SourceForge and Csound
| Date | 2015-05-29 22:51 |
| From | Paul Batchelor |
| Subject | SourceForge and Csound |
| Attachments | None None |
As many of you probably already know, SourceForge.net has been caught bundling adware with GIMP, and many other applications:
According to the downloads page, the latest Csound builds are still hosted on Sourceforge: http://csound.github.io/download.html Is there any reason why we still have them there? We've migrated the Csound git repo to github, can we move the builds to github as well (or someplace other than SF)? It's very doubtful that SF is going to recover from this, and I imagine less and less people will want to use this to download the latest builds of Csound. -P |
| Date | 2015-05-30 13:39 |
| From | Nick Arner |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
I would definitely agree with this...SourceForge has proven to be very irresponsible. On Fri, May 29, 2015 at 5:51 PM, Paul Batchelor <ralphbluecoat@gmail.com> wrote:
Nick |
| Date | 2015-05-30 14:21 |
| From | Dave Seidel |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
+1 On Sat, May 30, 2015 at 8:39 AM, Nick Arner <nicholasarner@gmail.com> wrote:
|
| Date | 2015-05-30 14:24 |
| From | Victor Lazzarini |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
I'd be happy to consider our options. Victor Lazzarini Dean of Arts, Celtic Studies, and Philosophy Maynooth University Ireland
|
| Date | 2015-05-30 14:32 |
| From | Kevin Welsh |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
Another +1 On May 30, 2015 9:25 AM, "Victor Lazzarini" <Victor.Lazzarini@nuim.ie> wrote:
|
| Date | 2015-05-30 14:35 |
| From | Dave Seidel |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
One possibility to consider (I have no experience with it, but it's apparently free for OSS): https://bintray.com/ On Sat, May 30, 2015 at 9:24 AM, Victor Lazzarini <Victor.Lazzarini@nuim.ie> wrote:
|
| Date | 2015-05-30 14:39 |
| From | Rory Walsh |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
I've been releasing builds via github without any issues. They have a releases page that is easily set up. On 30 May 2015 at 14:24, Victor Lazzarini <Victor.Lazzarini@nuim.ie> wrote:
|
| Date | 2015-05-30 15:12 |
| From | jpff |
| Subject | Re: SourceForge and Csound |
Also if we bail out of SF we eed to consider two mailing lists as well
==John ff
------------------------------------------------------------------------------
_______________________________________________
Csound-users mailing list
Csound-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/csound-users
Send bugs reports to
https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here |
| Date | 2015-05-30 15:19 |
| From | "\\js" |
| Subject | Re: SourceForge and Csound |
hola
On 05/29/15 17:51, Paul Batchelor wrote:
> According to the downloads page, the latest Csound builds are still
> hosted on Sourceforge: http://csound.github.io/download.html
>
> Is there any reason why we still have them there? We've migrated the
> Csound git repo to github, can we move the builds to github as well
> (or someplace other than SF)?
i also would like to see a move away from sourceforge ... "it ain't like
it used to be!" what about csounds.com?
just another stop on the csound distribution trail ... [might be
interesting to track the distribution history of csound, reflecting
changes in network and culture]
------------------------------------------------------------------------------
_______________________________________________
Csound-users mailing list
Csound-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/csound-users
Send bugs reports to
https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here |
| Date | 2015-05-31 13:29 |
| From | Paul Batchelor |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
It makes the most sense to be releasing builds github, especially if they have it built in. I wouldn't know where to migrate the mailing list, but to me that has a lower priority. On Sat, May 30, 2015 at 10:19 AM, \js <johns@or8.net> wrote: hola |
| Date | 2015-05-31 13:59 |
| From | Victor Lazzarini |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
The thing is that github is nowhere as good as sourceforge for releases, but we might just have to live with it. If we get out of SF, we need to move everything out, and close the project, there is no halfway house. And lists are an absolute priority, as far as I am concerned. Victor Lazzarini Dean of Arts, Celtic Studies, and Philosophy Maynooth University Ireland
|
| Date | 2015-05-31 14:11 |
| From | Nick Arner |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
As far as GitHub's releases feature, this is the page describing it. Passing along in case anyone hasn't been able to find it/come across it yet. On Sun, May 31, 2015 at 8:59 AM, Victor Lazzarini <Victor.Lazzarini@nuim.ie> wrote:
Nick |
| Date | 2015-05-31 14:18 |
| From | Paul Batchelor |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
What I meant by "low priority" was that migration could happen later. I'm assuming it doesn't make sense to do this then? On Sun, May 31, 2015 at 8:59 AM, Victor Lazzarini <Victor.Lazzarini@nuim.ie> wrote:
|
| Date | 2015-05-31 16:40 |
| From | Justin Smith |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
A thing to note regarding malware bundling: sourceforge isn't just randomly bundling malware. The reason the malware-loaded installer was used is because the gimp project had pulled out and stop providing an installer on sourceforge. If csound stops providing sourceforge downloads, we shouldn't be surprised if sourceforge starts providing a malware bundled installer for csound. On Sun, May 31, 2015 at 6:18 AM, Paul Batchelor <ralphbluecoat@gmail.com> wrote:
|
| Date | 2015-05-31 16:42 |
| From | Justin Smith |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
put clearer: there won't be a bad installer on sourceforge if we stay. There may be if we leave. On Sun, May 31, 2015 at 8:40 AM, Justin Smith <noisesmith@gmail.com> wrote:
|
| Date | 2015-05-31 16:48 |
| From | Victor Lazzarini |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
That is why I am saying that if we decide to leave, we have to bin the project there, transferring everything elsewhere in one go. Victor Lazzarini Dean of Arts, Celtic Studies, and Philosophy Maynooth University Ireland
