SourceForge and GIMP [Updated] 384
New submitter tresf writes: In response to a Google+ post from the Gimp project claiming that "[Sourceforge] is now distributing an ads-enabled installer of GIMP," Sourceforge had this response: "In cases where a project is no longer actively being maintained, SourceForge has in some cases established a mirror of releases that are hosted elsewhere. This was done for GIMP-Win.
Submitter's note: Gimp is actively being maintained and the definition of "mirror" is quite misleading here as a modified binary is no longer a verbatim copy. Download statistics for Gimp on Windows show SourceForge as offering over 1,000 downloads per day of the Gimp software.
In an official response to this incident, the official Gimp project team reminds users to use official download methods. Slashdotters may remember the last time news like this surfaced (2013) when the Gimp team decided to move downloads from SourceForge to their own FTP service. "Therefore, we remind you again that GIMP only provides builds for Windows via its official Downloads page." Note: SourceForge and Slashdot share a corporate parent. Editor's note: I just got back from a busy weekend to see that a bunch of people are freaking out that we're "burying" this story, so here it is. Go hog wild. Sorry it took so long. (And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)
Update: 06/01 22:37 GMT by T : The SourceForge blog has a welcome update; SourceForge, it says, has effective today "stopped presenting third party offers for unmaintained SourceForge projects. ... At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers."
Submitter's note: Gimp is actively being maintained and the definition of "mirror" is quite misleading here as a modified binary is no longer a verbatim copy. Download statistics for Gimp on Windows show SourceForge as offering over 1,000 downloads per day of the Gimp software.
In an official response to this incident, the official Gimp project team reminds users to use official download methods. Slashdotters may remember the last time news like this surfaced (2013) when the Gimp team decided to move downloads from SourceForge to their own FTP service. "Therefore, we remind you again that GIMP only provides builds for Windows via its official Downloads page." Note: SourceForge and Slashdot share a corporate parent. Editor's note: I just got back from a busy weekend to see that a bunch of people are freaking out that we're "burying" this story, so here it is. Go hog wild. Sorry it took so long. (And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)
Update: 06/01 22:37 GMT by T : The SourceForge blog has a welcome update; SourceForge, it says, has effective today "stopped presenting third party offers for unmaintained SourceForge projects. ... At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers."
Took long enough for you to post this Slashdot (Score:5, Informative)
I remember seeing a submission on this early last week.
Re:Took long enough for you to post this Slashdot (Score:5, Insightful)
I am also pleased that they've finally posted it, but still seriously miffed that it took this long.
Seems to Be a Pattern of Behavior (Score:5, Interesting)
Wonder if they'll ever drop the anti-Gamergate narrative too (probably not, since they have most of the tech media circling wagons with them on the pro-corruption side)?
Re:Seems to Be a Pattern of Behavior (Score:5, Insightful)
It's just the Nth 'eternal September'.
It's also happening to Little Registry Cleaner [sourceforge.net]. If you don't read every dialog box very, very carefully you end up with crapware (look at the reviews [sourceforge.net]).
The tail end of GenX/Initial GenYs that originally ran Slashdot have moved on with their lives. They sold out (no problem with that, I would have too). Dice put a bunch of kids that grew up on Reddit in charge so you see Slashdot trying to mirror Reddit's content, 'messege', tone & look and it's showing to old hat /.ers.
If anyone is bored and looking for a place to lure my 30s year old self. Redo slashdot, allow markdown, bbedit, html, LaTeX.. editing. Keep the -2 to +5 moderation system because it limits band-wagoning and group think. Now that everyone can have an opinion it shows. I used to revel in the days that little 19 year old me was bestowed with 5 points to vote with (and tried to ration them accordingly).
Design a proper responsive layout (It was not Beta) and keep it about tech
I'm looking for a good place to discuss stuff that is relevant to me like Slashdot used to be. Reddit is good for certain things. Long drawn out posts with actual information isn't one of them. Everyone wants a tl;dr:.
