I download the bitcoin .exe, and it came clean, with the right signatures, but who knows how they are distributing the stuff. I have a Ubuntu computer. If they're at least a bit smart they will use their download redirects to serve the spyware only to Windows computers or something, so that could be why I got a clean binary. Bitcoin devs investigated, at my request. They removed the sf-editor1 user from the project owners and checked the binaries to see if sigs matched, and they did. But like I said, they could be filtering who they serve the "spyware" to.

wget at least isn't affected, as long as you copy the link from the files page (the one that normally displays ads and a countdown timer in browser - it'll download the file directly with wget, since they apparently do user-agent sniffing).

SourceForge has worked with wget, NSIS's inetc, etc for at least the last 10 years. We've been using it with PortableApps.com.

What does the SourceForge shell access get you? If it's only the ability to edit your website and maybe your code (and not install, compile, etc. things), is it valuable in a world with git-push-to-deploy and with web-based editors?

Trivial, technically, but can still be an unwanted cost for projects that push a lot of bits out. Our software at SF.net burns through several terabytes of bandwidth each year for several million package downloads. We've always appreciated their network of mirrors. But, it seems like it's time to move away from SourceForge.

We already relocated our revision control to github (though I'm considering another move to a self-hosted thing on Phabricator or gogs or gitlab, as I'm more cautious about using third party services for this kind of stuff these days).

:) Agree on that ! [Have not used any office in a while now - Markdowns have been sufficient]

They're distributing LibreOffice now too, presumably without bothering to ask for the permission of the actual developers.