Hacker News Reader

Comment by dspeyer | Hacker News Reader

How many legitimate websites use that CA? Especially ones Chinese users will visit often? If the browser blocks the CA, those will all break.

Perhaps the browser could do something subtler, but it's not straightforward. Or we could make the https cert protocol more flexible, but changing protocols is hard.

View on HN

Sourceforge and friends are known for injecting badware into binary installers for open-source software.

It will be interesting to see if the Chinese government makes their own alterations to the Firefox binary installers that pass through their network that add the CA back in.

Nobody checks their installers' GPG keys anyways

> Sourceforge and friends are known for injecting badware into binary installers for open-source software.

Wait... what???

GIMP no longer distributes binaries on sourceforge because sourceforge's installer "bundles third-party offers with Free Software packages. We do not want to support this kind of behavior, and have thus decided to abandon SourceForge."

http://www.gimp.org/

http://www.gluster.org/2013/08/how-far-the-once-mighty-sourc...

After reading that it doesn't look to me like they're sneaking into otherwise pure installers or doing it without project's knowledge. "When SourceForge introduced this, it bribed encouraged the top projects to participate by giving them a cut of the take. So these co-operating projects are also knowingly selling their users down the river."

For as long as I can remember Sourceforge's usability has sucked. That's reason enough to avoid it (but omg! free file hosting!) but the installer thing maybe isn't quite as deceptive and malwareish as your first message let on. It's just another facet of their lameness.

Kudos to Gimp for dumping them. Why does anyone stay with them at this point?

Aha, thanks for the clarification. It's good to know SF is only doing this under the consent of project leaders; I was under the impression that they were sneaking it under the radar.

I've actually been disappointed that downloading Firefox is only done over HTTP and I didn't see where SHASUMs for the builds were available. I actually tweeted at them about this and never got an answer: https://twitter.com/andrewdeandrade/status/40000123091669401...

Reply on news.ycombinator.com