News for hackers. Stuff that matters.
Re:Notepad++ drops code signing for its releases by zrobotics on Thursday March 07, 2019 @12:11PM (#19329799)
>>FOSS and reading all the code...

Don't forget, you have to compile from source as well. I'm thinking the parent you replied to forgot how awful sourceforge was, and even trustworthy projects could have garbage bundled in.

Re:Notepad++ drops code signing for its releases by antsar on Thursday March 07, 2019 @12:32PM (#19330017)
And compile your compiler, and ...

(In reference to the classic paper: https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...)

Re:Notepad++ drops code signing for its releases by duxup on Thursday March 07, 2019 @12:51PM (#19330253)
Also considering the layers of hardware with layers of firmware. ... I should probabbly learn something about that too....

I'm thinking along the lines of google's blog on Meltdown and Spectre recently that basically said if two things are on the same processor.... there's nothing you can do now security wise and be sure about it.

Re:Notepad++ drops code signing for its releases by snvzz on Friday March 08, 2019 @02:31AM (#19335816)
That's why there's been so much work on reproducible builds.
Re:Notepad++ drops code signing for its releases by lghh on Thursday March 07, 2019 @12:13PM (#19329821)
And also trust yourself to have a better idea than the devs do about security. Most flaws are accidents and accidents can be hard to catch.
Re:Notepad++ drops code signing for its releases by fjabre on Thursday March 07, 2019 @12:14PM (#19329834)
Every good dev knows to stay the hell away from sourceforge!
Re:Notepad++ drops code signing for its releases by miles on Thursday March 07, 2019 @01:07PM (#19330412)
Logan Abbott[0] bought SourceForge back in 2016 and has been cleaning it up ever since[1]:

> Hi, president of SourceForge here. Glad this is trending, albeit a few months later. These articles seem to trend on HN every few months, with many people not realizing SourceForge changed ownership in 2016 and that the new team's been working hard on improving. To be clear, we had nothing to do with the bundled adware decisions of 2015, and when we took over in 2016, the first thing we did was remove the bundled adware, as well as institute malware scans for every project on the site. We're working hard to restore trust, so if we win some of you back that would be cool. However, we're just focused on doing right by our million daily users.

[0] https://news.ycombinator.com/user?id=loganabbott

[1] https://news.ycombinator.com/item?id=17592523

Re:Notepad++ drops code signing for its releases by throwawaymath on Thursday March 07, 2019 @12:29PM (#19329993)
Only if that's part of your definition of a good dev. I know plenty of good devs who downloaded software from Sourceforge back when it was big.

Let me guess: you also dislike GitHub because it's closed, and wish people would distribute software from their own, self-hosted git repositories?

Re:Notepad++ drops code signing for its releases by thanksDr on Thursday March 07, 2019 @12:41PM (#19330129)
Devs get better by learning from mistakes.

Sourceforge is a hostile source of malware : https://mail.gnome.org/archives/gimp-developer-list/2015-May...

You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.

Re:Notepad++ drops code signing for its releases by detaro on Thursday March 07, 2019 @12:44PM (#19330154)
was, not is. Sourceforge has changed hands since then.
Re:Notepad++ drops code signing for its releases by duxup on Thursday March 07, 2019 @12:57PM (#19330320)
Yeah my understanding is after it changed hands they did away with all the nasty stuff that happened in the past.
Re:Notepad++ drops code signing for its releases by miles on Thursday March 07, 2019 @01:04PM (#19330384)
That was true back in 2015. New owners have been cleaning it up since 2016:

Under new management, SourceForge moves to put badness in past https://arstechnica.com/information-technology/2016/06/under...

Re:Notepad++ drops code signing for its releases by throwawaymath on Thursday March 07, 2019 @12:51PM (#19330247)
> You mock those who desire freedom at your own risk. Github is microsoft now, and supporting it feeds the beast.

Oh no, it's the 90s and Micro$oft is evil! They're going to embrace, extend, extinguish all my open source software! I won't be free to develop software anymore!

I'm quite happy with Microsoft, and if supporting GitHub "feeds the beast", then I'm likewise happy to see that beast well-fed.