Investigate alternative download hosting away from Sourceforge

[mfc]

Sourceforge has very poor practices:

• http://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/
• http://arstechnica.com/information-technology/2015/06/sourceforge-locked-in-projects-of-fleeing-users-cashed-in-on-malvertising/
• http://arstechnica.com/information-technology/2015/06/black-mirror-sourceforge-has-now-siezed-nmap-audit-tool-project/

Maybe investigate if the ISO and signature can be hosted on github:

• https://git-lfs.github.com
• https://github.com/early_access/large_file_storage

Hosting the signature on github at minimum might make more sense, and github implements HSTS which is a plus.

In a similar vein, I'm going to open an issue on setting up a official torrent file, as Tails and Whonix provide, for an official alternative download mechanism.

[marmarek]

Everything moved out of sf.net thanks to generous contribution.
Should we close sf.net account?

[marmarek]

Everything moved out of sf.net thanks to generous contribution.
Should we close sf.net account?

[mfc]

Awesome!! So happy.

For now I recommend not closing the account, but instead just have a
stub and redirect folks to the current infrastructure / website downloads.

In the past when projects abandoned sf.net, the sf.net folks took over
the project pages and keep hosting the projects but wrapped the
downloads with malware (see the Ars Technica articles mentioned earlier).

Maybe they have changed their policies, but maybe redirect folks for a
while just in case folks have hard-linked to the sf.net page at some point.

Marek Marczykowski-Górecki:

Everything moved out of sf.net thanks to generous contribution.
Should we close sf.net account?

---

Reply to this email directly or view it on GitHub:
#1021 (comment)

[mfc]

Awesome!! So happy.

For now I recommend not closing the account, but instead just have a
stub and redirect folks to the current infrastructure / website downloads.

In the past when projects abandoned sf.net, the sf.net folks took over
the project pages and keep hosting the projects but wrapped the
downloads with malware (see the Ars Technica articles mentioned earlier).

Maybe they have changed their policies, but maybe redirect folks for a
while just in case folks have hard-linked to the sf.net page at some point.

Marek Marczykowski-Górecki:

Everything moved out of sf.net thanks to generous contribution.
Should we close sf.net account?

---

Reply to this email directly or view it on GitHub:
#1021 (comment)

[adrelanos]

+1

[adrelanos]

+1