Fair Software Installation

rossjudson writes: "There's a little war going on in your computer; it's a war that you might be aware of if you're an experienced computer user. If you're new to the game, there's very little chance you know about it, but it affects you, and it gets worse, not better. The battleground in this war is your CPU, your disk space, and your system's stability." He's got a particular beef with NEW.NET, but lays out (in the article below) what he thinks is a workable, generalized code of conduct for software installation.

Fair Software Installation These days, we all download and install software from the Internet. And that software is rarely written entirely by one entity; rather, components are combined to create the programs we want. There is an increasing and disturbing trend to ship components that perform-system level tasks and have system-level effects. These effects are magnified because many of these components are installed without adequate notification to the user (either by omission, or deliberately).

The NEW.NET domain resolution component is a good example. This component is installed by a number of freely downloadable Windows programs on the Internet. Some of those programs notify the user that they are going to install the NEW.NET software; others do not.

Installation of NEW.NET alters the basic functionality of your system: It causes your system to behave in a manner that is inconsistent with international standards. That this is done in a stealthy manner is unacceptable. The fact that NEW.NET is unstable besides is another issue that we will deal with separately.

If I am installing a program that calculates speaker enclosure volumes, I shouldn't have to worry about it redefining my network stack and destabilizing my computer.

What does a reasonable software program or component do? It should perform its defined, published task. It should not consume excessive resources. It should have a defined starting point and defined ending point. If it is defined to be a service, it should publish that fact and indicate the starting mechanism it uses.

Let me draw upon the realm of commercial software for an example of a program that is an offender. Creative's PlayCenter 2 application is used to move music to and from Creative Nomad MP3 players. It can also play media. When you run the PlayCenter application, you get the functionality you expect. When you start examining your system files afterwards, though, the picture changes.

PlayCenter installs a service, a disk detection system, and a news collection daemon. It does not attempt to inform the user that these daemon-level processes are being put in place. It does not offer the option to make them manually-startable. Worse, the news collection daemon would actually chew up all your CPU idle time.

I think creators of software have some basic obligations:

1. Inform users when drivers, services, or daemons are being installed.
2. Allow users to omit any of the above that are not strictly necessary for program operation.
3. Ensure that during uninstallation, system-level components are accurately removed, "leaving no trace."
4. System-level and daemon components must be subject to a higher level of quality control. It is possible that some level of legal liability should be present for the corruption of the system.
5. Transmit no information from a component to any party unless specification notification to the user has taken place, and is renewed on a periodic basis.
6. Collect no information on a user without prior agreement, and a renewal of that agreement on a periodic basis.

There's been a longstanding battle between virus writers and anti-virus software. The equivalent to anti-virus software in the component world is Lavasoft's Ad-Aware. If you haven't run it before and you have a Windows box, get it and run it. The first time can be a real shocker -- tremendous amounts of crap can build up in your system without you knowing about it.

The little war I mentioned earlier is going to get nastier soon. Uninvited components like Cydoor and NEW.NET are sure to take steps to defeat Ad-Aware and programs like it. If I wrote a stealth component today, I would have it seek out an Ad-Aware signature file and modify it to ignore me, or add my directory to the ignore lists. Ad-Aware could respond by digitally signing the files, or with other techniques. This cycle will escalate, with each side taking new steps to ensure its dominance. Users will pay the price in decreasing system stability.

I am hard-pressed to see the difference between NEW.NET and the Sub7 trojan horse. Both subvert a computer for the purposes of others; both do it in stealth. The good folks at NEW.NET will surely disagree; they'll say that those applications that install their software inform the user, and as such, it really isn't their responsibility.

I say it is. NEW.NET makes active use of the component on your computer; I think that they cannot duck their responsibility for its behavior. They are a not passive participants; they are not a library component being used by others.

I've been beating up on NEW.NET quite a bit in this article. I suppose it's because the deinstallation of their component trashed the IP stack on my Windows 2000 system and it took me a half day to put it back together again. What the hell were they thinking when they stuffed a buggy service deep into my IP stack without telling me? I think they should have to compensate me in some way. A $250 Small claims court action here in Virginia might be a way to do it.

The bottom line is, where does it end? Software installation programs should install components that the user expects. Full disclosure should be the order of the day. There will always be violators, though. There are a couple of remedies which could help:

1. A legal framework for "allowable" system modifications during installation can be created. By adhering to the requirements of disclosure and stability, manufacturers can avoid liability. The thread of liability may be required (although capped) to enforce conformance and responsibility.
2. A technical framework in the operating system can establish and protect secure boundaries around the system's core. Certain operating systems already do this (Unix), but the most widespread consumer OS does not.
3. A "signed installation" program, run by known entities, asserting that a given program and its installation don't violate the rules.

These remedies are necessary as the entities creating these components can't be counted on to do the right thing. Their business models are often predicated on the stealthy gathering of knowledge, and the altering of what goes into your computer.

Just think -- what if NEW.NET decided to start redirecting www.bestbuy.com to www.circuitcity.com? Is there a law somewhere or a technical remedy for this situation? I think there should be.

Slashdot welcomes reader-submitted features; use the story submission page if you'd like to submit yours.

Comments

What do you mean "your computer".

[lynx_user_abroad]

If you're running someone elses software on it, it's no longer your computer. They own it.

In most cases they're gracious enough to let you keep doing things with it, but make no mistake about it.

It comes down to a question of how much you trust the person/company who wrote the software.

Re:What do you mean "your computer".

[TRACK-YOUR-POSITION]

Assuming that most of us would like users to own their own computers, the name of the game would appear to be "minimize the number of people/companies you have to trust in order to efficiently use your computer." This is because once you've trusted Company A to supply your OS, trusting Company B to supply an application does not relieve vulnerabilities to A at all but adds vulnerabilities to B.

There are two paths we can take here:

A. Pick one company to put all of your trust in, and never install software from anyone else. This ideal company either develops the software almost in house or reads the source code that others have developed. Never install software created by anyone else unless you've read all of it's source code and compiled it yourself.

This means only companies large enough to do this can sell software, assuming a reasonably secure

B. Add the social and technical tools that this article and others suggest. Why the heck shouldn't it be illegal to INTENTIONALLY misrepresent what a piece of software is doing? Forget negligence--at least let's make false advertising illegal, huh? Why the heck should my operating system allow a video game to read my credit card number and modify my system?

Personally, I'd really like the ability to say "only let this program do X and Y and nothing else", where X might be (temporary) control of output devices and Y might be adding files to a particular directory. Yeah, I guess I could create a new user in Linux with just the permissions I want to give it for every program on my computer, then run the program with the appropriate user. But that would be a lot of work, even for me, and it wouldn't save every who uses computers whom I care about who happens to have better things to do in their life.

Re:What do you mean "your computer".

[L-Wave]

You see, its a battle of wills, and I'm the most stubborn individual on the planet and I will NOT be told how to use something in my possession

I see you own a gun, do NOT shoot yourself in the foot. =) hehe

Re:What do you mean "your computer".

[Archfeld]

yeah and point to a click thru EULA that has stood up in court ??? I don't think you can...

Good idea

[crumbz]

This is one area where open source software can really pull ahead of Microsoft. Provide excellent documentation of the software and the coding as well. That's all folks. As shoddy as Microsoft's image is regarding security, they won't be able to have it both ways. Not to pick on them, as there are plenty of other targets (AOL being another), but they do have a poor track record in this arena.

The most direct benefit of this initiative is well-written code. Well-written code that undergoes peer review from impartial others is the best thing we can do to further this industry.

Re:Good idea

[Anonymous Coward]

No, no, no, New.net is not to do with Microsoft's .NET thing. It's some weirdass domain level company that buggers up your IP stack. There aren't any links in the article, but you can find more here.

None of the weird domains run on my boxes, so I suppose that's a good thing right now... *g*

Re:Good idea

[q-soe]

Sorry but i miss your point. Microsoft have some security issues (although a quick read or CERT will show you that so do many open source products - they dont get publicity on it) but i dont understand the point your trying to make ?

When have Microsoft ever actually included spyware in products ? (and dont talk to me about Media Player - its been in the user agreement for a long time)

This issue has nothing to do with well written or badly written code IMHO - it has to do with companies willingness to take money from anyone who comes along, NEW.NET is spyware just like Gator or Bonzi Buddy.

Holding up open source with its lack of focus, consistency and in some cases stability as a standard is not relevant to this discussion - try getting a lot of common open source software to run with minimal knowledge on a linux system - try getting an out of the box Mandrake to play DIV-X movies as a new linux user. You can't unless you know to downgrade glibc and fix the other numerous dependency issues.

The fact is Microsoft have questionable business practicies and a rapacious attitude to business ethics but the thing is the average user just doesnt care - the stuff works. They dont give a crap if its bloated or needs activation because they can walk into a store, buy a cd, install it and it just works.

The open source model makes so much sense but its no panacea to the ills of the world. The fact that spyware isnt found in open source has nothing to do with the philosophy of the product but more to do with the fact that most of the software is developed privately or not for profit. Its no gurantee of quality or well written code.

As open source grows more mature (if it survives) this problem will grow as well, just like viruses will.

Stop putting everything back on MS and accept that the world is full on unscrupulous people out to make a quick buck, they exist in all areas.

PS if you want to look at it this way im not slamming open source or trolling for microsoft in any way. Im writing this on my Lycoris box (redmond linux) and i use and like linux despite so issues with it at times, i just cant stand the attitiude that everything bad is MS and everything good is open source.

Re:Good idea

[shyster]

No, no, no, New.net is not to do with Microsoft's .NET thing. It's some weirdass domain level company that buggers up your IP stack. There aren't any links in the article, but you can find more here [new.net].

How, exactly, does New.net's software mess with the IP stack? At worst, I understand it to be a simple DNS proxy that filters between new.net domains and regular domains. If I try to browse to ladeda.lala, my IP stack doesn't know that's invalid, the DNS server I use does, and returns that error.

