SourceForge's GitHub Importer

>>> jimrandomh (https://news.ycombinator.com/item?id=17281278)

>>> It's actually worse than that. As an open-source developer deciding where to host a project, I not only need to trust the host, I also need to expect users to also trust the host. If I expect 10% of potential users to bounce when they see that it's hosted on Sourceforge, well, hosting is enough of a commodity that I have no reason to give up on that 10%.

>> exikyut

>> I think you've unpacked why SF is - sadly - not quite dead, but not quite as alive as it used to be.

> loganabbott [flagged] [dead]

> I could probably say the same thing about you though

---

Wh-- uhh, no. To answer your statement, I've historically been in somewhat bad shape with various mental/other health issues that I've only begun to understand and properly remedy very recently. So, I'm the most alive I've ever been (and still improving).

Okay, maybe responding that way was a bit tangential. I'm honestly not sure how to interpret your comment though. (For what it's worth, I wasn't personally uploading anything to SF when it was in its heyday, kind of because I wasn't. I did know about and download stuff though, like other developers and power/ordinary users.)

I began mentally drafting a reply to your other comment https://news.ycombinator.com/item?id=17282035 before noticing this one. I think this is the more appropriate comment for me to reply to {I said this before the comment died}, and I'll fold in the sentiment I was going to say to the other here.

Reading the other comment, I understand your somewhat frustration. Here's my perspective as a would-be developer and general intermediate-advanced user (and particularly as a frequent lurker of HN): all I've (and presumably we've) got to work with are the dead-chewing-gum armchair opinions and cargo cult views and reiterations about "yeah someone bought it (nothing seems to have happened since then though)". That's literally the only noise being made around here in terms of "news" or "updates" we get about SF. It's as bad as the lowest-quality commentating on reddit (and I consider that very bad, considering the bent towards intellectualization and healthy debate on here).

IMO, you need to work on advertising your [new] position. It will probably be an uphill (even vertical?) slog for longer than likely comfortable (maybe even financially so - ie, it sounds like some decent, long-term social media management chops may be needed).

That's a bit of a broad statement, so let me add some more data to characterize what I mean.

The open source landscape's changed a lot. Or, in less words, "everyone switched to GitHub"; or at least "all" the developers did - but that means so did all the users wanting first-hand software updates from the devs who switched. Of course only power users (or those following scripts) likely actually clone; it'd be interesting to see what projects[' users] primarily use Releases or other mechanisms to get their updates. In any case GH is the core of a lot of operations nowadays (by "operations" I mean different projects).

I am genuinely interested to learn more about the million users a day you say visit SF. Let me clarify what I mean by "interested".

Firstly, to be frank, I'm kind of amazed that a million people a day visit SourceForge and want proof :) because that's truly impressive. I don't disbelieve you, note; I just kind of want to do a trust-but-verify.

Next, from my own perspective, when I think of GitHub I see it as something most other developers either understand or, at the very least, vaguely know about as "the scary place where you have to use the commandline to make it work" (hopefully this subgroup doesn't get stuck for too long :) ). Generally in terms of publishing libraries and small programs GH removes about 98% of friction, for two reasons. First it uses Git, which (once you at least learn the clone command) Just Works™ with GitHub because GitHub URLs can be pasted straight to Git, https:// and all, and it figures it out. Secondly everyone has at least a vague understanding of Git and GitHub and there are a billion (approximately) videos and websites so people can easily find 100 things all in their preferred presentational style to get started with.

So from a social networking standpoint GitHub provides a level of predictability; I as a publisher can partially know what to expect in advance in terms of userbase and social network. Okay, so you say SourceForge has a bunch of people on board; as a developer, or an artist, or $abstract_computer_person_with_arbitrary_agenda, what can I expect in terms of connections and demographic from SourceForge? The platform itself is a gateway and an enabler; I'm frankly less interested in SF itself (that it supports SVN, Git, etc; or that it supports wikis, etc) than who it can connect me with, and what I can expect of them.

I can opine/surmise a tiny tiny fraction of the kind of thing I'm getting at when I download random obscure computer-science related things and an eyebrow goes up when I see "18 downloads/week" and I think "...how?! lol" (I know the number is valid because my download bumps it up :P). It would be pretty cool for GitHub to publicize the same kinds of statistics, but it's (sadly) probably easier to single out a rogue browser than a Git client.

It would be cool to leverage those statistics to connect obscure niche interest groups - the current approach of "insert email here [_______] (we Most Definitely© Won't® send you things you won't be interested in™)" doesn't really scale to hundreds of interests per user, to be honest.

So, that's the demographic question. Here's something potentially trickier.

I can't say I'm a fan of SF's interface. My main problem is that it is very very heavy. On the 12-year old machine I'm using right now it takes a lot longer to load a SF page than a GH page. This isn't because of the ads, which I'll honestly say I have nuked via /etc/hosts, primarily as a sanity measure (if ads kill browsing on modern machines, try browsing with ads enabled on a single-core 32-bit Pentium M that takes 45sec to open a new tab :D)... it's just that the pages are really heavy. Besides system load (which isn't really a legitimate statistic, I'll accept that), I definitely far prefer GitHub's much more to-the-point approach. It seems faster and more fluid.

There is one specific area of the UI that bothers me a lot: the "recommended downloads", which seem to be the same for me, every time I visit, and include a link to... Apache OpenOffice. Um. This is... dishonest? Everyone knows LibreOffice is where the development is at.

I realize this last point be a hard one to answer. I'll offer two things. Firstly, I understand that GitHub was developed as a green-field from-scratch platform, it got to start again, and it started with a somewhat different, leaner approach: just offering a Git UI, with nothing else on the webpage. So there's that. Secondly, I understand that what you bought had a lot of, er, state in the air that needed to be maintained to keep the ecosystem running smoothly (and happily).

