What next after sourceforge.net?
This discussion is connected to the gimp-developer-list.gnome.org mailing list which is provided by the GIMP developers and not related to gimpusers.com.
This is a read-only list on gimpusers.com so this discussion thread is read-only, too.
| What next after sourceforge.net? | Mukund Sivaraman | 29 May 05:39 |
| What next after sourceforge.net? | Kevin Brubeck Unhammer | 29 May 07:43 |
| What next after sourceforge.net? | Øyvind Kolås | 29 May 13:32 |
| What next after sourceforge.net? | Hanno Böck | 29 May 17:51 |
| What next after sourceforge.net? | Michael Schumacher | 29 May 18:35 |
| What next after sourceforge.net? | Sam Gleske | 30 May 01:46 |
| What next after sourceforge.net? | Michael Schumacher | 30 May 14:25 |
What next after sourceforge.net?
Sourceforge deceived us but this problem seems to be more widespread. What are some steps we can take to avoid problems for users and inform them?
(For purposes of defining malware below: A user wishes to install GIMP. The user does not expect the installer to side-load other software that is often undesirable, whether it does so without asking or not.)
From The Free On-line Dictionary of Computing (20 July 2014) [foldoc]:
malware
Any {software} designed to do something that the user would not wish it to do, hasn't asked it to do, and often has no knowledge of until it's too late.
First, note that Sourceforge doesn't appear as that old project host. Even if we don't have a project there, they "mirror" projects with the side-loading malware installer so that they can profit from the work of others. They are able to do this because Sourceforge was once trusted by users as a reputed provider of free software. The installer that eventually gets used is ender's, so they are not even building GIMP for Windows. They have made no contributions to GIMP for Windows. We have not asked them to continue to update a mirror for GIMP.
Sourceforge is not alone in making such side-loading malware installers. A Google web search for "gimp" or "gimp download" returns numerous crapware results and just 1 legitimate result. They all claim to make GIMP available for download. Note that you will not find free-as-in-beer commercial software like Google Earth for download through their malware installers on these websites (they link to the respective software's website for these), just free software projects which are not capable of defending themselves are chosen to exploit.
The GNU GPL gives a lot of freedom to use, modify and redistribute software. Many developers/contributors of free software actually want this. They put their hearts and minds into improving software so that the general public can benefit from the software and don't face any restrictions. There is little that contributors expect.
There are some who are taking advantage of that freedom by misrepresenting the creators of that software and fool the public in order to profit. Profiting from free software is a good thing, but there are right and wrong ways to do it.
When it comes to software projects, copyright and name (the mark) are two rights that creators of the effects have. The GNU GPL gives a lot of rights away so that the software is free. But it doesn't exactly allow misrepresentation and masquerade.
Many distros ship GIMP, even slightly patched versions for bugfixes or better integration into their environments. This improves the experience for users. Formally registering a GIMP trademark may not be seen in a good light by distributions, even if we readily wish to see them use the name. See Firefox vs. Iceweasel for example.
Even though GIMP is an established project, we generally don't want to spend time as contributors to fight a legal battle. There are even questions of whether we *should*, i.e., whether an established free software project has to register trademarks and involve lawyers to protect it from being misused this way.
Looking forward, we would like to protect our users in some way. This would actually make a difference to users, rather than fighting some battles.
1. Discourage wrapping of real installer inside a side-loading installer ------------------------------------------------------------------------
Red Hat distributes ISO images of its Enterprise Linux project to its customers. The ISO images contain RPM packages, which further contain compiled binaries of various projects licensed, among others, under the GNU GPL license. Though Red Hat distributes the sources for all software, the ISO images are not put up for redistribution.
The GIMP installer EXE file is a binary archive, that contains, within it, the compiled object files from GIMP's source code, and various resources and other files. The installer EXE, though it is a program, is not technically a derived work as per the GNU GPL as it is not ever linked to GIMP. The installer EXE is also signed by ender (Jernej Simončič).
It is non-trivial to make this GIMP installer EXE for those who have not spent a significant amount of time learning how to do this. The way that most side-loading malware installers like Sourceforge.net's operate, is that after installing crapware, when the time comes to actually install GIMP, they take ender's installer as-is and run it.
Without losing sight of the principles of free software, we might add a notice alongside this binary installer about what kinds of activity are not allowed with this specific installer EXE so that our users don't end up being fooled.
2. Cleanup search results -------------------------
If a user searches for "gimp", they ought not to see downloads for GIMP that fool the user into installing other things on the machine. There is only one legitimate result for the actual stable release of GIMP, and several results for side-loading installers even within the first page on Google. All of these masquerade as GIMP. There are even results that show up with notices like "Trusted download of GIMP".
Google has various categories on how to takedown such malware results that misrepresent projects. It seems that such side-loading installers fall into more than one category. Contacting someone at Google to ask about it would be best, as we'd have to maintain this as more such side-loading installers show up.
I'm sure Google cares about whether it wants the general public to have a good experience by using its search engine and not get masquerading misrepresenting results that take advantage of naive users and do other things with the system, esp. for software executables.