[And this message took longer to type than one in Markdown because HTML is pretty slow now that I use markdown for everything, blog and all. Not that I don't know but ** is easier, ~~~~, ]
Re:Seems to Be a Pattern of Behavior (Score:5, Informative)
If anyone is bored and looking for a place to lure my 30s year old self. Redo slashdot, allow markdown, bbedit, html, LaTeX.. editing.
If this is where your interests are, Soylent [soylentnews.com] has forked an re-opened Slash, so people can contribute to it. There's been tremendous cleanup/ and some refactoring, to make Slash a more sane/maintainable project.
They're very picky on submissions, though, so the variety and community aspects aren't what Slashdot is.
Re:Seems to Be a Pattern of Behavior (Score:5, Informative)
I think you dropped this: .org
soylentnews.org [soylentnews.org]
Re: (Score:3)
Re:Seems to Be a Pattern of Behavior (Score:5, Insightful)
The adware bundling is also happening with Filezilla [wikipedia.org] now too. I recently downloaded the FTP program to my computer at work and it set off a bunch of virus alerts with our system engineers. It was very embarrassing, but the engineers said they fell for it too.
The worst part is that there is no opt-out option in the installation process. By downloading the version of the package with the adware, you are agreeing to install the viruses. I eventually found a clean install of Filezilla on Sourceforge, but it's not obvious.
Google needs to flag Sourceforge as a malware site for these shenanigans.
Re:Seems to Be a Pattern of Behavior (Score:4, Interesting)
Re: (Score:3, Insightful)
Yeah, but I didn't agree to anything.
Re:Seems to Be a Pattern of Behavior (Score:5, Informative)
For the record, the FileZilla developers actually opted-in to this [filezilla-project.org], several years ago, in some kind of revenue-sharing program with Sourceforge.
What is new is that SF now does it with "abandoned" projects without the owners' consent too.
Re:Seems to Be a Pattern of Behavior (Score:5, Interesting)
Have you heard of http://ninite.com/ [ninite.com]?
You can install Filezilla directly from them without the bundled malware and other shenanigans.
Their installer does take away choice so software will install to the default location. But it skips desktop shortcuts, bundled toolbars, and other crap I don't want.
They work especially well when you are setting up a new PC, you simply select what you want to install and it will automatically install the latest versions of everything without you needing to track down individual installers or prompting you during installation.
Re: (Score:3)
I've taken a look at Slashdot's homepage with no adblock or anything - completely filled with flashing banner ads, video ads for cosmetics, clickbait links from Taboola, etc.
Are you comparing 1999 Slashdot to 2015 Reddit or 2015 Slashdot to 2015 Reddit?
Slashdot even used to reward you for not making shit posts. There was a simple checkbox to turn all of that off if you had enough Karma. They actually valued your posts so much to drive people to /. that they allowed you to turn off all ads.
I used to hate that I never knew what my Karma was. But now I'm glad I didn't. It just turns people into narcissists as they try and go for more link and post karma. "Excellent" is all I neede
Re:Seems to Be a Pattern of Behavior (Score:5, Informative)
They still let you turn off all ads if you have sufficient karma.
Re: (Score:3)
Yes, the checkbox is still there. But it doesn't do anymore what it says it should do. For a while it did, but not anymore.
And the Slashdot mobile site is even worse, with non-dismissable pop-over boxes that take up to 25% of the screen.
Re: (Score:3)
>> I've taken a look at Slashdot's homepage with no adblock or anything
Who would want to surf the net without adblock ?
Re: (Score:3)
>> I've taken a look at Slashdot's homepage with no adblock or anything
Who would want to surf the net without adblock ?
Well, people at work who aren't allowed to install add-ons or alternative browsers, for one.
Re: (Score:3)
And when all you're doing is trying to communicate a few ideas with links. I shouldn't have to remember the full HREF specification to link out or ul,ol,li to make a list. For short terse online discussion it's a perfectly cromulent language.
Re: (Score:2)
Re:Seems to Be a Pattern of Behavior (Score:4, Insightful)
Look at the amount of pushback it took to defeat Beta and Bennet Hasselton.
I was actually quite surprised at how responsive the owners have been on those two issues. They clearly invested a lot of money and time into beta, and I dread to think what kind of favours Bennet was offering, but in the end they listened to us. I really didn't think it would happen, I expected beta to become the only option and my beloved (in an abusive partner kind of way) Slashdot die a slow and painful death.
So kudos for listening. And yeah, I can buy the weekend excuse. Come on, this is Slashdot, the "editors" seem barely literate at times and can't remember posting the same story a mere 24 hours previously. Never attribute to malice what can be adequately explained by incompetence.
Re: (Score:3)
So kudos for listening.
They didn't listen. They were ground into submission by an angry mob who were wreaking the very project they were defending. I mean this in a good way. It was a high-impact revolt that was sure to get noticed and forced the hand of the site owners by making it very clear that a) the existing customers cared little for their shit, and b) that new potential customers ended up at a news aggregating site where all comments are filled with hate for the very site they were on.
It's not kudos for listening. Just be
Re:Seems to Be a Pattern of Behavior (Score:5, Funny)
Bennet Hasselton article shows up only if someone mentions Bennet Hasselton three times in a single post.
Re:Seems to Be a Pattern of Behavior (Score:5, Funny)
>>>Bennet Hasselton cannot be defeated. He's merely resting. Bennet Hasselton article shows up only if someone mentions Bennet Hasselton three times in a single post.
You bastard!
Aaargh! you made me do it too!
Re:Seems to Be a Pattern of Behavior (Score:5, Funny)
In his house at R'lyeh, dead Bennet Hasselton waits dreaming.
Re: (Score:2)
I saw several submissions, and frankly, not one of them was decent journalism. I voted them down.
Copying a juicy bit from the article and saying "Link to original source" is not a summary.
Re: (Score:3, Insightful)
Decent journalism? You know you're on slashdot, right?
dupe or new info? (Score:2)
I remember seeing pretty much this same story last week on slashdot!?
is it an update to the story or is it a dupe?
Re:dupe or new info? (Score:5, Informative)
Dice handled this case really bad (Score:3)
What was the problem? Was it the bandwidth costs? AFAIK most of the files you can download from SourceForge are actually not served by SourceForge itself but by mirrors. So those guys are shouldering the brunt of the costs not you. By doing something like this I would not be surprised if some of the mirrors decided they do not want to work with you anymore.
If you wanted the extra revenue by bundling ads with applications you should have done this explicitly with a prior public notification of this being don
Re:Took long enough for you to post this Slashdot (Score:4, Informative)
And his weekends start on Wednesday [slashdot.org].
Re:Took long enough for you to post this Slashdot (Score:5, Funny)
I suspect Timothy just loads stuff on cron at the start of the weekend and takes off fishing, or something.
I actually think that someone loads "Timmy" up on cron at the start of the weekend and takes off fishing.
Re:stopped using sourfeforge after filezilla (Score:5, Informative)
Not only do they bundle it with adware, but they've apparently sabotaged GIMP too - for example, they apparently changed the save dialog so that you can only save XCF files and have to click through a "you have unsaved changes" warning when you export to a different format. They added an very difficult to precisely adjust sliders to things like brush size. They took out 16 bit color support. Basically, sourceforge has really totalled GIMP. ;)
Re: (Score:3)
You mean they've gimped GIMP?
Compare editing a CSV with a spreadsheet (Score:3)
they've apparently sabotaged GIMP too - for example, they apparently changed the save dialog so that you can only save XCF files and have to click through a "you have unsaved changes" warning when you export to a different format.
Is that any different from how Microsoft Excel, LibreOffice Calc, or Gnumeric prompts to save a spreadsheet in native format even if you've already exported it to CSV? Or how Microsoft Word, LibreOffice Writer, or AbiWord prompts to save a document in native format even if you've already exported it to plain text or RTF? Most formats other than XCF do not support layers, and if your document has layers, flattening them to save would lose data.
Re: (Score:3)
What are you talking about? I just did "echo 1,2 > test.csv" then opened test.csv in OpenOffice Calc, then saved it as test2.csv from the save dialog. No complaints. Then I clicked to close it. No complaints about unsaved changes. Did you actually try that out before you commented? I don't have any of the other programs you mention on this computer, so I'll pick another - let's try OpenOffice Writer. Made a text file, opened it, saved it as a .txt file, it asked me for the encoding, I confirmed it, I cl
Re: (Score:3)
Actually, it was the GIMP team themselves broke saving in 2.8. (If they've since fixed it, then sourceforge probably just doesn't have the updates).
