Startups should use a relational database - <AUTHOR> http://raycmorgan.com/e/startups-should-use-relational-database.html <comment><USER3> One thing that could likely get you fired rather quickly is running analytics on your live transactional system. Yes, your business needs to make decisions based on data, this is not terribly new. To think that you only have one data store is a bit short-sighted.

Many businesses (including startups) have moved to using document stores for high read environments and scraping nightly drops to their backend analytics systems. This is smart - you don't want to run summing/aggregation on a live transactional system for (hopefully) obvious reasons.

EDIT: it's also worth noting that map/reduce is typically much more powerful when aggregating large datasets. When trying to run analytics on top of a transactional system, developers like Ray here would end up with multiple joins and groupings - all of which slow _everything_ down. Map/reduce certainly isn't perfect, but the author dismisses it as difficult witchcraft when, in practice, parallel execution of MR queries can greatly decrease resources and time to information.

I sort of think we've moved beyond this discussion.

<comment><USER4> The disconnect between your comment and the article is the term "startup" now means giant companies like Airbnb and tiny two person companies that haven't yet created an MVP.

I think this article is targeted at the latter: pre-MVP and just post-MVP. For those startups, having two databases with one dedicated to a backend analytics system reeks of premature optimization.

<comment><USER5> "having two databases with one dedicated to a backend analytics system reeks of premature optimization."

Its free software, you don't have to pay for two instances of Oracle.

One thing that will quickly kill a biz is combining the functions of PROD and DEV/TEST. Making the DEV/TEST box the DEV/TEST/REPORTS box is not a big deal, and you can't run a (real) biz without a DEV/TEST box.

<comment><USER6> Having run the technical side of ~5 "small" businesses now (no more than $1.5M revenue), I disagree.

Eventually, nothing can match the performance of storing binary blobs on a cluster. But that only becomes worthwhile if you database is significantly larger than a terabyte. And I'm only talking about the operational "core" database, not your "data warehouse" (the log dumping ground, which should be split off when your database gets to be a few dozen gigs).

Meanwhile, mysql has big advantages :

1) can do basic optimization with "ALTER TABLE", even (mostly) live.

2) you can mix PROD and DEV/TEST (though obviously you need to use good judgement). Obviously you should also have a DEV/TEST instance for actual testing. Sometimes you want to run a test quickly against PROD though. Adding a slave, having it sync and then running against the slave is a joy.

3) creating reports is quick, customizable and everything you want.

4) It's "idiot-friendly". Employees can ramp up to the structure in a mysql db in 2 weeks flat. Try that with custom document stores.

5) It's typesafe and relational safe (if correctly designed), with the advantages that brings : significantly less weirdness in the database.

6) Phpmyadmin. Mysql workbench. Django. Php ...

I'm even going to argue that the GP's argument, that running analytics on PROD can get you fired, is not just wrong, it's actually an advantage of using mysql. (And the open source SAP database can run "live" analytics. You just can't believe how great that is for dashboards)

</comment></comment></comment></comment><comment><USER7> The unhappy truth is that for many startups, relational integrity and transaction safety are simply not very valuable. Customers of an early-stage startup are by definition willing to take a risk on whatever they're getting from that startup. So simply _not thinking_ about these problems - <USER2> that occasionally a partial write will happen, or two writes will collide, or a migration will not quite work correctly and your pages will crash until it's fixed - is a worthwhile sacrifice to increase development speed.

<comment><USER8> This is just a very bad excuse for doing ridiculously shitty systems that stay shitty way after the startup phase. If you at all bother to understand your problem domain, and are not just a monkey at the typewriter, writing down a good domain model and adding the constraints is not going to decrease development speed, quite to the contrary, it's going to increase it, web developers often spend whole workdays just tracking down in the logs the "story" of some now angry customer that happened to violate some unformalized assumption of the system and got mishandled later in the process, especially if this customer happened to pay already. Not to mention that with a good domain model, the code for the individual functionality flows out naturally, while with a shitty one, you might end up with three times as much code for the same thing.

Also, those mistakes in modelling the domain and in enforcing the constraints are often there to stay and slowly become impossible to fix, once you have 10000 records that do not fall into a few well specified states, it's hard to go through all of them, find some common denominators, and migrate the database. Not to mention that with the mess people can do in the code, and with the messy stack in use today, it's easy to introduce bugs that might be hard for anyone to notice but seriously harm your business.

The amount of fashionable nonsense in software engineering seems to be higher than ever, unfortunately.

<comment><USER9> > If you at all bother to understand your problem domain

This is a startup. There is no problem domain. There is no spec. There's none for a startup. You may not even have code.

If you're doing a "startup" but have this ironed out, great, everything you said then applies, but it's not a startup, since you found your business model, it's a small company.

And I would love to enforce constraints on the DB but unfortunately, I already had "primary keys" that repeat, unbeknownst to the project customers.

<comment><USER10> > This is a startup. There is no problem domain.

Is the startup just a game developers do on their free time? Because if it is trying to solve a problem, there is a problem domain, even if it's the wrong problem.

</comment></comment></comment></comment><comment><USER11> I'm totally with you. We've experienced to have Object database or XML database and NoSQL database. Now we understand that relational database is just the right way to go for web applications, because it deals with structured data so well, keeps querying and sorting, filtering seamlessly and effortlessly. It's a must.

It is the same thing for choosing Linux distribution and JDK mode. See the references here:

[http://bingobo.info/blog/table-of- contents.jsp](http://bingobo.info/blog/table-of-contents.jsp)

BTW, your title should have "relational" instead of "relation".

</comment><comment><USER12> Serious question: what are NoSQL databases really good for? I'm only really used to relational DBs, and I'm unclear about which problems a NoSQL database is useful for.

<comment><USER13> _which problems a NoSQL database is useful for_

It depends in which NoSQL database. Depending on your problem, you can probably find a NoSQL DB optimised for it. It will often be unclear if that NoSQL DB is actually better than a relational database until you try it.

Examples:

High write throughput: Cassandra

Simple key-value: Redis

Text search: Solr/Elastic Search

etc..

<comment><USER14> Redis does more than simple key-value - rather than just reading and writing values, since values can be complex types like lists and dictionaries, it can insert into them, append to them, etc. It's still key-value, it's just not _simple_ key-value!

That said, i would hesitate to describe Redis as a database at all. A key characteristic of databases is that they store every write in a durable way. Redis can checkpoint its state periodically, but as i understand it, it either can't or typically isn't used to safely keep every write. Redis is something in between a database and memcached. I doubt there's ever a situation where you have to choose between PostgreSQL/Cassandra/CouchDB and Redis; Redis is something you would use in addition to a database.

As for text search - RDBMSs have full text search, and at least in the case of PostregSQL, it seems pretty good - see slide 49 in [http://es.slideshare.net/billkarwin/full-text-search-in- post...](http://es.slideshare.net/billkarwin/full-text-search-in-postgresql) from 2009. You might not want to be leaning on your database for text search when you're at scale (for operational reasons more than performance ones), but it's a plausible way to start.

</comment></comment></comment><comment><USER15> People too often forget about graph databases when talking about NoSQL solutions. Graph databases offer an interesting and elegant alternative to relational databases and I could definitely see a startup decide to use this kind of technology.

As far as I know, most graph databases support transactions and offer great scalability. Such databases are also schema-less and can be queried with Gremlin, a powerful graph traversal language (see www.tinkerpop.com).

With respect to scalability and transactions, Titan ([http://thinkaurelius.com/](http://thinkaurelius.com/)) looks very promising: it supports various backends for storage (Cassandra, HBase, etc.) and indexing (currently Elastic Search and Lucene). Graph analytics can be done via Faunus ([http://thinkaurelius.github.io/faunus/](http://thinkaurelius.github.io/faunus/)), backed by Hadoop.

There are other vendors out there (Neo4J, OrientDB, etc.) which offer interesting solutions worth looking at - I'm just a bit less familiar with them.

The major downside I see with graph databases is that most of them are fairly recent and their ecosystem is tiny (though growing). Should a startup venture on such young technologies, or stick to mature and battle-tested solutions (ie. relational databases)?

Could startups use this kind of graph "NoSQL" databases? I don't see why not. If your startup is some kind of social network, graph databases are certainly an option worth considering. If I were to create a startup, I'd hardly use a document database like MongoDB but I will really consider using a graph database. In the end, it's all about having the right tool in hand, and knowing how to assert what is "right" for you.

</comment><comment><USER16> A blog post titled "Startups should use NoSQL databases" in 3, 2, 1, ...

</comment><comment><USER5> There can only be one DB much like the LOTR can only have one ring. Why? Thats the only area the linked article falls down on. Its a pretty good article other than that.

So you properly normalized your entire system, customer billing transaction records all the way up to article tags. Then article tags gets too huge. So next version looks at RDBMS and Redis, and the next version after that only looks at Redis. Customer billing transactions remains on a "real" DB and the tag cloud lives on redis. And the problem with that is... what exactly?

Its obsolete thinking. I can't have two databases because we're a poor startup and the only databases that exist are DB2 and Oracle and everyone knows they're super expensive so super expensive times two is unaffordable. Dude, its almost 2014 not 1980, Postgres/mysql/redis its all free.

<comment><AUTHOR> Thank you for your comment. I agree that there is nothing wrong with using a plurality of systems when needed. Your example of moving from one to another is great! Start with a simple system, and once you find bottlenecks, optimize with specialized stores.

</comment></comment><comment><USER17> This comes up every now and then on HN. There are plenty of NoSQL horror stories.

Thing is. Most SQL database at scale is a bit of a horror too. Have you seen real-life production relational databases? Gawd. Hacks on hacks. Then you add another database. And another analytics database. And a bunch of point to point data feeds. Argh.

But hey. That's data.

If you think choosing SQL will solve your analytics woes down the line -- it's just not true. You're in for some pain no matter what you do.