At best, note that ladeda.lala.new.net is actually what ladeda.lala is being referenced to. (Try it, you can't browse to www.nike.golf, but you can do www.nike.golf.new.net). So, at best, this plugin should simply make a registry entry to append .new.net to the domain suffix search list. Then, when the DNS servers return a not found for nike.golf, you try again with nike.golf.new.net.

Not that I think this is a particualry useful idea, but I don't see how IP stack corruption could come from this. With that being said, I won't install it to find out. ;)

For instructions on configuring a DNS server to add these domains, see here.For a MS Word doc explaining alternatives to using their plugin, see here. If you're too much of Linux zealot to read an MS Word doc, and won't even use StarOffice to read it on principle, then here it is in plain text glory:

SysAdmin Instructions
Resolving our new TLDs in a business network environment
If your business accesses the Internet via one of our service provider partners, then your staff will be already activated to access the new domains. If not, however, then there are several options open to you to get your company activated.
Enable DNS resolution of our domains without the plug-in
Alternatively, you can enable users to access our domains by adding ".new.net" to the search path in your company's DNS system that you wish to grant such access to; either centrally via the Registry, or locally on each machine via the Append Search Paths option.
Editing the Registry
Under Win2000 and WinNT, the "append these DNS suffixes" data are stored as comma-delimited data in the REG_SZ value "SearchList" in the following registry key:
KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service s\Tcpip\Parameters
You will of course use Regedit to do this task, and you will need to have system administrator status to edit the Registry. Edit the value of "SearchList" to add "new.net" making it the last entry in that key (or the only one if you have no others listed already). You should propagate this change to the machines on your network in the usual manner in which you employ for such updates.
Adding "new.net" to the Domain Suffix Search Order in TCP/IP Properties
In the Control Panel on each machine that you wish to activate for the new domains, Open "Network." Select "Protocols" and then select the item listed there, "TCP/IP Protocol." Now select "Properties." In the properties box select the menu item "DNS." At the bottom of this dialog box is a section headed "Domain Suffix Search Order." Click "Add" and then enter "new.net" and press "Add" again. Now you have successfully added the new.net domain to your DNS search path and all the new domains will now be resolved. Exit the Network control panels.
Note: if you have added new.net to the DNS search path via a Registry change, then this will also appear here too.
(c) by new.net, not by me

Re:Good idea

[TheCarp]

> How, exactly, does New.net's software mess with the IP stack?
> At worst, I understand it to be a simple DNS proxy that filters
> between new.net domains and regular domains.

Yup...your right about this... and the search path thing. The mistake you make is to assume that because the method of doing this that you thought of makes sense and works, that new.net did it that way.

Yes, they tell you thats ONE WAY to make it work. However, even the document that you quoted states, thats how to do it "Without the plugin". A Plugin is NOT a registry entry, its a program. Your assumption that this is how the plugi nworks is quite unfounded.

I can imagine a plugin that modifies the IP stack in some way to achieve this same end. It may even do other things too. It sounds to me like this is what they are doing (perhaps the whole point of the plugin is to add new.net to the search path while hiding the fact that its there, and preventing it from being changed)

If it was really as simple as you describe, then there is no need for this "plugin" to exist at all, all they need is a one shot program that changes a registry entry.

-Steve

Re:Good idea

[ryanwright]

When have Microsoft ever actually included spyware in products ? (and dont talk to me about Media Player - its been in the user agreement for a long time)

Oh, I see... Spyware is OK as long as they bury the disclosure somewhere in a 20 page EULA that they know damn well nobody will read. To think that all this time I thought there was something wrong about invading people's privacy...

Re:Good idea

[q-soe]

I didnt defend MS but yes its NOT spyware (IMHO) if its written in the EULA. Ignoarnce is no defence and if you can't be bothered to read the license the thats an issue for you.

Whether you agree of not once you hit i agree and install the product it isnt an invasion of your privacy as you have agreed to it.

Re:Good idea

[shyster]

Your assumption that this is how the plugi nworks is quite unfounded.

Perhaps, but I at least know the basics of what they're trying to accomplish. Rewriting and/or modifying the IP stack is not the way they'd go about doing it.

I can imagine a plugin that modifies the IP stack in some way to achieve this same end. It may even do other things too. It sounds to me like this is what they are doing (perhaps the whole point of the plugin is to add new.net to the search path while hiding the fact that its there, and preventing it from being changed)

You can imagine it? Wonderful. Unfortunately for you, that's nowhere near even circumstantial eveidence that that's what they've done.

AFAIK, there's only 1 version of the plugin. With Windows 2000 having a different stack than Win9x, I'd assume they'd need a different plugin. And note that the plugin, by claiming to only work with Netscape or Internet Explorer, does not seem to be coded at such a low level as you seem to believe. If it did modify the IP stack (a step that Win2K would not take too lightly, I might add) then it would work with ALL TCP/IP applications.

Now, do you, or anybody else, have any evidence supporting your claim that it modifes the IP stack? Besides, "I removed it and it trashed my IP stack"? Once again, I'm not saying that I'd go out and install this plugin, but it's highly unlikely that it's a nefarious as you seem to believe.

Re:Good idea

[ryanwright]

Whether you agree of not once you hit i agree and install the product it isnt an invasion of your privacy as you have agreed to it.

Sorry, but you're wrong. It's still an invasion of my privacy, it doesn't matter whether Microsoft thinks I agreed to it. Imagine if you installed a hidden camera in a restroom and then posted a 20 page agreement, in small print, on the front of the restroom. The agreement starts off with limits & liabilities in using the restroom, states what you are and are not allowed to do in the restroom - all in legalese, of course - and somewhere in the middle says, "You agree to release us of any and all liability if someone should post a picture of you taking a crap in this bathroom on the Internet."

When someone runs across a picture of themselves doing their business and sues you, who the hell do you think is going to win? Do you think the courts are going to tell the victim, "Well, he warned you. You should have known better." Hell no. They're going to lock you up and throw away the key.

The ONLY - and I mean ONLY - way this sort of thing (Both the restroom camera example and collecting personal information via spyware) is going to stand up in court (both the legal courts and the court of public opinion) is if a pop-up box comes up during install and/or use of the software proclaiming, "NOTICE! We are sending data about your web surfing habits back to (company name). If you want to stop this from happening, click the REMOVE button below." To make this right, you've got to be bold about it. A big bold sign on your restroom door that says "You absolutely positively will have your photograph taken while doing your business and that photograph may be posted on the Internet at our discretion" would probably release you of liability, depending on the location of the restroom. Hiding it in an EULA doesn't cut it.

Creative Playcenter?

[alen]

First the software gives you a custom install option. Second it took me all of 5 seconds to turn off disk detector. Third how many average computer users will know what to do when reading a screen that tells them it has to install something. A while back Kodak thought 9 clicks to install it's software was too confusing for the average user. What about this?

And what is this new.net thing?

Re:Creative Playcenter?

[mansemat]

This is just one example. What if somebody else doesn't give you the choice to turn of those components?

His point, I think, is that we need full disclosure about what the software install on your computer that is above and beyond the corse software function.

Sure most people will never read that crap, but it should be available for those of us who want to know what all that extra shit it they've installed on the computer just so you could, for instance, dump songs from your harddrive to you MP3 player.

Re:Creative Playcenter?

[Jinky]

And what is this new.net thing?

new.net is a company that tried to get a shit load more top level domains added, but couldn't. So, they went and made their own database for them all. (ie: .golf, .xxx, .love, .mp3, etc). The software installed by new.net mentioned in the article is basically a redirect when trying to go to those domains.

Say, for example, I had a site called www.stuff.mp3. Under nearly every ISP out there, this obviously would not work. The new.net software modifies the system to be able to recognize it. Outside of this software, the only way to get to this address would be to go to www.stuff.mp3.new.net.

I think that made sense :)

Re:Creative Playcenter?

[ncc74656]

And what is this new.net thing?

It's an alternate DNS that works by installing a DLL that hijacks all name-resolution requests. If some software needs to know the address of foobar.com, the DLL checks first to see what address info new.net has on hand. If new.net can resolve foobar.com, it returns the address. If it can't, it passes the request on to whatever was previously configured for DNS. Removing it is a pain in the ass; the procedure involves fairly involved registry editing (let's just say it's more involved than getting your Windows box to talk to your Samba server).

Theoretically, there's no reason why they couldn't make it so that what looks like a link to Best Buy takes you to Circuit City's website instead. I had to tweak the Best Buy URL so that it became a username fed to Circuit City's server (which presumably ignored it). With new.net, you could do the same by linking your IP address to your competitor's domain name. A 404 handler on your webserver that knows the general layout of your competitor's website would redirect people to the appropriate page on your site, so that just trying to go to one site's homepage takes you to something completely different, no matter what you do.

(Dammit...looks like /. filters out anything between "http://" and "@". The first link is supposed to be http://www.bestbuy.com%2fHomeAudioVideo%2fDVDPlaye rs%2findex.asp%3fm=1%26cat=32@www.circuitcity.com/ ewebIMa/frame1.jsp?BV_SessionID=@@@@0243569614.101 6223317@@@@&BV_EngineID=ccedadcejfdehhhcfngcfkmdff hdffg.0&upper=head.jsp&lower=frame2.jsp&left=leftc hildcat.jsp&department=TV+Video+and+Camcorders&cat egory=DVD&right=productsearch.jsp. Must've been too many idiots tacking on goatse.cx to the end of CNET URLs or something.)

Re:Creative Playcenter?

[matman]

Couldn't you just add a DNS suffix to the system for new.net and achieve the same thing?

Re:Creative Playcenter?

[GigsVT]

I guess you meant search domains. Wow, I'm an asshole. Disregard other message, you are right.

Re:Creative Playcenter?

