demand that it be re-branded? See: Icecat/Ice Weasel, CentOS, etc. The code stays open source, but SF would have to rename it and give it a different icon and that should hopefully alert anyone who has half a clue.
    • Then Github gets bought out by Dice, or Cnet, or whatever other malware company.

  • Public Relations Arm (Score:4, Interesting)

    by Anonymous Coward on Friday June 05, 2015 @10:12AM (#49848375)

    Must be nice for SourceForge to have their own Public Relations arm now via slashdot. Just post the story you want, say "Nah - It's fine trust us" and then boost it to the front page of /.

    I'll await my downvotes

  • dafuq? (Score:5, Insightful)

    by Penguinisto ( 415985 ) on Friday June 05, 2015 @10:13AM (#49848387) Journal

    "Infosec professionals do not generally wish to install secondary offers."

    WTF? Nobody with a clue wants to install "secondary offers". Otherwise we'd seek that crap out and install it ourselves, dumbasses...

    • by Anonymous Coward

      After a McAfee popup announced yesterday that my Windows PC passed security inspection, I felt like sending off a slightly edited version of Prof David Mazières' most famous paper [stanford.edu] to Adobe Systems.

    • Re:dafuq? (Score:5, Insightful)

      by dunkindave ( 1801608 ) on Friday June 05, 2015 @10:24AM (#49848489)

      "Infosec professionals do not generally wish to install secondary offers."

      WTF? Nobody with a clue wants to install "secondary offers".

      That's the point. Infosec professionals normally have a clue, and the general population in general does not. Desire isn't the problem, understanding the situation is.

      • by praxis ( 19962 )

        Yes, but the quote implied that non-infosec professionals did *wish* to install secondary offers. They made no statement about understanding the situation but about desire. "Desire" is the problem with that quote and what Penguinisto was pointing out.

    • by Anonymous Coward

      Wow such restraint. These folks aren't by chance is the business of consulting frats on how to treat drunk girls??

      "We knew which ones wanted it"

    • WTF? Nobody with a clue wants to install "secondary offers". Otherwise we'd seek that crap out and install it ourselves, dumbasses...

      Duh. The few people who actually like these "secondary offers" are 1) extremely unlikely to have found out about that program on their own and 2) extremely unlikely to download and install it themselves. Thus, being bundled with legitimate software is the lifeblood of these "secondary offers".

    • On the contrary, some infosec pros have a professional interest in malware.

      Think of it as free samples.
      --
      Remember the literal definition of the cloud: "Someone else's server."

  • No Trust (Score:5, Insightful)

    by Anonymous Coward on Friday June 05, 2015 @10:14AM (#49848395)

    Here's your problem, SourceForge. You've abused your trust with the community. Why should the community trust you? Even the evidence you provide requires the community to trust you haven't been doing nefarious things to ensure the evidence looks good later on when you need it. Sure, it's far fetched.

    And 15 years ago, I would have said it's far fetched that SourceForge would include malware with their downloads. Today? We're a stepping stone away.

    How can SourceForge fix this? I don't know. I simply don't get myself into this sort of situation in the first place, so I don't have to weasel my way out of them.

    • by emho24 ( 2531820 )
      Attempting to download software from SF is such a disgusting process, it's similar to negotiating with a car salesman. You will be taken advantage of at every opportunity, and if you don't have your guard up at all times you will be hurt. I'm forever done with SF. I nearly exclusively use Chrome as my browser of choice so 2 browser plugins make sure I never visit that site again. "Personal Blocklist (by Google)" will makes sure that no SF results get returned in a Google search, and "Block site" will ma
  • We've confirmed conclusively that no changes were made to the project or data

    other than the parts we changed.