... That's unless you get a porcelain schema first time. Which, if you're in a startup, probably means you're working on the wrong problem.

That's not an argument _for_ using NoSQL (I used MongoDB daily, but I've got plenty of love for PostgreSQL). It's a rebuttal that SQL magically solves a different problem.

</comment><comment><USER18> Startups should use the right tool.

A relational database might be just as wrong as a nosql one if all you need is redis.

</comment><comment><USER19> Strongly disagree with the article as simplification always looks shiny. Start-Ups should sit back for a few hour and days and invest the work to answer some serious questions as these [http://nosql-database.org/select-the- right-database.html](http://nosql-database.org/select-the-right-database.html) (there are other cataloges like this one).

Then you get a little closer to the truth.

</comment><comment><USER20> I often read that argument that NoSQL Databases are Schemaless and yes the Database is but your Data is or it isn't. YOU must know your Data.

"All the while moving work onto the developers to standardize how they handle different migration cases."

I know a startup is fast and bla bla... BUT your team should know the tools that you are using... For me SQL DB's force me to add a new field and some kind of value and i don't like to be forced to a solution.

"In document stores, you have two choices: store related data as sub- documents, or store related data as separate documents with references. It is up to the developers to understand the trade-offs of both approaches. Selecting one over the other can lead to performance gains or issues, scalability issues and above all, make asking certain questions of the data a lot harder."

Again know the tools you are using. And for example MongoDB has good ORM's too.

"But that takes much more forethought and is dependent on a particular problem."

If your startup is doing something new and shiny you don't have the knowledge and forethought and you often dont know what particular problem will come at you.

Most of the point's look like: You learned at your University SQL now you know it(but in really life you don't) and now use it because you know how to normalize a Database. This argumentation is often used to say why java is so great or why javascript is bad.

I personally started with php then moved to rails and now to meteor(uses MongoDB) and we never before meteor could make so fast a good prototype which for a startup is very important.

So yeah if you are comfy with SQL use it if your comfy with NoSQL use it.

</comment><comment> guard-of-terra Don't they? For some tasks relational databases are good, for some they are worse. Call me captain.

However relational databases will have hard time with big data because your dataset is bigger than your database and you have no relational integrity.

</comment><comment><USER21> Depends what your startup is doing. If you are only using your database to store some basic transactions, then a relational database is a very good fit. This is really the case for most startups tackling common problems. However, if your startup is tackling a problem with unique technical challenges, then you can't just ignore the issue. For example, a geo-location startup tracking the location in real time of users with a free app is simply not going to be able to use a relational database.

<comment><USER22> > _For example, a geo-location startup tracking the location in real time of > users with a free app is simply not going to be able to use a relational > database._

Why not?

<comment><USER13> Rapidly growing, infrequently queried data is not the ideal scenario for most relational databases.

1) Relational databases typically aren't optimised for write-throughput. It's quite possible to do it, but you'll need fast and large disks (eg, FusionIO in a SAN or something).

2) Location-tracking applications typically don't require interactive queries - generally it is more a batch-based system that can be run offline.

Saying you are _not going to be able to use a relational database_ is overstating it a bit in my view.

Clearly you can make it work, but something like Cassandra will give you better write thoughput, won't force you to rely on a SAN/NAS for data storage and will let you use Map/Reduce to batch process the data.

</comment></comment></comment><comment><USER23> I don't know. It's a hard question. MongoDB is pretty much used in any hackathons simply because it's easy to setup, driver support is good, and schemaless. The last one is really why people use MongoDB over SQL DBMS. For startup, there might be a concern that schema migration is tough.

But one can argue that not careful with schema design can break api and make codebase messy.

I guess I will stick with the hard work now... I guess not careful with schema will definitely bite me.

<comment><USER24> Another reason to choose MongoDB is built-in array and nested dict support, with good enough indexing.

So you don't have to create bullshit m2m tables with tedious joins for a fucking tagging system

<comment><USER25> Obligatory JSON and hstore in Postgres comment.

<comment><USER24> stable version, every value is string. No atomic incremental operations, no nesting, shitty index.

<comment><USER25> JSON has non-string values and nesting. [1]

I read somewhere that nesting in hstore is coming in the next version (Q3 2014?) and non-string types are on deck.

Compared to the nightmarish development workflows and processes I've had to deal with resulting from using CouchDB as a main datastore, having to get the entire JSON value in order to update one key seems like not that big of a deal. What NoSQL databases even let you do incremental operations in that sense?

Shitty index? It seems like you should be able to make an index on a value inside the JSON just as easily as any other index.

Then maybe some advanced features of Postgres can really shine: [http://www.postgresql.org/docs/8.3/static/indexes-bitmap- sca...](http://www.postgresql.org/docs/8.3/static/indexes-bitmap-scans.html) [https://wiki.postgresql.org/wiki/Index- only_scans](https://wiki.postgresql.org/wiki/Index-only_scans)

I'm also exploring a solution for abstracting that as a normal, non-JSON table for semi-structured data using views.

Basically, it seems like for _semi-structured data_ where you know what the schema is, but maybe it just changes over time or isn't 100% certain, so it's not possible to store it using a typical schema, JSON + indexes + views offers the best of both worlds.

[1] [http://clarkdave.net/2013/06/what-can-you-do-with- postgresql...](http://clarkdave.net/2013/06/what-can-you-do-with-postgresql- and-json/)

</comment></comment></comment></comment></comment><comment><USER26> "Blog titles should stop using should."

</comment><comment><USER27> He forgot one of the very important reasons to use (some) NoSQL databases: high availability. Relational database systems are very poor at providing that. Most often the availability options are limited to resistance to node failures. RDBMSes have several SPOFs and must use failover which is not dependable, hard to test, and in many times needs manual intervention. Forget resistance to network partitions.

<comment><USER28> CAP theorem tells us that you can't have availability without sacrificing consistency or partition tolerance, which means that there isn't a NoSQL database which can do that either.

It is not true that relational databases must have a single point of failure (SPoF) or must use failover: MySQL Cluster is a sharded multi-master distributed database without a SPoF.

On the other hand Redis, for example, is a master-slave failover NoSQL datastore.

<comment><USER27> CAP theorem says it cannot be done _at the same time_. But it is perfectly fine to sacrifice consistency for availability at the time partition happens and restore consistency once the partition is fixed. Still better than nothing if revenue counts. Financial institutions do like that all the time.</comment></comment></comment>


A Beginner's Guide to Optimizing Pandas Code for Speed - <AUTHOR> https://engineering.upside.com/a-beginners-guide-to-optimizing-pandas-code-for-speed-c09ef2c6a4d6 <comment><USER2> This is a good point to plug my talks on 'Pandas from the Inside' (A), 'Big Pandas' (B) and 'Pandas 2.0' (C) that I presented at various PyData conferences over the last 18 months:

\- PyData London 2016 - (A), 60 mins, videos online

\- PyData Washington DC 2016 - (A), 90 mins, videos online

\- PyData Amsterdam 2017 - (A) and (B), 3 hours

\- PyData Berlin 2017 - (A) and (B), compressed 90 mins, video probably online

\- PyCon UK 2017 - (A), (B) and (C), 2 hours

PDF slides for (A) are here: [https://github.com/stevesimmons/pydata- ams2017-pandas-and-da...](https://github.com/stevesimmons/pydata- ams2017-pandas-and-dask-from-the-inside/raw/master/slides-1-pandas-from-the- inside.pdf)

Others are in my other repos on github: [https://github.com/stevesimmons](https://github.com/stevesimmons)

</comment><comment><USER3> Doesn't NumPy use SIMD instructions? There's no mention of that in the article.

<comment><USER4> It does under certain installations. Anaconda tends to favor intel MKL on most x86 systems

</comment></comment><comment><USER4> Main performance tip is to find ways not to copy data generally:

\- use .loc[]

\- use inplace=True

<comment><USER5> can you elaborate on `using .loc[]` -- what is the defective approach it replaces?

<comment><USER6> I would assume using df[['colA', 'colB']] for projection/column selection?

<comment><USER6> Also, I would caution about using inplace=True. See: [https://tomaugspurger.github.io/method- chaining.html](https://tomaugspurger.github.io/method-chaining.html) (ctrl+F: "Inplace?")

</comment></comment></comment></comment><comment><USER7> There's something really offensive about attributing "premature optimization..." to xkcd, even as a joke

</comment><comment><USER8> step 1 - don't use pandas

<comment><USER9> Pandas isn't perfect, but for small- to medium-size datasets, I haven't seen much that matches its performance, and I haven't seen anything that matches its combination of performance and ease of use.

<comment><USER10> As a person who deeply enjoys developing with python, I'd have to reluctantly say R's tidyverse is a delight to use and often faster than pandas in my experience.

<comment><USER9> Ah, good to know. I haven't touched R in a while.

Does tidyverse fix up the mess that is string handling in R?

<comment><USER10> Sorry for the late reply. stringr does a pretty good job (though I like how python handles strings better).</comment></comment></comment></comment></comment>


Help?  Flash crashing every time ... - <AUTHOR>

Anyone help?  For reasons I won't go into I have a Windows XP laptop.  The latest update has just been applied, and now Flash won't run.
Any suggestions before I finally give up on Windows and just buy a Mac?
ADDED IN EDIT:  Yes, I've tried all the forums I know of and no, they haven't helped.  Yes, I've looked up all the sites I canthink of that might be useful and no, they haven't helped.  Yes, I've tried Googling for the problem and no, nothing seemed to help.  Yes, I have tried to solve this myself (for over 6 hours) and no, I don't seem to have managed.  For reference, I'm not a system admin type person. <comment><USER2> Having spent far more of my time fixing Windows problems than I really wish to recall :-/, what I've found to work most reliably in practice is to wipe the harddisk and reinstall the operating system.

