SourceForge has sworn off its ways of wrapping "unmaintained" code from open source projects in installers that offer bundled commercial products in the wake of objections raised by some open source communities. But one policy remains in effect—the takeover of project pages SourceForge's staff decides are inactive, and assignment of ownership of those projects to staff accounts. One of the latest projects grabbed in this way is the Nmap security auditing tool.
The practice of reassigning ownership was broadly exposed by SourceForge's takeover of the project page for the Windows version of the GIMP image manipulation tool. While SourceForge staff claimed in a blog post that the project's account had been abandoned, an official statement from the GIMP development team denied that SourceForge had contacted them about the account, saying that no permission had been given to SourceForge to take over maintenance of the project.
Something similar happened to Nmap, as its developer Gordon Lyon reported in an e-mail message to the project's mailing list today. "The bad news is that Sourceforge has also hijacked the Nmap account from me," Lyon, known as "Fyodor" in Internet discussions, wrote. "The old Nmap project page is now blank. Meanwhile they have moved all the Nmap content to their new page which only they control. So far they seem to be providing just the official Nmap files (as long as you don't click on the fake download buttons) and we haven't caught them trojaning Nmap the way they did with GIMP. But we certainly don't trust them one bit! "
Lyon urged Nmap users to only download the tool from Nmap's official web page to ensure their security. "We will ask Sourceforge to remove the hijacked Nmap page, but more importantly we want to reiterate that you should only download Nmap from our official SSL Nmap site," he wrote. "If you don't trust SSL by itself (and we don't blame you), you can also check the GPG signatures."
Update:
Ludovic Fauvet, founder and CTO of Videolabs SAS. Developer of VLC media player, said in a blog post yesterday that SourceForge similarly took over the VLC project's account on SourceForge. VLC was, in 2012, the most downloaded project on SourceForge, and still remains among its top projects even though the project moved to its own download infrastructure two years ago. That happened, because as Fauvet wrote, "in 2012 Geeknet started to add more banners to their pages and did not bother filtering ads that were obvious scam, misleading users to click on these fake “downloads” buttons. Some if not all of these advertisers were distributing VLC bundled with crapware (as we like to call them)." The VLC team complained to SourceForge, and were assured by the SourceForge team that something would be done about it.
But the misleading ads kept coming back. "In consequence they also offered to share some revenues with us," Fauvet wrote. "They gave few thousands dollars every couple of month to the non-profit (which was welcome since we’re all volunteers) but we were still unhappy because a lot of VLC users were still impacted by these misleading ads." And after Dice acquired Slashdot Media in September of 2012, Fauvet said, the contacts at SourceForge that the VLC team had been working with disappeared, "leaving us without any way to reach the new team for quite some time." The misleading ads got worse, so in April 2013 the VLC team started to move the project to its own dedicated servers for download, ending user complaints about the ads—but also eliminating a major source of revenue for SourceForge, as "they lost their biggest project which was making a significant portion of their revenues since VLC was the most downloaded software on SourceForge at the time."
SourceForge attempted to lure VLC back with its "DevShare" revenue sharing program, Fauvet said, in July of 2013. At the same time, VLC's new servers were targeted by a large distributed denial of service attack. "We still don't know who was behind the attack and their motivations but the coincidence is striking," Fauvet wrote.
When news emerged that GIMP had been taken over as a mirror, Fauvet noted, "We were quite surprised to discover that the same happened to VLC, the project has been taken over without notice, removing all access to it but luckily the binaries weren’t touched."
Ars has received a response from Slashdot Media's Roberto Galoppini,Senior Director of Business Development for SourceForge, regarding Lyon's complaint:
We have taken Fyodor’s concerns seriously and below you find our take on the matter:
We find no indication that the “nmap” project has ever contained files, delivered any downloads, or had any changes made aside from the automated migration from our old SourceForge platform to the new platform which is powered by Apache Allura.
We wish to assure the Open Source and security communities that we never modified fyodor’s “nmap” project on SourceForge.
At the end of 2011, we established a SourceForge-hosted mirror of the nmap software, using verbatim copies of nmap’s releases, and have continued to keep that mirror up-to-date since.
SourceForge was founded on the idea that Open Source software should always be available to the community, an idea backed by the Open Source Definition, and we continue to uphold that belief by mirroring important projects on our site.
In an e-mail to Ars, Lyon said, "Sourceforge did not communicate with me prior to seizing the account. They have communicated with me many times in the past about participating in these monetization strategies, and I always declined."
In response to Galoppini's statement that the Nmap project had no files in it, Lyon retorted, "Actually we had so many files there that we received numerous that we were over our Sourceforge file storage limit! Perhaps the confusion is that we were using the SF-provided 'web storage' space so we could directly link the files and include HTML and images rather than their individual-file-download-from-a-list system. We never liked the latter system."
Lyon also forwarded a screenshot of an e-mail from Galoppini from December of 2011, in which Galoppini said SourceForge would never repeat the mistake that CNET's Download.com made: bundling other software with downloaded installers. Lyon had explained the reason Nmap was using a link to perform downloads from its own repository was related to "the brouhaha we had this week over Download.com's practice of bundling malware with our installer."
Gallopini replied, "That's really bad...Of course we don't do similar things."
reader comments
82