    • by KGIII ( 973947 )

      The problem I have, and I suspect I am not alone but I have not read any comments about this, is that they can say these things but I simply can not trust them. I was installing an application that I had seen linked from a comment in here. I do not need to shame them. That application installed what was basically a wrapper and I had selected to install a YouTube viewing agent. During the install, and I watch carefully, they downloaded the application separately as it is not a part of the main application. T

  • by buk110 ( 904868 ) on Friday June 05, 2015 @10:17AM (#49848423)
    Must be nice for Sourceforge. Controlling the message via slashdot. Listen, no one wants malware. You can shine it up and call it "a secondary offer" but it's still junk. I hope as time goes on more people realize what a virusden that site is and more people rely on github
    • Re: (Score:2, Insightful)

      by Monty845 ( 739787 )
      I'm done with Slashdot. Its long had quality issues, but this is just over the top. The whole network of companies is contaminated at this point. Deleting my Slashdot shortcuts.
    • by HiThere ( 15173 )

      This is an inherent problem with systems that have a centralized control. Including GitHub. git is inherently decentralized, so it has different problems, which the designers of GitHub tried to resolve through centralization. If you'll notice, it worked. The problems with decentralization were solved. But now we have the problems of centralization.

      I don't know what a real solution would be. Google is a good example in another area. Web pages are decentralized, but Google makes it possible to find wha

  • by Needs2BeSaid ( 4062029 ) on Friday June 05, 2015 @10:24AM (#49848487) Homepage
    They ruined Filezilla
    They pissed of GIMP.org
    .... now nmap.
    • by PPH ( 736903 )

      Some things need to be said...

      If only there was a discussion group not under the control of the same corporate parent. Hmm ......

    • by Anonymous Coward

      Not defending SF here, but they didn't ruin Filezilla- the creator of Filezilla did. He chose to bundle the SF filezilla download with crapware and is adamantly FOR it and claims it is useful and people like it.

      • I agree however, when a drug dealer offers you a free "taste".... in the end, there was still a drug dealer starting it all.
  • No more DHI Group anything, ever.

    You want to bitch about it- call these people- don't even bother posting here:

    http://www.dhigroupinc.com/investors/corporate-governance/default.aspx
  • Dice is rape (Score:5, Interesting)

    by Megaweapon ( 25185 ) on Friday June 05, 2015 @10:30AM (#49848533) Homepage

    Just shut every fucking site you've purchased down already. I can't imagine you guys EVER regaining whatever credibility you might have thought you had. Your websites are bleeding to death while you're picking their pockets for every last penny you can find.

    You've "won". It's over. Shut them all down.

    • by Anonymous Coward

      Seriously, who even uses Dice to search for work? It's a shit platform.

      • I did. I got a bunch of shitty job offers that I had time refusing. And it turns out they scraped the job from another site and reposted it.

        So, exactly like sourceforge.

    • by FreeUser ( 11483 ) on Friday June 05, 2015 @11:26AM (#49849037)

      As a result of this, I've been looking for a slashdot alternative, since I expect Dice to wreck this site as well in the not to terribly distant future. Sad, because I've been here for years.

      Anyway, Soylent News looks promising:

      https://soylentnews.org/ [soylentnews.org] ... anyone have any other suggestions? Kiro5hin looked good at one time, but went full-bore political.

      • by Wee ( 17189 )

        since I expect Dice to wreck this site as well in the not to terribly distant future. Sad, because I've been here for years.

        I've been here a while myself. Dice wrecked this site years ago. You might like reddit.

        -B

      • Kiro5hin looked good at one time, but went full-bore political.

        Political?? It went hard core trollfest. I actually liked it better at it's prime than Slashdot at it prime.

        But then Rusty sold 'memberships', and it was all downhill since then.

      • I've only been to /. a handful of times in the last several months. I spend most of my reading on the web time over at news.ycombinator.com (Hacker News) these days. Good signal to noise ration, no ads, a reasonable community of moderators, etc.

  • Comment removed based on user account deletion
  • At times (at work) when I can't access various project webpages due to overeager web filtering, and I find a sourceforge mirror of a project, that comes in awful handy. If they follow through with their "opt-in" advertising only, so much the better. Of course, i'm generally downloading source to build, so the advertising doesn't come up.
  • Am I confused here, or did the summary wording say they basically are claiming no culpability for the site's contents not being live anymore because they didn't literally change the files, they merely replaced the entire server?? How does it then follow that this wasn't their fault because they "automated" it?

    • Fyodor's original message to the "Nmap Development" list includes the following claim:

      The old Nmap project page is now blank:

      http://sourceforge.net/projects/nmap/ [sourceforge.net]

      It's true that if you go to the "files" tab [sourceforge.net] you won't see any files. However, the SF blog posting says that Fyodor never put anything in the File Release System, so "now blank" is literally accurate but misleading. It implies that SF deleted something, which they didn't.