On the one hand, this will take a day of work (either of your time, or, if you don't have the expertise to do it yourself, of someone you pay to do it). On the other hand, you'll usually end up with a working computer; and the process is usually merely tedious.

On the third hand, naturally you may find a less drastic solution to this particular problem; on the fourth hand, it might take you as long or longer to find that fix than to do the full reinstall.

I don't know enough about Macs to give advice as to whether that would be a better solution for you.

<comment><AUTHOR> Thanks for the comments. I find it vaguely offensive that a complete re- install of Windows is so commonly recommended, but it does seem to be the prevailing wisdom.

So far I've gone to chrome://plugins and disabled the Flash plugin, then re- enabled it, and now it seems to work.

Mostly.

</comment></comment><comment><USER3> I'm on Win XP (nothing to be ashamed of :), and Flash works fine for me. Seems likely the problem is something else.

</comment><comment><USER4> Wow! Hacker News is a PC support forum now! I didn't know...

<comment><AUTHOR> Thanks for your reply - I didn't understand. I do now.

I won't bother to ask questions about technical matters here again, nor to ask if people I respect are having the same problems, nor to try to raise awareness of possible issues with the technology that many of us use every day.

Nor will I talk about questions of how to investigate whether recent Windows updates have code specifically to destabilise Chrome, or other things that I would've thought of interest to the HN community.

No, instead I'll watch the countless discussions of whether it's the idea or the execution, more discussion of whether it's better to go to school/college/university or to go straight into business, or yet another submission of some other much loved favorite.

Never mind that I've tried several technical forums and they are all bloody useless. Never mind that this was, I thought, somewhere that people with similar interests occasionally helped each other.

I'll go away now.

<comment><USER5> > _No, instead I'll watch the countless discussions of whether it's the idea > or the execution, more discussion of whether it's better to go to > school/college/university or to go straight into business, or yet another > submission of a much loved favorite._

Have you read the FAQ[1]? _"Please don't post on HN to ask or tell us something."_ ( _Ask_ and _Tell HN_ posts where people showcase their projects and startups are part of its culture, however.)

HN was originally "Startup News", and a lot of its content is related to startups and entrepreneurialism, but with a hacker flair.

> _Nor will I talk about my investigations of whether recent Windows updates > have code specifically to destabilise Chrome, or other things that I > would've thought of interest to the HN community._

It would have been interesting to read your ideas on this in a blog post. (The site _is_ Hacker _News_.)

Regarding your question, put more effort in asking and people will put more effort in answering.[2]

> _Never mind that I've tried several technical forums and they are all bloody > useless._

Have you tried SuperUser[3]?

[1] <http://ycombinator.com/newsguidelines.html> [2] <http://www.catb.org/~esr/faqs/smart-questions.html#beprecise> [3] <http://superuser.com/>

<comment><AUTHOR> Oddly enough if you look at my posting history you'll discover that I know the guidelines. Specifically, the bit you quote:

        Please don't post on HN to ask or tell us something
        (e.g. to ask us questions about Y Combinator, or to
        ask or complain about moderation) ...

... is talking about not posting to the group questions that are intended for YC or for PG - the "us" in the above excerpt. "Ask" and "Tell" are not part of the culture, they are independent of this.

Moving on ...

My investigations haven't got very far, not least because I've been struggling for the past 6 hours to make my machine usable again. I've given up. I'll just do without flash until someone can tell me how to fix it. The forums I've checked haven't helped at all, although I didn't know of SuperUser. I'll try that tomorrow.

And regarding ESR's recommendations, again, oddly enough I've suggested in the past that people read them, and I had them in mind when I posted, but I am seriously beyond caring. I had hoped someone would (a) recognise the problem,and (b) cut me a little slack.

I guess I was wrong. Pursuant to your observation, I've edited my original submission to give some indication that I have expended at least a little effort already in trying to solve this.

ADDED IN EDIT: The question appears to have been asked in SuperUser and has had no replies. Based on other searches in other forums I'm not surprised, but I'll make more searches tomorrow.

<comment><USER6> Have you tried using Chrome, with its embedded version of Flash (check chrome://plugins to enable only the embedded one)? If that doesn't work either, it sounds like there's a bust configuration somewhere, rather than a problem with the installation as such. Another thing to try: log in with another OS user account, and see if it works there. Finally: what's the failure mode, exactly? Browsers pretend no flash is installed? Flash hangs on start, etc.?

<comment><AUTHOR> Thanks for that - useful. I'll have a look at using the embedded version. Currently Chrome comes up with the bar across the top saying something like "the following plug-in has crashed: Shockwave Flash" (or something - I don't have the machine in front of me right now, and can't remember exactly).

<comment><USER6> I don't know if this works on the windows version, but you could try launching it from the command line and see if there's any output. Maybe get a chromium debug build or something? Have you tried other browsers?

You might be able to trace which files are accessed by it as it starts (using whatever the equivalent of strace is on windows - Process Explorer?).

<comment><AUTHOR> Thanks for the advice and comments. Not sure how to launch from the command line - I've very little experience of Windows, although lots and lots of experience with DOS (of various flavors), Linux console/shell, and Linux GUIs.

I can get to the command line, just don't know what executable to run. I haven't tried other browsers, and I have no idea how to trace system calls on Windows without some sort of dev environment.

So far I've gone to chrome://plugins and disabled the Flash plugin, then re- enabled it, and now it seems to work.

Mostly.

<comment><USER6> Start -> Run; type "cmd"; drag & drop the chrome icon onto the command line window. You may need to prefix it with

      start /wait

To capture output. But there might not be any output.

Process Explorer traces some stuff, and doesn't need a system environment. I'm not sure if it would suffice, particularly with a process that dies quickly. You'd have to try it.

Good to hear that it works - not quite sure what you mean by "mostly". :-)

I'm no Windows expert but feel free to contact me out-of-band (contact info is in my profile) if you think I could help.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


When Greedy Algorithms Are Good Enough (2014) - <AUTHOR> http://jeremykun.com/2014/07/07/when-greedy-algorithms-are-good-enough-submodularity-and-the-1-1e-approximation/ <comment><USER2> Why do computer science papers need to dip down into mathematical notation to express ideas, instead of just using pseudocode, which is easier to understand ... and nearly as compact?

<comment><AUTHOR> I don't see how the math in this paper can easily be expressed as pseudocode. How would you express the first proposition?

<comment><USER2> F is submodular if F(intersection(A,B) + union(A,B)) <= F(A) + F(B)

And in this way we can actually cut and copy code into text boxes like this one. Whereas we can't with the math forumulas which use a bunch of notation that doesn't work in plaintext.

Also, most math notation uses a bunch of stuff that has no meaning without context (which isn't usually provided to novice readers).

I view math notation as artificial barriers to entry for programmers that didn't have a chance to go to university.

<comment><USER3> It might help to get the notation correct first. What you have is a type error :)

The fact that you are better trained in a language designed for computers than in a different language designed for humans is not a reason to scrap the language designed for humans. You wouldn't say the same thing about the article if it were written in French.</comment></comment></comment></comment>


Linux Community to Adopt New Code of Conduct - <AUTHOR> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8a104f8b5867c682d994ffa7a74093c54469c11f <comment><USER2> One of my concerns about code of conducts are views held outside the project's code, mailing lists, chat rooms and issue trackers.

The contributor covenant doesn't address this at all, yet there are key people behind the contributors covenant that have gone after maintainers because of view points held on other social media that have nothing to do with the project (e.g if a maintainer doesn't agree with marriage equality or trans issues).

What if you have a contributor who has his or her own blog posts showing they approve of James Damore's memo (maybe even just in part?)

I worry that tech culture is starting to crack down on opposing views in the same of inclusivity. I really agree with the Redis developer who calls some of the current trends almost "puritan."

In general this code of conduct doesn't seem like a bad thing, and it's been used on a ton of project. But I feel like there are situations where it isn't good enough for the most vocal in the community.</comment>


Why Distributed Systems Are Hard to Develop – and How to Fix It - <AUTHOR> https://medium.com/garden-io/why-distributed-systems-are-hard-to-develop-and-how-to-fix-it-e5dfe9bac421 <comment><USER2> I find the concept of "Stack Graph" very interesting, I like that it's something thought to be complementary and descriptive to your project and not yet another tool you have to change your implementation around it. Very looking forward to seeing how the project will develop in the future.

<comment><USER3> Hey 10ko, Garden co-founder here. Thanks for the feedback!

You're right, you shouldn't have to design your project around your tools. Rather you describe the individual components of your system, really just document them in a structured manner, and let your tool manage the resulting graph.

Here's a link the Github repo in case you're interested: [https://github.com/garden-io/garden](https://github.com/garden-io/garden). Always happy to get some feedback!

</comment></comment><comment><USER4> Can you really make a tool that works for different platforms? Won't the abstractions always leak?

<comment><AUTHOR> It's always a balancing act. Make the abstractions really stiff, and you can optimize heavily for that context. Too loose, and it becomes opaque and hard to reason about. And messy.

That's why we spent so much time working out the plugin mechanism, and figuring out what's native to the core framework. Terraform, for example, nails the infrastructure stuff quite well and strikes a good balance there, so we used that as a reference. But we added specific primitives for developing the application layer, and made that pluggable through a similar approach. Providers figure out the _how_, but the relationships in the graph are predictable.

Case in point, we now have a handful of different ways to deploy code. There's a Helm module type, which is very flexible but carries all the complexity and manual effort you need to make Helm charts. On the other side there's OpenFaaS, which is very constrained in features, but super easy to get going. So you can pick and choose depending on the level of abstraction you need.

Plus you'll soon be able to make your own, so you can tailor the abstractions to your needs, but keep the consistency of a single core dev tool.

<comment><USER4> Thanks for the response.

