Scam site selling GNUCash

[John Ralls]

On Apr 17, 2012, at 1:43 PM, Fraser Murrell wrote:

> Hello,
> 
> A friend of our family recently paid £35 to http://www.mi-shop.co.uk/ for accounting software that they call "P.S.B.A".  They received the CD through the post and installed it, and found that it installs GNUCash.
> 
> Appreciate you release it under GPL license, but is this considered a scam?  There is no mention on their website that they are re-distributing GNUCash, and charging for it.  It feels like they are basically taking donation money out of your pockets, and to be honest, I don't trust the distribution that they send out either (based on no evidence).

If they've included the license and at least a pointer back to our website in lieu of the sources for every GPL library plus Gnucash, they're complying with the terms of the GPL. It's not very honest of them to conceal what they're selling, but AFAIK it's not illegal.

There's actually a screenshot on the "Product Features" page with the heading "example-reporting gnucash - Checking Account.

That said, I wouldn't trust the program they provided either unless the SHA-256 hashes for their installer and ours match. It's far too easy for them to modify the code to record your bank account numbers and credentials and report them back, or to install malware. After all, the website does say that it includes "bonus software". Remember that the installer has presumably run with admin privilege and advise your friend accordingly.

Regards,
John Ralls