AOL's Upgrade of Death

Kethryvis writes "CNN is reporting about the joyousness that is the new version of AOL. Version 5.0 seizes control of all Internet connections on your machine and handles all Web requests, e-mail, etc. So, if you use your system to connect to other ISPs, your business, your school, etc. and you install AOL 5.0, yer screwed. The CNN article is here. Read deeper into the story to find out how the new version can also cripple machines just by installing. Scary stuff."

Comments

Takeover Expectations, and Precedent

[Effugas]

A little bit of clarification here:

AOL has *always* taken over your IP configuration whenever you connect, or at least it has since AOL 3.0. I figured this out a few years ago, when I realized that this one girl I was troubleshooting(heh) over ICQ had somehow managed to appear on an IP address far, far outside our dorm network.

AOL doesn't trust *anyone's* code--they put a custom VPN style interface into every windows machine they're shoved into. (This is that "AOL Adapter" thing.)

Incidentally, AOL makes for quite an excellent covert channel--high bandwidth expectation, protocol unhandled by most sniffers(as far as I know), and a Linux client. Never, ever allow AOL access out of your corporate firewalls :-)

This latest behavior *does* seem rather insane. They're basically uninstalling the software of other companies--that's far and away beyond the expectations of the user doing the installation! That exceeds the implied contract, and has all *sorts* of problems with sheer fraud--what if AT&T phone service automagically prevented Sprint from calling you with a lower rate? What if NBC sent hidden signals to your television station removing CBS and ABC from your channel listings? (Yes, I'm noticing the irony with the recent CBS brouhaha.) Hell, what if putting in a demo for Quake 3, Unreal Tournament was wiped from your hard drive?

Lets expand on that: There'd be a significant amount of anger if Id Software sold a "competitive upgrade" for Unreal Tournament at a reduced cost that left UT unplayable, but even that would pale to the rage if the user wasn't warned prior to purchase or even installation that installing one game would remove its competitor.

In the name of simplicity, that's what AOL is pulling.

And what about the privacy implications? After all, half of privacy is the ability to sequester oneself in a private domain. (All "explicit privation" methods fall in this category, from locking one's door to calling someone on a pay phone.) AOL's behavior intentionally removes the options of accessing a private domain, requiring intentional and difficult re-enabling of those alternate ISPs.

Not good. Not good at all.

Yours Truly,

Dan Kaminsky
DoxPara Research
http://www.doxpara.com

Re:AOL 5.0 Versus Windows 2000 In A Steel Cage!

[bis]

what you're looking for is http://support.micro soft.com/support/kb/articles/Q222/4/73.ASP

which will tell you that you need to set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable
to 1 or 2 to disable the file protection.

what fun!

--------------------
this space left intentionally blank

Re:AOL 5.0 Versus Windows 2000 In A Steel Cage!

[ewhac]

Win2K has FINALLY gotten it right.

No, they got it wrong. Again. The correct, time-honored solution would be:

$ chown root.root /dosc/windows/*
$ chmod a-w /dosc/windows/*

"Those who do not understand UNIX are condemned to reinvent it -- badly."
-- Henry Spencer

Schwab

Re:Legal or Illegal

[pen]

Helping people with their computers occasionally, I have a little experience with AOL. Some of these claims are very exagerrated, and some of the things they discuss have existed since AOL 4.0.

• Remember, AOL doesn't do this until you tell it that it's OK by clicking "Yes". If a user is clueless enough not to know what the program is asking them, they are actually being helped, since they will probably want to use AOL for their email and browsing.
• For those that like AOL and use it, this is actually a Good Thing, and something that many other programs do. All that happens is that instead of Outlook Express or Netscape Messenger, you get the AOL interface when you click a mailto: link. Is it bad when AOL takes over TCP/IP when they use no other ISP?

On the other hand, there are issues that weren't discussed in the article that are a lot worse.

For one thing, AOL carries with it all the TCP/IP and Winsock drivers for many different versions of Windows, and installs the versions it has regardless of the ones already existing. This has all kinds of effects, including crippling some TCP/IP programs, and re-introducing previously patched bugs and vulnerabilities.

--

Not to be mean but.......

[HomerJ]

That's what AOL'ers get. I'm against AOL, and I believe their users get what they deserve.

I'm not tyring to sound supiror or anything, but why didn't these people do research before they signed up to AOL? If they would have, they would have read survey after survey about how AOL is rated dead last in about every customer satisfaction survey. They would have read about the horrors of 5.0 before they installed it. Not to mention they are drasticly overpaying for service. $21.95? Most of the local ISPs around here are $14.95 or under, and offer everything AOL has.