</comment></comment></comment><comment><USER5> This is amazingly cool, can't wait to try it out. Is it viable even for small home projects?</comment>


Show HN: Ampache – Self-hosted personal music and video streaming server - <AUTHOR> http://ampache.org <comment><USER2> I live Ampache - but I've still not found a good mobile / Android client for it.

The core server is great at cataloguing my music and streaming it to the browser, but I'm struggling on mobile playback. Any one found a good player?

<comment><USER3> Have you tried dSub _? It 's a subsonic client but it works when you enable the subsonic api in Ampache.

Tomahawk is an interesting one, but is missing a little for me.

Honestly, I use foldersync to just d/l newly added music from my server on a routine basis and rely on dSub for when I've added something that hasn't synced.

_ [https://play.google.com/store/apps/details?id=github.daneren...](https://play.google.com/store/apps/details?id=github.daneren2005.dsub&hl=en)

</comment></comment><comment><USER4> I love Ampache. While the web interface is not that great, it really shines with its multitude of backends: Subsonic, Plex, DAAP, UPnP/DLNA, and also WebDAV access. I'm mostly accessing Ampache via the Subsonic and UPnP backends, and it works really great. There are excellent mobile clients which work pretty much out of the box with it (DSub, BubbleUPnP).

</comment><comment><USER5> Changelog - [https://github.com/ampache/ampache/blob/master/docs/CHANGELO...](https://github.com/ampache/ampache/blob/master/docs/CHANGELOG.md#381)

This is a pretty great streaming solution but last time I used it didn't deal with as many codecs as Kodi

<comment><AUTHOR> That's right but I believe both Ampache and Kodi are complementary (I'm using both, Ampache on a web server and Kodi at home) and have a quite different approach.

</comment></comment><comment><USER6> Very nice. Alas, I wrote my own ghetto version of this in, gosh, 2005 and have slowly improved and changed it over the following decade into something rather bespoke and custom to my needs and thus will never get non-trivial contributions from others.

<comment><USER7> 2005 eh? Well, ampache is so old, it has a freshmeat entry! ;-) [http://freshmeat.net/projects/ampache](http://freshmeat.net/projects/ampache)

<comment><AUTHOR> Yeah, even 15 years old now if you take a look at Internet archives. That's a long lifetime for a web-based app!

</comment></comment></comment><comment><USER8> A C++ / Witty alternative: [https://github.com/epoupon/lms](https://github.com/epoupon/lms)

</comment><comment><USER9> is this compatible to with any of the mainstream tv systems such as amazon fire tv, apple tv etc? if not what are some good alternatives?

<comment><USER3> I still don't feel like I have a complete solution for this. You can use Plex or any subsonic client with Ampache as the backend but it doesn't seem perfect, or near-perfect, to me.

</comment></comment><comment><USER10> Where am I supposed to store all the music? S3?

<comment><AUTHOR> I'm storing it on a personal server. S3 would be theoretically fine if you mount it as a file system but I'm not sure this would be the cheaper plan.

<comment><USER11> S3 or other static hosts can certainly be the cheapest thing if used efficiently, cheapness is one of the main reasons people use them at all! So it should be mounted, I guess that's the easiest way of enumerating tracks and getting metadata (edit: and all the file manager features, duh). But would the traffic also have to go though Ampache? Like this:

          S3 (music files) -> Ampache server -> client

Because it would be a lot more efficient to have the option of specifying that files should be streamed directly from another host like this:

          S3 (music files) --->(streaming)></comment></comment></comment><comment>--\
           |                                        \
      (read metadata, manage files)                  `-> client
           |                                         /
           |                                        /
         Ampache server -->(web interface etc.)>---/

I now realize it might be kind of a PITA to implement this because of Ampache's extensive feature set. Still, it would be really cool and an efficient way from a pricing as well as speed point of view. Of course, having a fixed IP and a server in your basement is a also decent solution when it's available to you. (hah, definitely not available to me right now)

</comment><comment><USER12> saw this and immediately upvoted b/c i really want something a lot like this.

went to github and realized i won't use it b/c it's implemented in PHP, i probably don't want _exactly_ what this is, and i don't want to edit/debug PHP (not on my own time, anyway).

is that myopic? anyway, that was my honest, off-the-cuff response to the post.

<comment><USER13> Do you refuse to use any website written in PHP? How do you manage to have a normal internet life in the year 2015?

<comment><USER14> There's plenty of websites that don't run on PHP though? StackOverflow runs on ASP .NET, Twitter ran on Rails at one point, now it's partially a mix of things but some of it is in Scala I suppose, plenty of major sites don't run off of PHP. PHP isn't impossible to use or anything, but it's not the only solution. Everyone should use whatever they're comfortable using. Edit: So long as what they're comfortable using does the job correctly and effectively.</comment></comment></comment>


Boy, 16, was given estrogen at L.A. juvenile hall, suit says - <AUTHOR> https://www.latimes.com/california/story/2020-07-15/teenage-boy-was-given-estrogen-developed-breast-tissue-while-in-l-a-county-juvenile-hall-lawsuit-alleges <comment><USER2> This doctor must lose their medical license for life. At _best_ they are wildly incompetent, at _worst_ they are maliciously inflicting harm upon a teen for personal or political reasons.

Giving estrogen to men usually causes _irreversible sterility for life_. The doctor would have known this. The pharmacist would have known this. That they chose to proceed with the risk of _sterilizing_ a boy without notifying his parents implies horrific things about the doctor's view of the lack of humanity of their patient.

Edit:

I added "the risk of" to the previous paragraph, as elsethread notes that the sterility outcome usually requires much longer dosing intervals. Noted, but if I remember correctly, men pursuing a change in gender are expected to sign their name or initial in the box at least ten times in a row in order to receive their prescription — once for each side effect, due to the severity and permanence of those side effects. Both doctor and pharmacist had a professional duty to review those severe side effects with the patient and their legal guardian.

<comment><USER3> > men pursuing a change in gender are expected to sign their name or initial > in the box at least ten times in a row in order to receive their > prescription

This is not true, at least not anywhere I've gotten Estradiol.

Also, while I'm sure you intended to be respectful with your comment, most people getting this treatment see themselves as women who are changing their bodies to match their gender, not as men who are changing their gender.

<comment><USER4> How should one phrase that sentence without it becoming completely confusing?

Would it be offensive to say "a person with an x and y chromosome"?

Even though gender is only a social construct... for some reason, taking estrogen will have totally different effects on a person, depending on that gender.

<comment><USER5> It's always going to be confusing but I believe "transgender woman" is unambiguously someone assigned male gender at birth who identifies as a woman.

<comment><USER6> What if a biological male is assigned female gender at birth? Would they be transgender, or just female?

<comment><USER7> 1\. When is that going to happen? (Genuinely curious if it does happen)

2\. It is really up to the person.

<comment><USER8> Regarding 1:

[https://www.bbc.com/news/magazine-34290981](https://www.bbc.com/news/magazine-34290981)

</comment></comment></comment></comment></comment></comment></comment><comment> non-entity > Prior to that, Ouchi said, his client felt compelled to take the pills > because he feared that disobeying Wang would have a detrimental effect on > his pending criminal case.

Makes you wonder what all kind of shady medical shit is done in jails and prisons.

<comment><USER9> I have seen a cop order a medic to give sedative to a human that was being choked by said cops for more than 10 minutes (he was basically already dead when they injected him). Search for Tony Timpa on Youtube if you want to see the video. And they were joking while killing him. And last but not least, they all kept their jobs. All humans can be bastards.

<comment><USER10> > And last but not least, they all kept their jobs

Police unions are some of the most powerful organizations. Not being able to fire bad actors is one of the worst parts of unions. I've never understood why there hasn't been a movement to reform them. Their coworkers get stuck with them too and bringing the whole unit down.

Instead we're always sold some nostalgic narrative of past golden eras of unions. Glossing over all the warts and cruft built up over time. We're long overdue for modernized unions.

<comment><USER11> It is more that their definition of bad actor is different. Cops that break rank and complain and testify are fired or demoted. Cops that do that stuff are promoted.

</comment></comment></comment></comment><comment><USER12> > _"Estrogen is not a treatment for ODD. I can't be more emphatic about that," > McGough said. "You won't find a reference anywhere that supports the use of > estrogen for ODD."_

Well certainly the doctor got this theory from someplace. They believed this young man would be better behaved if he had less testosterone and more estrogen, and went ahead with a treatment against scientific evidence (and ethics quite frankly).

So where did the doctor get this theory? Let's ask ourselves that question, and follow up with this question: what other theories are medical and science professionals getting that aren't science based?

<comment><USER13> Not to defend the doctor, but common sense? Sex hormones obviously have a huge effect on behavior, and anyone who has interacted with both men and women can see these effects. I'll refer you to the following study to answer your question about "non-science based theories and treatments": [https://www.bmj.com/content/363/bmj.k5094](https://www.bmj.com/content/363/bmj.k5094)

<comment><USER14> Not that I think "oppositional defiant disorder" is even a sound classification to begin with, but the lawyer's assertion that estrogen is not an accepted or common treatment for males with ODD is spot on. This was done solely with the intent to harm, by offending a deep and fundamental aspect of the person in question.

</comment></comment></comment><comment><USER15> In the US, the criminal justice system is not concerned primarily with reforming criminals or deterring future crimes. It's concerned mostly with making the lives of people convicted or accused of crimes (many of whom are innocent or otherwise had extenuating circumstances) absolutely miserable, retribution taken to the extreme (tangentially, I'm not against retribution in principle, but don't think it should always be the only reason to punish someone). And any sort of "non-compliance" while retribution is being exacted leads to the misery being dialed up. Is there any civilized country other than the US where long prison terms in sadistic conditions is considered "normal"?

<comment><USER16> Retribution should not be a part of any justice system. As retribution is not justice.

Restitution, Rehabilitation and isolation should be the 3 goals of a true justice system.