With the above said, I don't know what arrangements are in place behind the scenes, but I do think recommending OpenOffice is a tiny bit much from where I stand.

To sum up, I want to understand what I can get out of SF, I think it would be nice to clean the pages up (the redesign is nice, but I feel it removed a lot of info while retaining the "weight" (imposingness?) of the old design), it would be nice to understand some of the machninations behind SourceForge today, and it would be cool to better connect users and developers with each other. If a million people a day are visiting, learning about that hive of activity will attract me to the platform.

All of this doesn't need a direct reply; I would be very happy to see a highly-upvoted blog post or similar thing posted to HN sometime :)

(Obviously I can't express interest in the behind-the-scenes aspects of SF I don't know about. An in-depth exposé on how SF is currently run would probably be very interesting to some people here.)

When you guys came back and solicited feedback and ways to improve, I begged you to follow suit.

I have no intention of crapping on SourceForge. I am merely making an observation. I think many would agree that users have lost trust in Sourceforge regardless of the history or current state of ownership.

In fact, I used to appreciate loganabbott's (the new president of Sourceforge) attempt to amend SourceForge until today when I see the same person posting insinuating and insulting comments towards potential users.

I have no intention of crapping on SourceForge because SourceForge is largely irrelevant to me. I host my projects on GitHub these days. If GitHub becomes untenable for any reason, I might move to Gitea. But I am definitely not coming back to Sourceforge after seeing these juvenile comments coming off from the president of Sourceforge in this thread. Don't know about others but he has definitely managed to piss me off as a user.

Regarding why Sourceforge gets the kind of flak other companies don't, I have commented about it here: https://news.ycombinator.com/item?id=17281519 (again this is merely a conversation, not a passing of judgement).

sourceforge is a more niche product.

I am very much aware and I followed the HN thread [1] when you acquired Sourceforge and when you commented extensively trying to reassure us that you will turn Sourceforge around. Sure you have made efforts but I think it is quite clear that the good measures you took came a little too late.

Frankly, your comments in that acquisition thread [1] were more balanced and matured. The comments you are posting in this thread are coming off as immature.

You also seem to be misinformed about Websense. Websense and other web application firewalls and content gateways are very much in use in many corporate networks including mine. Looks like I am not the only one with this issue.[2]

[1] https://news.ycombinator.com/item?id=11092219

[2] https://news.ycombinator.com/item?id=14388551

anecdotal but i work at a megacorp with a 6-figure headcount, and i've seen a websense message or two.

We can't all be experts, but we all need to make a choice, and "that site that started posting malware" is not a compelling option no matter what happened afterwards. This is super unfortunate, but it's true, and I imagine it's the same reason why web filters and reputation indexes have been unkind.

But I think that's not even the worst problem. SourceForge was definitely on a decline before the adware incident. Like, many of us will feel uneasy about GitHub under MS, and I already don't know how much I trust young venture capitalist funded websites with my important data. Still, GitHub changed the game with their non-advertising-based profit model and now it feels weird to even consider going back. Frankly, I feel a bit dirty when downloading FOSS from a page with ads and a countdown even though SourceForge is not the only one doing that.

Truthfully, I do want to love SourceForge the way we all used to, but I find it challenging. The adware-supported installers just felt like a super evil extension of the profit model SourceForge already had, and the association in my head stuck. I doubt I'm the only one.

None of this is fair to you, the person trying to fix all of this, but of course whether it's fair or not isn't going to matter. Insulting people who aren't giving you a fair shake is probably not going to help your case, though I certainly sympathize with you.

In those years, most of the developers who chose to host their projects on Sourceforge strongly believed in this ideology. GPLv2 was the most popular open source license then. Given all this, it makes sense that those early users who held freedom of software to be sacred were very pissed when Sourceforge decided to bundle closed source adware into the binaries of these open source projects without the explicit permission of these open source developers.

Times have changed a lot since then. GPLv2/v3 license is now considered too restrictive and the MIT license is more popular. Most of the tech community understands the concept of open source more or less. The movement in favor of software freedom has begun to lose momentum. Open source software makes a lot of business sense, so we don't need the push for open source software anymore like we used to in the early 2000s.

Even some people like me who once would run nothing but completely free operating system with free tools have now begun to use proprietary drivers because as we have grown older, got busy, with kids and family, the time spent tinkering with open source drivers is not worth it, we would rather use something that just works. When we use Microsoft and Facebook we know what we are getting into and most of us are more or less okay with it. It's different times and different kinds of users. That explains why Microsoft and Facebook do not get penalized as heavily as Sourceforge did. Sourceforge violated something that was held sacred during those times. Microsoft and Facebook have no notion of sacred-anything.

Second, what SourceForge did was worse than your examples. They modified trusted applications to add essentially a malware payload. This is worse than Facebook collecting too much data and being shady with it. SourceForge was installing spyware on machines without permission. This betrayed the trust of both users and publishers and even damaged users’ trust in those publishers.

The only one of your examples that is comparable is Lenovo’s Superfish mess, and in that case they only betrayed users, not publishers. Not that it actually makes it better, but it changes the impact to Lenovo.

Disclosure: Microsoft employee.

Not assuming absolute malice, but I am really curious.

Yes it is. There is a certain consistency/uniformity to the url and site structure with Github that Sourceforge does not have, for whatever reason. Not to mention the absence of the mirror choosing routine. I really appreciate the ease and simplicity of Github downloads, which is precisely why I am concerned about the future.