Trojan found in Filezilla downloaded from SourceForge

Re:Trojan found in Filezilla downloaded from SourceForge by Relys on Thursday December 03, 2015 @12:56PM (#10671202)

"Since the content they host is open-source, this is technically legal, but it's scummy as all hell."

If the project is licensed under GPLv3 (or any other strong copyleft license), wouldn't they be illegally hosting it because they are bundling their malware dropper with software that isn't compatible with the license?

[ Parent | on HN ]

Re:Trojan found in Filezilla downloaded from SourceForge by amyjess on Thursday December 03, 2015 @01:04PM (#10671277)

Simple bundling is not a GPL violation, only linking.

[ Parent | on HN ]

Re:Trojan found in Filezilla downloaded from SourceForge by Relys on Thursday December 03, 2015 @02:58PM (#10672125)

Is there any license that prohibits this then? If not, should one be created?

[ Parent | on HN ]

Re:Trojan found in Filezilla downloaded from SourceForge by amyjess on Thursday December 03, 2015 @03:46PM (#10672495)

If there was, it wouldn't be open source. The Open Source Definition explicitly prohibits any license that restricts simple bundling [0]:

> The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources.

Same with the Debian Free Software Guidelines [1]:

> The license of a Debian component may not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources.

[0] https://opensource.org/osd-annotated

[1] http://www.debian.org/social_contract#guidelines

[ Parent | on HN ]