Victims should have a path to restitution when possible (some crimes this is not)

Criminals should have a path to rehabilitation when possible (some crimes this is not)

For when the other 2 fail, Isolation is the final step, isolation means we isolate people that have been proven to be a danger to others and do not have the ability to be rehabilitated.

Retribution is just unethical, it makes the population of a system of retribution to be no better than the criminals they are abusing.

Support for retribution is a visceral reaction but holds no value or place if the goal is justice.

<comment><USER17> You have made a series of claims, but not given any reasons to back them up. What theory of ethics/justice are you invoking, when you claim that retribution/deterrence is unethical and should not be a goal of our justice system. If a billionaire is found guilty of pedophilia, and offers to build for himself a lifetime "prison" that is really a 5-star resort, should he be allowed to do so? According to your argument, the answer is yes, as long as he is equally isolated.

<comment><USER16> >>What theory of ethics/justice are you invoking

Mainly Zero-Aggression principle, under which the only ethical use of force is for defense of either yourself or others, and only to the extent eliminate the aggressive force being applied.

>>If a billionaire is found guilty of pedophilia, and offers to build for himself a lifetime "prison" that is really a 5-star resort, should he be allowed to do so?

That is a strawman and a red herring all in one. No a person should not be allowed to build their own guided cage, however the prison s/he is sent to should be humane, where s/he would not be physically abused by other inmates or guards, not be subjected to physical or psychological abuse, should be provided basic nutrition, and health care, etc

This can not be said to be true for the US prison system today

Further the system I advocate for would provide for massive amounts of restitution for the victim(s) of this billionaire, unlike the system of today which holds the criminal has a "debt to society" but not necessarily their victims where any restitution would be secondary to the retribution offered to society as "payment" for this debt

I advocate for victim restitution being the primary goal, and hold that society is owed nothing in the equation.

This once a person is isolated from society and can not harm anyone, continued abuse or violence is unethical, "punishment" in captivity is unethical.

<comment><USER17> >> _If a billionaire is found guilty of pedophilia, and offers to build for himself a lifetime "prison" that is really a 5-star resort, should he be allowed to do so?_

> _That is a strawman and a red herring all in one. No a person should not be > allowed to build their own guided cage_

This is a direct implication of what you're proposing. The fact that you don't like the implication, doesn't make it a strawman.

You stated that the only goals of the criminal justice system should be rehabilitation, restitution and isolation. Allowing a billionaire pedophile to sequester themselves in a self-funded 5-star resort, is consistent with all of your stated goals, while still being minimally aggressive, and maximizing their welfare. If you find this objectionable, you need to revise your earlier claim.

</comment></comment></comment></comment></comment><comment><USER18> Something doesn't add up with this story and I suspect it's going to come out in the lawsuit.

If the doctor REALLY did want to lower testosterone levels in the 16 year old, there's a slew of medications that would have been more effective (Spiro, Lupron, Bica, etc). That amount of Estradiol isn't going to do much to lower T levels.

<comment><USER19> It's possible the doctor knows something the parents of the kid don't. You don't treat the symptom (high T levels) you treat the disease (the behavior disorder). It's possible there is something about the boy's medical history that made it seem like this treatment would work better for his body chemistry, perhaps.

<comment><USER20> It is possible that the doctor refused to talk not to ruin his case in court. But it is also possible he is incompetent and simply blew it.

</comment></comment></comment><comment><USER21> This reads like the plot of a dystopian young adult sci-fi novel. Children who resist authority being diagnosed with a "behavioural disorder" and being forcibly given hormones by an evil doctor. Yet apparently this is the reality of modern society.

<comment><USER22> I remember when I had "strange behaviors" as young boy. Some times later i was circumcised. 30 years later I still suffer from it.

I want to get kids soon. I hope they get a strange as I was. Stupid, funny, dangerous.

<comment><USER23> You might already be aware, but it is possible to reclaim most of what was lost via the principle of tissue expansion. It's called foreskin restoration and allows you to regrow basically everything except the frenulum/ridged band.

It's time-consuming and takes awhile to learn how to tug properly, and in a certain sense can be psychologically painful to go through, but the results I've personally seen so far have been very encouraging.

Sorry again to hear what happened to you.

<comment><USER24> Off topic, but I have always felt like something was taken from me re: my circumsion as a child.

Do you have any resources or guides you recommend on restoration? I've looked in to manual tugging and some of the stretching devices. The devices don't seem practical to wear around discreetly on a day to day basis, and I haven't gotten manual technique to show results yet.

<comment><USER23> I haven't tried devices. I mainly do MM3 (andre's method) and MM2. It took me quite some time to learn how to tug effectively.

Results are very slow and I started from a very tight cut. I'm still not even at a "loose cut" level so I have quite a bit left to go.

Not sure if you've heard of it, but red light therapy makes a big difference in the rate of tissue expansion.

[http://www.jmbe.org.tw/files/1641/public/1641-4366-1-PB.pdf](http://www.jmbe.org.tw/files/1641/public/1641-4366-1-PB.pdf)

I think adding RLT to manual methods will drastically improve your results. Just a couple sessions of fairly high intensity RLT a day does wonders.

—-

TL;DR: like you I'm still figuring things out. But I'm pretty encouraged overall.

</comment></comment></comment></comment></comment><comment><USER25> "oppositional defiant disorder"

That's what they call mouthy rebels these days

<comment><USER26> Meh. It's a real thing.

A small but not trivial portion of the public immediately lapses into a near- rage at anything that appears to be an authority figure. People seem to grow out of it.

Maybe it's PTSD from poor interactions with past authorities, maybe it's some kind of pack hierarchy hold over, who knows-- but it appears to be a pretty widespread phenomena.

It doesn't stop being real just because the description could also be abused to dismiss someone who has a legitimate complaint about a particular authority.

<comment><USER27> The claim that "it's a real thing" doesn't mean anything other than that some people exhibit certain behaviors that some other people decided to group together, give them a name, and put it in DSM-5. None of this refute GP's claim that "that's what they call mouthy rebels these days".

</comment></comment></comment><comment><USER28> Google: Oppositional defiant disorder: A condition in which a child displays argumentative behavior towards people in authority.

Really.

Not violence. Just "argumentative behavior".

<comment><USER29> The Wikipedia page for that is something to behold, reading it you get the distinct impression that someone has succeeded in convincing the psychiatric profession to make an entire stage of human development into a disorder.

</comment></comment><comment><USER30> In this thread could we have people preface their comments with the intent they're assuming of the doctor? It seems to be a split between "the doctor was using an non-indicated treatment { in an attempt at gender-bending | for unknown reasons }", and the discussion is a disaster because everyone is talking past each other.

</comment><comment><USER31> Tangential is yesterday's JRE podcast with Abigail Shrier[0] who's a journalist for the Wall Street Journal.

The interview discusses her new book's findings about hormone therapy given specifically to teenage girls through the means of "informed consent", which led to terrible developmental and reproductive damage that was in most cases irreversible.

[0] [https://www.youtube.com/watch?v=CtftWcgXjdg](https://www.youtube.com/watch?v=CtftWcgXjdg)

</comment><comment><USER32> It's been a while since I've done biology, but if the boy was ingesting estrogen in a pill form, doesn't that also put additional strain on the liver?

<comment><USER2> Testosterone carries a significant risk of liver damage — even if it's injected. Estrogen doesn't, ingested or otherwise.

<comment><USER33> That's interesting. Why the difference?

<comment><USER2> I'm not sure if science knows why yet. [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3897047/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3897047/) may be a good starting point, but IANAYD etc.

</comment></comment></comment></comment><comment><USER34> As someone who recently had surgery for gynecomastia that I've had since puberty, I feel sorry for the kid and hope the breast tissue will naturally resolve.

The event is confusing for several reasons - not only are testosterone levels not linked to ODD, even if they were, there are drugs that can gently reduce testosterone production. Estrogen isn't one of them.

</comment><comment><USER35> [https://archive.is/NSV1u](https://archive.is/NSV1u)

</comment><comment><USER36> One thing not addressed here is that the surge of estrogen during puberty is what causes your long bones to fuse at the ends and you stop growing. It is possible that this young man's growth may have been permanently capped by this irresponsible behavior.

</comment><comment><USER37> The I love when people have perfect names. The victims lawyers name is Ouchi.

This is pretty tragic, reading the article there is no way this is an isolated incident

<comment><USER38> Wang, Oh, Ouchi... Asian names can be hilarious for an English speaker. The incident itself is not that hilarious on the other hand.

<comment><USER39> The reverse is also true - I recall reading an artucle that lists English names and their (often offensive) homonyms in Cantonese.

</comment></comment></comment><comment><USER40> The doctor should be stripped of their license.

<comment><USER41> Given that nobody seems to be able to account for his decision, it seems like maybe he should be in prison.

If somebody assaults my testicles and renders me infertile, that is an extremely serious crime; this doctor may well have done the equivalent (along with completely destroying the boy mentally) with the stroke of a pen.

<comment><USER42> Came here ready to be horrified at the gender paranoia living under the surface of HN, was actually surprised with how reasonable everyone was. Except this comment.

None of those symptoms (infertility, "complete mental destruction" or, heh, "assault on the testicles") are alleged here. He got an inappropriate drug, possibly punitively. And that's horrifying enough without painting figurative spectres of the unimaginable cruelty of... emasculation?

<comment><USER41> You did not read the complete details of the case (or frankly, even read the comment you're replying to). The dose was large enough to give him gynecomastia, which the other inmates bullied him for, and for which he will require surgery. His father reports that his son's personality is completely different, he is now a total shut-in.

> _He got an inappropriate drug_

He was injected† with non-indicated (as in, there is no literature on this rogue prescription) contradictory sex hormones during _adolescence_ and under duress; I don't know why you're downplaying this, I hope it's just because you don't know what this means.

> _infertility_

Infertility is a common outcome of sex hormone therapies.

