Re: [SciPy-Dev] [Numpy-discussion] Verify your sourceforge windows installer downloads
On Fri, May 29, 2015 at 2:00 AM, Andrew Collette <andrew.collette@gmail.com> wrote:
Here is their lame excuse:
https://sourceforge.net/blog/gimp-win-project-wasnt-hijacked-just-abandoned/
It probably means this:
If NumPy installers are moved away from Sourceforge, they will set up a mirror and load the mirrored installers with all sorts of crapware. It is some sort of racket the mob couldn't do better.
I noticed that like most BSD-licensed software, NumPy's license includes this clause:
"Neither the name of the NumPy Developers nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission."
There's an argument to be made that SF isn't legally permitted to distribute poisoned installers under the name "NumPy" without permission. I recall a similar dust-up a while ago about "Standard Markdown" using the name "Markdown"; the original author (John Gruber) took action and got them to change the name.
In any case I've always been surprised that NumPy is distributed through SourceForge, which has been sketchy for years now. Could it simply be hosted on PyPI?
They don't accept arbitrary binaries like SF does, and some of our installer formats can't be uploaded there. David
Andrew _______________________________________________ NumPy-Discussion mailing list NumPy-Discussion@scipy.org http://mail.scipy.org/mailman/listinfo/numpy-discussion
On 28 May 2015 at 10:05, David Cournapeau <cournape@gmail.com> wrote:
On Fri, May 29, 2015 at 2:00 AM, Andrew Collette <andrew.collette@gmail.com> wrote:
Here is their lame excuse:
https://sourceforge.net/blog/gimp-win-project-wasnt-hijacked-just-abandoned/
It probably means this:
If NumPy installers are moved away from Sourceforge, they will set up a mirror and load the mirrored installers with all sorts of crapware. It is some sort of racket the mob couldn't do better.
I noticed that like most BSD-licensed software, NumPy's license includes this clause:
"Neither the name of the NumPy Developers nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission."
There's an argument to be made that SF isn't legally permitted to distribute poisoned installers under the name "NumPy" without permission. I recall a similar dust-up a while ago about "Standard Markdown" using the name "Markdown"; the original author (John Gruber) took action and got them to change the name.
In any case I've always been surprised that NumPy is distributed through SourceForge, which has been sketchy for years now. Could it simply be hosted on PyPI?
They don't accept arbitrary binaries like SF does, and some of our installer formats can't be uploaded there.
Bintray [1] has been providing a free service for hosting 'bottles'(compiled binaries) for the Homebrew project [2]. Probably an option to look at. [1] https://bintray.com/ [2] http://brew.sh/
David
Andrew _______________________________________________ NumPy-Discussion mailing list NumPy-Discussion@scipy.org http://mail.scipy.org/mailman/listinfo/numpy-discussion
_______________________________________________ NumPy-Discussion mailing list NumPy-Discussion@scipy.org http://mail.scipy.org/mailman/listinfo/numpy-discussion
participants (2)
-
David Cournapeau -
Saket Choudhary