1) There is nothing clear and open about the project being abandoned by the author
2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money?
3) Is SourceForge just going to maintain any project that leaves them and makes a mirror?
The sad state of Download.com and SourceForge keeps getting grimmer and grimmer.
YCombinator also invested in a company that did this.
http://www.istartedsomething.com/20130115/y-combinator-is-fu...
Here's pg's response:
>2. The apps that get installed are "crapware."
>This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things.
What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.
I wonder if we will see more of it as distros move to Snappy or similar schemes. I guess it will come down to how "frameworks" gets handled etc.
Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.
There aren't any technical measures in place to prevent this. Imagine the backlash, however, if any Linux distribution decided to do this.
https://threatpost.com/microsoft-to-detect-search-protection...
The search hijacker that came with my copy of FileZilla Server was the first such infection I've had in a decade.
Ninite.com is a great resource for getting tools like this (and things like Chrome, Firefox, etc) without all of the packaged adware.
I use it almost exclusively to get all of my dev tools on a Windows machine.
I typically use the Ninite installer on a clean, freshly installed Windows machine because the installer can be ran again in the future to update those same apps. Chrome/Firefox/etc. will auto-update themselves but for those apps that don't, they will be updated to the latest version if/when you re-run the same installer that you originally downloaded.
It makes it handy to keep the 'installer' that you download, as it will go through and update all of the listed apps later on.
Disclaimer and full disclosure: I am not affiliated with them, just a happy user for many years
Doesn't GPL have to say something about this? Wouldn't this mean that the adware would need to be open sourced?
Edit: The difference between murder and manslaughter has now been explained, multiple, multiple times. Manslaughter is still a crime and in that way it is still the same. The comparison was used as a device to elaborate why the reasoning was unimportant, the difference between murder and manslaughter isn't important within that context. Suffice to say, now that I have been corrected repeatedly over this nonsense, this would have been a better anecdote:
> "I killed him because he slept with my wife" doesn't change the fact that you killed someone.
I assume the name GIMP is trademarked and it is creating user confusion that the actual GIMP organization is backing that installer.
As far as I can tell, there's no formal "GIMP organization".
By the way, the trademark you mention was Caughron, Mathew K. INDIVIDUAL UNITED STATES, who seems to have been responsible for the old WinGIMP and MacGIMP distributions that cost money.
"By sending or transmitting to us Content, or by posting such Content to any area of the Sites, you grant us and our designees a worldwide, non-exclusive, sub-licensable (through multiple tiers), assignable, royalty-free, perpetual, irrevocable right to link to, reproduce, distribute (through multiple tiers), adapt, create derivative works of, publicly perform, publicly display, digitally perform or otherwise use such Content in any media now known or hereafter developed. You hereby grant the Company permission to display your logo, trademarks and company name on the Sites and in press and other public releases or filings. Further, by submitting Content to the Company, you acknowledge that you have the authority to grant such rights to the Company. PLEASE NOTE THAT YOU RETAIN OWNERSHIP OF ANY COPYRIGHTS, TRADEMARKS AND SERVICE MARKS IN ANY CONTENT YOU SUBMIT."
This does not appear to include the right to use the trademark in installers, as an installer is neither a site nor press release, etc.
Hate, well, love to be pedantic, but it actually it does matter.
Courts and society alike take the reason for a murder (e.g. self-defense, revenge because of having been abused, being crazy or intoxicated etc.) into consideration for less harsh sentences or even acquital.
No. The adware is part of the installer, and is considered separate by the GPL:
http://www.gnu.org/licenses/gpl-faq.en.html#GPLCompatInstall...
[1]: https://en.wikipedia.org/wiki/Murder_(United_States_law)#Deg...
Intent and reason is quite important. It is the difference between receiving no punishment and receiving the death penalty (in places that still have it).
I get it. The anecdote had technical issues. Not-with-standing that being technically correct is not what anecdotes are about in the first place.
One way this happens is.... people open HN, click on a few links to open them up in tabs, then get distracted by work or other things.
An hour or two later, they don't refresh the page and just make comments based on what they see.
I'm guilty of it too sometimes.
Honestly. I respond as I read. I tend not to keep reading and then go back to respond.
>Not-with-standing that being technically correct is not what anecdotes are about in the first place.
This is more than a mere technicality. The whole issue of mens rea is that one's state of mind is a factor is how someone is judged for their actions.
Your point, even without the analogy issue, is that the reason is irrelevant. That is simply not the case. Putting a security flaw in place to give the FBI a backdoor is vastly different than putting a security flaw in place due to poor coding. You may say they are both the same in that they both compromised security, but only one of these is backdooring and the damage to one's reputation is going to be different.
Now, in this particular case, the reason isn't sufficient to warrant a different judgment. But that is because of the details of this case.
That it is open source does generally allow anyone to do this, right?
But yeah, Sourceforge sucks.
That's why the typical workflow is to say in the header of your GPL license "Foo is copyright John Doe... Permission to modify is provided ..."
Sourceforge may be allowed to redistribute software with malware but as far as I can tell, copyright law should stop them from calling the software by the same name, right?
Does the author have a copyright on the gimp-win name? Maybe I don't understand the law correctly though, IANAL, etc.
That's trademark, not copyright. Though I believe some free/copyleft licenses allow you to require a name change if they make changes.
Copyright doesn't apply to names. That's trademark laws. Contrary to copyright, trademarks have to be registered and cost money. There is no registered trademark for Gimp or gimp-win in the US or Europe.
Trademarking the name of your project is considered incompatible with Free Software by a number of people. It's one of the issues that lead to the creation of Iceweasel, after Mozilla Corporation told Debian to stop distributing their builds of Firefox[1]. The issue also resulted in RMS telling people not to use Firefox.
But if we go back to the _point_ of open source, especially the GPL: It's to let users keep using and modifying and distributing modifications to the software, without needing the permission of the original authors. That's the whole point, for users to have that freedom, that the authors can not take away from you. That sourceforge can keep distributing the software without the permission of the original authors is the entire point.
To the extent that trying to prevent third parties from using the name makes it harder to distribute the software (for instance, would it require changing the source to take the name out? Would it make it harder for users to find software that the authors are _trying_ to suppress?), I think we could argue that it would be against the spirit of the GPL, regardless of what trademark law says.
Their malware is open source?
Then you say:
> 2) The author left SourceForge...
Pretty sure if you left SF with the project still up on SF, any reasonable person could consider that abandoning the project. A more responsible thing would have been to remove the project entirely and shut it down.
> 3) Is SourceForge just going to maintain any project that leaves them and makes a mirror?
I assume you mean the only obvious option is to remove the project entirely (or disable from view) for those that leave. Leaving up old code at the scale of GIMP has the potential for leaving up unpatched code that is still downloaded and used. If your opinion is that nothing should have been done at all, I think that's far worse than what anything SF did.
https://sourceforge.net/u/sf-editor1/profile/
It is part of their "mirror directory" project, which seems designed merely to get traffic from popular Open Source software, and occasionally inject malware into downloads that they can dupe people into getting from SF.net rather than the authoritative source.
And, of course, in this case, the author of Gimp-Win has plainly stated they did not abandon the SF project. They were locked out by SourceForge staff.
I'm all for caution before reaching for the pitchforks and the torches, but there's an awful lot of very large, very credible, projects saying, "Yes, SourceForge did this to our project."
I sent them an email yesterday asking for clarification, but have not received a reply.
Well, why not?