> _...the unimaginable cruelty of... emasculation?_

If suppressing gender dysphoric people is wrong, how can it be moral to medically intervene to deprive an adolescent of _the normal functioning of his body, and an already solidified gender identity?_ Using non-indicated medical interventions to emasculate or defeminate somebody who is already secure is a form of extreme cruelty, from basically any moral frame, yes.

† Correction from helpful reply: not injected, taken as pills. I got the "injection" thing from this thread, had thought it was pills before.

<comment><USER42> > He was injected with non-indicated contradictory sex hormones during > adolescence and under duress; I don't know why you're downplaying this

I'm not downplaying this at all. It's you who are boosting your interpretation because of "assault on the testicles", "mental destruction", "sex hormone", and other things that tell me what you're really upset about is his masculinity and not his well being.

No, I don't think this is any worse than had he gotten an equivalently dangerous drug (say, fentanyl for sedation, which has also been alleged in juvenile detention facilities IIRC). And I'm point out the fact that you do is... unseemly.

<comment><USER43> This is worse precisely because of the reasons transphobia is bad. This poor boy has been forced - by a medical professional, no less - into a place on the gender plane that is different to the one that he identifies as. The psychological effects of that are _horrifying_ , and the physiological effects are potentially permanent.

There's nothing wrong with being trans and going through HRT so long as you do it with full and knowing consent. You do that because you feel deeply dysphoric about the gap between the body you've been forced into and your true identity, but it's not without cost. To force both the cost and dysphoria onto someone is, again, truly abhorrent.

<comment><USER30> >This poor boy has been forced - by a medical professional, no less - into a place on the gender plane that is different to the one that he identifies as.

Where are you getting this intent from? I don't see anything in the article to suggest this was the doctor's goal.

<comment><USER44> It may well not have been the objective, but that was the rather unsurprising result. Depraved indifference; behaviour that can lead to criminal liability.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER45> Is it the Danny Wang in Duarte CA?

</comment><comment><USER46> A woman that uses the pill as birth control consumes 0.00365 gram of estrogen a year. At a consumption price of the pill for $300 a gram of estradiol is thus worth $82,191.79. Compare that to $44 for a gram of gold and you wonder if big Pharma is ready for disruption?

<comment><USER47> You're not factoring in labor, packaging, pharmacy profit, pharmacist wages, insurance company profit. If you think you can do it cheaper, then go for it

<comment><USER48> When Florida is importing drugs from Canada instead of buying them domestically then its pretty self-evident that it can be done for cheaper.

Not sure if this is an earnest defense of the state of healthcare costs in the US but you'd have to be deluded if you think that the rampant profit-seeking in the US for healthcare is merely the cost of doing business.

<comment><USER49> Estradiol is a generic drug and generic drugs tends to be _cheaper_ in the US than Canada[1] and the EU. The US generic drug market is incredibly competitive.

It's brand name drugs that are cheaper in other countries.

[1][https://www.who.int/intellectualproperty/events/en/R&Dpaper2...](https://www.who.int/intellectualproperty/events/en/R&Dpaper2.pdf)

</comment></comment></comment></comment><comment><USER50> They should make the doctor take the treatment he prescribed for the kid for the same duration. Only fair he experience what he did with malice.

</comment><comment><USER51> > was diagnosed with oppositional defiant disorder, or ODD, two days after he > was arrested and housed at Eastlake Juvenile Hall in June 2019, the lawsuit > said. Medical records reviewed by The Times show that the teen's > testosterone levels were "slightly high" when the doctor who diagnosed him > prescribed daily doses of estrogen

This is sickening, not so much for the drugging but the 'oppositional defiant disorder' interpretation. Knuckle under, kid.

However, simply on a factual basis (I assume the story was based on an established practice anyway), I remember as a kid reading a story in 1001 nights where some male child was castrated to stop him being bolshy. They do that to animals for the same reason and with the same effect. There's precedent.

<comment><USER52> Castration reduces testorone. Estrogen does not reduce testorone as far as I know. Which is why transgender women take both estrogen and testorone blockers. If the doctor had prescribed a testorone blocker you might have a point about precedent.</comment></comment>


GIMP-Win project wasn't hijacked, just abandoned - chris-at https://sourceforge.net/blog/gimp-win-project-wasnt-hijacked-just-abandoned/ <comment><USER4> There is zero excuse for what they did, and zero excuse for what they have been doing for the past years.

Once again reposting what I said in the other thread (which seems to have been modded off the frontpage, sad).

I'm one of the lead devs of LXQt and an LXDE sysadmin. We use Sourceforge for our mailing lists and some LXDE legacy stuff.

I'm absolutely sick of them. It's not the first time this has happened. I've been pushing for us to move off SF for a while and this is a good occasion to push for it harder.

I've sent an email [1] detailing plans to move. I am urging everyone who still has projects on Sourceforge to do the same.

If you have similar migration problems to solve as the ones I've highlighted in the email, please contact me directly and we can share the workload. My email is available on my Github profile [2].

[1] [http://sourceforge.net/p/lxde/mailman/message/34148903/](http://sourceforge.net/p/lxde/mailman/message/34148903/) [2] [https://github.com/jleclanche](https://github.com/jleclanche)

<comment><USER5> It's unfortunate there aren't many good hosted mailing list services out there. Google Groups makes it hard to use without a google id, and mailman is tricky to setup/maintain.

<comment><USER6> Have a look at freelists www.freelists.org/

<comment><USER7> I love their Terms of Service:

> I have read and agree to the above terms , and agree that if I ask FreeLists > for email addresses or send SPAM using their resources, they have > _permission to inflict severe pain on me with large, blunt objects._

[emphasis mine]

<comment><USER8> Oh that brings to mind the old User Friendly comic attitude. We really need more of that these days.

</comment></comment></comment></comment></comment><comment><USER9> This makes me even more angry at SourceForge and not less.

1) There is nothing clear and open about the project being abandoned by the author

2) The author left SourceForge due to their business practices and this allows SourceForge to take over the repos and continue making money?

3) Is SourceForge just going to maintain any project that leaves them and makes a mirror?

The sad state of Download.com and SourceForge keeps getting grimmer and grimmer.

<comment><USER10> >This makes me even more angry at SourceForge and not less.

YCombinator also invested in a company that did this.

[http://www.istartedsomething.com/20130115/y-combinator-is- fu...](http://www.istartedsomething.com/20130115/y-combinator-is-funding-the- future-of-spam-in-windows-drive-by-crapware-installers/)

Here's pg's response:

>2\. The apps that get installed are "crapware."

>This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things.

[https://news.ycombinator.com/item?id=5092711](https://news.ycombinator.com/item?id=5092711)

<comment><USER11> Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but- not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time.

What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know _I_ don't read the dependencies.

<comment><USER12> > What systems are in place to prevent this from happening with package > manager systems like apt-get, yum, or even npm? How often do we just blindly > "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.

Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.

<comment><USER11> So the answer is "trust"? We're supposed to just trust Canonical, the company that put Amazon ads in our desktop search, to not figure out they could put adware in their package repository?

<comment><USER12> I wouldn't. But I'd trust Debian.

<comment><USER13> And, I would trust Fedora (which has similarly stringent Open Source guidelines for inclusion).

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Sourceforge took over more than 300 dormant projects.

Here is the list, [http://sourceforge.net/u/sf- editor1/profile/](http://sourceforge.net/u/sf-editor1/profile/) [http://sourceforge.net/u/sf-editor2/profile/](http://sourceforge.net/u/sf- editor2/profile/) [http://sourceforge.net/u/sf- editor3/profile/](http://sourceforge.net/u/sf-editor3/profile/)

<comment><USER15> On the list Apache Hadoop, Apache Lucene, OpenOffice, SQLite, etc. wow - <AUTHOR> all these downloads come with an malware installer..

</comment></comment><comment><USER16> The GIMP developer has asked SourceForge to remove the installer. Guess they just ignore him.

[https://mail.gnome.org/archives/gimp-developer- list/2015-May...](https://mail.gnome.org/archives/gimp-developer- list/2015-May/msg00098.html)

<comment><USER17> This alone seems like reason enough not to use SourceForge even if just for mirroring a project. Which is what a lot of projects do including some Linux Distributions, what are alternative hosts at that point though?

<comment><USER18> Gitlab, Bitbucket, GitHub are the big three. There's a whole lot of others, but those are the ones I know off the top of my head.

<comment><USER19> There's also Gitorious

<comment><USER20> GitLab CEO here, Gitorious was acquired by GitLab [https://about.gitlab.com/2015/03/03/gitlab-acquires- gitoriou...](https://about.gitlab.com/2015/03/03/gitlab-acquires-gitorious/)

<comment><USER21> It seems like there's an opportunity here for the big three.

I'm thinking something along the lines of, "Don't like the way services like SourceForge are handling your project nowadays? There are better services to use; here's a list. Obviously, we'd like you to use ours. We've already set up a home for you on our service in anticipation of your stay with us, which we think you'd enjoy. You'll find that it's already fully furnished, even. Here are the keys. Give us the go-ahead and we'll aggressively pursue the takedown of badware distributors."

The benefits to any of the three who go for this plan would be the host's association with such high-profile projects. GitHub may look at this and decide that at this point in their trajectory, there's just not enough in it for them, but it seems like either GitLab or Atlassian could benefit from it.

<comment><USER20> At GitLab we already have one-click importers for GitHub.com, Google Code and Bitbucket. We would love for someone to contribute a SourceForge importer.

<comment><USER18> That's not quite the angle he(?) was going for — he(?) is saying that an aggressive campaign from one of the Big Three in Git hosting to aggressively take down badware distributors while hosting your software would be one hell of a PR campaign.

<comment><USER20> I don't think any of the big three are hosting badware. We want people to choose GitLab, I don't want to start distributing software like Gimp without their blessing.

