SourceForge eyes a comeback

Years ago, SourceForge.net was the premiere hosting service for open-source and free-software projects. But, after changing hands several times, the site ran seriously afoul of the development community in 2015; its staff was accused of secretly commandeering inactive project accounts and of replacing project downloads with installers side-loaded with adware or even malware. In early 2016, however, the site changed hands yet again, and its new owners have set out to regain the community's trust.

To recap, SourceForge was launched in 1999 by VA Linux Systems, which was initially a hardware vendor. Over the next few years, the company acquired several other free-software related sites, including Freshmeat, Slashdot, and NewsForge (where I worked for several years). For a while, VA operated SourceForge.net for "community" open-source projects and offered a separate "enterprise" edition to corporate clients.

After some rearranging, the enterprise version of the hosting platform became the primary product and the company became SourceForge, Inc. Eventually, various pieces of the business (including the enterprise edition of the hosting software) were sold or spun off in different directions, and all that remained was the SourceForge.net hosting service and Slashdot, which were acquired by the job-search site Dice.com in 2012.

Such corporate shuffling is commonplace but, while SourceForge's popularity as a service had been waning in favor of GitHub, under the Dice.com regime, events took a dark turn. In 2013, the company announced a "revenue sharing" plan called DevShare, through which hosted projects could earn a little cash by allowing SourceForge to package their releases into an installer that would also include third-party, side-loaded apps.

Although the DevShare program was initially touted as something voluntary that would be completely under the individual project's control, in May 2015, the GIMP for Windows project discovered that SourceForge had unilaterally (and, some would say, secretly) replaced its release packages with adware-loaded DevShare installers. To make matters worse, the owner of the GIMP for Windows project account, Jernej Simončič, then discovered that he had been locked out of his account and found that SourceForge employees would not restore his access.

As it turned out, SourceForge had quietly started what it called the "SourceForge Open Source Mirror Directory," a program that seemed to entail site management taking over the accounts of project teams that had migrated their software off of SourceForge onto other hosting services. Needless to say, those project teams did not find the "mirroring" welcome: at best, it confused users about where to look for new releases or where to go for help. At worst, users could find downloads coupled with annoying adware, spyware, or other undesirable add-ons that neither the user nor the developers agreed to.

An uphill battle

Shortly after the 2015 controversy, Dice.com announced that it planned to sell off Slashdot and SourceForge. The sale took place in January 2016 to BIZX, LLC. New president Logan Abbott posted a message announcing plans for the site soon afterward, including:

In May, SourceForge started scanning all downloads for malware. On June 8, Abbott appeared on Reddit to hold an unofficial "Ask Me Anything" session about the site. He highlighted the fact that the new management team was unrelated to the one on hand for the DevShare debacle, promised to continue modernizing the site's functionality, and vowed to further move away from the shady practices of the recent past.

For instance, Abbott noted that SourceForge has been criticized for allowing misleading ads that look like download buttons; staff is now working to remove these ads, he said, and users would soon be able to report them. He also reported that SourceForge has given all seized project accounts back to their original owners, and added:

To be sure, restoring the community's trust in the SourceForge name will require quite a bit of effort. On top of that, rebuilding the hosting service into a competitive challenger to current market leader GitHub will not happen overnight, either. In the first comment linked-to above, Abbott noted that the site still gets over one million unique visitors every day, and hosts more than half a million active projects.

In the discussion, Abbott noted a few changes already in the works, like a site redesign and the addition of servers outside the US.

What might surprise some in the free-software community is that so many participants in the discussion expressed optimism that SourceForge could be resurrected and turned into a modern project-hosting service. Evidently, the site still has its fans. User "FluentInTypo" commented that SourceForge is more convenient to hosting large binaries (including ISO images) for download. When Abbott asked for input, user "pier4r" made several feature requests, such as integrated Gist-like code-sharing and support for holding discussions outside of issue comments. Many others in the thread shared their own feature requests.

Looking forward

To be sure, many of the feature requests offered in the debate are not new; most (like the lack of a general-purpose discussion tool) are common requests whenever users lament gaps in GitHub's feature set, too. But that is telling in and of itself; despite all the conventional wisdom that GitHub is "too big" to catch, complaints about the service's shortcomings are not difficult to find.

It is also interesting to note how many projects still use at least some SourceForge services, even if they also use GitHub, GNOME or KDE servers, or their own infrastructure. To cite one example, FontForge has migrated its code to GitHub, but continues to use its old SourceForge-based mailing lists. Such inertia is a subtle issue keeping projects on their existing infrastructure; while GitHub and other services make it relatively easy to migrate code repositories, migrating bug trackers, mailing lists, and other materials is rarely as smooth.

And, of course, many long-term developers may be reluctant to jump ship to whatever the latest hosting site du jour is. SourceForge's day in the sun may have been a long time ago, but one must not forget that not all that long ago, Google Code had its turn as the go-to hosting destination. When Google Code was launched in 2006, it was seen as vastly superior to SourceForge; it took several years for GitHub to supplant it.

Whatever the cause, there are still many free-software developers using SourceForge. The new owners have a lot of ground to make up, but it is far from out of the question that SourceForge could make a recovery and prove itself relevant again.