Their GNOME-like "reasoning" was that "professional" users wanted to save in XCF, and that amateurs should just use something else. It rang pretty hollow when the gold-standard Photoshop didn't behave the same way.
What will they do next? (Score:4, Funny)
Interfere with slashdot posts?
*** BUY ACME SPEARMINT ***
Re: (Score:2)
This post brought to you by Carl's Jr.
Not ignoring the story is a good start! (Score:5, Interesting)
Re:Not ignoring the story is a good start! (Score:5, Interesting)
Additionally, offering such a weak*) excuse for sitting on this story (apparently) for a week actually rings all my alarm bells. Please slashdot editors, explicitly deny (or confirm) there has been any kind of pressure influencing your treatment of this topic.
*) Weak to react to it cynically, dismissively, the editor just had a busy weekend, and how dare the readers ever even imagine there might be some sort of hesitation on your part for not publishing this article promptly. After all, it's only a very grave accusation to a service run by the same company for the same audience.
Re:Not ignoring the story is a good start! (Score:4, Informative)
There's been no pressure influencing my treatment of this topic.
The main reason it's late is that we were asking some questions internally so we could put up a more informative post on the subject. Unfortunately, communications were slow. Rather than keep waiting, I just put up the most accurate submission we've gotten. (May or may not still happen later.)
Re:Not ignoring the story is a good start! (Score:5, Insightful)
Then why the hell did you blame a busy weekend to start? Smells like BS to me.
Re: (Score:3)
^^ THIS
Re: (Score:3, Insightful)
Your statement here appears to conflict with your edit in TFS. Both of which look like excuses rather than genuine reasons. As such the damage IS done. You are going to need to be 100% transparent even to start recovering from this debacle.
Re: (Score:2)
People are going to look for reasons to be mad, no matter what I do. They're entitled to that. I'm just doing what I can to make the situation right.
Re: (Score:2)
And I am pointing out that posting two mutually exclusive reasons for why this particular story was not posted until today is a major fuck up. But continually repeating them (without acknowledging that it is a fuck up) just adds to the fucked upness of the whole situation.
Re:Not ignoring the story is a good start! (Score:5, Informative)
I acknowledge that this was a fuck up. As I said in my note on the story, I'm sorry it took so long for this post to go up.
Enough is enough (Score:4, Insightful)
OzPeter,
Soulskill has apologized. Repeatedly, and professionally. Accept it and move on.
Re: (Score:3, Insightful)
These people are mad, convinced that you are acting against their interests, and are ignoring any evidence which supports a kinder or more reasonable interpretation of your motivations.
Here's my take: The editors saw a story with claims relevant to their own area of expertise. They decided to do some digging before publishing a story with potentially false or incomplete data. The public outcry convinced Soulskill to publish the best of the unverified stories rather than waiting for the analysis to complete.
Re:Not ignoring the story is a good start! (Score:4, Informative)
Your statement clearly conflicts with screencaps many have of the firehose, where almost EVERY SINGLE STORY regarding this was removed despite comments and being RED status.
Would you care to try again, SoulSkill? You seem to forget how easily the internet can keep track of what you do and when.
Re:Not ignoring the story is a good start! (Score:4, Informative)
I see several that I voted up totally removed (the tell-tale 'imprinting' of the bar when you vote being the giveaway.)
Every story I see back through Wednesday is one I hadn't voted on.
Re: (Score:3)
so which is it? Long weekend, or gathering more information?
Clearly these are mutually exclusive, and so it is a CONSPIRACY.
Re: (Score:3)
I don't take my work phone with me when I go hunting.
Re: (Score:3)
Re: (Score:2)
You must be new here.
Re:Not ignoring the story is a good start! (Score:5, Informative)
Have you been to Arstechnica, Phoronix, and The Register? Browse their headlines and you'll see a 12-24 hour preview of what's going to show up on /.