  • by 0100010001010011 ( 652467 ) on Friday June 05, 2015 @10:49AM (#49848705)

    Some other projects SourceForge has taken: [slashdot.org]

    • Evolution
    • Firefox
    • MySQL
    • PostgreSQL
    • openvz
    • Apache HTTP Server
    • Apache Hadoop
    • SQLite
    • SWRare Iron
    • Thunderbird
    • The R Project
    • NetBeans IDE

    Those authors haven't gotten up in arms yet but they could (Especially with Firefox's defense of its logo/name for anyone not them)

    Your comment has too few characters per line (currently 11.7).

    Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer nec odio. Praesent libero. Sed cursus ante dapibus diam. Sed nisi. Nulla quis sem at nibh elementum imperdiet. Duis sagittis ipsum. Praesent mauris. Fusce nec tellus sed augue semper porta. Mauris massa. Vestibulum lacinia arcu eget nulla. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.

  • by gstoddart ( 321705 ) on Friday June 05, 2015 @10:50AM (#49848707) Homepage

    "Infosec professionals do not generally wish to install secondary offers."

    Honestly, who the fuck does?

    I get the sense they didn't do this because they knew Infosec professionals would pillory them, but they're more than willing to embed shit in everything else.

    Too little, too late there Sourceforge.

  • The "nmap" project really is just a "placeholder". The FRS part is completely empty. If Fyodor doesn't want to put the current release there because of staleness concerns, fine, but it would be polite to at least put a "README.txt" there with a link to the real distribution-site and an explanation of why he chooses not to host the files on SourceForge.

    And I'm not happy about all the recent changes (dropping OpenID authentication, for example), but other changes in the last year or so have been positive,

    • by ledow ( 319597 )

      I worry about using any large project - especially web browsers and network tools - that actually hosts things off-site anyway.

      Sure, a mirror used to be handy to combat huge download amounts, but the core of the codebase like git trees, and the like? And with today's cloudiness?

      I'm not sure what either github or sourceforce or freshmeat/whatever it's called now actually offer any more. Put a listing up, sure, linking to your page with your software, your licence details, etc. but actual downloads or git-t

    • SF is still a reasonable place to host a project

      SourceForge hasn't been a reasonable place to host a project for years now, and it hasn't been getting any better. I wouldn't touch SF with a ten foot pole, either to host my projects or to download other projects.

      Which is a shame. I remember when SF was great.

  • My god, what the fuck SourceForge. You used to be so good! Now you're packing in shitware with popular open source projects? Filezilla, now nmap, seriously?

    Github is the obvious choice, but will no one stand up and create a front end to make it a little more end user friendly, or create a SF clone that doesn't ever mess with the projects they host? I realize this is a costly endeavour, but SF must be stopped :/

    • by DrVxD ( 184537 )

      Github is the obvious choice, but will no one stand up and create a front end to make it a little more end user friendly

      What's un "user-friendly" about Github? I find it straightforward enough to use.
      If you don't say what you think it broken, then nobody's going to fix it for you.

      (Of course, there are other obvious alternatives such as GitLab/Gitorious, BitBucket and CodePlex)

  • by aardvarkjoe ( 156801 ) on Friday June 05, 2015 @11:03AM (#49848821)

    If Sourceforge is to be believed -- that all they did was create a mirror, without touching the owner's page -- then that's not in itself a bad thing to do. Providing mirrors of open-source software would be perfectly acceptable for another organization.

    But this isn't another organization, this is Sourceforge. They've already demonstrated that they have no qualms about using their "mirrors" to distribute malware by misrepresenting the content of the downloads. Therefore, they have no credibility to be running a mirror, and nobody should trust anything that comes from their download pages.

  • Techdirt? Ars Technica?

    I have been around this site for so long, I would be sad to abandon it. But it really seems like things have jumped the shark here.

    • I don't think you'll find a single site to replace /., except reddit with specific subreddits.

      But let's be honest, its never really been that great a site. It was good enough back in the day when it didn't have much competition, but that time has long since past.

    • by Wee ( 17189 )
      I hang about on reddit mostly. Slashdot is corporate mouthparts these days.

