Slashdot Mirror
Pop-Under Deception and Private Property
RogerRamjet98 writes "I was browsing the web today and I got hit with a pop-under ad. Annoying but no big deal, right?
Wrong. This one managed to change my home page to (CT:Link removed. Why would we send these dicks traffic?)
Which pretends to be yahoo, and is convincing enough to fool the average computer user, but is really a platform for launching more pop-under ads.
Combine this with the AOL/WinXP news, and it makes me think that the settings on my computer ought to enjoy legal protection as private property: Changing them without my permission (such as adjusting my home page, or whatnot) should constitute assault or trespass." Or turn of JavaScript. Or don't run IE. But good luck on that trespass case. With a history of laws like the DMCA, Uncle Sam can only make it worse.
Actually this is a common problem and growing more so at the moment - it was only on warez sites and porn sites but is increasingly common. The other night i was involved in 'ahem' warez surfing (i know i know) and came across a link i thought looked good, clicked on it and copped 12 popup windows (yep i expected it and should have) what i didnt expect is a changed home page and 10 new favourites not to mention that lovely code that locks a window at full screen and you cant close it - you have to CTRL-ALT-DEL
no warnings and no question - this can be done and according to my developers is really easy to do - and as these days to get all web pages to work you need to use IE- theres not a lot of choice - of course you can lock it down but that means many things wont work properly anyway - so whats the solution ?
someone come up with an answer for this ? PS popup killer doesnt work with My IE - i use cable and of course it doesnt work as its a customised version.
So any ideas ? (please dont advise me to change to Mosaic or Netscape or opera as i cannot do that with my cable provider (i love opera but it wont work properly with most of my plugins without playing and i dont see the point of having a broadband link and a crippled browser - i spend my days playing with servers and dont want to spend my nights configuring browsers - this is why i dont use linux at home)
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
Most recent browsers provide a function in their scripting that lets you set the home page for the browser. This is what sites use when they provide a button that says "Click to make this site your home page" or some such. If you've got sensible browser security settings in place, you'll get prompted before the browser will actually do it, but many people have security settings too low for that. For those people, all it takes is a web site that hooks up the script to set the home page to run when the page is finished loading, and bang, one reconfigured browser.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
---- El diablo esta en mis pantalones! Mire, mire!
Changing them without my permission (such as adjusting my home page, or whatnot) should constitute assault or trespass.
Actually, this may constitute breaking the law. After all, if you hack into someone's computer and change any data on their computer, then you've broken the law. If you write a virus that goes in and changes data on someone's computer without their knowledge, again, you've broken the law. Seems to me that this qualifies. You don't have to do any damage, per se, but changing the data on their computer is enough.
IANAL, but I don't see a real distinction between a virus and what these ads are doing. Just MHO.
You were just trying out a neat new javascript trick on the front page for a few min and THOSE DICKS are really the slashdot crew. ::grins::
unless, perhaps, they are taking advantage of security holes to alter your settings in destructive ways.
Exactly. We're talking about the potential for someone inspecting or modifying data stored on your computer without permission, explicit or implicit. Although the browser manufacturers are partially responsible, in my opinion it would be an easy sell to have lawmakers consider this in the same way as cracking. Especially if you embellish it a bit for your congressperson: "Just think -- one of these could pop up and change your homepage to pr0n! Or Ralph Nader's homepage! Think of the children!"
Toronto-area transit rider? Rate your ride.
If CmdrTaco does so much as to even mention the name, that will almost guarantee increased hits, which is exactly what they want. Advertising is not about making people happy. It's about making people remember you and visit your website. It's based on one of the oldest principles of advertising: An entertaining ad is not nearly as effective as an annoying one.
.sig the way it is drives more hits to my MP3.com page than anything else I've tried -- internet pyramid schemes, MP3.com's auctions, and submitting to search engines.
Slashdotters are curious. We'll click any link and search any subject to learn more. Look at my post. Posting to slashdot with my
No, I can't help but feel that CmdrTaco did the right thing; even speaking their name here helps them out.
But of course, it's only a matter of time before some friendly poster mentions who it is anyhow.
Personally, I would put the link in and make sure they get hella /.ed.
This doesn't sound *too* bad, but it won't stop there. It won't be long until some script kiddie figures out a way to change all the URLs on people's favorites to theirs. And by the time that people find out, it's too late -- They don't even know where the popup was (or that it even was a popup! I had no idea until just now...)
Got Rhinos?
Are there any people (who have enough knowledge of Internet Explorer or the Windows OS in general) how this could be achieved? I find it very disturbing that such settings (such as your browser's home page) could be altered remotely without your permission, which could constitute a breach of computer security. As far as I know, (depending on your jurisdiction) there isn't any specific legislation that marks your computer's settings as your private property. The only thing you can do is, like Taco said, disable JavaScript or don't run IE. Which makes sense anyway.
----------
When the pin is pulled, Mr. Grenade is no longer our friend.
Granted, I agree that we shouldn't send "those dicks" any traffic. And I agree that companies who do this sort of thing are indeed dicks. And I also agree that it would be most amusing to see an entire
But it would also get old quickly. So, Taco, what's the name of the organization whose link-to you removed? Not a domain or anything, just a noun that we can use instead of "those dicks."
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
I wish there were a better solution. Unfortunately, some of the sites I like to hit use javascript. Javascript is occasionally useful (more often than not, in fact). It seems that forsaking a technology simply because some people choose to abuse it isn't the way to go about doing things (*cough*napster*cough*).
