A few recent HN discussions have tremendously eased my anxiety of this...thankfully they working on moving things in the right direction.

https://news.ycombinator.com/item?id=11092219 https://news.ycombinator.com/item?id=11860752

SourceForge changed owners and doesn't have many of those issues anymore.

https://sourceforge.net/blog/sourceforge-now-scans-all-proje... http://www.linuxinsider.com/story/83105.html

Yes and I hear the DNC has changed ownership as well.

Being careful with downloaded software might be one thing (even though there isn't any indication that there is any of that going on right now), but not visiting the site? Did SF ever did something justifying that?

No, you're certainly not the only one. Personally, unless I absolutely need some package or utility, I avoid SourceForge like the plague. In the recent past I even blocked their domain on my network so I did't download things from them on accident.

I still don't trust them despite their new ownership because all I have to go by is words. It takes more time and effort than that to win back lost trust.

Furthermore, I feel like any project still hosted at SourceForge probably isn't worth looking at. For one, I certainly don't want to interact with SourceForge in order to use or contribute because that would be annoying since the UI/UX for that site is utter crap.

Also, the fact that the devs (who host projects at SF) didn't move to newer and better ways speaks volumes to me and I want nothing to do with them.

NSIS has ages of history. It was written while many HNers were still in elementary school. Projects with that much built-up documentation and massive amounts of deep links don't just move on a whim.

Yes. This. We have so much invested in SourceForge including scripts, a whole Wiki and tons of history. Ideally we'd move to GitHub one day, but it'll be a sizable project. There is already a mirror of the code on https://github.com/kichik/nsis and hopefully more will come in the future.

As for SourceForge injecting adware, they only do that to dead projects or projects that volunteer. NSIS is neither. Many people approached me asking to bundle their stuff, even outside of the recent SourceForge efforts, and they were always swiftly rejected.