Lunarsoft

SourceForge takes over GIMP for Windows and bundles adware

Published

SourceForge, the code repository site owned by Slashdot Media, has apparently seized control of the account hosting GIMP for Windows on the service, according to e-mails and discussions amongst members of the GIMP community—locking out GIMP’s lead Windows developer. And now anyone downloading the Windows version of the open source image editing tool from SourceForge gets the software wrapped in an installer replete with advertisements.

Update: In a blog post issued shortly after this story posted, an unidentified member of SourceForge’s community team wrote that, in fact, “this project was actually abandoned over 18 months ago, and SourceForge has stepped-in to keep this project current.” That runs counter to claims by members of the GIMP development community.

The GIMP project is not officially distributed through SourceForge—approved releases are only posted on the GIMP project’s own Web page. But Jernej Simončič, the developer who has been responsible for building Windows versions of GIMP for some time, has maintained an account on SourceForge to act as a distribution mirror. That is, he had until today, when he discovered he was locked out of the Gimp-Win account, and the project’s ownership “byline” had been changed to “sf-editor1″—a SourceForge staff account. Additionally, the site now provided Gimp in an executable installer that has in-installer advertising enabled. Ars tested the downloader and found that it offered during the installation to bundle Norton anti-virus and myPCBackup.com remote backup services with GIMP—before downloading the installer authored by Simončič (his name still appears on the installer’s splash screen).

Apparently, SourceForge’s mysterious “sf-editor1” has also claimed ownership of a number of other accounts for open source and other software projects. The following are just a sampling of downloads now “brought to you by sf-editor1”:

  • Most of the Apache Foundation’s projects—including Allura, Derby, Directory Studio, the Apache HTTP server, Hadoop, OpenOffice, Solr, and Subversion;
  • The Mozilla Project’s Firefox, Thunderbird, and FireFTP;
  • The Evolution and Open-Xchange mail clients;
  • The Drupal and WordPress content management systems;
  • The Eclipse, Aptana, Komodo, MonoDevelop, and NetBeans integrated development environments;
  • The VLC, Audacious, Banshee.fm, Helix, and Tomahawk media players;
  • The Reaver WPS Wi-Fi hacking tool;
  • and a host of games, utilities, and other applications.

Many of these are projects that abandoned their SourceForge accounts—only to have SourceForge staff pick them up and keep them active. The Apache accounts appear to be recently updated, while others haven’t had new code releases since 2012. SourceForge has set these accounts up as “SourceForge Mirrors” for popular open source projects.

“Millions of people use SourceForge every day to search for Open Source software, and we want to give them the best experience possible, even if the best answer to their search is a project hosted elsewhere, or an abandoned project newly maintained by the SourceForge team,” a SourceForge team member wrote on the site’s open source mirror page. “By mirroring these projects here, we come a step closer to that reality. And, in the process, we do those projects a small favor in return, providing another way to get to their website, and being part of their software distribution mirroring network. We’re putting your software in front of more than 42 million additional potential users a month.”

According to the same page, SourceForge’s community team wants feedback from open source developers—”If you want your project mirrored on our site, or if you don’t want your project mirrored on our site, please let us know.” The site does not say, however, that those requesting not to be mirrored will be automatically opted out.

The majority of these projects are hosted directly by SourceForge as-is, with no ad-driven installers. However, the GIMP for Windows installer is hosted through the goodbundlecenter.com content delivery network—a service with a domain registered through the Israeli registrar Galcomm’s privacy protection service.

Update: A representative of SourceForge direct-messaged Ars via Twitter shortly after this story posted, with a link to a blog post from the SourceForge Community Team, stating that the GIMP-Win project page had been taken over by SourceForge because it had been abandoned. “Based on our prior outreach to the GIMP-Win author, we understand that they had concerns about the presence of misleading third-party ads on SourceForge.” Many of those ads include fake download buttons that deliver other software products—some of which may be laden with adware or even malware. SourceForge launched an initiative called “BlockThis” to try to stop “misleading ads,” but they are still legion on the site’s download pages.

SourceForge also admitted to putting bundle-ware installers on some open source projects. “Mirrored projects help enable end users to stay current with the latest releases, particularly where SourceForge continues to house historical releases for community benefit,” the unidentified spokesperson wrote. “Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available.”

Source: ArsTechnica

Tags: