Slashdot Mirror

Pretty sure that "free" chat client aggregater Digsby has been using CPU time on machines it's been installed on for ages - one of the reasons I don't recommend people use it.

It's in section 15 of their TOS.

Don't know if they've ever used this specifically for Bitcoin mining, but there's no reason they couldn't.

In 2008, there was a bit of a stink raised when chat client Digsby implemented a "Research Module" that used local CPU resources while the machine was not active. Their blog post announcing the fact was in 2008, and I'm not sure that they ever removed this functionality.

It was reason enough for me to force anyone I knew to uninstall the tool - I'm not keen on subscriptions, especially fluctuating cost ones.

This looks like an attempt to monetize a botnet. What, exactly, do the people running their "client" get out of this? Do they know they're sucking bandwidth, and possibly being billed for it, on behalf of someone else?

I run a web spider of sorts. And I know the people who run a big search engine. Reading the web sites isn't the bottleneck. Analyzing the results and building the database is. Outsourcing the reading part doesn't buy you much. If this just did a crawl, it would be of very limited value. That's not what it does.

What they're really doing is offering a service that lets their customers run the customer's Java code on other people's machines in the botnet. That's worrisome. There are some security limits, which might even work. Supposedly, all the Java apps can do is look at crawled pages and phone results home. Right.

This thing uses the Plura botnet. "Plura® is a grid computing system. We contract with affiliates, who are owners of web pages, software, and other services, to distribute our grid computing code. We utilize the excess resources of peripheral computers that are browsing the internet when such browsing leads to a web page of one of our affiliates. That web page has imbedded code that allows the visitor to participate in the grid computing process. We also utilize embedded code in software and other services to allow such participation." Not good.

The main infection vector is apparently the Digsby chat client, which comes bundled with various crapware. The Digsby feature list does not mention that Plura is in their package.

This thing needs to be treated as hostile code by firewalls and virus scanners.

PaulS wrote: - The first Digsby blog post about the research module was two weeks after someone first noticed the module working. Why were people not informed *before* the module was in place? - Who on the digsby development team, specifically, suggested that an unannounced enabled-by-default research module which ran in the background would be a good idea?

Aaron (Digsby Developer) wrote: A bad management decision. I'm not going to name names, it's not my place, and we did apologies for that. The reasoning was they wanted to test it without giving other IM clients the same idea. It was a bad decision, and we know that.

All of this uproar is a bunch of BS. They're not doing anything sneaky. They told users about this eight months ago!

Digsby is still a great piece of software. If you actually took time to read about the research module you'd learn a few things: 1. It only runs when your computer is idle, and as a low priority process. 2. It doesn't run on laptops when they're on battery power. 3. It can be disabled quite easily.

From where I stand, the only slight misstep they made was making the button to disable the research module difficult to find. You're getting a very useful tool for free. For the love of FSM, quit bitching about having to decline a few tool bars and turn off a service!

This article made it seem a lot worse than it really is. I have been using Digsby for about a year now, think its great and was almost about to uninstall it after reading this article until I saw Digsby's post on the options added. It can be read here http://blog.digsby.com/archives/693 #2 article even tells you that you can disable the software from from allowing this option from happening. As long as they are honest about it and I can actually turn this function off I am fine with what they have done. I just wish they would have told you more about it upon installing it instead of finding out about it this way.

Actually they say it won't do any background processing if you are on battery power (see their blog posting about this).

This summary's horrible.

First off, they've been talking about it since December of 2008. They responded pretty quickly to concerns.

Second, it's not like you don't see the following on the download page:

Clicking this Download button starts InstallIQâ
It manages your installation. Learn More.
Installing to a USB drive or secondary hard drive? Having trouble with the above installer? Click Here.

I agree that having the disable-sharing-my-cpu flag hidden under Help, Support Digsby is a pain in the ass, so I'd prefer they moved it to Preferences where it belongs, but come ON, folks. Nobody died.

This summary's horrible.

First off, they've been talking about it since December of 2008. They responded pretty quickly to concerns.

Second, it's not like you don't see the following on the download page:

Clicking this Download button starts InstallIQâ
It manages your installation. Learn More.
Installing to a USB drive or secondary hard drive? Having trouble with the above installer? Click Here.