[blibbleblobble]

Are you one of the few who read the EULA? I know I am, and it confuses the hell out of some workmates! ;-)

As my boss says, "you agree to sell your soul to microsoft, right?" <click!>

Re:Creative Playcenter?

[Reziac]

Do you have any real examples offhand?

Reason I ask, I do NOT have new.net software installed (nor any other variety of obnoxiware that can't be beat into submission), but lately seen some weird top level suffixes on the order of what new.net lists -- and so far they've all worked with my old Netscape and Earthlink. ???

Just not sure if they were new.net domains or what.

Re:Creative Playcenter?

[Reziac]

Nope, I have absolutely NOT installed new.net's software, but maybe Earthlink has hooked into their domain server, cuz "www.mp3.mp3" works just fine in my beloved old Netscape 3.04.

That arrived at http://www.mp3.mp3/ where the page has the title

"BEHosting.be - Coming Soon"

and informed me

"This domain is reserved for a client of (swax) medialab"

but has no other content. ViewSource reveals a crapload of commented-out table cells containing "http://www.hyena.net/behosting/images/spacer.gif"

Thanks for the sample!

Re:Creative Playcenter?

[Reziac]

I don't install stuff downloaded off the net unless I know *exactly* how it behaves in advance, and have never installed any of the Morpheus clan or their ilk at all. Really, I know everything that's on this system, and everything that's running. I realise most people can't say that about Windows, but I'm a freak ;) (Likely why this box never crashes, too :)

I just tested it on my Win98 box -- it has NO programs installed whatsoever other than default Win98 (not SE, *no* updates), CorelDraw8, WordPerfect 2002, and Netscape 4.50 commercial release (purchased CD from Netscape Corp. in 1998, long before new.net was even a gleam in someone's eye). Guess what, "www.mp3.mp3" worked on that box, too!!

LISB4, it's likely something Earthlink hooked into -- they're real good about staying up to date on that sort of thing (there are reasons why I've had this account for 5.5 years now!) But you're probably right for most folk, especially those who install downloaded software of uncertain ethics.

Legal Framework?

[dgb2n]

I was with the author all the way up until the point that he mentioned a legal framework for enforcement.

While all of those objectives are admirable, at the mention of involving governmental organizations in the enforcement of such standards I begin to get nervous. We live in a litigous society in the US as it is. Do we really want to enable a new class of lawsuits based upon violation of software installation standards.

Sure, publish some guidelines and get corporations to sign up agreeing to adhere. I'm just not sure I need or want legal protection to enforce it.

I certainly don't want to have my installation routines prescreened by the legal department before I can ship my code. Sheesh.

Re:Legal Framework?

[hagardtroll]

I think the "Legal Framework" needs to be built into the code as well as the law.

The O/S should be the O/S should be the O/S. No third party application should be able to change the functionality or performance of the O/S.

The Application should be the application should be the application. No OTHER application should be able to change the functioning of the original application.

If the browser is an application that is part of the O/S that can be modified by a differnt application, then you never know what to expect.

If I want to run App A, later install App B. App B shouldn't be able to change App A unless that is what is advertised to do.

App B shouldn't be allowed to mess up App A or the O/S. If it does, that behavior should be detected and stopped.

That way if App B fails to work, it can be removed and the O/S and App A can go on their merry way.

Re:Legal Framework?

[zangdesign]

The O/S should be ...

Well, there's goes third party extensions to the OS, such as skinning (can change the functionality), media players (can change the performance), virus scanner (can change both), etc.

The Application should be ...

And there goes third party extensions to programs, such as plugins for Photoshop, plugins for Dreamweaver, plugins for Logic Audio, etc.

You've negated yourself, there.

Re:Legal Framework?

[geekoid]

Nervous is ok, but don't get paranoid, a great many good stadards has come out of the US government.

Without somesort of consumer guigelines that can be enforced, companies won't bother doing it.

Re:Legal Framework?

[rossjudson]

The Spam wars have taught us that a conscience and "doing the right thing" simply aren't reality for a lot of people. Unless I can recover damages from people who secretly install crap on my computer, it will be difficult to prevent.
I also offer the possibility of a "signing authority", that validates that software meets the guidelines. I think this may go a long way.

Re:Legal Framework?

[gartogg]

So basically, don't use the legal system. People should not defend their rights.

Even John Browne (libertarian candidate for US president) would disagree with you. This isn't small government, it's just being stupid.

Just because too many laws already exist, it does not mean that all laws are bad. The better solution is to look at your two points as seperate problems: There are too many laws, and something needs to be done about the problem with abusive software. The fact that there are too many useless laws does not mean all new laws are bad.

Re:Legal Framework?

[Tackhead]

> Why are viruses (which I've never had ANY trouble with because they're frankly pretty easy to avoid) illegal, but virus-like behaviour in commercial software (which affects me much more frequently) is acceptable?

s/virus/trojan/g

"Because marketing departments have better lawyers than the writers of trojans."

Re:Legal Framework?

[blibbleblobble]

signing authority? How about www.linux.org/apps ?

Re:Legal Framework?

[Malcontent]

Well in this case we need the govt to protect us from the corporations. The corporations got us into this mess so it's unreasonable to expect them to get us out. I guess the govt is the only hammer we have left. That and open source.

Anyone want to start a software company?

[cperciva]

It seems to me that "scumware" is starting to take on proportions very similar to "wormware"; as the author notes, there seems to be little difference between the subseven trojan and the new.net software (or, I might note, whatever that horrible program was which made yellow links pop up everywhere).

Since anti-virus software doesn't seem to scan for these, perhaps someone should create a product which operates similar to antivirus software but instead scans for a dictionary of scumware?

Re:Anyone want to start a software company?

[Reality Master 101]

Ad-Aware is what you're describing. This software rocks, by the way. Highly recommended.

Re:Anyone want to start a software company?

[ncc74656]

Since anti-virus software doesn't seem to scan for these, perhaps someone should create a product which operates similar to antivirus software but instead scans for a dictionary of scumware?

...umm, something like this?

Yeah, Brother!

[jackjumper]

The other day I discovered that I couldn't burn CDs at 10x any more. In fact, I had to slow down to 2x in order for it to work.

This led me on a chase through my computer. Through a combination of Ad-Aware, Startup Cop, and Process Explorer I managed to get rid of a bunch of leftover or not wanted CRAP that was hogging up my system!

Quicken, for example, had two programs that started up every time my system started. There was a Lexmark printer application running, even though I no longer have the printer and had uninstalled the driver!

And don't even get me started on Real One...

What a pain in the ass...

Re:Yeah, Brother!

[Tackhead]

> I used to love Real and Real Player. Now they install so much extra junk and do everything they can to always have something running. Ugh. One of the worst offenders out there and they only install their own software.

On an old 98SE box, I installed Real 5.0.

When it wanted to be upgraded to G2 (because a file I wanted to play needed the new codec, and I didn't want to upgrade the spam-free 5.0 player), I imaged the drive, ran the "over-the-net" upgrade ("Play the video, then let us download and run an executable, just trust us!") on the imaged drive, swapped drives back and compared the results.

I then copied the modified DLLs from the "upgraded" drive into the proper directory on the "old" drive, and voila, RealPlayer 5.0 playing G2 streams.

Did it all over again for Realplayer 7.* and 8.*.

Man, I love my South Park ;-)

The practical upshot of all this was that many of the "new" RealVideo streams don't need the new player - they just need the right DLLs copied into the right directories and the old player will work fine.

And WTF is NEW.NET?

[grnbrg]

Anyone? Anyone? Bueller?

A URL or something?

Google just points you to http://new.net/, which doesn't look like anything.....

Re:And WTF is NEW.NET?

[rossjudson]

NEW.NET supplies a new series of top level domains. They aren't doing this with anybody's authorization; they have simply shipped a trojan with a ton of popular free software packages that alters your IP stack to point to their TLDs. If you go to new.net and click on "enable", a Java applet will install this stack-altering crap on your system, after you foolishly allow it to do so. But, really, they install with a lot of different "free" packages.

Property Questions

[Loundry]

I've long maintained that I do not think that information is property, and I therefore can't agree with things like Intellectual Property laws.

This post raises some interesting thoughts: are my computer's CPU cycles and my system's stability my "property"? Do companies have a right to infringe on those things? Do I have a right to sue if other companies infringe on those things without my explicit permission?

Don't mod me up; I just want to see the discussion that ensues. :)

Re:Property Questions

[BitwizeGHC]

Your computer system and your CPU are your property. They are physical, tangible objects that you paid money for.

Companies using your property for reasons that you didn't authorize, through subterfuge, are clearly in violation of your property rights. And "By clicking here, you agree to yadda yadda" is BS, particularly concerning software components you aren't told about.

Re:Property Questions

[gilroy]

Blockquoth the poster:

"Fraud" is a good word for the password analogy, but only if the password were used to fool someone. What if, instead, it were used to gain access to your system?

Maybe we need to broaden the definition of "someone". Obviously a stolen password is intended to be used to fool your system. As we move toward semi-autonomous software, we going to have to expand our concepts of identity, fraud, lying, etc.

Re:Property Questions

[foobar104]

are my computer's CPU cycles and my system's stability my "property"?

Various legal traditions define property as (paraphrasing) any tangible or intangible thing that can be a source or element of income or wealth.

Your car is property because you could sell it and turn it into income. If somebody takes your car from you illegally, then you have been deprived of the potential income you could have gotten from selling your car. You've been deprived of property.

But what if your neighbor borrows your car when you're not using it? Assume, for sake of argument, that your neighbor only borrows your car when you wouldn't be using it, returns it whenever you ask for it, doesn't use any gas or other tangible good, and doesn't induce wear and tear on the car. You can still turn around and sell it at any time, with zero interference.

In that case, you wouldn't be deprived of any property. The fact that your neighbor is borrowing your car has absolutely no impact on you.

