Sourceforge is bundling malware in the GIMP for Windows installer



  • Newer versions of Photoshop have quite a few vector tools.


  • BINNED

    I'm aware of that. Most people actively using it aren't, IME at least.


  • ♿ (Parody)

    @blakeyrat said:

    Yes it is. SourceForge is doing something they're explicitly allowed to do, software creators who explicitly gave them permission to are bitching about it.

    Where in any software license does it state that sourceforge can take over their account and do whatever they want with it?

    EDIT: The problem isn't that someone is releasing software with a license that permits it. The problem is that someone is releasing software in a way designed to trick users as to who is doing the releasing.



  • @boomzilla said:

    Where in any software license does it state that sourceforge can take over their account and do whatever they want with it?

    EDIT: The problem isn't that someone is releasing software with a license that permits it. The problem is that someone is releasing software in a way designed to trick users as to who is doing the releasing.

    Right I get that.

    But these software makers had the power to prevent that from happening. They chose not to.

    So they should stop bitching.


  • ♿ (Parody)

    That's almost funny.

    But stop saying that stuff and then admitting that you're wrong:

    @blakeyrat said:

    Right I get that.

    At least keep trolling the Good Troll.



  • No; the two things are not mutually-exclusive:

    SF is clearly in the wrong here by hijacking accounts. That's a WTF.

    These open source projects that could have prevented this, chose not to, then bitch about it anyway are also a WTF.


  • BINNED

    So where does stuff like CNET installers come into this? They do (or could do) the same shit, even with non-GPL software. And the fact you're downloading their installer instead of the official one is also pretty vaguely hinted at, IIRC.


  • ♿ (Parody)

    @blakeyrat said:

    These open source projects that could have prevented this, chose not to, then bitch about it anyway are also a WTF.

    How could they have done that? I guess they could have deleted their stuff on SF. Or stayed active.

    This was the only reference I could find for "active" on their ToU:

    Slashdot Media reserves the right to mark as “inactive” and archive accounts and/or Content that are inactive for an extended period of time. Slashdot Media reserves the right to change these general practices at any time, in its sole discretion, with notice to users and the public as described above.

    Termination of accounts:

    Slashdot Media may terminate a user’s account in Slashdot Media’s absolute discretion and for any reason. Slashdot Media is especially likely to terminate for reasons that include, but are not limited to, the following: (1) violation of this Agreement; (2) abuse of Site resources or attempt to gain unauthorized entry to the Sites or Site resources; (3) use of a Site in a manner inconsistent with the Purpose; (4) a user’s request for such termination; or (4) as required by law, regulation, court or governing agency order. Slashdot Media’s termination of any user’s access to any or all Sites may be effected without notice and, on such termination, Slashdot Media may immediately deactivate or delete user’s account and/or bar any further access to such files. Slashdot Media shall not be liable to any user or other third party for any termination of that user’s access or account hereunder. In addition, a user’s request for termination will result in deactivation but not necessarily deletion of the account. Slashdot Media reserves the right to delete, or not delete, a user’s account at Slashdot Media’s sole discretion, as well as to delete, or not delete, Content at Slashdot Media’s sole discretion.

    I don't see anywhere in there where they talk about taking ownership of something and then actively releasing.

    @Onyx said:

    So where does stuff like CNET installers come into this?

    A major difference is that you're at CNET, not what you think is an "official" outlet for the project. Though I'm sure a lot of people don't get that.



  • @boomzilla said:

    How could they have done that?

    I ALREADY TOLD YOU I'M NOT REPEATING MYSELF FUCK YOU BOOMZILLA GO MODERATE THE STATUS THREAD WHERE SOME DUMBFUCKS ARE POSTING LIKE 5348276432467326237462 SURVEYS IN A ROW AND IT'S REALLY SPAMMY


  • ♿ (Parody)

    @blakeyrat said:

    I ALREADY TOLD YOU

    No, you just said some wrong stuff. But I'll consider this your apology for being wrong.

    @blakeyrat said:

    FUCK YOU BOOMZILLA

    Apology accepted.


  • BINNED

    @boomzilla said:

    A major difference is that you're at CNET, not what you think is an "official" outlet for the project. Though I'm sure a lot of people don't get that.

    I don't consider SF as such, either. The only reason I'm there is if the project author sends me there.

    But that's beside the point I was making: most of licences don't explicitly forbid wrapping custom installers around your installer. Or so it would seem. GPL or no GPL is not an issue here. SF's behaviour is, be it legal or not.


  • ♿ (Parody)

    @Onyx said:

    But that's beside the point I was making: most of licences don't explicitly forbid wrapping custom installers around your installer.