I mean, people research what cel phone company they use. They research what long distance phone company they use. But they just see a corny commerical on TV about people that "have a special kinship because they have AOL" and sign up, install buggy software, and alot of the time screw their Windows/MacOS install.

So I say good for them. They should have known what they were getting into before they handed over their $21.95 a month. Just like people that don't read long distance agreements when they sign up because if they sign up they get $25. And then realize that they pay 30 cents a minute. If someone can't do a little bit of research before they make a decision like finding a ISP, or a long distance company, and they get get screwed because they didn't, they got what they deserve.

Maybe next time, they will read a couple articles and ask a couple friends before making a decision. That is, unstead of falling for a comercial with some idiot pre-teen going "I've got mail, yipee horay!"

Re:Not to be mean but.......

[ToLu the Happy Furby]

That's what AOL'ers get. I'm against AOL, and I believe their users get what they deserve.

This makes me feel squeamish. No, actually this makes me feel disturbed and yet rather entertained at the same time. You're against...an internet provider? Like, I suppose I can understand this, if they ever did anything to harm you personally, or gave you bad service, or something...although I doubt you'd ever admit to even emailing someone with an AOL address. But wishing harm on their 20 million users?? For their choice of an ISP?? Huh? Did you run that statement by yourself before you wrote it??

I'm not tyring to sound supiror or anything, but why didn't these people do research before they signed up to AOL?

Well you sure as hell don't come off looking too "supiror". Why didn't you do research on the English language before you presumed to write it down?

$21.95? Most of the local ISPs around here are $14.95 or under, and offer everything AOL has.

Erm, no. AOL is still a proprietary network community that allows access to the internet. They have their own dial-up procedure, which is significantly easier to setup than any other ISP's; they have their own integrated interface; they have their own content, searchable by keyword, and their own communities. Now, you and I know that at least 99% of the information available on AOL is available for free on the internet--although much of it can be harder to find reliably, even for someone who knows what he's doing. And we (or, at least I know; you seem mighty ignorant) know that the internet connection AOL provides is technically inferior for some internet activities (read: playing Quake). However, the claim that any other ISP offers "everything AOL has" is patently false.

Now, I'm not afraid to admit that I've been an AOL user. Indeed, my family's used AOL for over 7 years now, and I've been on the whole moderately happy with it. I was definitely happy to have it 7 years ago, on our 486sx with 4 MB RAM and a 2400 baud modem, because that box--and especially that modem; ugh--sure couldn't handle Netscape (1.0 had just come out IIRC), and as a 13 year old I got a lot more use out of AOL's content than I could have with just FTP, telnet, and USENET (which AOL provided me anyways). So I wasn't 133t in my prepubescent days. Sue me.

Of course, now that I'm used to my fat pipe at college, I'll never go back to a narrowband connection, and if for some reason I were to get one for myself, I'd go with another ISP than AOL. Still, I'm still glad my parents have stuck with AOL, because it's frankly the best choice for them. It may be incomprehensible to someone as supiror as you, but for many people who aren't terribly comfortable with computers, it's just easier to find what you're looking for on AOL.

As for AOL's reputation as a god-awful ISP...AOL supported my 56k modem before most all of the local ISPs in my hometown (St. Louis); and over the past 7 years, AOL has provided a much more consistent and reliable connection than my friends' local ISPs as well. (Yes, I just said that. But while I'm sure the whole "busy signal" fiasco may have been truly awful in the rest of the country, in St. Louis it was only a bit annoying for a month or so. Meanwhile, whenever one AOL station is giving me trouble, there's about 50 other local numbers I can dial; when a small-time ISP goes down, it's down.)

As for this ricidulous FUD filled article, I find it outrageous that you or any true /.er would take it at face value. Essentially what it says is that if you check the button that tells your computer to make AOL's software your default browsing software, it (*gasp!*) uses AOL's software, um, as the default when you browse. Also, when you install it...it makes changes to the registry! Unbelievable. Amazingly, this may mean that someone who had a different web browser selected as their default web browser...would no longer have that web browser selected as their default web browser. Certain things that used to work because they depended on that browser being the default may work no longer. The mind boggles.

As pointed out by someone else here, this is exactly the same behavior that just about any program these days that handles a standard that other programs may handle--be it a web browser, a media format player, or whathaveyou--does. Wow. Criminal.