That's a stupid analogy on its face, but it's a pretty good one for considering the case of a software vendor "stealing" clock cycles from your computer. No matter what's going on under the hood, you're not being directly deprived of any property. Your computer isn't magically worth less because it's running somebody else's code.

So no, CPU cycles aren't property.

There might be an argument to be made, though, that you are being deprived of your rightful use of your computer. I'd have to think about that one, though....

Re:Property Questions

[swillden]

You not only authorized, it, you requested it. Your software on your computer sent an HTTP GET, downloaded the data, processed it, saw the Javascript, processed that, sent another HTTP GET request (or several) to download the contents of the popup window and displayed that.

If you don't want the popup, either (1) don't instruct your computer to perform the first GET or (2) don't instruct your computer to honor the Javascript.

(2) can be done easily by turning off Javascript, or by using a browser that allows you to selectively disable the popup feature of Javascript.

Re:Property Questions

[foobar104]

Look into the college that sued its employee when they installed a grid computing program to crack the RSA algorithm while everyone was on Christmas break.

This isn't very specific; Google doesn't know what to do with this. Can you please provide any specific information about the case?

Re:Property Questions

[foobar104]

I think this the case was based on 16-9-93(b) of the Georgia Computer System Protection Act. The anandtech.com article you pointed to refers to section (a) part 3, but I think they're misreading the statute.

Section (a) of that part defines the crime of computer theft. The whole definition is too long to excerpt here (read the whole act at this address), but the gist is that computer theft is the crime of using a computer without authority in an attempt to appropriate, obtain, or convert property illegally. In other words, if you commit theft, and you use a computer, without authorization, to do it, then you're guilty of computer theft. In that way, the legal definition of computer theft similar to that of the crime of armed robbery. No robbery, no armed robbery. Likewise, no theft, no computer theft.

Section (b), on the other hand, describes the crime of computer trespass. This crime covers using a computer without authorization to delete data, interfere with the normal use of the computer system, or alter or damage the computer. This is clearly where the meat of the McOwen case lay: his installing of the Distributed.net client without permission had the side effect (arguably) of interfering with the normal operations of the computer systems in question.

McOwen was only charged with one count of computer theft, but seven counts of computer trespass. The count of computer theft was probably justified by the fact that Distributed.net offers a $1,000 prize related to the cracking of RC5, thereby implying that McOwen acted to use a computer without authorization to illegally obtain property (the $1,000). The property in question, here, is the $1,000 prize. Not the computer capacity that he (allegedly) stole.

So this case, while interesting in its implications, has nothing to do with whether or not computer capacity (i.e., CPU cycles) is property.

Really interesting case, though. In a way, it's too bad McOwen decided to plead it out instead of taking it to trial. The judge's ruling would have been just fascinating.

Re:Property Questions

[Dynedain]

Not quite....what if for example, I often need every precious CPU cycle I can get....for instance, rendered animations in 3D studio. And lets say for instance that that is my livlyhood (which it is)....

I recently installed the drivers on my new dual proc Athalon for the Creative SBLive! Platinum. It included newsupd.exe, the wonderful spyware program. Knowing what I did about the nasty proggy (which has a tendency to lock up in XP) I brought up task manager and low and behold, Creative's spyware was using up exactly %50 of the processor time. It was using up AN ENTIRE PROCESSOR!! For what? spyware!

Now, factor in that if I was trying to do renderings. If 50% of my processor availablity is gone, that means my 2 hour render is suddenly 4 hours, which means a loss of 2 billable hours of productivity time (since rendering time bills out for much less than manhours).

Sounds like an impact on me, doesn't seem to be "zero interference" and I have been deprived of potential income.

Good thing I disabled it huh?

Re:he has some valid points...but....

[mansemat]

When you install something for FREE from the internet, you can't assume it will work as you want it to. Also, just because it works on your machine does't mean it works on everyone elses. this is pretty redundant IMO.

NEW.NET is only a component. You could also find NEW.NET in commerical software that you pay for.

In that case you've PAYED for something. Do you still assume is will work as you want it to?

What a day to be without moderation points...

There is a "signed installation" system out there

[Dynedain]

You say one of the solutions is:

A "signed installation" program, run by known entities, asserting that a given program and its installation don't violate the rules

Guess what? That already exists for Windows (which is the platform you are obviously complaining about)...its called WHQL Certification.

interesting article

[Str8Dog]

RIAA and MPAA have made huge strides to protect thier copyrights. But the same companies would see no problem with this type of deception. We really want the government to say away from regulating the computer industry, but untill they do this BS will continue to get worse. The average AOL user has no idea and are building a army of zombie DOS machines and now an army of zombie marketing harvesters....

Re:he has some valid points...but....

[DahGhostfacedFiddlah]

If someone gives you a free hot-dog that happens to contain poison, can you take them to court?

Sorry for the stupidity - but it's the first analogy I could think of. The program/component was misrepresented (as something that wouldn't fuck with the IP stack), and that misrepresentation caused damage to his computer and a certain amount of time getting it to work again. I don't agree with punishing free software developers for bugs, and there's little precedent, but just because it's free doesn't mean that the creators can't be held liable.

Re:GIGO

[rossjudson]

Well how about when you have a Creative Nomad Jukebox on your system and you need to move files over to it? it isn't a normal drive. I'm not trying to give advice to super smart guys like you, who obviously don't need anybody's advice on any topic.
I do agree with you; Creative software is crap. No argument there. Wish I didn't have to use it.
So how are people supposed to know what is "spyware infected" and what isn't?

If Spyware would only follow these rules...

[jjhall]

I installed Kazaa the other day at home, knowing it would attempt to install the BDE3 (I think) viewer. Since my hard drive is NTFS, I created the BDE directory under my second account, and used NTFS permissions to be only readable/writable by the "Administrator" account. I thought that would stop it from installing. I was wrong, however. The program simply installed inside of a different directory.

It doesn't run because I did the same thing to that directory, but it still installed when I took fairly advanced measures to prevent it. The fact that programmers are writing applications that users have no control over is a step in the wrong direction. I don't want the "3D Advertising Projector" on my system, yet it installed anyway. That to me sounds like something Norton should be protecting from...

I do write simple programs for personal use for myself. I have given a few to friends, but I never install a "Jeremy in 3D" viewer or anything like that. Note to programmers: If it is ABSOLUTELY ESSENTIAL to the operation of the program, go ahead and force installation, but tell the user what it is and why you need it. If it is not essential, simply put a check box to not install it. Or at least instructions on how to safely remove it.

I understand that Kazaa is trying to make some money by forcing ads, but when people won't even install their software because of the ads, they are shooting themselves in the foot. If they used simple HTML banners, I probably wouldn't go to the trouble to block them.

Another thing that annoys me greatly is the Real Player (whatever they are calling this version) notification program. It pops up ads and new version notifications near the systray. There is not an option ANYWHERE I can find to disable that function. They used to have the real icon in the tray that you could close. And they had an option to keep it from loading. How much of my system resources is it taking to check in the background for new updates/ads? There are a few things I need real for (unfortunately) or I would uninstall it and be done with it. If I try to play a stream that won't play with the version I have, I will upgrade on my own. I don't need a resource hog app telling me when to upgrade.

Re:If Spyware would only follow these rules...

[arkanes]

BDE is ALSO some stupid video viewer that kazaa installs. It doesn't need it, it's a spyware app. it has nothing to do with the Borland engine.

Re:If Spyware would only follow these rules...

[CtrlPhreak]

Get rid of all that spyware, I use ad aware. It has worked for a lot of things I never heard of and it's simple/small. Check it out www.lavasoft.de. Free as well.

Re:If Spyware would only follow these rules...

[Skuld-Chan]

You know the easier way to remove bde view (the 3d advertising projector that eats up 80% of your cpu) is just to click on add/remove under add remove software (in the control panel) and poof it goes away. I've done this (under XP) - kaaza doesn't complain when it loads up either :).

Re:If Spyware would only follow these rules...

[w3woody]

Note to programmers: If it is ABSOLUTELY ESSENTIAL to the operation of the program, go ahead and force installation, but tell the user what it is and why you need it.

I would say you should never force *anything* in that manner. Instead, I would put up an alert saying that the software cannot be installed without this module, and give the user to either continue or abort installation.

Re:he has some valid points...but....

[Hiro Antagonist]

Funny; I grabbed all of my application software, from StarOffice to Opera, for free, off of the Internet, and it seems to work just fine. So do the numerous other, smaller applications, like 'mutt' and 'ssh' -- they haven't trashed my computer, either, and they were free.

I think what the author is trying to get across is that the user needs to be informed; and while this is taken for granted in the free software world, it seems to be largely absent nowadays in the world of commercial software.

When a Debian package is going to make changes to a configuration file, it asks me first (unless I tell it not to); when most Windows-based installers decide that it's time to replace the IP stack with a Jell-O recipe, it just goes ahead without informing the end user of squat. While Microsoft has made this easier, it's not totally their fault (for once); and it's something that applications developers need to keep in mind.

Re:he has some valid points...but....

[UsonianAutomatic]

Right... especially when the EULA of whatever software you install indemnifies the creator of any damage the software might cause your system.

It's like suing tobacco companies after getting cancer/emphysema after years of smoking cigarettes that have a GREAT BIG SURGEON GENERAL WARNING on them.

Two more examples

[rogerl]

Real Player: Real Player assumes that you want their "service" running at times. It assumes that you want it to be your default media player. You try and turn some of these off via there options screen. Sometimes it works, Sometimes it does not.

Weather Bug: This is another one. It just starts running and does not give an option to turn it off. I had to hack the registry to get rid of it.

Oh well... I am slowly converting to completly Linux...