    Right.

    @Onyx said:

    GPL or no GPL is not an issue here. SF's behaviour is, be it legal or not.

    Yes.


  • ♿ (Parody)

    @Onyx said:

    I don't consider SF as such, either.

    The only thing here is that SF is meant for user content, so you have users who use it to host their stuff. If someone created something on github or bitbucket or whatever and claimed to be GIMP (when they really aren't), and then did this stuff, they'd be the people acting wrongly. That's what SF has done, except with the added deception of taking stuff that was legitimate and making it illegitimate.


  • Discourse touched me in a no-no place

    @CoyneTheDup said:

    See, most of those major projects left SourceForge back in 2013 when it first started bundling

    Shoulda deleted the projects first, not just abandoned them. (or, failing that, push out new 0-byte versions of all the source files.)



  • @FrostCat said:

    (or, failing that, push out new 0-byte versions of all the source files.)

    How would that help?


  • Discourse touched me in a no-no place

    @Magus said:

    How would that help?

    Automated installers would have a tough time producing a viable binary. (IIRC SF can do that; if not, then obviously the next step before departing would've been to build a useless binary. So maybe, then, not 0-byte source files, but make 'em all "hello world" functions.)



  • If they can take control of s source controlled project, I still have a hard time understanding how that would matter?


  • Discourse touched me in a no-no place

    @Magus said:

    If they can take control of s source controlled project, I still have a hard time understanding how that would matter?

    They're not doing anything that I've heard other than wrapping an adware-installing installer around the project file. So if you poison the output before leaving, they'd be producing a bogus file.

    This would require them to either stop doing that for any given project that sabotaged itself, or spend time manually undoing said sabotage. That would tend to provide a disincentive.



  • @Dreikin said:

    Hattings are officialated? I thought people were just trying to class the joint up.

    Yes. That's why there's a Mad Hatter Hijinx thread. Official hattings have my special signature in them somewhere.



  • @Dreikin said:

    More like intermittently present. I missed the Burns thing, too

    That wasn't really here. That was a foray over to hostile territory.



  • @FrostCat said:

    Shoulda deleted the projects first, not just abandoned them. (or, failing that, push out new 0-byte versions of all the source files.)

    It wouldn't matter. The source is available from their new project site (it's GPL) and SourceForge can just download it and build their own. No way to restrict that.



  • Any alternatives that are good compared to dice.com then? I don't really want to support such a scumbag company.



  • But it was discussed prominently in the Likes Thread.



  • @aliceif said:

    But it was discussed prominently in the Likes Thread.

    As one of the Mr. Burns involved, I am aware.



  • I didn't join the Mr. Burns thing because I like my fairy too much.

    But I have an avatar on the ready, just in case.



  • @aliceif said:

    I didn't join the Mr. Burns thing because I like my fairy too much.

    But I have an avatar on the ready, just in case.

    @cipher1 doesn't have a Burnsvatar because he doesn't want to be too closely associated with us. He's enjoying his new avatar though!


  • Discourse touched me in a no-no place

    @CoyneTheDup said:

    It wouldn't matter. The source is available from their new project site (it's GPL) and SourceForge can just download it and build their own. No way to restrict that.

    Of course not. But that would require work. I bet all that's going on is that SF is just taking the latest release (or maybe generating a new version of it if there isn't one) and just wrapping it in their installer. Refreshing from the current version hosted elsewhere? That cuts into the free ad income.

    If there's a popular product, they might do it, but I bet they haven't been.


  • BINNED

    @aliceif said:

    I didn't join the Mr. Burns thing

    As the originator of the idea I am offend!

    </sarcasm>


  • @accalia said:

    photoshop

    Photoshop is becoming..... photoshop.

    It's no longer the generic art program.

    I still have Paint Shop Pro 8.



  • Fine, then ...


  • BINNED

    I shouldn't have put the hidden tag in there ...

    As in, should have escaped the entities...



  • When I forked Alien Swarm Director Mod, I didn't call my fork Alien Swarm Director Mod. Similarly, when Philip Pittle forked Alien Swarm, he didn't call his fork Alien Swarm. Why would you call your fork the same thing as the original if you weren't being malicious?



  • @ben_lubar said:

    Why would you call your fork the same thing as the original if you weren't being malicious?
    Some OSS licenses require that you clearly differentiate your modifications from the original author's work. Seems this might run afoul of that. Maybe. Unless there are trademark rights in the name, that might be best tool the authors have to stop the shenanigans, if the particular license they chose includes that provision.



  • In other news ./ is apparently now censoring posts about this topic.



