Most users will get it through a distro package manager.

Please excuse my ignorance, but what are better options for code hosting and collaboration?

Anything that doesn't alter your binaries from time to time.

I seem to remember that being a "Feature" of a desperate SourceForge not to long ago.

tl;dr: Slashdot and SourceForge have a new owner which removed all this nonsense from those sites - including the adware.

I believe the average HN reader - including you - should be interested in this then: https://www.reddit.com/r/sysadmin/comments/4n3e1s/the_state_...

Allegedly the most recent owners have reversed the earlier policies and are trying to reclaim SourceForge's previous sterling reputation, FYI. Seems reasonably credible.

That said, I'm one of those people who bothers to check the signatures on binaries before installing them, so as long as I trust the signature and dev, doesn't much matter to me if I downloaded it from xxx-malware-binaries.biz.ru.

You get that 'for free' with apt-based systems, as packages are GPG-signed by default, and will throw up an error if the signature is missing or is not in your trust store.

They've been bought by a different company since then, and they've cleaned it up. https://news.ycombinator.com/item?id=11860752

Any company that resorts to practices that low will never regain my trust.

Even if they were bought out by RMS himself, I'd never host any of my projects there.

It's just something I don't think I'll ever support after what happened; it's a matter of principle.

Who exactly has lost your trust? A company is a group of people, but a brand is not. Companies can sell brands off to other companies. You can choose to trust—or not trust—a company, but if a brand moves from one company to another, the trust (or lack thereof) adhered to the brand because of the company shouldn't come along with it.

For an example: IBM made a brand of laptop called ThinkPad. Now Lenovo makes a brand of laptop called ThinkPad. IBM's ThinkPads were excellent; Lenovo's ThinkPads are average. They're two different products, produced by two different companies, that happen to share a brand because one company sold that brand to the other. The brand conveys absolutely no information about whether you should trust the product. The company owning the brand conveys 100% of the information.

Trying to say "this brand was bought by another entity so now all that negative brand equity and well-deserved consumer ire it had earned before is null and void" seems a bit like trying to have your cake and eat it too.

No employees came along with the brand? None of the decisionmakers responsible for the previous SourceForge derp over the past couple of years? It's a clean slate - tabula rasa? That's fine, but it'll take time for people to warm up to that idea. That's what happens when you abuse trust.

What you think logically should happen is not what actually happens. Read about the accounting, marketing, and legal aspects of what are called goodwill and brand equity.

You get it! This is what I'm referring to.

The brand is tarnished in my mind.

And I was, conversely, not talking about what actually happens by default, but rather what way you need to force yourself to think if you want to avoid bias when doing something important involving the corporate reputations of others—like, say, picking stocks.

If you have both information about a "brand", and information about the actual group or individuals underlying it, giving any weight to the brand will give a suboptimal result and let people exploit you. The reputational information has some value, but only if you have no "observational" information. Trying to use them both together is double-counting. Just use the information about the individuals and throw the brand information away.

In in other words, basically http://lesswrong.com/lw/lx/argument_screens_off_authority/, but with a more generalized halo effect in place of "authority."

The acquiring company removed that feature the moment they acquired SF