      -B
  • Logging Out (Score:5, Insightful)

    by l0ungeb0y ( 442022 ) on Friday June 05, 2015 @11:32AM (#49849085) Homepage Journal

    I know that people posting "I'm done here" is usually a sign over short term anger -- but I am feeling utterly compelled to abandon this site. After the years of general decline and now these actions by Dice Network I really don't see any other option.

    Seeing the abuse of SourceForge by Dice was cause for concern
    Seeing that they were actively denying the acceptance of stories reporting this was distasteful
    Seeing the earlier Slashdot "story" that essentially put words in the complaining code maintainers mouth while downplaying everything was alarming
    Being fed this one sided propaganda piece by Dice/Sourceforge/Slashdot is simply taking things too far.

    Fact of the matter is people put their trust into SourceForge to host their code repos -- SourceForge decided to no longer act as a trusted partner and started hijacking popular software to repackage it with adware for their own profit -- profits not share with the creators or maintainers of the software nor done with their consent.

    Such behavior is exploitative to those who have labored to create those OSS Projects and SourceForge's actions not only damage their relationship with the Developers of those projects, but is an affront to the entire OSS Community world wide.

    Due to the actions of Sourceforge and The Dice Network's use of Slashdot as a propaganda tool to first quash all discussion of their actions then disseminating these ridiculously slanted "stories", has caused Slashdot to lose all credibility. I now see Slashdot as a news source to be on the level I view FOX News and will for now on hold them in the same regard

    *logging out*

    • by Anonymous Coward

      Logging Back In (Score:2)
      by l0ungeb0y (442022) Alter Relationship on Friday June 05, 2015 @12:33PM (#49849086) Homepage Journal
      Hi everyone! The l0ungeb0y account is back. The abandoned account is being maintained by sfeditor01, sfeditor02, and sfeditor03, so that l0ungeb0y can bring you the same quality of comments you've become accustomed to, 24hours a day. The comments will contain encrypted punch lines, which you can decrypt with software from https://sf.net/projects/all-ad... [sf.net]

  • Slashdot should get in on this game - take over "unused" user IDs for the purpose of posting comments ("secondary" opinions) to articles such as this. They could even monetize it by putting in endorsements and links to product.

    I jest, I jest - Slashdot is easily my favorite website. Hoping they keep it that way.

  • Note: SourceForge and Slashdot share a corporate overlord.

    Is it the Chinese or Russians. "All this base belong to us!"

  • That's what you call malware? Because slipping adware into a package is fucking malware. NOBODY wants it, and SourceForge are being whores by including it.

    SF are preying on the unsuspecting and they should fucking stop, any Slashdot spin notwithstanding.

    -B
  • Thanks to all of the SF misbehavior, my corporate overloads have blocked SF entirely.

    Great job guys.

    All the posturing isn't going to change the fact that projects whose only public repository are SF are now off limits to many.

    *sigh*

  • Nmap violates GPLv2.

    He is actively abusing the license by adding conditions that remove provisions of the GPL such as the "arms length" exception.

    He can do that if he stops using the GPL preamble and rename it to something else, but he hasn't and therefore is as bad as sourceforge.

    They kind of deserve each other.

    He is no better than the jackass running Filezilla.
  • The Nmap project at https://sourceforge.net/projec... [sourceforge.net] appears empty and run by Fyodor. However, there's another Nmap project at https://sourceforge.net/projec... [sourceforge.net] that says clearly "Brought to you by: sf-editor1, sf-editor3".

  • "Infosec professionals do not generally blindly click "install" but actually pay attention to what's going on, and aren't as easy to trick to install secondary offers."

    FTFY.

  • What good did Slashdot editors think it would do to post SourceForge's response in a story like this?

    Nobody here is going to believe the corporate spin from Dice, so why bother posting it at all? I know that Slashdot likes to drive traffic and commentary to their stories by posting inflammatory articles or misleading summaries. However, when the topic actually involves Dice/DHI, getting the user base riled up about it is pretty self-defeating.

    Also, rather than being from the "before-the-weekend" department,

Ocean: A body of water occupying about two-thirds of a world made for man -- who has no gills. -- Ambrose Bierce

Working...