  • Editor's note: I just got back from a busy weekend to see that a bunch of people are freaking out that we're "burying" this story, so here it is. Go hog wild. Sorry it took so long. (And for future reference, user submissions are easily found in the firehose, listed in the order they appear, newest first.)

    How open source of them. Sure we won't promote the article because it makes our parent company look like douches, but you can view the user-submitted articles at any time!!!!!!!!!!

    IT WAS A BUSY WEEKEND GUYZ!!!!!

    Stupidly, in the comments he posts a much BETTER excuse, "I was waiting for feedback from the team that runs Sourceforge and they haven't gotten back to me yet", but in the story that everybody reads it's "BUSY WEEKEND!"


  • Discourse touched me in a no-no place

    @blakeyrat said:

    IT WAS A BUSY WEEKEND GUYZ!!!!!

    Unless it wasn't:

    Soulskill:
    The main reason it's late is that we were asking some questions internally so we could put up a more informative post on the subject. Unfortunately, communications were slow. Rather than keep waiting, I just put up the most accurate submission we've gotten. (May or may not still happen later.)

    I gave up on Slashdot as a serious site ages ago anyway.


  • FoxDev

    @PJH said:

    Slashdot as a serious site

    It used to be a serious site?



  • Oh yeah. They've always been awful, but at least a year or two ago they were timely. They occasionally even broke stories.

    Now they never discuss anything that hasn't appeared on every other site 3 days previously.



  • Yeah, about... 12 year ago. Or more.


  • ♿ (Parody)

    In the past they would have just posted them all so everyone could yell "Dupe!"


  • Discourse touched me in a no-no place

    Well it was reasonable when I first started using it. (2002 from what I can figure from what's left of the history under my profile.)



  • @accalia said:

    as a replacement for MSPaint. PDN is fantastic

    I just want Paint like it was before I got windows 7. They took away so much of the old functionality and replaced it with bizzarro facsimiles of physical drawing media that I never want to use.

    I get that it's called paint, so why not simulate painting, but I never ever in a million lightyears of time want to do it. I use paint for quick and dirty flipping and cropping and the like, and sometimes for drawing where I want the 'paint look' of flat colours and sharp edges, which I will probably zoom right into and edit pixel-by-pixel. If I want something to look like I actually drew it with physical paints or pencils I would Belgium draw it on Belgium paper. If I was trying to make real digital art, this is not the program I would be using.

    You know what I do these days if I want to tilt a picture? I copy it from Paint into Word, rotate it, and copy it back, because Word has better image manipulation than Paint does now. I get the idea of adding in the fake paints and crayons, even and I vaguely understand the principle behind paring down the conventional paint tools to fit them in. But why on Belgium Earth did they think it was a good idea to slice out the ability to rotate by any number of degrees? They don't even leave 45 degree angles in...



  • I haven't used pre-7 Paint in years, but I don't think you could rotate by arbitrary angles. This seems to indicate that you have to do some tricks to simulate the effect.



  • @hungrier said:

    I haven't used pre-7 Paint in years, but I don't think you could rotate by arbitrary angles.

    Well, I could on my last computer. And skew as well (not that I used that much, but as far as I can tell I can't do it now, should I ever want to). Definitely. That had Vista and was four years old when I finally replaced it almost two years ago, so it's possible it was quite some time ago that they got rid of the feature.



  • Skew is in the resize dialog, same as it always (IIRC) was.


  • FoxDev

    @CarrieVS said:

    They took away so much of the old functionality and replaced it with bizzarro facsimiles of physical drawing media that I never want to use.

    this functionality?


  • FoxDev

    Those may be Win7 screens, but those things exist in Win8.1 as well



  • @hungrier said:

    Skew is in the resize dialog, same as it always (IIRC) was.

    ...Could be you're right. But still, it most definitely had arbitrary rotation. Little box - and I could swear it was on the same page as skew, rather than that being alongside resize - to type the number of degrees.

    @accalia said:

    this functionality?

    No. The other functionality, the stuff that isn't there any more. I got mixed up about skew but I never used that anyway.


  • FoxDev

    @CarrieVS said:

    The other functionality, the stuff that isn't there any more.

    /me tries really hard to think of anything that was possible in XP paint that isn't in Win7/8.1 paint

    sorry, i can't think of anything other than rotate to an arbitrary angle, which i'll be frank, i never used nor did i miss. for anything other than "paste screenshot, crop, draw circle around that bit, add text, copy, paste into JIRA" paint (even winXP paint) was far too painful to use. just install paint.net and rejoice. :-P



  • All I can come up with is the hidden third colour that you could use in the old colour selector.


Log in to reply