Hacker News Reader

I agree with you that the situation isn't as dire as portrayed in the article, but frankly, I'm quite willing to call toolbars and the like malware. I have come across various pieces of such things (Babylon, Ask, Yahoo!, Google and half a dozen other ones) installed on various computers in both Australia and India, and have never seen anyone who appreciated them—they don't tend to know why it got there and didn't know how to, or couldn't manage to, get rid of them. These users are always glad to see them go and have their browser released from being a hostage.

Normal (viz., non-computer-literate) users are used to clicking the big green button in the position the "next" button is in installers. A frighteningly high proportion of the populace simply do not notice the contents of the screen. My experience with real users is quite sufficient to lead me to call it drive-by installation: that was never the intent of the user.

(Sure, in a case like FileZilla you're dealing with slightly more competent people, but you'll still get a surprising number of undesired installations, and—my guess—no desired installations.)

i appreciate your argument, but semantics are important. malware is software that is malicious. a toolbar that i did not intend to install, but is not malicious, is not malware.

The argument against the use of the word "malware" also assumes that the "mal" is "malicious". The prefix "mal" comes from the french word and indicates "illness" or "affliction" which most certainly matches with the regard for these pieces of software.

https://www.google.com/search?q=define+malware

"software that is intended to damage or disable computers and computer systems. origin: blend of malicious and software ."

The regard that people hold for these pieces of software aside, most of them are not actively malicious. Yes, they're annoying, but most of them are not doing anything worse to you than what the major ad networks are doing.

I hate that, I block that behavior with noscript and adblock, etc. But it's a stretch to call that malicious.

It is not a stretch. These programs slow down the users browser experience. Though they may not be actively in collusion, more and more of these tool bars are installed and the browser almost grinds to a halt. I have opened the browser on my parents laptop to fin the top half of the screen cut off because it was full of tool bars. While they may not be intentionally malicious the result is malicious. Therefore they are malware.

Toolbars definitely damage software.

Mal. That's "bad", in the Latin.

Where do you draw the line of malicious? I guess somewhere between selling your usage patterns vs selling your passwords as you type them into websites.

selling our usage patterns is something that nearly every major site does. anybody who's displaying ads is complicit if not active, and Google is a friggin' ring leader. do you consider these major players to be malicious?

these toolbars don't have backdoor downloaders, they don't display pop-ups, they're not damaging our devices. they suck, i hate them, i uninstall them for my friends and family. but they're no more malicious than ads on the washington post, and they're there for the same reasons.

for the record, i think this is a bad move on SourceForge's part. it's misleading, it's abusive of user's goodwill and trust, and most users are going to accidentally install these toolbars that they don't want or need. but just because it's a bad idea and it's intrusive and rude, doesn't make it malicious.

"they suck, i hate them, i uninstall them for my friends and family."

Then they are malware.

malicious software is programs that runs against the wishes of the person who owns the hardware. They try to illegally gain access to private computer systems and do this either through social engineering which depend on tricking the users, or by exploiting a bug. Toolbars are of the first kind, in that they depend on tricking the user into installing them, and by obfuscate how to remove them.

Ads on the washington post that runs code in my browser is in the same boat. They depend on tricking the users computer into running code contrary to the wishes of those who own the computer. Software like ad-block, ghostery, no-script, disconnect and many other are designed to prevent said malware from running. They are the antivirus tools of 2010s, and is thankfully so far free.

Last, lets just put down Micrsoft own definition of malware: 'Malware' is a general term used to refer to a variety of forms of hostile or intrusive software

Not malware, granted. Let's call it scumware, then.

Or possibly spamware. In the same way spam ends up uselessly clogging up your inbox, spamware ends up uselessly clogging up your computer.

Crapware. Shovelware. You know what he means.

Even if it is not malware those toolbars are a scam.

An accept/decline button on installing additional software is just as bad as a pre-ticked box.

If you've ever done user studies with people installing software you'll notice 90% click the next button until it's done without reading the pages

The way that the accept button is positioned in these "optional" offers makes it look like you have to click it to proceed. This is exactly what a dark pattern is (http://darkpatterns.org/ or http://www.90percentofeverything.com/2013/07/23/the-slippery...).

I downloaded Filezilla from Sourceforge to see how this offer system is implemented - http://i.imgur.com/7tZuUoE.png. From quickly glancing at the window it looks like accept is the only valid way of continuing with the installer. Furthermore the program installs Hotspot Shield which will constantly show the user ads after it's installed, I doubt even 1% of the people installing Hotspot shield through this offer want it on their PC.

I doubt even 1% of the people installing Hotspot shield through this offer want it on their PC.

