GIMP Windows Installers move from Sourceforge to ftp.gimp.org
gimp.org
gimp.org
The OSS project I maintained for several years was always in the top 10 downloaded lists on Sourceforge, but I got frustrated with how things were going and eventually moved the code to Github and hosted a simple website on my own.
Honestly, I can't think of a reason why an OSS project would choose Sourceforge in this day and age.
Sourceforge is very user-oriented (in contrast, GitHub is very coder-oriented). Non tech-savvy users don't know how to download software using torrents while HTTP just works using one click.
For users with adblock. I would never send my technically illiterate friends to SF as there is a high chance they click on an ad instead of the real download.
edit - I mean when at work, I can't torrent any large ova's or iso's. Sadly fortune 500 america will hardly ever allow torrent through their firewall for obvious reasons.
We considered building torrent into the PortableApps.com Platform and getting users to help share bandwidth with other users, but those stumbling blocks are pretty big ones.
Most companies also block random software like PortableApps.com.
But I think writing off torrents because companies filter them isn't a reason to do so.
As long as they can download random executables and run them, they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.
Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.
>Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.
I think that's a little far-fetched, nearly all open source projects utilize torrents for distribution with noone blocking them. Torrents are just the default way of providing high-speed software mirrors these days.
It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet.
In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html )
HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.
I have heard that GitHub has been DDOSed a few times in recent times. Therefore, for me, it is swings and roundabouts.
But I am not sure about these days. Perhaps that is a sign of losing relevancy...
Github is an option for some folks but not for us. We need solid file hosting with lots of bandwidth (pushing well over 50TB a month at SF) that will be sticking around next month and next year. In my comment linked above, I mention that Github ditched binary downloads (they did last year). In the ensuing discussion, it was pointed out that Github added the feature back in this year as 'Releases'. It remains to be seen if the feature will stick around, though, and I wouldn't put my all my eggs in that basket. When Github discontinued binary downloads last year, users were offered no alternative. So, it's not inconceivable that Github would pull the binary hosting feature again in the future as they stabilize their product offerings. SourceForge has been serving our binaries for 7 years now.
- Most users just click OK for installers, it is like the EULA
- I am yet to see a toolbar that does anything useful to anybody; other than make their system slower and buggy. I hold a very low opinion of people (like Ask.com) who bundle things with the clear knowledge that most people are unknowingly installing their app/toolbar. Much worse than spammers.
With your extensive experience with user behavior, it is interesting that you see this differently.
I couldn't agree more. Whenever a session of searching for a solution ultimately lands me on a sourceforge page, I feel a pit form in my stomach. When it happens it typically means one of two things, often both: I took a terribly wrong turn somewhere, and/or I am in for a world of hurt.
Contrast this with finding myself on a github page, which very often signals success.
My hypothesis is that a sourceforge page signals that the author is dated, the author has abandoned the software, or the author doesn't care much for the users.
And by user, I do not mean a dumb user. I would consider myself the user of a library if I'm not planning to contribute. I can only contribute meaningfully to a dozen of OSS projects; for the others I'm pretty much an ordinary user. In that case I care much more about introduction, documentation and stable releases. Github is pretty much useless by itself in these cases, and the idea that you can just dump a half-assed readme and "call it a day" is something that I've only seen since github became popular.
Developers should really stop behaving like dumb users.
> You should then consider a better host.
Very well then; step one: identify a better host where PortableApps.com can get over 50TB per month for free. I'm not aware of any other than SourceForge which would do such a thing and John does not have the money to spend on commercial rates for such bandwidth. (Incidentally, donations are always welcome at PortableApps.com, because the rest of the infrastructure does still cost money, and quite a considerable amount.)
Edit: I am not saying portableapps.com is at fault here for using this free facility. SourceForge is, for their business model.
With those amounts of traffic for SF's larger projects I wonder how and if one could build a competing website for hosting binary FOSS today and have it be profitable without resorting to shady tactics. Clearly, making the projects themselves pay is not an option.
As for SF, even before the installer business under the current management it had really misleading banners everywhere. I doubt they would have resorted to those of they could have been comfortably profitable with AdWords.
The only other one is Github as they're growing and have $100m they raised earlier this year. They added in binary hosting as "Releases" but it's relatively new (this year) and after they killed binary hosting last year with no path to move to, I'd worry about it happening again as Github stabilizes its product offerings.
This installer specifically has a separate page for the offer with a big Accept and Decline button along with a What's This link in between that links to a page explaining it.