Re:Keep it simple

[Sorthum]

The problem with this idea is that end users generally don't want to know the nitty gritty details about their machines-- they just want the damned things to run. That's why this standards idea is such a good idea-- it keeps the end users happy because programs such as the old AOL versions won't mess with settings without telling you about it, and it makes those more knowledgable happy because they're not having to rebuild IP stacks (as an example) because some buggy code made it into a final release.

What New.Net is:

[PunchMonkey]

new.net is a company who decided that instead of waiting for the new top level domains to be approved, they'd just start up their own root domain servers and sell the new top level domains themselves.

So if you want to buy sweat.shop, you can go to new.net and do just that.

The software in question is a "plugin" that "fixes" windows to use their dns servers when requesting a domain that ends in ".shop" or whatever.

For more info, don't be so lazy and click on the "About Us" button at the bottom of the new.net homepage

http://www.new.net/about_us_mission.tp

I submitted a story about this on slashdot long ago and, surprise! it was rejected. I'm sure I wasn't the only one who thought this site and company is worth discussing.

-- Punch the Monkey!

Re:What New.Net is:

[rbeattie]

I've often wondered what would've happened if Microsoft had thought of this several years ago - or decided to do something similar tomorrow.

Imagine if every WindowsXP that was sold had browsers that resolved Microsoft Name Service ( MSNS or simply ".NET") addresses? Imagine if Microsoft had thought about this in 1997 and every Microsoft browser (forget any other internet app - since that's obviously what New.net is doing) since then checked Microsoft.com's MSNS service for it's own custom domain names BEFORE your local DNS?

If they marketed it enough, my Mom wouldn't know the difference between .com and .shopping (a Microsoft-only domain).

It's an interesting thought... they could've controlled A LOT more of the internet than they do already. Maybe Microsoft isn't as smart and vicious as we all think...

But you know, all the ICANN haters always point out that the DNS system we use today is strictly voluntary and they have a point.

-Russ

Re:Here is an idea...

[alen]

I think Real Player is the king of unwanted components. And when you turn them off from running in the system tray, they turn back on. Unbelievable.

Screw it

[drivers]

I'm switching to free software.

daemons?

[room101]

daemons? what are those. I don't think they exist on windows. (;-)

On windows, they are "services". They give you exciting service. Way better than those unix daemons. They only talk to you in your head and tell you to burn things. Or at least, that's what they do to me. Maybe I'll post an "Ask Slashdot" to get further insight. Oh, maybe not, the voice in my head says that it will get rejected.

Re:daemons?

[pyramid termite]

daemons? what are those. I don't think they exist on windows. (;-) On windows, they are "services". They give you exciting service.

They service you. Repeatedly and often, painfully.

Re:daemons?

[einhverfr]

On windows, they are "services". They give you exciting service. Way better than those unix daemons. They only talk to you in your head and tell you to burn things. Or at least, that's what they do to me. Maybe I'll post an "Ask Slashdot" to get further insight. Oh, maybe not, the voice in my head says that it will get rejected.

My daemons send me email when they cannot do the jobs I tell them to :) I am the Daemonologist!!!

Would you rather be served by Windows services or by a hoard of Daemons? ;)

Windows Users

[jyak]

Take control back of YOUR computer with all the proper utilities. Go to onlythebestfreeware.com tto get the best free utilities to rid your computer oof unwanted items.

Three words: Package Management System

[JonKatzIsAnIdiot]

A package management system is the user's first and best defense against this type of thing. With it, a user can always determine which files are needed for which applications, and vice-versa. You can check what is going to be installed before you do it. While a malicious/ignorant software vendor could put malware into a package file, at least all of the files that make up that package can be determined later on. No other software management system can provide that information as easily. Not installer programs, and not even the sacred install-from-source routine.

Re:Three words: Package Management System

[Junta]

Of course, current package managers don't protect things sufficiently either, as they provide their own list of modified/new files. What the package *actually* installs/modifies does not necessarily coincide with what the package claims. A sort of enhancement I would like to see is a packgame managemant system in which packages are chrooted to a safe playground for all operations, and when it wishes to make changes/add new files to the real filesystem (presumably out of that playground), it would be *required* to do so only through a special commit facility provided by the package management utility. This commit facility could be configured for various levels of trust per app, from prompting on each operation to rejecting to allowing operations. Also, every operation is logged at a minimum of saying when and by what a file has been modified (keep a running history), to storing diffs between package modifications (good for, say, /etc files where changes are typically small and compress well).

Of course, as with anything, it couldn't protect against bypassing the mechanism (well, maybe with extensive kernel modifications, but probably not worth it), but for people currently relying on package management to keep their system consistent, this sort of infrastructure may be a good next step in the face of bad behaving packages.

EULAs unenforceable

[coyote-san]

First, EULAs have not been upheld by the courts. Especially when they "shock the sensibilities." That's why UCITA is trying to write enforceability into law.

Second, the EULA you saw focused on the main application being downloaded. It is unlikely that this EULA will discuss embedded applications with any depth, at most you might see a paragraph making vague references to third-party applications.

Third, one of the cornerstones of contracts is that it's an conscious, INFORMED agreement between multiple parties. One or more parties may decide to remain ignorant, but once one party begins to deliberately withhold pertinent information that another party wants it's a whole new ballgame. As the author points out, there is absolutely no reasonable way anyone could ever expect an application that computes the size of a speaker enclosure cause a critical part of the OS's network stack to be changed.

Finally, I think this situation is so outrageous that it's getting close to gross negligence, not just negligence. You can contractually limit your exposure due to negligence (you made an honest mistake), but you can't contractually limit your exposure due to gross negligence (you knew there was a problem, you know your inactions would cause harm to others, but you didn't give a damn).

A better analogy is that you bought a hot dog. Okay, this is a little iffy, but most people understand that some cheap hotdogs have filler and they'll pay more for a "100% beef" hotdog. But now you learn that you're now sterile because the hot dog producer has been dumping dangerous chemicals in the brew, but hey you agreed to this risk when you bought those cheap 'dogs.

What does open source have to do with it?

[JohnDenver]

Before you crap out an idea, maybe you can establish some context as what you're talking about. Try using a first sentence or a snippet from the main article to highlight the points that you are agreeing with, because I can't tell if you're accidentally posting in the wrong thread or if you're opinions are just stupid.

This is one area where open source software can really pull ahead of Microsoft. Provide excellent documentation of the software and the coding as well. That's all folks.

How would this make open source less susceptible to hosting a stealth component, or how would this prevent stealth components from piggy backing during an installation?

It seems that you think this is a security issue that can be solved like MS Outlook holes which allow scripts to propigate email. Unfortunately, all operating systems are susceptible to stealth code sneaking along with trusted software. There's really nothing you can do about it other than legal recourse.

Re:What does open source have to do with it?

[Negadecimal]

How would this make open source less susceptible to hosting a stealth component, or how would this prevent stealth components from piggy backing during an installation?

1) Download source code instead of binaries.
2) Review source code for "stealth code"
3) Compile.

Lather, rinse, repeat. This is naively simplistic, of course; searching large-ish apps for undesirable code is hard to impossible. But on platforms where OSS is the norm, chances are that someone will try anyway (especially when spyware starts leaving footprints on their firewall). It's our culture.

And for some reason, I'm reminded of a line from the second Harry Potter book: "Never trust something that can think for itself if you can't see where it keeps its brain!"

i concur

[SubtleNuance]

If I wrote a stealth component today, I would have it seek out an Ad-Aware signature file and modify it to ignore me, or add my directory to the ignore lists. Ad-Aware could respond by digitally signing the files, or with other techniques.

If this begins (too late?) than I fully expect our friends @ NAI or Symantec to add this trash to their virus software. Anything that tries to protect itself from being removed is a virus. %insert_your_own_windows_joke_here%.

Ive been very happy with Ad-Aware, and as the author suggests, the first run on my own machine was a real eye-opener. I have some frineds in a local PC clone shop, and they run AdAware on almost all their repair/re-stage jobs -- they have been amazed at the numbers of Malware apps they have found running on people's PCs.

Disclosure, choice and the future (rant)

[legLess]

That's my summary of what we need: disclosure and choice. The user must know every single non-required system modification, and have the choice to not install any of them.

But this won't work, of course. Our favorite example is Microsoft, who blithely says, "It's all required; it's all part of the OS; either take the package or don't." Making choices confuses people, see, and we want to avoid that.

Without being elitist at all, some of what they say is true. One reason Microsoft has succeeded is that they remove those scary choices from the users. It's the software equivalent of "bread and circuses" - don't bother people with the details, wow them with flash, and they'll mostly ignore what goes on in the background.

This succeeds because it's what people want. My 72-year-old mother doesn't know about patches and updates and service packs, and for fuck's sake she shouldn't have to. For good or ill, most people view computers as slightly cantankerous, very expensive toasters. They have no idea that they have, sitting on their desks, a little machine that can do very nearly anything. They want to do a couple things, and they want those things to be easy.

I can see a couple ways for this to go:

1. Special-purpose machines. Instead of one computer, you'll have a few little ones. A web pad in the kitchen that downloads recipies, a glorified word-processor in the study hooked up to a printer, maybe with accounting software. Most people will go to Office Depot and spend a few $hundred on a black box, kind of like a cell phone now days, then throw it away when a newer model appears. Microsoft is set to own this market.
2. General-purpose machines. Geeks will still want a real, live computer that they can control. This is only going to get harder and harder. Twenty years from now, I bet there'll be fewer general-purpose computers than there were twenty years ago. The after-market parts business will dry up as copy-control gets more and more intrusive. I mean, I can build a box from a bunch of parts, but I can't build a fucking motherboard or hard drive.

Computers have to get easier to use while at the same time getting more complicated and doing more things. The only way to do this is to remove end-user control of the device. Fewer scary options, fewer things to screw up. For the most part this is a good thing. Most people using PCs today are basically helpless aside from a few well-known command sequences.

