Open source software download site SourceForge has come under criticism again, this time for allegedly taking over the account of the Nmap security auditing software, according to its developer in an email to users.
The news comes days after SourceForge was accused of “hijacking” the account of image editing program, GIMP and bundling it in a downloader with adware. According to a report from Ars Technica, SourceForge has been assuming control of pages that are inactive.
“The old Nmap project page is now blank,” said Nmap’s developer Gordon “Fyodor” Lyon, who posted on Seclists after making the discovery. He claims that SourceForge, which is owned by Slashdot Media, has moved all of Nmap’s content to a new page that only SourceForge has control of.
“So far they seem to be providing just the official Nmap files (as long as you don’t click on the fake download buttons) and we haven’t caught them trojaning Nmap the way they did with GIMP,” he said. “But we certainly don’t trust them one bit!”
Lyon added that he will ask Sourceforge to remove the new page and directed users to the official Nmap website for downloading the program.
In response, SourceForge’s senior director of business development Roberto Galoppini stated that it has never modified the Nmap project at all.
“We find no indication that the “nmap” project has ever contained files, delivered any downloads, or had any changes made aside from the automated migration from our old SourceForge platform to the new platform which is powered by Apache Allura,” he wrote in a reply to Ars Technica’s queries.
“At the end of 2011, we established a SourceForge-hosted mirror of the nmap software, using verbatim copies of nmap’s releases, and have continued to keep that mirror up-to-date since.”
Earlier this week, SourceForge also published a blog stating that from now on any third party offers for un-maintained SourceForge projects will be opt-in only. This was in response to bundling ads with GIMP.
The code repository was sharply criticized for its practice when it was revealed that the Windows version of GIMP was archived on a SourceForge mirror site and loaded with third party ads, or adware. Sourceforge had done so as the GIMP page on its site had been left unmaintained with the program now usually downloaded elsewhere.