Re: (Score:2)
Then it sounds to me that we have a case of the "left hand" not having a clue what the "right hand" is doing.. vis a vis the Dice/Slashdot crew and the Dice/ Sourceforge crew... Is that about it??
Re: (Score:2)
I suppose you could put it that way. Slashdot and SourceForge have been under the same roof for a long time, but they've always been separate entities. I have no interaction with the SourceForge folks on a daily basis.
Re:Not ignoring the story is a good start! (Score:5, Insightful)
Offering a great product for free should be good enough to drive the traffic and ad revenue that SF needs. Taking a sh** on these great projects does nothing but alienate SF from the very community that helped it gain notoriety in the first place. Sure this is old news, but 1,000 malware installations a day aren't old news. 1,000 malware installations a day should be criminal.
Coincidentally -- the day after posting this article -- a colleague of mine made a similar mistake of installing OpenOffice from a high-ranking search result and is now dealing with the consequences. Long term, I'm not sure how we fix these bait-and-switch problems, but @Soulskill getting the word out is a good start.
On a personal note... I manage the downloads for a QT-based project known as LMMS [lmms.io] and we too feared the day that our installers would be compromized. In anticipation of this, LMMS has moved everything off of SF hosting. This took almost a year as it included forums, downloads, bug tracker, et al. We we very fortunate to get corporate sponsoring [networkredux.com], but not all projects have success in this regard.
On a personal-side-note, I'd like to add that I've been happy enough with the services over at GitHub that I've chosen them for some of non-free projects (private, paid repositories). Is this not how revenue **should** be generated? Should the exchange of good, honest services for cash not be the norm? Should preying on the innocent and invading privacy, installing viruses for those that would least suspect it NOT be ostracized? SF has become a predator against the unsuspecting.
PR Rule: Always disclose a conflict of interest (Score:3)
Re:Not ignoring the story is a good start! (Score:5, Funny)
/. being slower than everyone else to report on a story.
That is suspicious.
Absolutely unacceptable behaviour (Score:5, Insightful)
Re: (Score:3, Insightful)
This is why nobody uses sourceforge anymore. Years old versions of projects or look alikes of projects distributing malware.
So yeah...use anything BUT sourceforge. Hell put it in your hosts file as going to 127.0.0.1, apk would approve.
Re:Absolutely unacceptable behaviour (Score:5, Insightful)
Cnet irreparably destroyed the reputation of both download.com and the cnet brand.
Sourceforge's brand is probably damaged to a similar level for me.
I'm about ready to DNS blackhole sourceforge because it cannot be trusted at all anymore. 10 years ago, it was my go-to site.
Re: (Score:3, Informative)
RIP SourceForge. You died dishonourably.
Re:Absolutely unacceptable behaviour (Score:4, Insightful)
I'd piss on the grave, but why waste good piss?
WARNING: WOT still flags SF as "Trusted" (Score:3)
This behavior should get SourceForge blacklisted as both cyber-squatters and adware, possibly malware vendor.
I agree 100%. 10 years ago sourceforge was a great site. Now it's basically a malware haven. Unfortunately, plugins like Web of Trust (WoT) seem to have been slow to catch up ... WoT is still marking sourceforge as green ("trusted"). Perhaps blackholing the site in DNS really is the best answer...
Thanks DICE! (Score:2, Informative)
Glad to see DICE holding strong on their scumware downloaders.
I don't buy the /. editors' explanation. (Score:5, Insightful)
I don't buy the /. editors' explanation.
This story has been repeatedly submitted since at least late Wednesday [slashdot.org] and has [slashdot.org] been [slashdot.org] voted [slashdot.org] to [slashdot.org] red [slashdot.org] multiple times in the firehose.
Meanwhile, most other red stories have already appeared on the front page, so clearly some editors were still around...
Re:I don't buy the /. editors' explanation. (Score:4, Funny)
Maybe it's time to start emailing some advertisers to expose corruption in Tech journalism?
For future reference (Score:4, Insightful)
(And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)
Just curious here. Does voting a submission up or down have any effect on whether it's accepted? It seems some stories appear on the front page as soon as they're submitted, others languish for days. Gives the impression the editors are selecting stories based on some agenda other than what slashdot readers want to see.