> - I am yet to see a toolbar that does anything useful to anybody
They also offer trial versions of certain software like antivirus and were working on getting other software on board last I chatted with them.
Like I said, I'm not involved in the process at present and do not participate in the optional bundling program. Bundling 3rd party offers is prohibited within PortableApps.com Format.
I've got an old PC at home, with a ten year old installation of Windows XP, on which I play games. It never had an antivirus active, I just run ClamAV on it every couple of years. It was never virused either. My wife's laptop on the other hand is perpetually virused, in spite of the commercial antiviruses that she tried. That's because those antiviruses don't do shit for her, or for the hundreds of millions of users that get tricked into paying racketeering taxes.
Have a host as a secondary backup, for people who won't want to torrent.
S3 isn't the cheapest for really big bandwidth though.
Is their an opensource hosting service that provides a build service for binaries ? a little bit like Travis but just for builds , that would build bins for you and make it available to download ?
The only thing that SFEE did well was provide a single 'neck' for customers to strangle when things went wrong -- and we became very, very good at keeping those customers happy.
If you're looking for the last public release of the sf.net code, it's from around 2003/2004, and it's....messy. SFEE (the product that I worked on) was acquired by CollabNet in 2006, and is now something called CollabNet TeamForge, but, I wouldn't use it for an enterprise anything these days).
Define your company values early.
These ad-ware loaded installers are not the default. You have to explicitly opt-in. It provides SF and projects hosted there (a kinda shady) optional way to make money.
The FileZilla installer contains ad-ware because the FileZilla developers chose to add it. It is their attempt to make money. I use SF too but none of my projects come with ad-ware installers.
One should point out that bundling ad-ware is a common way developers of free (as in beer) software make money in the Windows world.. so SF has not cooked up some nefarious new scheme here.
One should point out that bundling ad-ware is a common
way *morally bankrupt money grabbing* developers of
free (as in beer) software ...People pay for valuable software. If people don't want to pay for your software, then it may mean that your software isn't worth paying for. And I can agree with ads loaded inside that software. In my eyes ads are a legitimate way of monetizing software.
But pushing extra adware junk down on users' throats, especially plugins for other pieces of software, like browsers? That's taking it a step way too far. And this also hurts developers that are monetizing their apps by serving tasteful ads. Not to mention that it hurts the browser makers - for example my wife wants Chrome, not Firefox, because she doesn't have the expertise to keep her Firefox clean and because Firefox is more open, more extensible, I've never seen a Firefox instance on Windows that's not overloaded with third-party junk.
But hey, lets poison the pool for everybody, right? Thanks guys for killing an otherwise viable business model, not to mention the only major browser built by a non-profit.
By the way, SourceForge, Freecode (aka Freshmeat) and Slashdot were all acquired by Dice.com in September 2012.
I use GIMP on a linux laptop of course so it is the version in the Debian Stable repository (2.8.2 on Wheezy).
50 TB of traffic would cost something like $ 200 (if all downloads were from the US or Europe) to $ 450 (if all of were from South America) according to this page: https://aws.amazon.com/cloudfront/?navclick=true#pricing
That's still a lot of money, of course.
1000 GB == 1TB
$0.08 * 50 * 1000 = $4,000
Or have I missed something?
According to [2] that file is 90.1 megabytes
So that one file used 122.5 TB of bandwidth in that month.
Assume for the purposes of argument this is 100% from the US and follows the cloudfront pricing outlined at [3], and per-request costs are trivial.
(10 terabytes) * (0.120 US$ per gigabyte)
+ (40 terabytes) * (0.080 US$ per gigabyte)
+ ((122.5-50) terabytes) * (0.060 US$ per gigabyte) in US$
= 8960 US$ [4]
It gets more expensive if people download from other countries, and 22% of downloads were for different files not included in the download count for the most popular file, which I used above. It would be trivial to top $12,000 a month in cloudfront fees.
[1] http://sourceforge.net/projects/gimp-win/files/GIMP%20%2B%20... [2] http://sourceforge.net/projects/gimp-win/files/GIMP%20%2B%20... [3] https://aws.amazon.com/cloudfront/#pricing [4] https://www.google.co.uk/search?q=(10+terabytes)+*+(0.120+US...
So not free, but not as expensive as S3 and friends.
As a user, it is a good idea to research the sustenance plan of a service before using it.
Not Found
The requested URL /pub/gimp/v2.8/windows/gimp-2.8.8-setup.exe was not found on this server.
Bad timing for me apparently.