Goodbye, Sourceforge

Sourceforge is essentially a gigantic set of Google doorway pages which MITM downloads initiated by unsuspecting (largely non-technical) Internet users of popular free-as-in-beer projects. They&#x27;re open about doing this. <a href="https:&#x2F;&#x2F;sourceforge.net&#x2F;blog&#x2F;gimp-win-project-wasnt-hijacked-just-abandoned&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sourceforge.net&#x2F;blog&#x2F;gimp-win-project-wasnt-hijacked...</a><p>These &quot;mirror&quot; (MITM) pages outrank the authoritative sites for many projects because Sourceforge has been around for 10+ years and has superior trust&#x2F;backlink profiles compared to the newer author-blessed sites which presently host the software. Gimp is actually fortunate in this regard -- gimp.org is stickied to the top spot when searching [gimp] and Sourceforge floats around #8 or so.<p>Sourceforge should get hit with Google&#x27;s standard penalty, which is &quot;we smite your rankings with the hammer of an avenging god.&quot; <i>Minimally</i>, Google should at least tighten up their enforcement of AdWords policies. Their &quot;installers&quot; are per-se violations of the Unwanted Software Policy (<a href="http:&#x2F;&#x2F;www.google.com&#x2F;about&#x2F;company&#x2F;unwanted-software-policy.html?hl=en" rel="nofollow">http:&#x2F;&#x2F;www.google.com&#x2F;about&#x2F;company&#x2F;unwanted-software-policy...</a>).<p>How about it, resident Googlers?

To be honest I can&#x27;t say I have any good memory of Sourceforge. It used to a heavy website with a confusing UI, and never really got better over the years. When Google Code started, I was glad I could move to it, and then GitHub.

If you&#x27;re downloading open source software on Windows, friendly reminder to get it via Chocolatey rather than ever clicking on a download button. Chocolatey has reviewed, silent, direct, crapware free downloads of just about anything you&#x27;d want.<p><a href="https:&#x2F;&#x2F;chocolatey.org&#x2F;packages" rel="nofollow">https:&#x2F;&#x2F;chocolatey.org&#x2F;packages</a>

For a second there, I thought this was an official GitHub page and thought &quot;Wow, those GitHub guys really have balls to attack SF that directly&quot;. But then I realized it is &quot;helb&quot; and not &quot;help&quot; in the URL.

I was shocked the other day when I went to grab FileZilla from SF, and my virus scanner tagged it for malware. I hadn&#x27;t realized it had fallen so far as to bundle crapware. SF used to be my goto site for looking for weird open source stuff. Now I guess I will have to finally take SF off my list goto sites.<p>You either die a hero or live long enough to become the villain.

I find this state of affairs rather tragic. To see what was one of the pioneers of the global open-source movement reduced to such infamy.

I&#x27;ve found that Sourceforge is still the only place you can get a lot of good-but-unmaintained software. I was there just the other week for the Saxon project[1], and it was painful to see how low SF have sunk.<p>I wonder if it would be possible (and legal) for somebody who isn&#x27;t the project owner to copy some of these unmaintained projects into another system?<p>[1] <a href="http:&#x2F;&#x2F;sourceforge.net&#x2F;projects&#x2F;saxon&#x2F;" rel="nofollow">http:&#x2F;&#x2F;sourceforge.net&#x2F;projects&#x2F;saxon&#x2F;</a>

If I were a project manager who run a sourceforge account the last thing I would do now is abandon it.<p>Why? Because SF have proven if I were to do so they&#x27;d take my work under my name and bundle their crap into it. The only way to stop that is to keep it active.<p>That feeling of being trapped into a terrible system because it&#x27;ll screw over people even worse if you leave.

Perhaps it is worth asking the mirror services to put some pressure on as well as the content creators?<p>These are two popular mirrors in the UK &amp; Ireland (both academic institutions):<p><a href="http:&#x2F;&#x2F;www.mirrorservice.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.mirrorservice.org&#x2F;</a> (University of Kent)<p><a href="http:&#x2F;&#x2F;ftp.heanet.ie&#x2F;" rel="nofollow">http:&#x2F;&#x2F;ftp.heanet.ie&#x2F;</a> (Ireland’s National Education and Research Network)

Can Archive.org&#x2F;etc backup all the open source projects from Sourceforge.org and Google Code? It would be a big loss if the unmaintained but often still very useful source code get lost forever.