And then they trot out the CTO of Prodigy, and some random Win95 user who suffered conflicts and crashes after installing a large piece of software (that's certainly never happened before!) to spread some FUD. Top it off with some third-hand hearsay from Windows Magazine which amounts to, AOL 5.0 installs a bunch of its own software to handle its internet connection; your computer may already have other files which do analogous things (though they are not the ones AOL is designed to work with); therefore this is...bad. And it potentially may not work, even though, uh, it actually does work. (I can confirm this; I keep a copy of AOL on my computer at school just in case the fancy to log on strikes me; I upgraded to 5.0 with absolutely no problems or interference with my university internet connection.) Oh, and several people emailed me to complain about AOL. And some of them are MSCE's!

Conclusion: this isn't the sort of thing that deserves to be posted on /. But I'm not one to complain about a bad posting, because usually the /. community is able to sniff out the BS in many mainstream media computer stories, instead of falling for it like the "ignorant masses" we too often feel contempt for. Unfortunately, when the article is about some company which many of us "unbiased /. geeks who are just interested in tech news which is honest and intelligent" happen to have a prejudice against...we tend to buy it hook, line and sinker.

Shame on you for being a techno-elitist (or maybe the correct term is "asshole") who wishes ill on people just because their choice of ISP (I mean, of all things! How ridiculous!!) doesn't square with yours. And shame on most of the rest of /. for accepting this drivel without the skepticism we rightly pride ourselves on having.

They're getting sued for this over here

[Kaufmann]

Last year, AOL decided to crash into the Brazilian ISP market, with a bang. They were aiming to get at 20-30% of the market by now.

Current situation: not even a full 5%. Market penetration: almost zero. Of course, there was a lot of hype about AOL, but there are already a few very well-established and powerful ISPs around here who were able to set up a defensive strategy. The day after AOL officially announced its Brazilian entry, I received a free Internet CD-ROM from ZAZ, the second largest Brazilian ISP. (I didn't install any of those, mind you. I like my neighbourhood ISP just fine, thank you very much.)

My point is, some people did install AOL's free Internet CD. The result was pretty much as described in the main article. No warning, of course, was included in the CD-ROM cover. But Brazil being Brazil, some of these people decided to avenge their lost setups. They sued AOL. Big time. They made a lot of noise about it. They got it on the cover of just about every major newspaper around here. They successfully managed to spread this meme to the near-entirety of the Brazilian Internet-using public. The end result: AOL is going nowhere here.

Let us celebrate.

(Here's a more-or-less related article; it's in Portuguese, you might want to use your favourite translation program.)

This is ridiculous

[Dilly Bar]

I installed AOL 5.0 on my home machine after I set up my regular ISP account. There were no troubles when I used my existing AOL account. It just asks if it can become the default browser and email application, just like every other browser or email app.

The only difference between AOL 4.0 and AOL 5.0 is that 5.0 adds a dial-up networking connection. However, did doesn't overwrite anything.

In fact I had less troubles with AOL 5.0 than 4.0. Sure AOL has terrible connection speeds, bad traffic, stupid users, but then give credit where credit is due. If a user is so dumb that they don't read a message on their screen, then they deserve what they get. AOL targets the lowest common denominator, and they get a huge outcry about their software. I imagine these are the same people whose interactions with tech support are posted on every computer humor site. Imagine what would happen if these people were forced to install Linux... It wouldn't be pretty.

System stability after AOL 5.0

[JatTDB]

My company does support for a number of medium-sized organizations, and I've seen a couple instances of this sort of thing. While most of the sites we support have high-speed internet access through my company's network, a number of users have AOL software installed for one reason or another. Don't ask me why, I can't get a straight answer either.

Just today I had to reinstall one WinNT workstation in order to get it working properly again. Various actions on the system would reliably BSOD the machine. None of this started on this particular machine before the user installed AOL 5.0, and other than that the machine was configured just like the hundreds of others in the same organization that are chugging along just fine. Absolutely ridiculous. You think with the kind of resources they have they could put out something that works properly...but then again, look at most Microsoft products.

Re:Incompetence or evil intent?

[mjh]

After all, AOL is a flat rate service now. They get their monthly fee whether the user logs on or not, so they have little incentive to prevent anyone from logging on to other providers

That's not entirely true. AOL also sells advertising that they collect revenue on when they pop up those annoying windows. I would hazard to guess that they leverage the number of users they have in other ways than just advertising.

Remember, if you take AOL's market cap ($146 billion) and divide it by the number of users they have (20 million), you come up with $7300 per user! This to me is a clear sign that AOL sells itself in terms of the influence that it can have over its users, and the market is buying it.

And that's where the lion's share of AOL's wealth comes from. $20/mo * 20 mil = 4 bil. The monthly fee is only 2% of that company's worth. The monthly bill is not what they're going after. They want eyeballs and lots of 'em.

