Their mirrors system is working very well. It's very easy to distribute big files (like ISO images) through Sourceforge's mirrors. No wonder that Adobe's leaked users database was (or still is) being distributed using Sourceforge mirrors.
It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet.
In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html )
HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.
Sourceforge is very user-oriented (in contrast, GitHub is very coder-oriented). Non tech-savvy users don't know how to download software using torrents while HTTP just works using one click.
For users with adblock. I would never send my technically illiterate friends to SF as there is a high chance they click on an ad instead of the real download.
edit - I mean when at work, I can't torrent any large ova's or iso's. Sadly fortune 500 america will hardly ever allow torrent through their firewall for obvious reasons.
We considered building torrent into the PortableApps.com Platform and getting users to help share bandwidth with other users, but those stumbling blocks are pretty big ones.
Most companies also block random software like PortableApps.com.
But I think writing off torrents because companies filter them isn't a reason to do so.
As long as they can download random executables and run them, they'll be able to download torrents, either via .torrent files, magnet links, via a proxy or whatever method they figure out.
Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.
>Like it or not, even with all the legitimate uses torrent has, to many people it's about stolen software, stolen music, stolen movies, and porn.
I think that's a little far-fetched, nearly all open source projects utilize torrents for distribution with noone blocking them. Torrents are just the default way of providing high-speed software mirrors these days.