I would urge the Mumble team to consider leaving SourceForge

[Richard Barnes]

SourceForge, has for years been a place where open source software can thrive. Recently they have been changing how they have been dealing with accounts and they have been packing malware/adware into the install packages.

I would urge the Mumble team to reconsider using SourceForge, switch to a truly open repository system and place your source and binaries there.

for more information;

http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/

http://helb.github.io/goodbye-sourceforge/

[fwaggle]

I can't speak for the project, but most of our stuff has been off SF for a long time now. The authoritative repo is in github, which is where we keep pull requests and some of the bugs (I'm not sure if all the bugs were moved over or not). The forums and Wiki were both moved off SF a while ago too - we've been steadily working on ditching SF since the last time SF did something shady, but I think the wiki and forum issues were due to performance, not necessarily questionable behaviour from SF.

I guess a good starting place for the actual discussion is how much stuff do you actually think is still at SF in a critical fashion, and where do you think they should be moved to?

[Richard Barnes]

I worry mostly about the binaries. SF seams to be repacking installers with mallware/adware and that is what I think would be the most harmfull to mumble.

[fwaggle]

I worry mostly about the binaries. SF seams to be repacking installers with mallware/adware and that is what I think would be the most harmfull to mumble.

 

Yeah, I can't speak to the plans of that as I have nothing to do with that. I feel like the snapshots are already hosted outside of SF anyway I think? But again, I can't speak to that you'll have to wait for someone else to chime in.

[ngollan]

I worry mostly about the binaries. SF seams to be repacking installers with malware/adware and that is what I think would be the most harmful to mumble.

No they generally don't. Projects can choose to include the adware installer. The GIMP incident hit an abandoned 3rd party project, and yes, that was a dick move on behalf of SFnet.

Mumble uses that service for two things, one is the stable downloads (because it's cool to have a free* globally distributed CDN), and for feature requests (because the github tracker is lacking features like voting).

Oh, and SFnet also allows any logged in user to edit anonymous tracker comments, so I guess that's a bonus :roll:

(edit while I'm correcting typos) It's cool to see some initiative, but at the same time it's annoying to only ever see people croak about things when there's a totally out-of-the-water and at best half-understood media hype around something.

[kissaki]

What ngollan said is correct. As long as you keep your project, which we do, they don’t mirror installers with adware.

We do and will be uploading releases to sourceforge for the forseable future.

Snapshots are already hosted from our own domain.

We already have a plan going forward, moving our *primary* binary hosting elsewhere. It’s a bit of work though, so it has not happened yet.

[Richard Barnes]

I worry mostly about the binaries. SF seams to be repacking installers with malware/adware and that is what I think would be the most harmful to mumble.

No they generally don't. Projects can choose to include the adware installer. The GIMP incident hit an abandoned 3rd party project, and yes, that was a dick move on behalf of SFnet.

Mumble uses that service for two things, one is the stable downloads (because it's cool to have a free* globally distributed CDN), and for feature requests (because the github tracker is lacking features like voting).

Oh, and SFnet also allows any logged in user to edit anonymous tracker comments, so I guess that's a bonus :roll:

(edit while I'm correcting typos) It's cool to see some initiative, but at the same time it's annoying to only ever see people croak about things when there's a totally out-of-the-water and at best half-understood media hype around something.

 

Fair Enough, I understand what you have said, and the features that SF supplies where Git does not do add to the community. I personally have had problems with Sourceforge / Slashdot since the DHI (DICE) Group purchased it. When money controls direction there are bound to be progressions like we have seen with projects like "GIMP". This is just the tip of the iceberg, this will descend further down as adshare gets smaller and stock price are affected.

All I ask is that the project be aware of the problem and monitor changes so that Mumble does not become embroiled in issues with SF. I love mumble use it everyday, I don't want the project to have issues due to some uncontrollable factor.

[hacst]

We already moved from serving our downloads for the recent 1.2.9 release from SF to github. We'll keep uploading to SF for the forseeable future though. There's lots of links out there referring to it for our project and that's the safest way to stay in control of it.

In general all of our releases are signed so it's not that simple to get away with modifying our stuff anyways (not that it doesn't still happen....).