Re:Version 6.66 will handle your TV

[orangesquid]

Here's my experience with AOL 5.....

I (stupidly) installed a copy on my parents' Windoze machine, since they still use AOL (thru tcp/ip) even though we have a better ISP now... Everything worked fine after having to reconfigure my LAN and routing settings (I dialup via a linux box with IP masquerading)

Several months later, my linux box needs to go on vacation... so I move the modem to the windows box, set it up to access our ISP, and reboot (since network changes require that)

There really wasn't much to the change... the LAN was still there, it just wasnt handling the internet access.. so i got rid of the router, changed the hostname, and installed ppp... you'd think everything would work fine...

However, I discover AOL 5.0 installed a number of windows 98 network files over my previous windows 95 files. It actually overwrote _all_ of the old network DLL's and VXD's, so even though the two sets of files arent compatible, the system still worked.... until I installed Win95 PPP....

Needless to say, I ended up re-installing windows. I vow I'll never install AOL 5 again unless I'm being tortured by a foreign government, in which case I'll tell them that I'll install AOL 5.0 in exchanged for them to stop torturing -- and of course, after I install it, their LAN won't work, and they'll be screwed! Muahahahahahahahahaha!!!!!!!

Re:AOL 5.0 Versus Windows 2000 In A Steel Cage!

[Pfhreakaz0id]

Ummm.. that's what an operating system SHOULD do. An app should not be able to overwrite the OS. WIn2k has FINALLY gotten it right. If AOL follows the new procedure, they can run their .dlls in "side by side" mode so they can run any version they want, from their own directory and not unduly screw up everything in the OS as they have been doing for years..

It happened to me...

[Carnage4Life]

The reason she had to reinstall windows is because for some strange reason (at least on the machine i tried to install AOL 5.0 on for a friend) AOL 5.0 corrupts the msmouse.vxd file. You can test this easily by trying to install AOL 5.0 on a Windows machine and after it crashes have the machine boot at prompt you before performing each task on bootup.

After this occured the machine would always freeze upon booting unless booted in safe mode. Since I had no idea how to edit the msmouse.vxd file or even how to tell what was wrong (plus my friend was getting hysterical) I reinstalled Windows.

Also if you read the December 23rd online issue of the Washington Post where this story first broke you'll notice that the article qoutes several ISP's help desks as being swamped by calls from people who tried to install AOL 5.0. it would be a simple matter for the AP writer to call an ISP and get a story from them. On the other hand journalists famous for creating imaginary victims to humanize a story.

PS: It seems shitty code is contagious (Netscape 4.7...)

I've got a better use for the AOL 5.0 cds:

[Goetia]

Microwave 'em for three seconds, label side up with the lights off. Enjoy the light show, but don't cook them any longer that that, or they get leathery. :^)

Re:I've got a better use for the AOL 5.0 cds:

[Goetia]

Well, at least these can be cut up with a Dremel to make either christmas ornaments or ninja stars. I wonder what Martha Stewart does with hers? :^)

Naughty CNN!

[Evro]

How dare you say anything negative about the soon-to-be mothership!

(CNN is owned by Time Warner, in case ya didn't know)

Maybe CNN doesn't want to be acquired...

______________________________________
um, sigs should be heard and not seen?

AOL 5.0 Versus Windows 2000 In A Steel Cage!

[dougman]

Or something like that....

What I mean, really, is that AOL 5.0 seems to shamelessly install rogue system .dll's , and Windows 2000 is notorious for reverting those same system dll's upon attempt to replace them.

For my own amusement, I tried this experiment on a test machine on my network. Sure enough, AOL misbehaved, and within seconds of completing the install, Windows started telling me it was reverting files. Amusing, actually.

I'm actively working on figuring out exactly how W2K does that - file police. I'll let y'all know if I find some way to defeat it.

Breaking News

[Accipiter]

DULLES, VA. - In a shocking move parallel to the release of the America Online 5.0 Software, AOL CEO Steve Case announced a "Major Hardware Upgrade" to AOL's existing network. According to insiders at AOL, the upgrade is an external US Robotics Sportster 14,400 BPS Modem.

"We see this advancement in AOL's networks as a breakthrough..." said Case in a press announcement earlier today. "This is exactly the kind of upgrade our customers expect from AOL, and I won't disappoint them." Later, Case was quoted as saying "With just this modem added to our networks, we're capable of handling approximately 500 more users. They'll get to share this modem, as well as the 4 others we have here at AOL's network center."