3. Inform the user ------------------
Because the side-loading installer runs the actual GIMP installer as provided by the project, we could add a page in the installer wizard that informs the user of how some websites wrap the GIMP installer this way, and ask if they have downloaded GIMP by following a link from www.gimp.org. We can even ask users to report such websites as malware websites from their browsers, or in search engines.
Mukund
What next after sourceforge.net?
Mukund Sivaraman writes:
Many distros ship GIMP, even slightly patched versions for bugfixes or better integration into their environments. This improves the experience for users. Formally registering a GIMP trademark may not be seen in a good light by distributions, even if we readily wish to see them use the name. See Firefox vs. Iceweasel for example.
The Firefox *logo* did not meet Debian Free Software Guidelines. Since
Debian didn't want to include non-free artwork, and Firefox's trademark
policy is that you need to include the logo to call it Firefox, it was
rebranded for Debian. If Wilber were a non-free artwork, Debian would
not include it regardless of trademarks, but I see Wilber at
https://screenshots.debian.net/package/gimp so I'm pretty sure the logo
must be Debian-proof :) And
https://en.wikipedia.org/wiki/File:GIMP_Icon.svg says public domain.
Even though GIMP is an established project, we generally don't want to spend time as contributors to fight a legal battle. There are even questions of whether we *should*, i.e., whether an established free software project has to register trademarks and involve lawyers to protect it from being misused this way.
Is trademarking completely out of the question? I see not only Firefox, but ImageMagick, Inkscape, GNOME, GNU and Linux in https://en.wikipedia.org/wiki/List_of_trademarked_open-source_software – Inkscape being of similar "size" to GIMP, does anyone know how much work it cost them to register their trademark, and how much it costs them to keep it?
Reading through
https://www.softwarefreedom.org/resources/2008/foss-primer.html#x1-60000k5
it doesn't look too bad in terms of money. (The whole section on
trademarks there is worth reading.)
Also, it seems you may in fact call it GIMP™ already, since you have certain "unregistered rights" to the trademark just because GIMP has been used by this project as a trademark in practice. (But "®" requires registering.)
If you have a trademark, but never object to anyone using it in commercial/confusing settings, it might get lost. But you can avoid having to explicitly say yes to every distro and similar "good usage" by having a simple license like GNOME does: https://wiki.gnome.org/action/show/FoundationBoard/Resources/LicensingGuidelines See also https://www.gnome.org/logo-and-trademarks/
Then there's the nasty part, which is actually going after abuses. SFLC says:
If you disapprove of someone’s unlicensed use which infringes upon your exclusive rights, you should send a polite email to the infringer notifying them of your claim to the mark, and that their use is unacceptable. You might suggest a licensing arrangement, contingent on some changes in their usage of the mark. If you believe such an arrangement is impossible, ask the violator to fix the problem. Be polite but firm. It is often the case that license violations are inadvertent and easily fixed. Offer to help the violator take whatever steps are needed to achieve compliance, and avoid threats of publicity and lawsuits for as long as possible. Make sure the violator understands that your primary concern is the project’s reputation, not a large financial settlement. Once you convince them of that point, they are likely to respond more positively even if they were initially unresponsive.
I'm pretty sure people are used to doing this kind of "polite-but-firm" emailing wrt. GPL violations anyway, except that with a registered trademark you have some weight behind you to do it with malware distributors such as SourceForge as well.
Kevin Brubeck Unhammer GPG: 0x766AC60C
What next after sourceforge.net?
On Fri, May 29, 2015 at 9:43 AM, Kevin Brubeck Unhammer wrote:
Is trademarking completely out of the question? I see not only Firefox, but ImageMagick, Inkscape, GNOME, GNU and Linux in https://en.wikipedia.org/wiki/List_of_trademarked_open-source_software – Inkscape being of similar "size" to GIMP, does anyone know how much work it cost them to register their trademark, and how much it costs them to keep it?
Reading through
https://www.softwarefreedom.org/resources/2008/foss-primer.html#x1-60000k5 it doesn't look too bad in terms of money. (The whole section on trademarks there is worth reading.)Also, it seems you may in fact call it GIMP™ already, since you have certain "unregistered rights" to the trademark just because GIMP has been used by this project as a trademark in practice. (But "®" requires registering.)
If you have a trademark, but never object to anyone using it in commercial/confusing settings, it might get lost. But you can avoid having to explicitly say yes to every distro and similar "good usage" by having a simple license like GNOME does: https://wiki.gnome.org/action/show/FoundationBoard/Resources/LicensingGuidelines See also https://www.gnome.org/logo-and-trademarks/
GIMP has existed for two decades in a decentralized ad-hoc manner without needing to incorporate as a legal person/entity in either the US or elsewhere. I hope it is possible for community based software projects to exist and to defend against bullying or misrepresentation without incorporating in various markets/territories.
/pippin
What next after sourceforge.net?
Hi,
I'm not a GIMP dev or involved in any way, but a quick comment from me.
One obvious thing: The easier you make it to find the legitimate / real download the less likely people will look for it elsewhere.
Now let's assume I'm a windows user, not super skilled, but I heared that GIMP is a good graphics tool and I want to get it.