The hard fight will be to retain control of real computers while consumer boxes get dumbed-down. What will make this possible (IMHO):

1. No DRM. Period. This will kill general-purpose computing forever.
2. More standardization. As the parts market shrinks and specialty boxes become more common, it'll be harder for ASUS (e.g.) to sell mobos into the after-market channel. There will be consolidation, but as long as #1 above is avoided it shouldn't be fatal.
3. Concentration on software quality. The OSS community generally goes a better job of this than closed-source, but it will have to get better. Quality alons isn't enough; as we know, 500% better isn't better enough if you don't have good marketing.

This is a long, winding rant, and has gone a little off-topic. Back to the point: I don't think this situation will get better, or at least not in the way we hope. It's going to be incredibly difficult to hold software manufacturers liable for anything; it'll be even harder to hold them liable and let OSS off the hook.

The best hope, I think, is operating system diversity, which at this point means forced licensing of the Windows source code. If you can use Microsoft Windows that basically bends over for any cute-looking virus or trojan, or (e.g.) IBM Windows that flat-out refuses to install anything that isn't digitally-signed and verified (assume, for the minute, non-DRM verified), what would you pick? What would your mom pick? What would you want your mom to pick?

Re:Disclosure, choice and the future (rant)

[imadork]

Computers have to get easier to use while at the same time getting more complicated and doing more things. The only way to do this is to remove end-user control of the device. Fewer scary options, fewer things to screw up. For the most part this is a good thing. Most people using PCs today are basically helpless aside from a few well-known command sequences.

You're forgetting one big point here. Even if the end-user doesn't make the decisions, someone has to. How can we be sure that the decisions are made in the best interests of the consumer?

The answer, of course, is that they won't be. That special-purpose machine will still have to be maintained, but this time it will be maintained my Microsoft (or A0L), remotely, who could care less about your mom's access to recipies on a smart-pad in the kitchen, if they can't bill her each and every one. Or make her access to recipies "bundled" with all sorts of stuff she doesn't need.

If you can use Microsoft Windows that basically bends over for any cute-looking virus or trojan, or (e.g.) IBM Windows that flat-out refuses to install anything that isn't digitally-signed and verified (assume, for the minute, non-DRM verified), what would you pick? What would your mom pick? What would you want your mom to pick?

OK, so maybe your Mom can't make decisions about her computer for herself. But can she really trust MS, or AOL, or IBM?

Re:Disclosure, choice and the future (rant)

[markmoss]

I agree with you, except for one thing: "Special-purpose machines... Microsoft is set to own this market." Microsoft is _trying_ to grab as much of this market as they can, but they do not and will not own it. The most prominent example of special purpose machines today is PDA's -- and the Palm OS is doing quite well in competition with Windows CE.

But you want to build a special purpose word processing machine. So, do you go spend $$$ on Windows CE and the Word component of MS Office, or do you download Linux, KDE or Gnome, and Star Office? Either way, you put lots of work into figuring out how to configure the software to work on your particular hardware. But with Linux, once it works, you can clone that setup indefinitely, for free. With Windows, you pay by the copy, after paying initially to get the development system. With Linux, you'll have to work harder to make it luser-friendly and hide all the system complexity. With Windows, MS has hidden much of the system complexity even from experts -- if it happens to all work right, that's great, but if it doesn't work, you'll have a hard time getting the info to fix it. And you cannot modify the code, or look at it to figure out why things are going wrong -- not that you want to do this in Linux either, but if things really go wrong it might salvage the project.

And finally, with Windows, there is always the risk that Bill Gates will decide he wants to buy Brazil or something, so next year your license costs jump from $50 to $200. It might make it pretty hard to compete with those $300 Linux boxes, but if you've built your whole business around Windows CE, you might not have a choice. Maybe you'd better co-develop an OSS implementation, just in case.

OTOH, when you market the system, you can piggyback onto lots and lots of MS advertising claiming that Windows is the biggest innovation since the wheel. Unless you try to sell it somewhere that lying advertisements are prosecuted as fraud, or to people that are clueful.

Windows will be a big player in this market, but it cannot dominate it. The basic problem is that MS's tactic of changing data file formats to force upgrades is beginning to wear thin even in conventional PC's; if they start telling people that they have to throw out perfectly good hardware because it doesn't support Word 2005, many will shift to something else instead. And if they stick to existing standards, they are going to wind up competing with _free_ without any really superior features. MS marketing is actually good enough to win this -- part of the time.

Re:Disclosure, choice and the future (rant)

[legLess]

You make an excellent point, and I allude to it briefly and obscurely in my rant, but you say it better. The data format argument is a good one.

This is part of what I meant by "software quality." So far MS is lousy at it, and OSS is better. Some companies pick this up and use embedded Linux, but we should mostly count that as a miracle - OSS has to be so much better than MS even to make a dent because MS has such a huge warchest to throw at marketing.

I don't know how to solve this. Some big companies (e.g. IBM) are betting parts of their business on OSS, and their marketing may be enough to combat Microsoft's.

Microsoft is fast, fast, fast, though. Many companies have discovered this to their detriment. Microsoft, once it decides on something, can go after it with more ferocity and better organization than nearly any other entity on the planet. Most of this is thanks to their immense bank account from monopoly profits.

One thing at which they're lousy is grass-roots, and this is where OSS shines. Bottom line: power to the people, baby!

Re:Disclosure, choice and the future (rant)

[Malcontent]

Your grandmother and her ilk are stupid. To be fair most of the world is stupid so in that they are not alone. As a part of the stupid masses they pay what I call "the stupidity tax". They pay this tax in mryiad of ways.

1) By paying more then smart people for everything from hardware and software to food and drugs.

2) Paying more taxes then smart people.

3) By having their privacy invaded and their information bought and sold by everybody from their banks to their doctors.

4) By being forced to view ads shoved on to their desktops by IE, realplayer etc. They are too stupid to config IE so they get to go MSN anytime they make a spelling mistake for example.

Smart people install junkbusters, ipchains, proxomitron, zonealarm etc to protect themselves.

Sometimes even the smart people have to pay the stupidity tax. For example both FedEx and UPS collect information on who sent stuff to you and who you send stuff to. They then sell this information to people who collect and correlate this data. These people then re-sell that information to anybody who wants to know things about you that even you forgot. For less then thirty dollars I can tell you how much your mothers ex husband bought his new house. The reason for that is that even we are not smart enough. Certainly not smart enough to vote for stronger privacy right or fight for our privacy.

Life is tough, it's tougher if you are stupid.

Some choice quotes

[mblase]

Some choice quotes from http://www.new.net/about_us_guiding.tp:

"New.net will seek to work with ICANN to ensure stability in the Internet, and we will attempt to work in the best interests of all parties to not interfere with anything that ICANN plans to do." (Clearly, the author of this article would argue with the use of the word "stability".)

"New.net is building a more open registry business that also will enable other parties to introduce new domain name extensions to the millions of users that have access to New.net domain names. New.net will determine which extensions to release in the future, applying the standards set forth below." (You call that open?)

"We are building a DNS infrastructure that is at least as reliable as the root servers that serve .com, .net, .org, .co.uk, and other top-level domains." (I don't consider having to install special software just to get to a URL "reliable", but maybe I'm narrow-minded.)

Shoe's on the Wrong Foot

[bumski]

The author makes a lot of good points, but in the end, he's placing the responsibility for preventing unwanted, system-level changes on the wrong party.

Installing or modifying "system-level" components such as drivers, services, and daemons shouldn't be possible for anyone without administrative privileges. If the operating system fails to distinguish between normal users and administrators, then it's the OS that needs to be fixed, rather than the practices of innumerable software suppliers.

And if the user chooses to run always with administrative privileges, well, he deserves what he gets.

Mac OS X Software installs...

[MidKnight]

One of the thing that is impressive about applications that are written natively for OS X is the installation procedure: it usually involves a complex procedure called "copying". All hyperbole aside, it is that easy.

For instance, I installed MS Office on my laptop a while ago (still waiting on Sun & Apple to resolve their differences & build StarOffice for the Mac). The entire procedure was:

1. Insert Office CD
2. Drag-And-Drop a folder onto my hard drive
3. Start using it.

Installing applications from the Internet is even easier. I'm a happy registered user of OmniGraffle, a diagramming and graphical tool that makes other programs like it feel worthless. The installation process for that is:

1. Download the file, which unpacks as a disk image & it automatically mounted.
2. Drag & Drop the application.
3. Start using it.

Another nifty feature is that, to the high-level graphical interface, an application appears as a Bundle, and therefore it looks like a single executable file. To the regular user, this is a far more intuitive presentation of what an "Application" is. However, if you whip up a terminal & go poking around a bundle, you'll see that it's really a collection of every file the application needs to work.

Mark my words, the Winblows platform will be emulating this behavior within their usual UI 5 year lag.

--Mid

Re:Mac OS X Software installs...

[markmoss]

Sorry, even Win98 had this beat. If you left it set up at defaults, it is:

1. Insert the CD. An install window opens automatically.
2. Click Yes.

Most of the time it works. What MS hates to discuss it that when it doesn't work, you are likely to be really f*d up. And it leaves too many openings for malicious or just badly written software to install things you didn't want. I assume the Mac has similar vulnerabilities, but since Apple maintains much tighter control over software for the Mac, the chances of an installation going bad is lower.

Re:Mac OS X Software installs...

[bdowne01]

Well, I think that's a little oversimplified. It actually involves clicking "Next" several times as well ;)

But I believe his point is that you have control over what's installed on the Mac. If you don't want it installed, don't copy it.

A Windows install is a scripted behind-the-scenes shindig. Who knows what's being added to your registry...where & what files are being installed, etc.

-brian

Re:Mac OS X Software installs...

[foobar104]

Component reuse is good in theory, but bad in practice because of versioning problems.