<comment><USER21> I think you're still not hearing what I'm getting at. The idea isn't that the big three are now peddling crapware-infested downloads, but there exist services like SourceForge and tons of download sites that are.

This is about aggressively courting existing projects that may still be on SourceForge out of nothing more than inertia. Migrating away is a process, even with importers. My original comment was about surveying the landscape for potential candidates that you'd like to see using GitLab, and then go ahead and set up a home for select projects before approaching them. This could include reserving accounts for the core developers, pre-seeding the project with whatever importing would be required, and just generally making it stupid-easy to migrate--as easy as just saying, "yeah, okay; we'll do that", and then setting up their password.

If you're worried about doing anything with their blessing, this could all happen in such a way as to not be publicly accessible until the project actually gives the go-ahead and confirms they would like to make the switch.

<comment><USER20> Making it easy is a great idea and our on-click importers are getting better all the time. Pre-creating all SourceForge accounts and content is wasteful, many good usernames will go unused and all our backups will contain many projects that are never accessed. So we'll focus on making in the import good and fast instead of doing it in advance and emailing people about it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Whenever a download link (and more often than not, for me, it's usually for a server-based tool) goes to Sourceforge, I cringe - more than a little. For Linux based tools, its because a simple 'wget' for a file is going to end up with a comlex filename that I have to rename. This, at least, is a simple problem for me to fix.

For desktop software, I'm more concerned after hearing of projects being wrapped in Adware/malware. This is a particular problem on sites like [http://download.cnet.com](http://download.cnet.com). I've been online since at least 1996, and those sites used to be great to be able to find useful software. Now, I prefer to not install much new software, in order to keep a stable desktop (and it does work - I've only had to wipe my desktop and install Windows from scratch once or twice in my entire online career, I get new PCs more often).

I've even seen jobs posted on some sites to work on open-source code - <USER2> then the project is hosted on sourceforge.net, and so it is using Subversion for version control. While I may be expert on the underlying technologies that particular project used (and the language) - its not something that would ever convince me to help them - not even while being well paid (and working remotely, which is what I'm aiming to do from now on).

</comment><comment><USER13> So, this is a reminder (and a very harsh one) that trusting third parties with your projects _may_ be a risky decision. I see many people suggesting moving off of SourceForge to Github. While we moved most of our stuff to github years ago, and I like github and have no major complaints about them today, I'm having doubts about the wisdom of staying on any third party hosting site, no matter how nice they seem today.

Let's put this in context: SourceForge was once (this was many, many years ago) a deeply trustworthy entity. They were _excellent_ stewards of Open Source projects. They consistently took guidance from the community, and wouldn't have chosen profits over users or projects (though, certainly, they've profited).

Markets change, leadership changes, acquisitions happen. One day, we may not recognize github as the entity we know today, just as we don't recognize the entity that SourceForge has become.

I'm not saying don't move to github. Obviously, nobody should be starting new projects on SourceForge and github is one of the better third party alternatives. But, it may be worth thinking about what happens when we as an Open Source community build up another SF.net like entity. A central repository for all the most popular Open Source software, controlled by one profit-driven corporation.

Maybe it was worth the tradeoff. Maybe SourceForge provided enough value over the years to where it's not worth belly-aching about having to rebuild our communities around new tools (maybe even another third party tool), and to educate users that SourceForge is now an untrustworthy provider that should be avoided. Maybe we have to just mourn the loss of a once great supporter of Open Source software and move on to another that will likely, someday, also turn its back on Open Source values in pursuit of profits.

I hate trash-talking SourceForge so harshly, as projects I've been involved in have been well-served by SF.net in the past (and even now, we're pushing out terabytes of downloads through their mirrors, even though we've moved our revision control to github long ago). But, the company as it exists today is nothing like what it once was. I must assume none of the original founders remain given how far this strays from the original vision of the thing, and certainly it's been through multiple acquisitions and leadership changes. Maybe I shouldn't feel so bad about it...maybe the SourceForge I knew has been dead for years, and I just didn't notice as it's taken a while to start to smell.

<comment><USER21> People, even hackers, get unreasonably attached to names. Your last paragraph is key. If the company operating SourceForge today were doing what they're doing today under any other banner, no one looking to evaluate the options available to them would come away with the conclusion that TAFKA SourceForge would be the thing to go with.

</comment></comment><comment><USER23> The whole blog post can be summarised in the one sentence "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers."

Makes me pretty sad since I still remember the days when SourceForge was one of the good guys.

<comment><USER24> > "Mirrored projects are sometimes used to deliver easy-to-decline third-party > offers."

If they just _mirrored_ the project, no one would be complaining. Having another place to download copies of the official releases is a good idea.

The issue is they _changed_ the release. They advertised it as "mirror of Gimp-Win version X". And it wasn't. It was Gimp-Win version X with a boatload of adware / crapware. This made the Gimp-Win people upset that the crapware was being falsely associated with their product.

If SF had advertised it as "SF Version of Gimp-Win with magic crapware", people would be less upset. And fewer people would download it, of course. Which isn't what SF wants.

Their self-serving statement about "mirror" is a lie. The people who wrote it should be ashamed of themselves.

</comment></comment><comment><USER25> They show their true colors in the last paragraph:

 _We welcome further discussion about how SourceForge can best serve the GIMP- Win author._

Just stop. How disingenuous can you be? What a disgrace.

Do we really need to go there? Ok, how about: "completely suspend and remove the project, and don't let the name be reclaimed."

Source Forge is trying to convince us they never thought of that. Really? Give me a break. You knew. You just don't care. Fine, you don't. But don't try to play that off as ignorance. "Oh, yeah, please enlighten us with further discussion!" Get out of here, stop wasting our time.

They could just as well have done away with the blog post and put up an image of a giant middle finger, instead. At least that would have been honest.

<comment><USER26> We should start discussing how they can shut themselves down and rid the world of the blight that SourceForge has become.

RubyForge folded and the world was better off.

</comment></comment><comment><USER27> I moved my project to github after one of their "enticing" offers installed a vpn client that redirected all my traffic and inserted ads into my browsing, when I installed filezilla. The installer they add is designed to make it very easy to install their "offers"without your realising it. I'm very wary of any code on sf now.

<comment><USER28> The Filezilla team also deserve some credit in that case, as they opted-in to the ads on purpose (the Filezilla team gets kickbacks from each adware install).

</comment></comment><comment><USER29> So in fact it was hijacked… by SF.

My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off.

Also, old HN post on "what happened to Sourceforge": [https://news.ycombinator.com/item?id=6700115](https://news.ycombinator.com/item?id=6700115)

<comment><USER30> _> My employer runs a sourceforge mirror – i am going to start some discussion if we can turn it off._

Please do. IIRC, most (all?) of their mirrors are provided by third-parties who are graciously offering their resources and SourceForge is taking advantage of them to serve up and profit from adware/malware installers.

</comment></comment><comment><USER31> In all fairness, the page for gimp-win on sourceforge clearly states it is a mirror of a project that is no longer distributed by the upstream author through sourceforge --

"Hey, this isn't a SourceForge project! Check out the SourceForge Open Source Mirror Directory for more information. " -> this links to a page that explains in detail what you are getting.

I don't have a windows installation handy so I can't 'test' the SF installer to see if the adware or add-on programs are easy to identify and accept or refuse -- has anybody tried that?

</comment><comment><USER32> I've heard about how SF has been some financial trouble, but isn't all this adware nonsense just going to hurt them more in the end? Surely some crowdfunding option could've been more of a viable effort...

<comment><USER33> They've been getting scummier and scummier. They've been doing this ad bundling thing for years, and their entire website is basically unusable without adblock. Someone at Slashdot enterprises has no idea what they're doing. At any rate, SourceForge is going to die soon. I wouldn't be surprised if Google starts to delist them for distributing malware.

</comment></comment><comment><USER10> Dice Holdings also bought Slashdot, and now there are things that look out of place, like the Kate Upton ad for God of War, Slashdot Deals [1], and annoying ads as tweets on the twitter account which made me unfollow.

[1] [https://deals.slashdot.org/?utm_source=slashdot&utm_medium=n...](https://deals.slashdot.org/?utm_source=slashdot&utm_medium=navbar&utm_campaign=dealshp_1)

Would be interesting to see if Slashdot posts this story.

<comment><USER34> > Slashdot Deals

This has to be some prank, they can't be serious about that.

</comment></comment><comment><USER35> That is some crazy amount of spin. SourceForge started their path down the scummy side a while ago but this is really taking it to a new level.

You'd think that if they really cared, they would back pedal on what they did, but no, instead, they double down by trying to justify what they did and "welcoming further discussions".

Also, this:

> deliver easy-to-decline third-party offers

How about delivering third-party offers that users need to opt in instead?

Terrible, terrible company and organization.

<comment><USER36> Software that requires opt out should be considered as malicious as software that doesn't give the ability to opt out.

</comment></comment><comment><USER37> >Mirrored projects are sometimes used to deliver easy-to-decline third-party offers

It's as if they know the majority of experienced users would decline those "enticing" offers.

<comment><USER38> Adobe pull this same scummy move with Flash downloads; Oracle do it with Java too. Surprised me recently setting up someone's Win 8.1 laptop as I had thought that such moves were now illegal in the EU - perhaps they are?

<comment><USER39> Legally, no - after all, people give their express permission by leaving the box ticked.

The newish anti-spam measures in the Netherlands actually forbid the 'Yes I would like to receive spam' checkboxes to be pre-checked - has to be opt-in instead of opt-out.

<comment><USER38> I thought that was the ruling for applying whatever directive it was - <USER3> the box couldn't be pre-checked to install other software but instead the user had to check it (as in your spam example).

[research ensues!]