Right now if I go to the gimp webpage I see a big download button. That
looks good.
However then it gets murky. I get to a download page that will offer me
a bunch of stuff I don't need and don't understand.
I have to scroll down quite a bit to read this: "Nightly builds for Windows are available at darkrefraction.com. This is unstable software, please use it at your own risk."
Ok, I as a poor user read: "This is something I don't understand (a nightly build) and it's dangerous, because they talk about risk."
There is no offer of a windows download that doesn't sound scary.
No wonder people will go elsewhere to get the GIMP.
Make it easier and non-scary to find the right download and you'll take away downloads from the badware-bundlers.
cu,
Hanno Böck http://hboeck.de/ mail/jabber: hanno@hboeck.de GPG: BBB51E42
What next after sourceforge.net?
On 05/29/2015 07:51 PM, Hanno Bck wrote:
Hi,
I'm not a GIMP dev or involved in any way, but a quick comment from me.
One obvious thing: The easier you make it to find the legitimate / real download the less likely people will look for it elsewhere.
Now let's assume I'm a windows user, not super skilled, but I heared that GIMP is a good graphics tool and I want to get it.
Right now if I go to the gimp webpage I see a big download button. That looks good.
However then it gets murky. I get to a download page that will offer me a bunch of stuff I don't need and don't understand.
See
https://mail.gnome.org/archives/gimp-developer-list/2015-May/msg00034.html
(the mail thread gets constructive beyond the first post).
In this thread, there is work on proposal for the downloads pages that makes both the torrent link and the direct link (to e.g. the Windows .exe file) more obvious. The reason for emphasizing the torrent file over the direct link was to spread knowledge of BitTorrent and put less load on our server, but having both as equals should work just as fine.
There has been another proposal on our #gimp IRC channel to make the platform selection available again, I'm currently checking the status of that.
Regards, Michael GPG: 96A8 B38A 728A 577D 724D 60E5 F855 53EC B36D 4CDD
What next after sourceforge.net?
On Fri, May 29, 2015 at 2:35 PM, Michael Schumacher wrote:
See
https://mail.gnome.org/archives/gimp-developer-list/2015-May/msg00034.html (the mail thread gets constructive beyond the first post).In this thread, there is work on proposal for the downloads pages that makes both the torrent link and the direct link (to e.g. the Windows .exe file) more obvious. The reason for emphasizing the torrent file over the direct link was to spread knowledge of BitTorrent and put less load on our server, but having both as equals should work just as fine.
There has been another proposal on our #gimp IRC channel to make the platform selection available again, I'm currently checking the status of that.
Yeah... most non-technical people haven't heart of torrents (except for maybe the ones downloading illegal software, movies, and music). The largest link for Windows on that page is a misleading .torrent link (as a normal person would expect to download the software to install it rather than download a file that requires them to install other software to install it). In fact, the direct download link for Windows is a tiny "this link" at the end of the description paragraph underneath the GIANT torrent link.
There are plenty of trusted binary hosting services for open source projects. One not need look far for alternate hosting if the worry is GIMP infrastructure overload. Personally I feel the "Download" button on the front page should actually download the software (detecting your browser language and platform). Then perhaps make the link on the right called "Downloads" or "More Downloads" where users can find the comprehensive list of items to download to their heart's content.
Regardless of the way in which the downloads are presented. I do think the downloads page is pretty busy. My friends need someone like me to help them sort it out when they're getting their copy of GIMP. I feel that flow is in need of improvement.
SAM
I prefer to encrypt my email GPG FINGERPRINT 4096 KEY 8D8B F0E2 42D8 A068 572E BF3C E8F7 3234 7257 E65F https://keybase.io/samrocketman Learn how to encrypt your email with the Email Self Defense guide: https://emailselfdefense.fsf.org/en/
What next after sourceforge.net?
On 05/30/2015 03:46 AM, Sam Gleske wrote:
In fact, the direct download link for Windows is a tiny "this link" at the end of the description paragraph underneath the GIANT torrent link.
As you can see in the thread I linked to, this is going to change - with both links to be more prominent than they have been before.
There are plenty of trusted binary hosting services for open source projects. One not need look far for alternate hosting if the worry is GIMP infrastructure overload.
I'm actually not sure if it ever was a real overload, could also jut be that the web server config we have limited the connections.
Nowadays, this does not seem to be an issue - probably due to the fact that there are tons of torrent seeders for the current downloads, and many people use it.
Changing to the current server was not entirely voluntary - we had our previous one failing, and now GNOME generously provides a virtual machine in one of the data centers the use themselves.
Personally I feel the "Download" button on the front page should actually download the software (detecting your browser language and platform).
For that to work, it will have to be easy to switch between different platforms.
Regardless of the way in which the downloads are presented. I do think the downloads page is pretty busy. My friends need someone like me to help them sort it out when they're getting their copy of GIMP. I feel that flow is in need of improvement.
I guess the new layout will make it easier for them.
Regards, Michael GPG: 96A8 B38A 728A 577D 724D 60E5 F855 53EC B36D 4CDD
