SourceForge replacing GIMP Windows downloads

In 2013, we reported that SourceForge.net had started to redirect the download links clicked on by some users, providing those users with an installer program that bundled in not just the software the user had requested, but a set of side-loaded "utilities" as well. The practice raised the ire of many in the community, even though it was an optional service that SourceForge offered to project owners. Matters may have changed recently, however, as the GIMP project discovered that "GIMP for Windows" downloads had suddenly become side-loading installers—and that the project could no longer access the SourceForge account that was used to distribute them.

As a refresher, the SourceForge side-loading installer was rolled out in 2013 as a program called DevShare, an optional service made available to SourceForge projects. The program replaced the generic installer package that a project uploaded for users with a customized installer that bundled in several smaller programs provided by SourceForge revenue partners. These side-loaded programs had a generally negative reputation—as "adware," "annoyware," or simply junk that consumed the user's computing resources uninvited.

But there were, at least initially, some clearly defined limits. DevShare only provided side-loading installers for Windows downloads, and project owners were told that they would have full control over what their program's installers contained. Nevertheless, a lot of projects found DevShare unacceptable and some of them—including GIMP—decided to move their project infrastructure off of SourceForge entirely. Perhaps notably, SourceForge responded to GIMP's departure in a blog post, highlighting the opt-in nature and transparency of DevShare—even reassuring the community that "we will NEVER bundle offers with any project without the developers consent."

Since late 2013, GIMP has hosted its downloads for all platforms (including Windows) at the gimp.org site. Up to that point, Jernej Simončič had been the maintainer of the GIMP for Windows project account at SourceForge, which the GIMP team had used to release Windows-specific installers. After the migration away from SourceForge, the GIMP for Windows account went dormant.

So it was a surprise that, on May 26, GIMP user "Ofnuts" first sent an email to the GIMP developers' list reporting that the GIMP for Windows page was now serving up DevShare side-loading installers. Ofnuts noted that the SourceForge project page was still the target of many links (which, of course, makes it rank high in search results), and suggested that it would be better to break those links than to have users download a side-loading installer.

Simončič then replied that he could no longer access the GIMP for Windows account, "apparently due to inactivity, although they haven't done anything like that with a few other inactive projects I'm a member of" and that SourceForge had not replied to his request that it stop distributing the unauthorized installer. Jehan Pagès noted that the SourceForge page included several packages posted after the GIMP team had left SourceForge, and that "this is clearly an impersonation of the official GIMP team. The GPL license allows anyone to do forks of GIMP, or do alternative packages. But that does not give them the right to pretend to be the official upstream."

The GIMP team then posted a notice on Google Plus, accusing SourceForge of hijacking the GIMP for Windows account, and warning users to download releases only from gimp.org itself. It also added an announcement to the GIMP home page warning users against downloading the SourceForge packages. The chain of events was quickly picked up by Hacker News, Reddit, and other online discussion forums.

A little more investigating revealed that administrative access for the GIMP for Windows project had been removed from Simončič's account entirely, replaced by the sf-editor1 account. In the Hacker News discussion, "makomk" reported that GIMP was not alone in this regard. In fact, makomk said, SourceForge seems to have adopted a new policy of "taking over the project pages of projects that've moved off Sourceforge and running the pages themselves as mirrors (apparently with added extras in the installers)." This program is described by SourceForge as the SourceForge Open Source Mirror Directory.

Furthermore, the sf-editor1 account is now listed as the administrator of well over 100 open-source projects, some of which are certainly mirrors of projects (such as Firefox) that have never have been hosted at SourceForge in the past. Others (such as VLC) are former SourceForge-hosted projects that have been abandoned and turned into mirrors. For some projects with lengthy histories, it is hard to say for sure whether or not the project ever had a SourceForge account at some point in the past. Exactly which projects are affected by the side-loading installer behavior is not yet clear.

For its part, SourceForge has since posted a reply on its blog, saying that the GIMP for Windows project "was actually abandoned over 18 months ago, and SourceForge has stepped-in to keep this project current." The post also claims that it changed the status of the project "to clearly delineate it as a mirror, and change administrative control of the project to clearly delineate that it is editorially curated by SourceForge." It goes on to say that SourceForge has not heard from GIMP for Windows's author:

That statement would certainly seem to contradict Simončič's account of recent events (Simončič said in the GIMP IRC channel that he first contacted the company about the issue on May 16). It is also debatable whether or not the current SourceForge project page adequately communicates that GIMP for Windows is a mirror. There are, for example, no links on the page that take the user to gimp.org—only links to the main SourceForge Open Source Mirror Directory page.

Regardless of whether or not the SourceForge project page looks like a mirror, though, the central problem remains that it has been replacing GIMP's official Windows builds with something else, and not informing users of that fact. By late in the day on May 27, several GIMP team members (such as Michael Schumacher) were reporting that the installers offered on the GIMP for Windows page no longer included the problematic side-loaded bundles. But the GIMP team has still not heard back from SourceForge representatives.

In the mailing-list discussion, Joao S. O. Bueno suggested that the team should take the matter to the GNOME Foundation for assistance. I spoke briefly to some members of the GIMP development team who said that, as of now, there is no plan to pursue any legal resolution to the situation—but that this is as much a pragmatic decision as anything else. Right now, the team just wants to "kick up a bit of a fuss" and quickly inform the public of what is going on. Requesting any formal legal advice would take much longer.

At the moment, the GIMP team appears to be winning the public-relations battle, so "kicking up a fuss" may prove to be the winning strategy. Nevertheless, there are still a lot of unanswered questions from this series of events, not the least of which is how many other open-source projects in SourceForge's mirror directory are still delivering Windows installers that are side-loaded with unrequested software addons—without the consent of the project teams. Given that the site performs OS detection and geolocation before redirecting a download request to a specific installer file, it can be a bit difficult to say for sure which projects' downloads are being affected—but the development community is certainly taking a close look.