When asked what prompted this hardware upgrade, Case stated that the release of AOL 5.0 was "pivotal" in the decision. "People expect us to keep pace with the changes in technology. The new AOL 5.0 software does that, while making our customers' lives easier." We gave the experts in our test labs a copy, and had them run a test of AOL 5.0. When the software was installed, Microsoft Windows took on a different appearence. The Windows logo on the Start Button was replaced with the AOL logo, and only 2 options were available on the menu: 1) Connect to AOL and 2) Crash System. Both menu options had the same effect, and a connection to AOL was never established.

With the recent AOL+Time Warner merger, predictions are abound with AOL's next upgrade, but nothing is cerain. Eyeing the future, Case closed his announcement. "We're looking to the next phase in AOL's development. Our new strategy: "AOL Anytime, Anywhere" is going to be hugely successful. With the addition of our next modem, scheduled for 3rd Quarter 2002, we hope to be the Internet provider for today as well as tomorrow."

-- Give him Head? Be a Beacon?

Windows Magazine links

[rillian]

Here's the article at WindowsMagazine that CNN was reporting on:

Fred Langra's column AOL 5.0: The Upgrade of Death?

that's because AOL isn't an ISP

[konstant]

AOL is not an internet service provider, any more than MSN or Compuserve simply provide. These are really interfaces that allow users to access a number of community-based features, including a sort of debased web and NNTP experience.

I spent Christmas with some AOL users and they were asking me questions like "how do I delete that word I just typed?" These are people who not only lack the expertise but also the volition to turn to any, purer ISP.

Since AOL sells themselves as an intermediary, they reasonably plan their software around the notion that no one will attempt direct transactions with the net. If they tried to produce software that gave full functionality to advanced users *and* coddled beginners, they probably would end up with a confusing and inconsistent UI story. It's the dumb-down equivalent of "make the common case fast".

Moral of the story: if you want to run two or three ISP's on your machine, don't install what is essentially a wrapper to protect you from the complexity of the internet!

And, just to be even-handed: AOL SUX!!!

-konstant
Yes! We are all individuals! I'm not!

You forgot to read the fine print

[IMarshal]

NOTE: For options 1 and 2: Both of these options require a kernel debugger to be hooked up for those options to become useable. If a kernel debugger is not hooked up, Windows File Protection is not disabled.

I presume you know how to hook up a KD?

Where do they get the anecdotal reports from?

[ecampbel]

For the longest time, I've wondered where national news services get there anecdotal reports from. Case in point:

Peg Graham of New York installed AOL's latest software on her laptop weeks after its initial release in October with disastrous results: Her computer crashed. In vain, her laptop manufacturer urged her to reinstall her entire Windows operating system -- she did three times -- before she finally paid a local repair shop $145 to fix it.

Afterward, she returned to an earlier version of AOL's software she considers less risky. She suspects the new program suffered conflicts with the laptop's network hardware she used to connect at her university.

How does the author of this AP news story find out about Peg Graham? Also, her problem is entirely unrelated to the issues of AOL taking over the Internet duties for the entire computer. Most likely this is a separate bug due to an incompatibility in AOL's custom TCP/IP stack, or it could be a problem with Windows. Obviously, if she reinstalled the operating system three times, and was still unable to fix the problem, there was something else going on. The point is, the author of the article does not know what caused her $145 worth of damage nor whether her story is unique case, but still tries to lump it in within an article about AOL taking over the Internet services of the entire computer. The author does this to make the story seem bigger and more urgent.

Re:I HATE AOL, but...thats not true..entirely

[legLess]

"...if they click yes during installation to allow AOL to become their default Internet browser, AOL largely takes over all the online functions on the computer." [emphasis mine]

So who's going to know, reading this, what exactly they mean? If IE or Netscape ask you this, it means simply that - for HTTP requests they will be the default. The mail apps included with them ask, also. The checkbox for that option isn't too hard to find, and it's described in the help file.

That's a pretty far f*cking cry from what AOL 5 is doing, IMHO. If one were to assume that AOL operates the same way IE and Netscape do (reasonable, I think, for most people), then you'd say, "Yeah, I want AOL to be my browser - duh - that's why I'm installing it." If the warning had said "AOL will disable all other Internet apps until you sacrifice a chicken, dancing around while sprinkling the blood in a prescribed pattern on the motherboard, singing a Vanilla Ice song" (which is how most people view the inner working of Windows) I guarantee that many people would have given different answers.

If you lie to your customers and literally damage their computers, and the find out, they get pissed off. If your customers get pissed off but can't leave you for a competitor, you're a monopoly. But what about a monopoly where the only thing keeping your customers with you is their wanton ignorance?