|
| Date | 2015-06-01 16:18 |
| From | Forrest Cahoon |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
On Sun, May 31, 2015 at 10:40 AM, Justin Smith <noisesmith@gmail.com> wrote:
That's not my understanding. Quoting the Ars Technica article: Jernej Simončič, the developer who has been responsible for building Windows versions of GIMP for some time, has maintained an account on SourceForge to act as a distribution mirror. That is, he had until today, when he discovered he was locked out of the Gimp-Win account, and the project's ownership "byline" had been changed to "sf-editor1"—a SourceForge staff account. Additionally, the site now provided Gimp in an executable installer that has in-installer advertising enabled. Ars tested the downloader and found that it offered during the installation to bundle Norton anti-virus and myPCBackup.com remote backup services with GIMP—before downloading the installer authored by Simončič (his name still appears on the installer's splash screen). What I get from this is: (1) The GIMP-Win project lead, Jernej Simončič, authors an installer (2) SF simply wrapped the official installer in a malware-installing wrapper (3) Simončič discovered this when he recently tried to log in to update the project (and here I have to read between the lines, but I presume that would obviously include updating the official installer). It really seems the Csound project is caught between a rock and a hard place here. Leaving Sourceforge comes with the threat that the the project is more likely to be treated as "abandoned", but staying means depending on and giving the projects good name to a bad actor. |
| Date | 2015-06-01 16:27 |
| From | Victor Lazzarini |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
It is not really an issue, if we leave SF we just bin the project, which is (or used to be last time I looked) allowed for project admins Victor Lazzarini Dean of Arts, Celtic Studies, and Philosophy Maynooth University Ireland
|
| Date | 2015-06-01 16:32 |
| From | Nick Arner |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
So, ti seems that even if the SourceForge account for Csound is still being actively maintained, there is still the potential that SourceForge could arbitrarily decide to bundle the Csound installer with a new one with malware. On Mon, Jun 1, 2015 at 11:18 AM, Forrest Cahoon <forrest.cahoon@gmail.com> wrote:
Nick |
| Date | 2015-06-01 16:40 |
| From | jpff |
| Subject | Re: SourceForge and Csound |
I ave not decided on my view on this but yesterday I archived all the
distribution files on SF to a university server just in case we bail out.
==John ff
------------------------------------------------------------------------------
_______________________________________________
Csound-users mailing list
Csound-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/csound-users
Send bugs reports to
https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here |
| Date | 2015-06-01 17:11 |
| From | Forrest Cahoon |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
Google Groups is a possibility for mailing lists; a number of open source projects do that.
On Sat, May 30, 2015 at 9:12 AM, jpff <jpff@codemist.co.uk> wrote: Also if we bail out of SF we eed to consider two mailing lists as well |
| Date | 2015-06-01 17:33 |
| From | Jacob Joaquin |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
I second google groups. The only drawback that I foresee as a possible issue is that I believe one needs a google account. However, one can still use their existing email account and not have to get a gmail account. As from moving away from sourceforge in general, Github's best days are still in future, while sourceforge is long past its prime. Everything about the sourceforge.net site is cringeworthy. And that's before the malware. On Mon, Jun 1, 2015 at 9:11 AM, Forrest Cahoon <forrest.cahoon@gmail.com> wrote:
|
| Date | 2015-06-01 17:48 |
| From | Nick Arner |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
+1 For everything Jacob said. On Mon, Jun 1, 2015 at 12:33 PM, Jacob Joaquin <jacobjoaquin@gmail.com> wrote:
Nick |
| Date | 2015-06-01 17:51 |
| From | Dave Seidel |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
I think having a good account is necessary only if you want to be able to use the web interface. AFAIK, you can add arbitrary email addresses to the group, and they will all receive the posts, regardless of google account status. I think google groups is a good option as well. On Mon, Jun 1, 2015 at 12:33 PM, Jacob Joaquin <jacobjoaquin@gmail.com> wrote:
|
| Date | 2015-06-02 18:19 |
| From | Chuckk Hubbard |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
Well, I may differ from everyone else on this, but, all things considered, I find Google to be a far more creepy firm than Sourceforge. Sourceforge quite obviously did it for the benjamins, nothing more. Of course, I'm using Google far, far more actively than Sourceforge at the moment, but if we're talking about general creep and not specifically reputation with FLOSS, Google wins in my book. They f'king drive around photographing everything in the world. Or they use satellites. "Roads? Where we're going, we don't need roads..." Then they log where individual people go. More specifically, I don't like the idea of having to use an account with them to access anything aside from the email I actively opened with them. And I deeply despised having them automatically link my YouTube account and my Google account a few years ago; I refused, which means that, in order to use my old YouTube account, I have to sign out of my Google account. Then, to use this Gmail address, I have to sign out of YouTube. I'm not Csound mailing list user #1, so I won't raise a stink either way, but to hell with trusting Google more than the average internet company. I can imagine half a dozen things they might pull in the next 10 years to make you regret transferring the mailing list to them. -Chuckk On Mon, Jun 1, 2015 at 7:33 PM, Jacob Joaquin <jacobjoaquin@gmail.com> wrote:
|
| Date | 2015-06-02 19:44 |
| From | Aaron Krister Johnson |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
What about having a mailing list directly hosted at Nabble, since they already archive csound lists?
