Re:SourceForge's GitHub Importer
by JohnTHaller on Monday June 11, 2018 @12:11AM
(#17281700)
It's worth noting that SourceForge didn't modify trusted applications. They switched their download buttons on the site to download an "installer app" by default that would act as the installer, offer bundleware, and then live download the actual app installer as part of the install process. Apps like GIMP etc were never, to my knowledge, modified to bundle GIMP and bundleware within a single installer.
Source: I was hosted on SourceForge at the time and approached about participating in DevShare. I researched it extensively and saved copies of the stub installers for things like GIMP as part of that research.
Re:SourceForge's GitHub Importer
by loganabbott on Monday June 11, 2018 @12:30AM
(#17281802)
My company had nothing to do with it, but it's worth noting you're one of the few people who actually remembers the actual non-revisionist history.
Re:SourceForge's GitHub Importer
by giancarlostoro on Monday June 11, 2018 @04:25AM
(#17282696)
Thanks for sharing the highly relevant piece of information. It always bothered me someone had to go through the effort to download the original source and rebuild the projects, just the thought of all the effort taken to do that... It seemed odd, I can imagine some projects having some obscure build processes (it happens) and the amount of effort taken to add in their spyware installer seemed a little crazy to me.
That is an interesting piece of info. I was under the impression that they had actually delivered modified installers. From a practical standpoint, though, this is an implementation detail and the effect was largely the same.
Second, what SourceForge did was worse than your examples. They modified trusted applications to add essentially a malware payload. This is worse than Facebook collecting too much data and being shady with it. SourceForge was installing spyware on machines without permission. This betrayed the trust of both users and publishers and even damaged users’ trust in those publishers.
The only one of your examples that is comparable is Lenovo’s Superfish mess, and in that case they only betrayed users, not publishers. Not that it actually makes it better, but it changes the impact to Lenovo.
Disclosure: Microsoft employee.