No, nobody wants it, that's why it's there. Your optimism presupposes that there has ever been a such thing as a person who wouldn't mind more commercials on TV. These people aren't out there, people only tolerate the advertising they do see, and software like this only exists to inflict itself on the user.

I have a technically literate friend who chose not to install Adblock in their web browser because they find it entertaining to see ads on the web while they browse. There's probably lots of people who enjoy these things.

Do they search out more ads, and install more sources of advertising, no matter what they are? There's a difference between liking interesting commercials as a distraction or hobby, and having an appetite for advertising in general.

In other words, Nike and Budweiser don't advertise on Sourceforge crapware toolbars, but have you suggested to him that he might want to install that kind of thing?

It's not just as bad, i would call it worse than a pre-ticked box. As you say accept or abort everything looks like the only two options. There is no decline and continue option.

Good write-up, thanks.

But this isn't a sustainable strategy. You're basically asserting SourceForge's unique selling point/competitive advantage is its ability to host files. You've got to be kidding.

GitHub has taken off like a rocket whose thrust show no signs of abating. SourceForge is going down the drain with a passiveness that shows no sign of abating--unless it is conceptually rethought, from the ground up. You know, does something new and innovative to address project needs from a contemporary point of view. Dice certainly doesn't seem to have an appetite for that kind of risk, just an appetite for the last drops of life sucked out of a dying carcass by throwing leeches on it.

SourceForge's old strategy of having ads on-site shown on project pages and as an interstitial when you download a file in a browser (but not via wget, NSIS, etc) was unsustainable. With ad revenue declining across the web, freeware/open source developers and hosters will need to find other avenues to support things. SourceForge was in a very precarious position financially a few years ago as ad revenue fell and there was whisperings of them shutting down entirely.

Offer-based installers are one way of monetizing and have become exceedingly popular, especially with closed-source freeware. Unfortunately, most of these installers are designed to trick users into installing (or go so far as to install without use consent). To SourceForge's credit, they make a single offer which is clearly defined and even have a link to a page explaining why the offer is made. Compare this to your typical download from Download.com which includes multiple offers including several tricks to get you to install (pages that seem to be license agreements for the main software but install adware when you click agree, pages that list a standard and a custom install type and you'll get adware unless you pick custom and uncheck the offer, etc).

The other option is freemium pricing, free for smaller users but bigger users pay. To go this route, you basically need to go after the enterprise to make money. Github has taken this route from the beginning and achieved profitability in 2009 if I recall. I'm not sure if Github is still profitable, but they got $100m in funding last year, so they have money to burn. That could be why the added binary hosting back in. They had it originally but removed it due to costs years ago. Still, I'm unsure if they would put up with a project as large as the ones on SourceForge (PortableApps.com, FileZilla, GIMP for Windows, etc) as that is quite a bit of bandwidth to give away for free as a loss leader (since Github wouldn't even make money on ads for those downloads). Unfortunately, SourceForge has no enterprise offerings at present, so this isn't a viable revenue source today. They could explore this route in the future as a competitor to Github, though. It would be a bit of a pivot for them and not without its own risks. But, even if they go down this route, they still need to have the revenue today to keep going. So, it's a bit of a catch 22.

Thanks for your reply. First off, you're right, cheers for resuscitating SF.

Not that it would by any means be easy, I was suggesting a conceptual re-think of SF to attract and enthrall new users/projects. However your response (and the refrain I hear from others) indicates a strategy of monetizing the big binary projects you already have. That's cool, and that's a market. But I would fear

- those projects being coaxed away by innovations from services in adjacent markets (GitHub using enterprise revenue to cover download costs), and

- those big binary projects eventually dying (as projects sometimes do), without replacement from new young projects (because they will prefer to start on GitHub and will then mature there).

Perhaps go after the conceptual strategy of "SF is where you go when you've grow out of GitHub".

Good luck.

First off, SourceForge isn't me :) I just run one of the largest projects hosted on SourceForge.

Second, Github doesn't really offer what the big binaries on SourceForge need which is tons of bandwidth to host downloads. Github ditched downloads back in December but appears to have added them back in with 'Releases' last month. It remains to be seen how much bandwidth a free and open source project can actually push through Github, though. And whether Github will keep Releases/downloads around at all since they've only been around for a month and were unceremoniously killed off just 8 months prior.

SourceForge is a known quantity with download mirrors all over the world that you can push 10s of TBs per month through for free as long as you're a fully open source project. Github, on the other hand, is an unknown quantity with respect to big downloads.

