It's actually worse than that. As an open-source developer deciding where to host a project, I not only need to trust the host, I also need to expect users to also trust the host. If I expect 10% of potential users to bounce when they see that it's hosted on Sourceforge, well, hosting is enough of a commodity that I have no reason to give up on that 10%.

In addition to the malware issues, when I land on a SourceForge project that pretty much tells me "this project is dead or on life support" nine times out of ten.

This is true for me as well. SourceForge stopped being the host for anything I cared about years ago. If I land on SourceForge today because they host project X that might solve my problem, I generally start looking for project Y somewhere else.

That doesn't really make any sense today though.

Sure it does. If hosting on SourceForge is predictive of abandoned software, avoiding SourceForge is a useful heuristic.

I get that this is probably not a story you want to hear about your product but it’s true.

No malware issues since 2016 https://arstechnica.com/information-technology/2016/06/under...

I was referring to the ongoing perception of malware issues even after the fact, but you're absolutely right. Guess I should have been clearer but it's too late to edit now.

As for the perception, I think it's going to be like those Red Cross donuts and it'll be very hard to live down.

I think you've unpacked why SF is - sadly - not quite dead, but not quite as alive as it used to be.

> I could probably say the same thing about you though

Are we sure this isn't just a troll account and not actually the President of SF?

My point was not to be insulting, it was to draw attention to the fact that I don't know this person, just like most people don't know what's going on behind the scenes at SourceForge, or just how healthy we are as a company.

Appreciate the clarification!

You're right, I don't know what's going on with SF nowadays. I'm interested to learn more though, probably many others would be too.

Right, and that's actually a problem; people would be more willing to use SourceForge if they knew that other people knew that it had changed for the better.

There are still a number of venerable projects hosted on SF; here are a few:

ReactOS https://sourceforge.net/projects/reactos/

FreeDOS https://sourceforge.net/projects/freedos/

hdparm https://sourceforge.net/projects/hdparm/

7-Zip https://sourceforge.net/projects/sevenzip/

Keepass as well.

They’re under different ownership; the new owners were apologetic about that nonsense and stopped it immediately. I don’t want to punish people for buying and fixing venerable Internet infrastructure, so though I was angry about the compromised downloads, I’ve no problem downloading from SourceForge since then.

Thank you for being reasonable

To be clear, the new owners did indeed -- not supposedly -- stop that behavior on day-one of their ownership.

Indeed, Thanks. We did.

Yeah that was in the area of unforgivable as far as I'm concerned.

We are not the same people who did that. We stopped it one day one.

Is this the same duxup of K5 fame?

Now thats a name I haven't heard in a long time... a long time....

But yes ;)

I haven't thought about kuro5hin in years. rip.

Do you know we have nothing to do with the people that made the decisions to do that bad stuff? I, like you, didn't like it, so I bought SourceForge to remove the bad stuff. I still get shit for it. Kinda weird because the people giving me shit didn't put their financial wellness or reputation on the line to fix what they didn't like, but still armchair quarterback about it. It's like someone saw it fit to burn down a museum, and then someone stepped in to save it and everything inside of it, but still takes the blame for the person who wanted to burn it down. Very odd...

Hi. Much appreciated for your good deed. It's unfortunate that the previous owners put a seemingly permanent black mark on the once-beloved SourceForge brand, but I think you need to not take it personally. Most of us, me included, simply don't know what's going on inside SourceForge, or GitHub, GitLab or Bitbucket, our only view in being headlines and rumors.

We can't all be experts, but we all need to make a choice, and "that site that started posting malware" is not a compelling option no matter what happened afterwards. This is super unfortunate, but it's true, and I imagine it's the same reason why web filters and reputation indexes have been unkind.

But I think that's not even the worst problem. SourceForge was definitely on a decline before the adware incident. Like, many of us will feel uneasy about GitHub under MS, and I already don't know how much I trust young venture capitalist funded websites with my important data. Still, GitHub changed the game with their non-advertising-based profit model and now it feels weird to even consider going back. Frankly, I feel a bit dirty when downloading FOSS from a page with ads and a countdown even though SourceForge is not the only one doing that.

Truthfully, I do want to love SourceForge the way we all used to, but I find it challenging. The adware-supported installers just felt like a super evil extension of the profit model SourceForge already had, and the association in my head stuck. I doubt I'm the only one.

None of this is fair to you, the person trying to fix all of this, but of course whether it's fair or not isn't going to matter. Insulting people who aren't giving you a fair shake is probably not going to help your case, though I certainly sympathize with you.

Thanks for the input. I am not trying to be insulting to anyone here. If it came off that way, I apologize. I am just, maybe too frustratingly, trying to get the point across that we are not the same as the previous owners. I understand why the name might confuse people though.

I still upload and maintain latest binaries for my project there:

https://sourceforge.net/projects/traccar/

I don't maintain code and description basically refers to GitHub for any issues, but there are still some people who use it, so I don't see any good reason for losing free traffic. Number of download has been falling for years though.

PortableApps.com is still hosted on SourceForge. I think we push around 40TB a month through their download servers. We can't afford that bandwidth on our own. Other hosts like Github aren't really designed for projects like ours that have hundreds of different open source apps.

And we very much appreciate PortableApps