Component reuse is good in theory if and only if disk and RAM are scarce. As this scarcity lessens (hell, I have 640 MB of RAM in the iMac I'm using to write this, just because it was so damn cheap) the need for shared libraries becomes less important.

Of course, the trade-off is having every process on your system load its own copy of libc.

Re:Mac OS X Software installs...

[foobar104]

Nothin'. Office 2001 for Mac OS 9 worked just like this. They had this little thing called the first-run utility, or something like that, that would scatter libraries throughout the System Folder.

It was kinda neat, too, to the extent that it would also perform sanity checks at application start up. If a critical component was missing or inconsistent, Office would fire off the first-run utility and fix it. Because only Office used those libraries, it never devolved into an argument between two programs trying to "repair" each other's libraries.

Under OS X, though, all the bits and pieces that would have been stored in the System Folder under OS 9 are stored in the application bundle itself. So each app has its own private copies of shared libraries.

As we've discussed many times, it's a trade-off between conserving disk and RAM (common libraries) and maximizing long-term system reliability (private libraries).

Re:Mac OS X Software installs...

[captaineo]

You also have to consider L1/L2 cache space, which is unfortunately not as plentiful as RAM... If you're running 10 programs, and each one has its own version of, say, malloc() that takes, say, 10KB of L2 cache, then you've just given up 100KB of L2... (most consumer CPUs these days have only 256KB of L2, although some have 512...)

But nonetheless, in the end I'd still prefer to take the performance hit in order to become immune to versioning conflicts. Nobody seems to be able to get shared library/shared data versioning right... (Debian comes pretty close though, and I have high hopes for .NET assemblies... But it remains to be seen whether third-party .NET vendors will be able to keep things clean in the versioning department...)

Re:Mac OS X Software installs...

[cduffy]

You'd rather need to update every single application after (to take a timely example) a zlib bug gets discovered?

I think not.

As long as the interfaces are kept constant between versions apps are liable to link to, shared libraries are a Darned Good Thing.

Re:Mac OS X Software installs...

[foobar104]

You'd rather need to update every single application after (to take a timely example) a zlib bug gets discovered?

Given the choice between that and the current state of shared code in consumer systems? Yes.

Re:Mac OS X Software installs...

[foobar104]

That's a really good point, about cache misses and performance. Of course, the current crop of desktop CPUs feature something like 256 KB or 512 KB of cache, and that's just silly. The two-year-old R12000-based servers and workstations at work have 8 MB of secondary cache per CPU.

Re:Mac OS X Software installs...

[Sycraft-fu]

NTFS already supports this. A given files can have as many forks associated with it as you like. Programs don't use this, because it would break compatibility with older Windows. However if you take a Windows 2000 server system and setup services for Mac, you can copy files over and preserve both forks of the file.

Currently the only other use I'm aware of is that you can record extended information about a file with an NTFS drive.

Oh and drag and drop installs are perfectly possable, they jsut use a time honoured UNIX tradition: store config settings in text files. Unreal Tournament does this, all it's config is stored in a couple of text files in it's system subdirectory. It still sports an installer through for convenience.

Re:Mac OS X Software installs...

[cduffy]

You'd rather need to update every single application after (to take a timely example) a zlib bug gets discovered?

Given the choice between that and the current state of shared code in consumer systems? Yes.

But those aren't your only two choices!

The UNIX shared library versioning system is simple and easy to implement -- even without OS support, if need be. I thought (perhaps was mistaken in thinking) that very current versions of Windows (XP?) had something similar to it; if not, implementing it there (and on MacOS -- it should already exist on MacOS X, no?) would be well worth the effort.

The only thing it really needs that is presently lacking is dicipline on the part of those writing shared libraries -- and it's far better to instill a little dicipline in them than make life harder on either the end user or those writing and supporting the apps.

Re:Mac OS X Software installs...

[foobar104]

I don't disagree with you at all, in principle. But look at the state of our industry. How successful do you think we'd be trying to implement a standard practice based on "discipline on the part of those writing shared libraries?"

Re:Mac OS X Software installs...

[Ayende Rahien]

Actually, there are plenty of uses for this, to store thumbnails for picture files, like Explorer does.

Re:Mac OS X Software installs...

[Oink.NET]

Mark my words, the Winblows platform will be emulating this behavior within their usual UI 5 year lag.

Microsoft's .NET has exactly this. Quote:

"On the .NET Platform, if you want to install an application, all you have to do is XCopy all the program files to a directory on the clients computer. Similarly if you want to un-install the application just delete the directory containing the application and your application is un-installed, no more stray registry entries or libraries!

"One more obvious but silent reason for Microsoft removing the dependence on the registry is the fact that Microsoft is planning to make applications on the .NET Platform, Platform independent and the Windows Registry is not supported on any other platform."

Earthlink and my neighbor's PC

[dpilot]

A while back, my neighbors switched from Earthlink to Adelphia cable. Trying to be a good netizen, I spoke with them about getting a firewall, and set up a time to install Zone Alarm on their machine.

When I went over, they made a side mention about all the stupid popup ads they were getting on Adelphia, how they hadn't gotten them on Earthlink, and Earthlink had promoted, 'No ads with us.' I responded that we didn't get any more than normal popups, on either Linux or Windows.

So we installed Zone Alarm, and started up the cable link, again. First thing we see is a program out of an Earthlink directory attempting to contact the nameserver. Press the 'No', and the popups were gone. Apparently some piece of Earthlink software got in a tiff because the nameserver belonged to another ISP, and decided we needed to be punished.

Did you read the site?

[mblase]

It tells you everything you need to know. You can even install their software, if you're feeling self-destructive.

Re:Huh?

[glitch!]

What the @##$% is new.net?

They are the new version of Alternic. Remember them? They set up their own root nameservers in order to sell their own top level domain names. In order to make it work, they had to persuade ISPs to use their root nameservers instead of the official ones.

New.net has apparently learned from the Alternic episode. No, they didn't learn the part about respecting the official DNS structure. They learned that getting all the ISPs to agree and cooperate is not very practical.

So instead of changing the DNS system from the top down (Alternic), they are trying to change it from the bottom up, starting with your Windows computer. In my opinion, this is just as sleazy, no! even more sleazy than the tricks USR pulled to get dialup customers to force the ISPs to buy overpriced X2 access servers.

Re:There is a "signed installation" system out the

[arkanes]

That's cool, except it's not what WHQL is, and hardly anything gets WHQL certified anyway.

How, I ask you,

[jwinter1]

How, I ask you, how are corporations supposed to cater to your every whim without efficient and effective spyware? Do you just expect movies about Britney Spears and snowboarding to just appear out of nowhere? They can't waste time and money with "original" ideas; they need proven material.

And that's why I gladly install as much spyware as I can. That way I know that my opinions on everything, from linux to pornography all the way to pornography and linux, are recorded by internet tracking software.

Thank you, spyware, thank you. And thank you too, Britney.

RealPlayer

[BranMan]

I think that just disabling the "startcenter" will get rid of most of your annoyances - if it isn't running all the time in the background, it can't pop up crap in your face all the time.

Your PC will also run faster.

Open up the preferences. I think it is a button on the "General" tab labeled startcenter. That opens up another dialog that allows you to disable it (top checkbox - uncheck it). It will pop up a message with a dire warning - just click Yes I really Want To Do This. That should be it.

All the startcenter is good for is preloading Real (so it starts up 3 seconds faster - big whoop) and poping up annoying messages.

Re:he has some valid points...but....

[tyllwin]

Oh, come now. Let us draw an analogy or two:

You're at the supermarket. At one of the tables set up along the aisle, an employee offers a free piece of candy, which you accept. The center is filled with ipecac, and you vomit for the rest of the day.

You're at a concert. You accept a free nerf ball being given away by a radio station. It turns out to contain a miniature microphone which transmits your conversations back to the station's marketing department.

In any other form of human endeavor, would "it's free, whaddaya expect?" justify this sort of deception?

When the software comes clearly labelled "THIS FREE DOWNLOAD WILL INSTALL 2 PIECES OF SPYWARE, CAUSE ADVERTISING POP-UPS TO APPEAR ON YOUR DESKTOP, AND MAY REPLACE AND/OR DAMAGE INTEGRAL COMPONENTS OF YOUR OPERATING SYSTEM," then I'll agree that the person who installs it gets what he deserves. Until then, I say s/he's being damaged by intentional deceit.

Preaching to the Choir?

[scott1853]

Ok, how many people here choose the standard installation options and how many ALWAYS choose Custom just so they know what's being put in their system?

The programs that I've seen install that New.NET and SaveNow crap have always had them as customizable installation options. You just had to click a button and read the contents of one more screen during the install.

The software that crap comes with is free anyways. So what's the problem? Are you going to write your own software or take a trip to the store to pay for software (assuming it's retail) just so you can save yourself 10 seconds off your install time?

Why don't you go talk to Fritz Hollings and maybe he can work that fine idea into some worthwhile legislation for you. Or better yet go talk to gates about only installing software that the author has spent thousand of dollars having verified by windows quality labs.

Re:Preaching to the Choir?

[GreyyGuy]

It took me a while to figure out where the SaveNow windows were coming from. I install everything custom and it still got on my system somehow. So either somebody wasn't playing nice and didn't make it an option, or made it something differently named, or I could have missed it when installing. But I usually pay very close attention when installign software.

Re:Preaching to the Choir?

[Reziac]

I *always* choose "Custom", and have ever since my first computer back in 1993. I look in every single option. This finds stuff I want that's NOT installed by default about as often as it finds something I don't want. (Then again, I rarely install downloadware.)

I also thump on my clients about the importance of knowing exactly what something installs. I've actually got most trained to use "Custom" exclusively, and to expand ALL the options. Even if they don't understand what they see, at least they can usually then tell me what they did/didn't install, when I come along to fix what they broke. :)

Famous words

[ftobin]

Because the program is licensed free of charge, there is no warranty for the program, to the extent permitted by applicable law. Except when otherwise stated in writing the copyright holders and/or other parties provide the program "as is" without warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The entire risk as to the quality and performance of the program is with you. Should the program prove defective, you assume the cost of all necessary servicing, repair or correction.