Re:For future reference (Score:5, Interesting)
When we select submissions, voting is the strongest factor, but it's not the only factor — timeliness, factual accuracy, the degree to which it's on topic, and several other characteristics all factor in. For example, we're not going to run a 5-year-old story no matter how many people vote it up, nor a story about the sun being made of freshly chopped artichoke hearts.
Re:For future reference (Score:5, Insightful)
And they won't run a story critical of Dice until they persuade the corporate overlords that it's too late to stop it.
Re: (Score:3)
Yeah, because this is untimely, facturally inaccurate, five years old, and equivalent to a story about the sun being made of freshly chopped artichoke hearts? Meanwhile things like this [slashdot.org] and this [slashdot.org] are timely wellsprings of useful information?
And care to respond to the people mocking your "busy weekend" excuse, given that your weekend appears to be five days long and your "the main reason it's late" post which gives an entirely different reason for the delay?
Re:For future reference (Score:5, Interesting)
First, thanks for coming on the thread to answer questions.
Out of interest, what is the criteria for the editorial staff putting together a post. Most of the front page stories are more or less exactly as the submitter submitted them. Under what circumstances do you generally exercise this kind of editorial control?
Re: (Score:2, Flamebait)
Well this is a fucking joke. All of those submissions were factually accurate and timely. They weren't about artichokes and they weren't five years old.
It is pretty clear that this was buried intentionally. The excuse that you wanted to wait to discuss internally and provide more information is stupid. STUPID. You've done nothing of the sort and there were submissions prior to this were acceptable by the criteria you've outlined.
Admit it. This was buried. Someone was scared or coerced.
Re: (Score:3, Insightful)
timeliness, factual accuracy, the degree to which it's on topic, and several other characteristics all factor in.
Factual accuracy and degree on topic hasn't stopped Slashdot from trying to shoehorn a SJW narrative in or other stuff that would have never been relevant on slashdot a decade ago.
This isn't Reddit, quit trying to shove what ever narrative Dice is pushing and leave it about tech. You're certainly not going to lure any teens and 20 somethings to Slashdot and all you're doing is pissing off all the Slashdotters here that would stay if it wasn't for shit like this.
Don't you feel any shame? (Score:4, Insightful)
Any at all for being so closely affiliated with a company distributing adware and using deceptive practices riding on the backs of open source?
My experiences with SourceForge (Score:5, Informative)
2) I call bullshit on SourceForge's assertion that their adware only comes with projects that aren't actively maintained. There have been a lot of complaints about FileZilla downloads (see, for example, https://forum.filezilla-projec... [filezilla-project.org]), and it is definitely a very active project.
Re:My experiences with SourceForge (Score:4, Informative)
2) I call bullshit on SourceForge's assertion that their adware only comes with projects that aren't actively maintained. There have been a lot of complaints about FileZilla downloads
FileZilla developers actually opted-in to this [filezilla-project.org] though.
That is not the case with GIMP.
People Still Use Sourceforge? (Score:4, Interesting)
SubjectsSuck (Score:5, Interesting)
The original announcement [sourceforge.net] for when Sourceforge added the "feature" of injecting malware into installers said that the money earned would be shared with the developers. So I have to wonder: did they send the GIMP a check? Have the GIMP developers demanded that Sourceforge do so?
On the assumption that Sourceforge did not, it seems like they've just burned a bridge that they shouldn't have. They killed any trust that users would have had for SF projects a long time ago, but developers who were willing to sell out have stuck around. But now that developers know that SF is willing to just assume control of a project (and the associated profits), why would any developer continue to use SF.
Trust (Score:5, Insightful)
I blanked my Mac a few weeks ago and when I started reinstalling software I got some survey crap popping up on my screen asking for my details. Turns out it was the SourceForge installer for FileZilla that had sneaked it through. Googling it threw up enough horror stories to make me just blank the Mac again and start over. I'll never download anything from SourceForge again. A decade of trust destroyed in one stupid move.