Well, to be honest, this is exactly where Sourceforge has been headed for years and years. You could look at its behavior years ago and say &quot;Yeah, follow this out on a line&quot; and see this exact situation in the crystal ball. Sourceforge has been scummy (and getting scummier) for years and years.

Author here. Thanks for your pull requests, I added some of the suggested services. Maybe some comparison table (like the one at Wikipedia) would be better than a simple list.<p>About that help&#x2F;helb confusion mentioned here – sorry about that, it&#x27;s not intentional, it&#x27;s just my nickname since 2nd grade or so.

What&#x27;s unsettling about this is that Slashdot also belongs to the same company that turned SF into the crapware distributor that it is now.

I like how you don&#x27;t have an option to shut down your project to help clear those links from Google. Either you keep it up to date or SF will &quot;step in&quot; and do it for you.

It&#x27;s high time that SF lands on malware blocklists.

May be worth noting that GitHub supports SVN as well (<a href="https:&#x2F;&#x2F;help.github.com&#x2F;articles&#x2F;support-for-subversion-clients&#x2F;" rel="nofollow">https:&#x2F;&#x2F;help.github.com&#x2F;articles&#x2F;support-for-subversion-clie...</a>), I believe some of the others do as well IIRC.<p>May be important to some legacy projects trying to get off of SF.

I still have a project hosted on Sourceforge (<a href="http:&#x2F;&#x2F;sourceforge.net&#x2F;projects&#x2F;pinyinput&#x2F;" rel="nofollow">http:&#x2F;&#x2F;sourceforge.net&#x2F;projects&#x2F;pinyinput&#x2F;</a>).<p>They haven&#x27;t injected their own installer on downloads so for the time being I leave it there because I&#x27;m too lazy to move it off.<p>A while back I did move the main project page to its own domain, so I&#x27;m only really using Sourceforge for downloads and source control (although the project is stable and hasn&#x27;t had commits for a long time so not even that really).

So i changed the service list into a simple table. Also, Gitlab providers are listed separately. Any ideas for a domain name? :)

Ah the old days when Sourceforge and Freshmeat were some of the go to places for OSS when I was learning Linux in the 90s. Occasionally I&#x27;ll end up back at SF somehow and man how terrible it has become. Makes you really appreciate places like Github now a days.

GitHub has been the go-to online source control for so long, I&#x27;m sure no one will miss SF.

Whenever I&#x27;ve had to go to a sourceforge page to download software I always think, ugh I have to deal with this crap again? (UI, annoying redirects, can&#x27;t find correct versions, etc) I honestly never understood why developers used the website for distributing binaries, I understand code hosting, but not the distribution (this was before they hijacked stuff).<p>Hopefully, this will hit a chord with enough projects that they will altogether stop using sourceforge.

Guilt by association? Perhaps SF is not the true source of badness&#x2F;malware but instead they tend to host the projects most likely to include such malware.

I like that they open-sourced their engine. <a href="https:&#x2F;&#x2F;allura.apache.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;allura.apache.org&#x2F;</a>

I still land on SF now and then, to download sources that are hosted there. But that only happens because another site&#x27;s “Download” button sent me there. In the beginning I was very impressed with SF. But as others have said, the UI is rather confusing and those ads they&#x27;ve been showing would devalue any site they run on to “lower-tier crap you need rubber gloves for”. A sad development.

Someone posted it to Reddit, discussion here: <a href="http:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;37pz5x&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;programming&#x2F;comments&#x2F;37pz5x&#x2F;</a>

I&#x27;m really surprised at how many people in this thread are Windows users frankly. I just presumed that most YC commenters were OS X&#x2F;Linux people with a few FreeBSD, etc.. OSes floating around.

What about mailing lists?

Maybe GitHub should start mirroring Sourceforge projects :)

&gt;&gt; SourceForge, once a trustworthy source code hosting site...<p>No, SourceForge was always sleazy.