On Tue, Jun 2, 2015 at 12:19 PM, Chuckk Hubbard <badmuthahubbard@gmail.com> wrote:
|
| Date | 2015-06-02 19:56 |
| From | Rory Walsh |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
That sounds like a simple solution. On 2 June 2015 at 19:44, Aaron Krister Johnson <akjmicro@gmail.com> wrote:
|
| Date | 2015-06-02 21:52 |
| From | luis jure |
| Subject | Re: SourceForge and Csound |
el 2015-06-02 a las 20:19 Chuckk Hubbard escribió:
> Well, I may differ from everyone else on this, but, all things
> considered, I find Google to be a far more creepy firm than Sourceforge.
i would also prefer that the list stayed away from google. i'm tired of
having to create fake google mail accounts for all the things that
"require" one...
------------------------------------------------------------------------------
_______________________________________________
Csound-users mailing list
Csound-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/csound-users
Send bugs reports to
https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
|
| Date | 2015-06-03 13:35 |
| From | s |
| Subject | Re: SourceForge and Csound |
another vote for avoiding google [nsa] as much as possible.
if nothing else, i run the .microsound lists with mailman and would be
happy to donate the server cycles for the csound list[s]. but with all
the accomplished tech luminaries on the list [only slightly sarcastic,
for humorous effect only] someone else may have access to an even better
home for the list.
i also am suspect of nabble, but i don't have as many [good] reasons as
i do for google, i haven't looked very closely at nabble at all.
and since i'm on a bit of a roll, we shouldn't worry about what happens
at source forge if we leave there. we have no control over that. i think
we have very good reasons for leaving.
On 6/2/15 16:52 , luis jure wrote:
>
> el 2015-06-02 a las 20:19 Chuckk Hubbard escribió:
>
>> Well, I may differ from everyone else on this, but, all things
>> considered, I find Google to be a far more creepy firm than Sourceforge.
>
> i would also prefer that the list stayed away from google. i'm tired of
> having to create fake google mail accounts for all the things that
> "require" one...
--
\js [http://or8.net/~johns/] -
------------------------------------------------------------------------------
_______________________________________________
Csound-users mailing list
Csound-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/csound-users
Send bugs reports to
https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
|
| Date | 2015-06-03 15:59 |
| From | s |
| Subject | Re: SourceForge and Csound |
On 5/29/15 17:51 , Paul Batchelor wrote: > http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ now nmap too: http://seclists.org/nmap-dev/2015/q2/194 |
| Date | 2015-06-03 16:31 |
| From | Dave Seidel |
| Subject | Re: SourceForge and Csound |
| Attachments | None None |
Worse and worse. On Wed, Jun 3, 2015 at 10:59 AM, s <johns@or8.net> wrote: On 5/29/15 17:51 , Paul Batchelor wrote: |
| Date | 2015-06-03 16:38 |
| From | joachim heintz |
| Subject | Re: SourceForge and Csound |
+1
Am 02.06.2015 um 22:52 schrieb luis jure:
>
> el 2015-06-02 a las 20:19 Chuckk Hubbard escribió:
>
>> Well, I may differ from everyone else on this, but, all things
>> considered, I find Google to be a far more creepy firm than Sourceforge.
>
> i would also prefer that the list stayed away from google. i'm tired of
> having to create fake google mail accounts for all the things that
> "require" one...
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Csound-users mailing list
> Csound-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/csound-users
> Send bugs reports to
> https://github.com/csound/csound/issues
> Discussions of bugs and features can be posted here
>
------------------------------------------------------------------------------
_______________________________________________
Csound-users mailing list
Csound-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/csound-users
Send bugs reports to
https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
|