I agree that having the disable-sharing-my-cpu flag hidden under Help, Support Digsby is a pain in the ass, so I'd prefer they moved it to Preferences where it belongs, but come ON, folks. Nobody died.

This summary's horrible.

First off, they've been talking about it since December of 2008. They responded pretty quickly to concerns.

Second, it's not like you don't see the following on the download page:

Clicking this Download button starts InstallIQâ
It manages your installation. Learn More.
Installing to a USB drive or secondary hard drive? Having trouble with the above installer? Click Here.

I agree that having the disable-sharing-my-cpu flag hidden under Help, Support Digsby is a pain in the ass, so I'd prefer they moved it to Preferences where it belongs, but come ON, folks. Nobody died.

@All: This issue will be addressed first thing in the morning. As for performance, the functionality has actually been off this entire time. It is in the TOS because it was planned for the future and Digsby has not been using your CPU/Bandwidth when idle so if you have had performance issues it is not Digsby related.

Agreed, and in the meantime, let them know why nobody is going to use their IM Client anymore.

bugs@digsby.com

http://forum.digsby.com/

From the article:

Summary: Stick with Open Source

The only way you are definitely going to avoid greedy software developers exploiting you is to stick with open source, make sure to donate to your favorite open source projects, and stop installing software with bundled crapware.

Did we already forget that Ubuntu also installed such and without consent (and Linux Mint) - here you atleast have the change to disallow installing it.

There has been countless numbers of open source projects that also do this. Just because it's open source it doesn't mean you're safe from such tactics - it just means the source is open. You can check the source and remove those parts, but not many of us do so.

This is actually more the nuisance of free software. If you've paid for your software, you can usually except that they wont fuck you over with that crap. It's more like the price you pay for using free ad supported software, because if they develop it professionally they also have to get the money somewhere.

And also from the article Digsby's response:

Update: Disgsby responds, saying they're pushing out a new build today with more transparency about the research module.

- they had updates by Instant Messenger as official feature for a while but couldn't make it work (why?! at least it should be practically free for them unlike SMS)
- there are some 3rd party solutions to update by IM but none work (plus you have to trust the 3rd party)

One of my friends uses Digsby to update his Twitter.

I work with compromise and worry about precedent every day. My career is in network security, and there's often compromise on new projects. The precedent that is set is worrisome, because it comes down to, "They did this over there, why can't we do it?" We then have to explain why the exception was granted, and why it can't be granted in this situation.

SecuROM is DRM. Steam is DRM with a trade-off of useful features. I know some people have been burned, and if I were Valve, I'd be working harder to establish a method by which those issues could be resolved. But the response where someone was burned once and therefore the entire technology is null and void is another issue I deal with on a regular basis. We have to convince the project managers why it is that we need firewalls, IPS, certificates, or encryption in particular places. They don't understand that while they had problems with it in their last job, we've got a good system here, and we're willing to work with them to improve it. Sometimes, we break something, and they decide that it's not worth it and they're not going to use it, and we have to explain what we broke, why the technology is still valid, and how it provides a benefit.

You and I are not as far apart as you may think. I bought Railroad Tycoon III a year ago (picked it up for $5 or so), and the DRM on it refused to let me install it at all. Even after the (weak) tech support suggestions, I couldn't get it to work, and I finally just tossed it aside in frustration, and since then I've not bought any CD-based games that have DRM. I don't have an iTunes account, and I'm suspicious of any application that wants to connect to the network for reasons that are not clearly defined. When I started using Digsby for IM a little while back, I broke out Wireshark and was monitoring the traffic, trying to figure out how it was securely saving the passwords server-side, until I managed to find an explanation which placated me.

I don't see this as compromising for short-term gain. I'm still playing games that I played years ago, and which I expect to continue playing for some time to come. I do, however, draw clear lines as to what I will allow when it comes to DRM. They just encompass a little more space than do yours.

>> Gaim-vv hasn't been developed in over two years and is so out of date that it's still going by Gaim and not Pidgin.

Gaim has been renamed to Pidgin a while now (even on my Windows PC).

You may want to try Digsby, I heard the new update to it has video support too.