Do you trust sourceforge?

[NickStone]

SourceForge has sworn off its ways of wrapping "unmaintained" code from open source projects in installers that offer bundled commercial products in the wake of objections raised by some open source communities. But one policy remains in effect—the takeover of project pages SourceForge's staff decides are inactive, and assignment of ownership of those projects to staff accounts. One of the latest projects grabbed in this way is the Nmap security auditing tool.

Read full article here

[MoonRise]

Sad to read that.

[GreyGeek]

SF installed "DevShare" and started packing crapware inside their install scripts about two years ago. I stopped using them then
I don't know if what they are doing is legal but IMO it is unethical. They have hijacked several projects, apparently without permission, in order to sell ads and peddle nagware. Here is a list of known hijacked projects given in one comment:

There are a lot of SF projects now owned by the sf editors (from the Projects section of each profile), including:

* Apache HTTP Server
* Apache OpenOffice
* Apache Subversion
* Audacity
* Drupal
* Eclipse
* Various GNOME projects (epiphany, evince, evolution, etc.)
* Fedora
* Firefox and Thunderbird
* LLVM
* LibreOffice
* Mono and MonoDevelop
* MySQL
* PostgreSQL
* Qt Creator
* SQLite
* The R Project (the statistical computing language/software)
* VLC Media Player
* git-core (the Git VCS) -- this is a mirror of https://code.google.com/p/git-core/
* selenium

They have joined the list of several FOSS oriented websites which have attempted to monetize their website with false download buttons and other deceptive tricks. One of my favorite sites, /. , went that route and I no longer visit them

The lesson is: use the repository OR the app's home page, not SF