Under new management, SourceForge moves to put badness in past

Adware installers and malvertising banished, the company looks to build user trust.
It has been six months since the company formerly known as Dice (DHI Group) sold off Slashdot Media—the business unit that runs Slashdot and SourceForge to BIZX, LLC, a San Diego-based digital media company. Since then, the new management has been moving to erase some of the mistakes made under the previous regime—mistakes that led to the site becoming a bit of a pariah among open source and free software developers.

In an e-mail to Ars, Logan Abbot—the new president of Slashdot and SourceForge—said, "SourceForge was in the media a lot last year due to several transgressions, which we have addressed since the acquisition. Unfortunately, the media has thus far elected not to cover the improvements (probably because bad press is more popular)." In the conversation that followed, Abbot emphasized the transformation underway at SourceForge.

Abbot has an uphill climb, to be sure. The shifting nature of the software development world has made repositories such as GitHub a go-to for open source projects of all sorts, while the focus on application downloads has shifted heavily toward the mobile world. But Abbot said he believes SourceForge is still "a great distribution channel," and that developers will come back to host with the repository "when end users see us as a trusted destination once again."

Abbot attempted to start the process of getting people to trust SourceForge again last week with a sort-of Ask Me Anything session on Reddit's Sysadmin subreddit. His openness was well-received. But he and Slashdot Media may have a bit more work to do before they can shake off the damage done during DHI's tenure.

The fall

The trust of end-users has been somewhat bruised, to say the least. SourceForge, under DHI's ownership, had become a den of deceptive advertising, with download pages filled with "advertisements" that disguised themselves as download buttons. These ads were often "malvertising," linked to borderline or even malicious downloads. And they were frustrating to developers. Despite DHI's pledge to police the ads, they continued to spread—and many developers moved their projects to their own sites.

But even as some projects checked out, SourceForge continued to host many departed open source projects—"mirroring" them without developers' knowledge and in some cases wrapping them in custom installers that doubled as a revenue source. The adware installers were part of SourceForge's "DevShare" program, which was originally intended to be a voluntary revenue-sharing program—generating money both for SlashDot and those hosting their software on the site.

Last May, the development community for the GIMP image manipulation tool found that SourceForge had closed down the inactive SourceForge account for the site and had set up a mirror of GIMP for Windows under the control of SourceForge editors. The GIMP code in the "mirror" account was wrapped with a DevShare installer. Other projects that had been inactive also claimed that SourceForge editors had seized control of their project accounts on the site, putting them behind similar installers. Less than a month after the outcry, DHI announced that it would be selling SourceForge and Slashdot.

Goodbye to all that

About two-thirds of Slashdot Media's employees kept their jobs after the transaction was complete, Abbot said. "Whenever there are mergers or acquisitions between two companies there is almost always some overlap in job functions, which is what happened in this case," he said. "The majority of those who came over are still on board." Aside from the redundancies, Abbot and the management team set out to perform immediate damage control.

When the acquisition closed, Abbot said, "The first thing we did was eliminate the DevShare program that bundled adware in installers." While DHI said that it had ended the practice of using DevShare installers with open source mirrors after the controversy boiled over last summer, the "bundle" offers were still a major chunk of the revenue strategy for the site before the acquisition.

There are still ads—and lots of them, since SourceForge's business model is driven by advertising. But the company put a staff member full time on the job of hunting down deceptive download button ads and blacklisting the advertisers behind them. "Ninety-nine percent of these ads are removed," Abbot noted, "and we are about to roll out a reporting system where any user can report a bad ad for blacklisting. We have not announced this yet, but it is live for 30 percent of our user base and will be fully live by the end of this week."

"There were some other security-related moves made early on," Abbot said. "In addition, we rolled out full HTTPS support for SourceForge.net."

SourceForge now also is partnered with BitDefender to provide malware scanning of all the projects uploaded to the repository. "We also run a scan with ESET," Abbot said. "Every project has been scanned, and if it has any malware or adware in it, then we will disable downloading unless a user bypasses a very prominent red warning badge. The vast majority of projects did not contain any malware or adware, but of the projects that did, their developers addressed the situation in the vast majority of cases."

And SourceForge is also embracing GitHub—with a tool that will allow developers to import and synchronize projects from GitHub. Abbot said differentiating from GitHub isn't a problem. "GitHub has raised a lot of money, and they have a different model than us, but I think the jury is still out on how sustainable that model is," he suggested. "We're also different than GitHub. For end users, we believe SourceForge is still the easiest place to download software that is ready to use, and be up and running in no time."

Repository ethics

Some in the free software space don't think SourceForge has come far enough yet to earn their trust. The Free Software Foundation recently released an "Ethical Repository Criteria" list, and it gave SourceForge a failing grade (though to be fair, they also flunked GitHub, and only GNU Savannah received an "A"). SourceForge failed because:

Important site functionality doesn't work without JavaScript or with LibreJS enabled.
It rejects users from certain countries.
Abbot explained that those things were not about to change—but were probably not fair criteria. "We reject users from certain countries because SourceForge hosts cryptographic software," he noted, "so we are bound by United States export laws. As for the Javascript point, the majority of our core features work without Javascript. Our revenue model is also largely driven by advertisements in order to keep SourceForge completely free, so there is Javascript in that respect, but we do not play ads for any logged in users at all."

There have been some notable improvements in transparency in regard to how SourceForge handles those mirrored free and open source software projects. While SourceForge still runs mirrors of open source projects, the pages for those projects now have a prominent notice that alerts users, "Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information."

This all adds up to a significant reversal of approach from where SourceForge was this time last year. It may take more to get developers to reconsider distributing their projects' compiled code through the repository. But even with the hit SourceForge has taken reputation-wise, the site is "profitable now," Abbot said. That may say as much about search engine optimization and the site's advertising density as it does about the loyalty of die-hard SourceForge users, who are still downloading in droves.