Check out FileZilla and how they handle it (Score:3)
This one is voluntary though. I even got the crapwere when I denied the install.
https://forum.filezilla-projec... [filezilla-project.org]
This whole thing is a lie. Lawsuit Info In Post (Score:5, Informative)
http://danluu.com/slashdot-sou... [danluu.com]
SF claims the project was abandoned in 2013.
To quote another user from Ars:
"the files page has the folder GIMP + GTK+ (stable release) with a last modified time of 2014-11-18. In that, GIMP 2.8.14 is the latest with the 2014-11-18 modification date. The previous file, GIMP 2.8.10 has a modification date of 2014-05-29. (This is just shy of 6 months.) The one before that, GIMP 2.8.8 is also last modified 2014-05-29, and the one before that is GIMP 2.8.6 last modified on 2013-06-24. (This one is just shy of 11 months back.)
So the project was abandoned, but a year later, it's still updating files. And it had three releases in the year after it was supposedly abandoned. The last release was just a few days over 6 months ago, and the project has a history of up to 11 months between releases. How does that qualify as "abandoned"?
No, this is a bullshit excuse Sourceforge was hoping no one would delve into the details to call their bullshit on. There is no other way to put it than they flat-out lied about the abandonment."
Oh, and to boot - According to the gimp-win developer, they locked him out of his account.
That's right, SourceForge STOLE THE ACCOUNT using an account called SF-editor1 in order to wrap one of the most popular FOSS projects with a malware installer.
So here's what we do, guys. I've got a really good attorney. Same one that helped me kick EA's ass back in the Spore lawsuit days.
We band together, we find every person that has had this malware pushed on them, and we sue the ever-living shit out of SourceForge in a class-action suit where accepting a settlement is NOT AN OPTION. Knowingly distributing malware, using misleading language to get the malware to install, and the damage the malware does to the user's computer are all entirely actionable in court and we need to band together to put a legal end to this crap once and for all. We now have the evidence in the testimony of the former account holder, we have copies of the malware, we have copies of the installer, we have screencapped evidence of the lies SourceForge has posted. SourceForge is DEAD IN COURT.
Look up Mark Punzalan Law. Let him know Alex from the Spore/EA case sent you.
If you want, I can come forth as class representative again. I will be more than happy to be the headman ripping these people apart in court.
I might get burned for this, but here goes... (Score:5, Insightful)
Saying you had a "very busy weekend", to my eyes, feels just like a euphemism for "management argued a lot before this got posted, and when it did get posted, the expression modified binary had to replace bundled with malware".
Personal Note: "bundled with malware" is what every other place I read the article used to define it.
Personal Note 2: If I happened to stumble on some facts, I want to stress I understand them completely as I also happen to have a very policy-centered full time job. I'm just letting my thoughts fly in a comment, because, well, comment section is still community moderated in full that I know, thus still being free (in the extreme, FSF-like sense of the word "free").
Re:Douch move for sure on SF (Score:5, Insightful)
Aren't we all smart enough to turn off the adware during install? I even know some old people who turn off "add-ons" that they don't need.
Well, given that adware 'offers' still get injected into installers, I'm going to use my incredible mental thinking skills to hypothesize "no, we aren't".
Aside from that, even if you don't get hit by the adware, having to defang an installer just to use a program leaves the indistinguishable taste of pure sleaze in your mouth for the rest of the process(looking at you, Oracle and the Ask.com toolbar...)
Sourceforge is dragging the GIMP project's name through the mud by bundling this shit, even if they don't hit anyone. That alone is more than enough to be displeased by.
Re:Douch move for sure on SF (Score:5, Insightful)
Hard to believe that Sourceforge was once a fairly reputable place to download software from. Seems like a millions years ago now.
Re:Douch move for sure on SF (Score:5, Informative)
For those who still use Windows and want GIMP (and a LOT of other opensource and freeware Windows programs) you can't beat Ninite.. https://ninite.com/ [ninite.com] Ninite does all of the work to make sure you only get the desired opensource program and NONE of the crapware/malware garbage that so many installers are adding on today.. (Yes, I'm looking at YOU, Oracle... You and your fuckin' Ask toolbar on Java installs)... Thankfully I've switched completely to Linux and don't have to worry about that crap...
Re:Douch move for sure on SF (Score:4, Insightful)
Aren't we all smart enough to turn off the adware during install?
No -- most people just keep clicking "OK" until the install is finished. Just like most people keep signing pages or initialing forms when presented with a bunch of paperwork... they stop reading the details.
The number of people who actually stop and read everything they sign is similar to the number that consider all the options during install scripts -- and that number is VERY SMALL.
(Small anecdote -- quite a few years ago I signed the rental agreement for my first apartment. I was told to initial each of the 10 pages or so and sign the final page. I stopped and read the thing before doing so. My landlord -- who managed something like 40 apartments and had been doing so for a couple decades -- said he could only recall one other person who read the whole rental agreement before signing. And I actually discovered some really interesting rental policies while doing so.)
Also, more on point -- there's the rather obvious evidence that companies wouldn't bother bundling adware if no one ever installed it.
I even know some old people who turn off "add-ons" that they don't need.
And I even know many young people who don't seem to pay any attention while installing and end up with all sorts of weird "add-ons" and don't know how they got there. What's your point?
Re:Douch move for sure on SF (Score:5, Interesting)
Do you even have an experience with such malware ridden installers?
The creators abuse every possible linguistic trick on the book to confuse the user about what s/he had selected and what is going to be installed. Sometimes even blatantly lying and claiming that something will not work properly if you choose not to install the optional "performance enhancer".
I had to deal once with such installer for a freebie game, which was bundled with 5(?) pieces of malware. Luckily for me it was an InstallShield which was showing a summary screen of what is going to be installed before doing anything. I had to go through the install wizard three times before the summary screen was showing that only the game itself would be installed. The last one was the trickiest: in description they used effectively triple negative and user had to actually check the box to not to install the malware.
Re: (Score:2, Insightful)
If it hadn't been for that moron, today's /. submission would've probably not been posted.
Re:So? (Score:5, Informative)
It used to be a respected site where open-source developers could host their binaries without fear of someone tampering with it.
Re: (Score:2)
This is news because Sourceforge used to be trustworthy. It used to be a respected site where open-source developers could host their binaries without fear of someone tampering with it.
Yeah, I know. USED to be. Seriously guys, they've been doing stuff like this since 2013. I remember telling it to everyone back then, but was only met with dismissal. Why is everyone so outraged now? Here, here's [sourceforge.net] a blog post from that period where they started it. Did nobody keep up with what was going on? Did nobody use Sourceforge at all in that time period?
I know I sound incredulous, but it's because I am. I've known about this for years, yet nobody cared at all. I don't know why GIMP is a special sn
Re: (Score:2)
As much fun as it is for the conspiracy theorists here to presume Slashdot is some tyrannical overlord, I figured there was a different reason for not posting it
ITYM Dice, not slashdot, who also holds Sourceforge. Anyway, it was all over the tech news and all over the firehose. This story is very belated. Now, sure, soulskill may have been away, but it's not like no new stories were put on the front page in the intervening time.
It's hardly paranoia that a company attempts to control its image on the "proper
Re:So? (Score:5, Interesting)
Re: (Score:3)
The GIMP is GPL'd so they can make derivative works all they like so long as they're also GPL'd. Mere aggregation (i.e. putting some other crap plus gimp in the same installer) doesn't make the other aggregated things have to fall under the GPL, as is specified in the license.
Re:So? (Score:5, Interesting)
Re: (Score:3)
(cough) Ninite (cough) .... The ONLY way to get GIMP and a LOT of other good stuff freeware/opensource programs for Windows.. Back when I still used Windows, I wouldn't be without it...
Re: Haven't they been doing this for months alread (Score:2)
It is particularly an issue with The GIMP because it is an open-source gateway program. GIMP is the first open-source software that some people directly experience. I know artists who use it and it's their first contact with the open source community. Sure, they use a lot of OS software without knowing, but this is a highly visible individual program.
Lots of geeks suggest The GIMP to their friends who are otherwise pirating Photoshop or languishing in MS Paint. It's just not a good thing for them to end up