SourceForge used to have an enterprise edition, but it looks like they sold it off ( http://en.wikipedia.org/wiki/SourceForge_Enterprise_Edition )

> quite a bit of bandwidth to give away for free as a loss leader

Really naive question, I'm sure, probably a simple answer for anyone working in providing services at this scale, but...

Why is everyone's business so dependent on funding expensive bandwidth? We've had bandwidth sharing for over a decade, what didn't P2P solve?

Bandwidth sharing isn't quite the panacea that a lot of people think it is.

For starters, you have to get the end user to download and install a piece of software first (torrent client, etc) and then direct them to the larger downloads of the actual software you're distributing.

Next, you can't just build this feature into something like our PortableApps.com Platform (with it's built in software downloader/app store/updater) as many end users are prohibited from running P2P software by their ISPs and we can't depend on them being technically knowledgeable enough to know whether or not they're allowed to.

Then you have the issues with routers and firewalls and punching holes in them to allow people to upload to others as well as download (which is a bit easier with upnp but not always automatic).

Then you have the issue that much of the world is still on metered connections. Here in NYC I have the choice between slow DSL provided by one company (and some resellers that use the same line), fast but unreliable cable provided by one company (no resellers or competitors), no fiber (Verizon cancelled FiOS buildouts), or wireless (which carries a limit of 5GB per month and you pay $10 per GB after that). I opted for the fast but unreliable cable and a wireless hotspot as a backup for the several hours a month the cable goes down. Lots of the world has even fewer options than I do.

And finally, most legitimate webhosts prohibit any kind of P2P hosting on their networks, so you can forget about running a torrent tracker on your regular web server. You can go with a second tier provider that is more forgiving (or clueless) but then you have the issues associated with such a provider (likely illegal activities on the same network, likely security issues, etc).

There are other issues and some workarounds for the above, of course, this is just my personal experience with researching it for PortableApps.com over the years.

Solid overview, makes a lot of sense.

Some parts of the problem sound like they could be described as a tragedy of the commons. Things would be more efficient all around if we just allowed intelligent bandwidth sharing through P2P, but network administrators concerned about the impact on their particular networks prevent such moves, actually making everything less efficient.

Not to understate the other technical hurdles.

Good points, thanks.

Take a look at some of SourceForge's top projects at http://sourceforge.net/top and you'll see a collection of very well known projects which GitHub cannot serve in its current form. That is a rather important aspect of SourceForge.

VLC, 7-Zip, PortableApps.com, FileZilla, MinGW, Apache OpenOffice, GIMP, Notepad++, ...

> GitHub has taken off like a rocket

I think this is in part because they charge. I like this model. Its simple. You want to use GitHub for free then you have to make your code freely available. You want to keep it proprietary then you have to pay for your account.

Where this doesn't translate well with SourceForge is that it was designed from the start to be of, by, and for Open Source projects. So the vast majority of projects would be non-paying.

However, they may be able to add some features that appeal to proprietary projects who are willing to pay and use that revenue to offset any losses. It would be hard work but ultimately I think it would be be better than the appearance (if indeed it is just that) of distributing malware.

I think this is in part because they charge. I like this model. Its simple. You want to use GitHub for free then you have to make your code freely available. You want to keep it proprietary then you have to pay for your account.

Agreed. I was a happy user of GitHub for solely public (free) repos, since all our startup projects are OSS. But as soon as we ran into the need for repos for private internal projects, or OSS stuff that we aren't ready to announce yet and want to keep private, it was a very natural, and seamless, process for us to sign up for a paid GitHub account. GitHub have, IMO, found a nice sweet spot in terms of taking advantage of the "freemium" model. And it's one paid service I totally don't mind paying for in the slightest. It just feels like they really got it right with their model.

That said, we don't need a large number of private repositories in our model. I know some people prefer BitBucket's model, if they need a larger number of private repos.

> You want to use GitHub for free then you have to make your code freely available.

Clarification: they do not offer gratis service based on free code, they offer gratis service based on public code. If you are public, it's no charge, even if you are using a proprietary license.

I agree. Along with that I'd add that they've taken off because of their expert marriage of the concepts of social networking with open source development, to harness Metcalfe's Law. By providing such a good social experience, they've pulled all developers into the fold. Once there, they have their foot in the door (doors?) whenever it comes time for private SCM. It's a great strategy pulled off well.

That seems to be SF's existential problem. What's their strategy? Adware installers are certainly interesting, perhaps even "innovative", but seem to be a near-term monetization tactic that doesn't address the strategic problem of community stagnanation. What happens in the hypothetical situation when all the big projects die or leave (perhaps because they've become so successful they can now support their own infrastructure costs)?