So besides disabling Javascript, what else can we do? Is legislation a viable option? Complaining to the webmaster of the site with the evil js?
What have you tried that has worked for you?
FP
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
But an IP address would also be nice, to give to the Code Red Worm...
Probably not. In fact iexplore has considerably finer-grained controls for javascript (or as it says, "scripting of java applets") than netscape (or at least current versions of netscape).
Options -> Internet Settings -> Security -> The Internet -> Custom -> Scripting
and set everything to either "Prompt" or "Disable" as whim requires.
When web advertising was less invasive, this was not such a big deal to readers. In fact, it was the business-model-of-last-resort: "ads will pay for an essentially free internet." (Let's play find-the-fallacy.) Web publishers ("content providers") promised the moon to advertising customers - that they could instantly generate sales and site visits, measure the results with click-throughs, and do this all without alienating their own base. It didn't work that way.
If the expectations of web advertising had been more moderate to begin with - in line with those of print ads - this sort of thing wouldn't be happening now. But I don't expect it to get better. I don't believe in rational markets with good information finding optima, I believe that irrational expectations create bad situations, vicious cycles develop, and things fall apart. The nice bit about it is that we are, ultimately, getting the internet back from the suits that are failing to selling it to us.
Actually...come to think of it...it is very surprising that trying to change your homepage from msn.com doesn't result in some kind of Microsoft FUD-ish message like:
"Warning! If your homepage is changed from MSN.Com you will not receive valuable updates and integrated web functionality! Are you sure you want to proceed with this reckless course of action?"
:)
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
There are any number of really good reasons to run both JavaScript and IE. As a web developer I love JavaScript. If I validate a form with JavaScript I save the user time since they don't have to wait for the server to validate and respond (the server its own validation, of course, so I don't save any CPU cycles). This is a win for both of us: the user gets a faster response and I get a happier user.
For people running Windows (nearly everyone, last I checked), IE is the fastest, most stable, and most feature-rich browser available. Yes, it's chock-full of security holes. That's by design. Microsoft is pretty explicit in trading usability for security, and it shows. [Some of] Their products are very user-friendly.
To avoid getting modded down as a troll, I'll say that Microsoft sucks and only lusers use IE. Lusers like my mom, of course, who has trouble enough on the web without me updating Mozilla to milestone "slightly faster than a melting glacier" every other week on her P200. I use Mozilla, and it kicks IE's ass for my use, and on my computer.
My point? The problems here are (a) lack of security focus by Microsoft. There should be no setting, anywhere, that allows changes to local software without explicit user consent. They have fucked this up royally, time and time again, and I don't think it's ever going to change. Plus, if they have their way, the concept of "local software" will go away entirely.
The other problem ((b), if you're keeping track) is human capacity for evil. Some PHB had a brilliant idea: "Ok, we need to change every directory name on the computer to 'Porn-R-Us.com'. You can do that, right?". Some low-life programmer said, "Sure, there's an ACtiveX control for it."
It all comes down to human decisions. Somewhere along the line a human being decided to fuck another human being to make a buck. The only way to stop this is to remove the buck. This is often done with a lawsuit, or other legal action. So I say yes, sue these bastards 'til they can't walk straight.
This isn't as much "normalization" as it is "don't take so many drugs when you're designing tables."
Hit his URL:o ns/javascript.html#7 for Netscape's guide to how to use JS to change user prefs...
http://developer.netscape.com/support/faqs/champi
Now that I have a super fast computer I am beginning to like mozilla and some of its features of turning off things, like images from certain servers. Maybe someone will implement turning off JS from hostile sites (like mozilla's cookie rejecting) or prompting you for this.
NOTE I am NOT talking about turing off ALL javascript, just allowing users more control over it.
This user may want to try proximitron (sp) it is a proxy that allows you to set up some filters. Thus turing off pop ups and pop back....
Only 'flamers' flame!
So when somebody portscans my system, I can't prosecute them because they "did nothing illegal". Even if they root my box, I can't prosecute because they "were just exposing how flawed my security system is"...
;) and information wants to be free.
When somebody distributes a copy of an MP3 ripped from a licensed piece of music, it's OK because you would not have bought the album anyway
But somebody changes your homepage, and suddenly it's a job for the federal government.
BTW, the DCMA, as stupid and flawed as it is, probably gives you some legitimate avenues to address this sort of offensive behavior.
I know the DCMA is the only reason you won't be seeing those dreaded "smart links" in the next version of Internet Explorer.
Mathematically impossible requirements are technically not against policy.
I've been to several pages with code that tries to alter my homepage and every time this little IE window pops up with a home icon and says "Such-And-Such is trying to make this your homepage, do you want to proceed? [OK][Cancel]"
This is on IE's Medium security level. On High I'm sure it is even more protective. So can we please be clear about this? Is this new trick able to bypass these kinds of protections? Is this a problem only on Netscape or IE or any JavaScript enable browser?
Keeping in mind that MS wants everyone's homepage to be MSN.com (the first thing IE goes to after installing is a page with code to make MSN your homepage) I can't believe they would allow any website to so easily snatch this setting without user interaction of some kind.
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
"Don't touch a hot stove, dear."
"But Mommy, what does a hot stove look like?"
"I can't tell you that, dear. You might touch one."
You cannot apply a technological solution to a sociological problem. (Edwards' Law)