[http://europa.eu/rapid/press- release_MEMO-11-675_en.htm](http://europa.eu/rapid/press- release_MEMO-11-675_en.htm) see (3) "Banning pre-ticked boxes on websites". I'm sure Oracle - or whoever - would argue that as the consumer isn't paying they don't have to abide by the regulation but Oracle are being paid to do it so I don't see how that's any better (in fact it's worse really).

</comment></comment></comment></comment><comment><USER40> So what they did was take an abandoned project, add their adware installer and release it?

<comment> chris-at [https://plus.google.com/+gimp/posts/cxhB1PScFpe](https://plus.google.com/+gimp/posts/cxhB1PScFpe)

> It appears that +SourceForge took over the control of the 'GIMP for Windows' > account and is now distributing an ads-enabled installer of GIMP. They also > locked out original owner of the account, Jernej Simončič, who has been > building the Windows versions of GIMP for our project for years.

<comment><USER41> Apparently happened with VLC too...

> We also got outed of our +VLC project on sourceforge...

> But it does not matter, we moved to our infrastructure a long time ago to > our own, which is better and more powerful!

</comment></comment></comment><comment><USER42> tl;dr "Hey, it's not our fault that we adopted policies so offensive to the project maintainer that they utterly washed their hands of us, but the license of GIMP basically prevents them from preventing us from distributing the software inside of our third-party shovelware bundle..."

Good job SourceForge. A++ would never download anything from again.

</comment><comment><USER36> Why don't they (SourceForge but also all the other software vendors out there, even Oracle with the Java and Ask.com bundling) just have it so it automatically installs all the crapware instead of asking you? Last I checked, it was because this would get them treated as outright malicious. I suggest that we consider such offers where the default option is to install them to be considered as malicious as installing them without asking.

</comment><comment><USER11> >> Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available.

So in other words, GIMP-Win was hijacked, just not by a 3rd party.

</comment><comment><USER43> Lets take action and report the website so browsers warn users once they try to navigate to the page.

[https://www.stopbadware.org/](https://www.stopbadware.org/)

Please report the entire website, not just some project. They had distributed enough malware already.

</comment><comment><USER44> "Mirrored projects are sometimes used to deliver easy-to-decline third-party offers, and the original downloads are always available."

Well, there's your problem.

</comment><comment><USER45> Wow, it's not clear _at all_ that the SF page is a "mirror" of the official project, and for now it remains the first google result.

What assholes.

</comment><comment><USER46> Source Forge has been doing this for a while now, not just gimp.

Pretty sure I downloaded Synergy and it deceivingly downloaded a common installer which was small and installed adware as it downloaded the proper executable which you desired to download in the first place

<comment><USER47> There are two problems.

1) wrapping the software in the sourceforge installer which includes adware. (That's what you mention).

2) having a page that looks like an official project page and distributing the software. This is bad for bla bunch of reasons, including 1) above.

</comment></comment><comment><USER48> I'm sure we only hear about "easy to decline/opt-out/remove" software when it is something nobody ever wants. If the first feature of your software is that it's easy to decline, maybe it's time to pack up shop.

</comment><comment><USER49> I have good memories of SF being the hub of OSS back in the day. I was particularly fond of how projects could actively post types of people they were looking for (artists, doc writers, etc) instead of just relying on being stumbled upon and/or just listing an issue.

However, recently, I cringe if I somehow end up at an SF link. Feels like I'm on the wrong side of the Internet and that I can't trust any downloads from them.

</comment><comment> chris-at > Based on our prior outreach to the GIMP-Win author, we understand that they > had concerns about the presence of misleading third-party ads on > SourceForge. They were not alone in those concerns — we were also concerned > — leading us to establish a program to enable users and developers to help > us remove misleading and confusing ads.

right.

</comment><comment><USER50> Isn't this a problem with overly permissive licences used in most OSS? AFAIK there is nothing stopping any commercial entity to just resell you OSS as-is (in case of GPL they just have to link to sources as well). There's also nothing stopping them from putting ad- and malware in, correct? IMO it might be a good idea to put some limits into OSS licences - even if most projects wouldn't have the means for litigation, at least it would give pause to some legal departments of such companies trying to abuse OSS. I'd also advocate to have a standard license similar to creative commons for non-commercial use. Why not adding some semi-enforced sponsorship element into OSS projects that are heavily used commercially?

<comment><USER21> This is true of any software that's freely redistributable. There's nothing particular to FOSS that enables what's going on in this case. (In theory, the source allows them to change it at the source-level and bake the badware in, but SourceForge doesn't seem to be doing that.)

</comment></comment><comment><USER51> I also notice this isn't covered by Slashdot, who is owned by DHI, who owns Sourceforge.

</comment><comment><USER52> 100% scummy. Question is, what do we do about it?

I wonder... Is bundling adware installers with GPL software a violation of the GPL? (If not, _should_ it be? v2?/v3?) Where's the installer's source? It wraps it in one linked executable file and presents itself as an installer for it, so I am not clear that any "mere aggregation" defence would hold?

There's also a reasonable argument that this brings the official project into disrepute: The GIMP may not be trademarked, but would it have to be?

Firefox, of course, _is_ trademarked. I dearly hope they've never wrapped Firefox installers with adware, because Mozilla would not like that.

<comment><USER53> I would assume that a non-GPL installer for GPL software would be fine, because it doesn't actually run the software, just installs it as a set of files (If it does run the program, generally it doesn't interact with it). I would equate it to using something like GNU 'indent' on proprietary software - I doubt using a GPL program to modify data would cause that data to have to be under the GPL or any other license.

What _is_ very possible is that if they integrated their installer into GIMP's installer (Since GIMP already has it's own installer), GIMP's installer is GPL so their modification would be a GPL violation unless they make the code available. If all their installer does is run GIMP's installer though, then there's no violation AFAIK.

<comment><USER54> They could just make the code available for the installer.

It's not as if an installer is software worth protecting via copyright in 2015.

</comment></comment></comment><comment><USER55> Sourceforge has been dead to me for a while now. I think it started with FileZilla.

</comment><comment><USER47> Gimp should just push an update that has a "Stop using Sourceforge" splash screen and see if Sourceforge distributes that new version.

It's a shame. Sourceforge used to be really good.

</comment><comment><USER29> [http://helb.github.io/goodbye-sourceforge/](http://helb.github.io/goodbye- sourceforge/)

</comment><comment><USER56> Given that the author hasn't given them permission to distribute GIMP, much less a modified installer of GIMP, can he send a DMCA to them?

<comment><USER57> Does an author need to grant permission for anyone to distribute his/her GPL'ed source?

<comment><USER58> They cannot file a DMCA because there are no copyright issues.

This is why popular open source projects should seek trademark protection on their names.

Sure, people get angry about Mozilla's protection of the Firefox trademark, but this demonstrates that there are legitimate reasons to trademark a name so you can protect it from malicious operators.

<comment><USER59> Which is presumably why Firefox's downloads aren't modified (I checked yesterday): [http://sourceforge.net/projects/firefox.mirror/](http://sourceforge.net/projects/firefox.mirror/)

</comment></comment></comment></comment><comment><USER60> It is a pitty because I use SF often. I think that the problems could be solved if we could use something like pkgsrc on Windows.

Unfortunately this is not a reality or an option but it would be a good alternative.

Msys2 project gives a few of these apps as binaries. But it would be more user friendly if we could just download from a source repository and compile locally on windows.

<comment><USER21> Windows 10 is supposed to finally ship with something resembling a proper package manager. Or something.

</comment></comment><comment><USER61> So they take the code from a 3rd party, compile it into an installer with malware bolted on, and reap the profits from the malware.

Yeah, hijacked.

</comment><comment><USER62> Question what are the alternative solutions to distribute window binaries freely,without adware like sf or download.com ? github used to allow binary distribution but not anymore, and I don't feel like tags are a good way to do that.

<comment><USER63> > github used to allow binary distribution but not anymore

Sorry I must be missing something, what's wrong with "Upload a release asset" [1].

[1] [https://developer.github.com/v3/repos/releases/#upload-a- rel...](https://developer.github.com/v3/repos/releases/#upload-a-release- asset)

<comment><USER64> Github used to have a simple binary files service, this was removed with no replacement, and then the release asset system was added shortly after.

I only recently found out release assets.

</comment></comment></comment><comment><USER65> They are doing something with GIMP what they did to VLC.

</comment><comment><USER66> Fuck SourceForge. The people that bought it blew it.

</comment><comment><USER67> Bye sourceforge!

<comment><USER68> I'm astonished they lasted this long. The only unique thing they ever did was their compile farm, now long gone.

</comment></comment><comment><USER69> I think I've recommended sourceforge.net be added to the webfilter global block list at every client I've worked with in the last 5 years. Once I pointed out the risk of their drive-by download strategy, no one has said no, and very rarely has an end-user complained (something almost always remedied by finding a legitimate download site for them).

</comment><comment><USER70> Personally, I see this as one of the natural consequences of permissively- licensed software, and the freedom of being able to obtain such from the open Internet. This is a feature, not a bug.

If you want something with more security guarantees, then use the walled- garden app stores. It reduces your chances of getting malware, but also reduces the choices available to you.

Whether or not people like what SF is doing does not change the fact that it is legal under the GPL. I hate adware myself, but if someone chooses to distribute it legally, then I respect their freedom to... and the only thing I would do is tell the users so they can make an informed decision. The official GIMP site has made a notice about this already.

As long as computing platforms exist which allow users to install any software, from anywhere they choose, they will eventually install something they don't want (and even in walled-garden app store environments they still manage to.)

Something to think about: "Freedom is not worth having if it does not include the freedom to make mistakes."

<comment><USER71> The problem is SourceForge hijacking the GIMP site

<comment><USER70> The official site is [http://www.gimp.org/](http://www.gimp.org/) and it has nothing to do with SourceForge.

<comment><USER71> So? SourceForge hijacked the GIMP page on SourceForge, which shows up in search results for GIMP downloads.</comment></comment></comment></comment>