The vast majority of projects on github also do not pay. The two major features you pay for on github are larger repositories, and private repositories. The free offering is good enough for almost all open source projects.

The big issue would be downloads when it comes to real apps, though. Github discontinued binary downloads in December of 2012. But, they then added the 'Releases' functionality last month. I don't think they'd put up with the large numbers of downloads (and the associated bandwidth) of big projects like FileZilla, though.

If those projects are looking for a new home, we'd be happy to welcome them at GitHub.

From a quick look, SourceForge pushed out about 19TB of FileZilla bandwidth in the last 30 days in terms of binary downloads. I'm not sure any projects on GitHub are pushing that kind of bandwidth for binary downloads yet. Or are they?

In terms of PortableApps.com, I don't think we'd be a good fit for GitHub since we're a project that's a conglomeration of apps made portable (for USB and cloud use). I think we're around 90TB of bandwidth for downloads in the last month for our open source apps via SourceForge (some of our open source apps the publishers self-host like Inkscape and LibreOffice so we don't push those through our SourceForge project).

You can get 100TB/month for under €100 on Leaseweb. Couldn't you raise this in donations each month? I'm sure with your traffic it'd be possible.

I generally don't trust anything that sells 'unmetered' bandwidth as it nearly always ends in disaster. Their metered accounts seem to be 10TB for $95 which is about what we're paying for freeware downloads now (we can't host those on SourceForge, of course).

PortableApps.com on sourceforge reports they had 943799 downloads last month. Popular files include Firefox portable (20mb) and chrome portable (2mb). Assuming the average download is half way between those (10mb) you're looking at about 480,000 GB of downloads a year. If you store that on S3 you'll be looking at about $46,800 of bandwidth charges a year.

Surprisingly expensive business.

Quite true. The total is quite a bit higher as some popular apps like GIMP (136,000 downloads in the last month) are 64MB and July and August are our slowest months. Additionally, apps like Inkscape are hosted on their own SourceForge project and LibreOffice is hosted by The Document Foundation (not included in the above numbers). Then there's all the freeware we host elsewhere that doesn't show in the SourceForge stats (which we pay the bandwidth on). All told, I think we're easily exceeding a petabyte a year. I used to actually keep those stats, maybe I should look into it again.

They are bundling in the Ask toolbar, a known piece of malware/spyware. See: http://www.benedelman.org/spyware/ask-toolbars/

Whenever you see the word "toolbar," just think "virus," because that's pretty much what they amount to. See: http://www.cracked.com/blog/6-reasons-guy-whos-fixing-your-c... (#2)

An organization claiming to be for "open source" should not be distributing KNOWN malware, by ANY means. PERIOD.

I have one major project on SourceForge that is pretty much inactive. If I ever do the rewrite of it I'm thinking of, that new code will not be hosted there. It'll probably be on GitHub.

Actually GitHub does have a binary release system. You can upload binaries tagged to a commit and provide a markdown description for the download.

Actually, they removed that feature in December. [1]

GitHub is a developer tool. Users not interested in viewing/changing/building the source code should get the software from the project's website.

[1] https://github.com/blog/1302

They added in "Releases" again last month after discontinuing file downloads in December: https://github.com/blog/1547-release-your-software

The examples all only show Zips but you can apparently add in EXEs, MSIs, DMGs, etc. I'd wager that they won't put up with high numbers of downloads on free projects ala FileZilla, GIMP, PortableApps.com on SourceForge, though.

"I'd wager that they won't put up with high numbers of downloads"

Pure speculation. More speculation: I'd wager they'd be OK with it. Bandwidth is practically free.

Except that bandwidth is not actually free. Setting up on a high quality network of mirror servers around the world is usually ~$50 per TB (on something like MaxCDN that we use) but more like $100+ per TB on something like Akamai. That's buying commercial bandwidth on server networks. I mention that as SourceForge has a worldwide network of servers they get from all sorts of companies in exchange for advertising and that we can use for free.

We could setup on something like an unmetered host. We'd lose the worldwide network and geographic closeness of the servers to the downloaders, of course. You can get a 1gbps dedicated unmetered connection for around $800+ a month (not including the actual server) at several providers. A 100mbps dedicated unmetered would not be sufficient for PortableApps.com as it would only total 20TB a month used fulltime (of the theoretical ~32GB max it could push if you discount overhead, etc).

They brought it back, under the name 'Releases', in July:

https://github.com/blog/1547-release-your-software

I was unaware of that with the original quoted post from a few weeks ago but it was pointed out when I posted so I included a mention in the last paragraph of my post here.