Now, not only does GPL'd software contain this clause, but practically any software. You accept a great deal of risk when you install software.

Re:One more example of why...

[Kymermosst]

RPMs are not nearly as bad. You can always do rpm -qp -l name.arch.rpm to find out what exactly it plans on installing, substitute the following for -l to do other stuff:

--info to see information
--scripts list config scripts that may run
--triggers list trigger scripts that may run

You have the option to extract scripts and check them yourself. You can also see the services and deps that the package provide, etc. All without installing it.

I know, you never install binaries, and of course, a binary may have something in there that shouldn't be there.

But then again, I imagine you rarely, if ever, read 100% of the source code you just compiled and installed, read the makefile, or keep track of where exactly it put things. You probably just trust it because you have the source, not because you READ the source.

Then again, I might be wrong, and you do.

Personally, I install binary RPMs from trusted sites. (Red Hat, SuSE, KDE, a couple others), and from source tarballs when I think there might be a trust issue.

A good, reputable, signed RPM is a good way to determine trust.

Did you participate in a eula from new.net?

[stienman]

If the EULA you read for the software that installed NEW.NET didn't force you to waive liability from new.net, and new.net didn't give you a EULA that waived their liability, then you could claim they are liable for the destruction of data and software on your PC, since you never waived such liability.

Seriously. Check with a lawyer.

-Adam

You, the consumer, have exactly what you want

[PrismaticBooger]

Microsoft has gone to a lot of effort to ensure that you don't have the level of control you're seem to want in this rant. If you really wanted this level of control, you'd use a product that offered it. Instead, Windows consumers have demonstrated to Microsoft that they don't care. Microsoft users will suffer through countless reboots. They'll even readily grab their ankles for a complete reinstall when some poorly written software hoses their fragile system.

Windows users will not only tolerate, but pay for all of that. And they'll pay for it, as Microsoft well knows, because it's applications that sell Windows. So they'll ensure that application developers can fully commandeer your machine if they want to, because that's what application developers say they need to make the users happy.

Who would ever have imagined that such privileges can be misused and abused?

Now stop whining to the government to protect you from yourself and start making some forward-thinking decisions about the software you use and support.

Most people wouldn't understand anyway.

[Eric Damron]

I agree with the author that you should always be able to remove any program completely leaving no little surprises behind. However, notifying people that it is about to install a driver, service, or daemon might be too much. Most people won't even know what a driver, service, or daemon is, so what would you say to them?

"About to install a daemon in your system... Do you really want to do this? DO YOU!!"

hehe Ok maybe it wouldn't go like that but most people won't be sure how to respond. All they want is for the program to do the job that they paid their money for it to do.

Not telling people about installing spyware should be a crime. The fact that information is being passed out of my PC without my approval is theft. It doesn't matter if it's my credit card number or a list of sites that I visit. It should not be up to corporations to decide what is to be considered private information on my PC. I can handle that job, thank you very much.

The problem

[jafac]

The problem with this is that Microsoft is the standard, and in order to be MS Certified software, you MUST use Microsoft's MSI installer (which is absolute SHIT!!!). And MSI isn't going to play nice in any of the ways you outlined, because MS doesn't want it to, and doesn't care.

The invisible hand job at work again. Wheeee!

Re:The problem

[Amazing Quantum Man]

What the hell did the OP have to do with MCSE? He was talking about MS Certified software (i.e. Windows Logo'ed software).

Re:There is a "signed installation" system out the

[IIOIOOIOO]

You have the right idea, but WHQL is for hardware drivers, which is nice in and of itself. Rather, microsoft will sign software for you if you consent to pass a bevy of tests that determine whether or not you play nice with the OS, including not thrashing system files. Unfortunately, this kind of certification is VERY expensive, and not really an option for shareware authors. What would be nice is creation of an independent, cheaper organization that would supply similar certifications.

That's actually an interesting idea

[drew_kime]

Yeah, I guess I could create a new user in Linux with just the permissions I want to give it for every program on my computer, then run the program with the appropriate user.

Or, you could write an installer application that you run to manage all other installations. Have this app create a new user for each program as it's installed, with these users members of the "installer" group. That way nothing you install later could overwrite anything else you installed.

If there's an insoluble technical reason why this wouldn't work, I'm sure someone will tell me. Problems I see:

• Several apps dynamically link to the same library. You try to update one of the apps, and it includes an update to that library. Only the one that initially installed it can do this. (This could actually be a good thing.)
• Massive proliferation of users. Would this require rethinking what a "user" is? Or is it really even a problem?
• Would the installer have to run as root for this to work?

I'm sure there are other problems, but at first glance I like the idea.

Re:That's actually an interesting idea

[TRACK-YOUR-POSITION]

Wow, you actually read through all those typos and places where I forgot to keep typing what I was thinking? You are amazing! ;) This installer program sounds like a very good idea indeed. I have a wacky extension proposal, though. If I understand this idea, this installer will prevent apps from writing over other. But if we give every resource/file a new group(!) we can even prevent them from reading/executing files that they shouldn't--only app-users that need a resource are added to the resource's group. I must admit, in linux as it is today, this extension requires more paranoia than I can muster today. Maybe in the future if spyware became a problem with linux programs... But from my ignorant perspective, your installer sounds like a really great idea. Maybe someone who wants to sell commercial software under Linux would want to implement it--as a free open source program that guarantees the validity of a commercial closed source program.

Re:That's actually an interesting idea

[ryanwright]

Several apps dynamically link to the same library. You try to update one of the apps, and it includes an update to that library.

This should never be a problem anymore. Why? Disk space. Nobody needs to link to shared libraries when disk space is so cheap. I've had it with troubleshooting two pieces of software where the end result is copying the different versions of the same DLL from /windows/system to each of the program directories. Especially when it's only a stupid 100k dll and I've got 80GB of free drive space. This sort of BS drives me insane.

Re:That's actually an interesting idea

[rodgerd]

I hope you enjoy tracking down the bazillion copies of statically or locally linked binaries on your system when one of those libraries turns out to have a security problem, a la zlib.

Shared libraries are valuable for more than disk space.

Re:There is a "signed installation" system out the

[Zathrus]

No. WHQL is only for hardware drivers. It is not their job to sign off on installation programs for random application software you may be interested in.

It's really amazing to see how much cluelessness is going on in this thread. Spyware programs are becoming pervasive on the Windows platform (and they could be written for Linux too if the spyers felt the marketshare was large enough to care about). And it's not just free software doing it. Pseudo-free software like Eudora is a huge culprit of spyware. And there are an increasingly large number of commercial software packages that install spyware to one extent or another (and while Creative may allow you to not install it, other software doesn't). MOST of the spyware doesn't bother asking you if you want to install it, and doesn't make any evidence of itself being installed. Probably because nobody in their right mind would want it installed.

And, sadly, it's a case of "it's not illegal, so it must be legal" reasoning that's going on here. You might be able to make a case for theft of computer services and/or trespassing, but it'd be a stretch.

I'm sorry... Let me rephrase

[JohnDenver]

Let me rephrase... I meant to write

How would this make an open source operating system less susceptible to hosting a stealth component, or how would this prevent stealth components from piggy backing during an installation?

I can understand why an open source product may be less susceptible. Heck, Why would anyone even try to add a stealth component to an open source app? Why are you even answering the loosly phrased original question when the answer is obvious?

Re:One more example of why...

[Junta]

And this helps you know what happens how? RPM doesn't provide perfect tracking either (packages can lie about what they do and be believed by the database), but it at least makes an effort to track what files were created on behalf of what package. Blindly compiling and installing packages to the default location does not offer enhanced security or better tracking by itself. Maybe if you take the time to manually review all the Makefiles and source, then yes, you are in better shape (and of course record all these changes somewhere). You can even use a program to timestamp everything and figure out what files changed in the intervals, but this isn't perfect either.

as soon as you type ./configure, you give the package permission to execute whatever it wants. Though currently you can reasonably expect good things to happen, in a world with more malicious linux software, this could be very dangerous.

Re:he has some valid points...but....

[ArnoldYabenson]

Nobody forced you to put it on your machine.

New.net is "bundled" with other software, most notably "imesh" (file-sharing).

I work at an ISP, and we see a fair share of problems from this Trojan Horse.

You're correct -- no one forces anyone to put new.net on their machines. But the most frequent scenario I encounter is the patriarch of the family calling about the "family system." When Add/Remove programs reveals the presence of IMesh and New.net, invariably the statement is, "I guess one of the kids..."

This is legally very precarious ground. Kids are not old enough to make contract agreements, so unless there is some sort of age-check performed, these Trojans are coming in a backdoor with no legal agreement involved.

This is especially dangerous where no "opt-out" is offered. DivX Nteworks is currently offering an "ad-sponsored" version of their new codec, DivX 5.0 (otherwise a nice piece of software) -- we are already getting calls about "where are all these pop-ups coming from?"

I installed the DivX package and guess what?

1. There is no choice in installing it, if you want this package, you must install the advertising software.

2. It doesn't just deliver ads. It provides detailed information about your net activities to a server that then decides what ads to deliver to your system.

3. Uninstalling DivX does not remove the service that it adds to an XP machine. DivX Networks claims in its forums that it uninstalls with their software, but no user has yet agreed with them on this point.

So, when "Junior" installs DivX on the family PC, the entire family gets spied upon, with no one of legal age having consented.

This is a lawsuit waiting to happen. DivX Networks in particular stand to lose a great deal in terms of community resect/user trust, if not in cash.

Alarm program for installers?

[esnible]

What's needed is a program that monitors installation programs and reports if they are attempting to do something shoddy.

Sort of a 'ZoneAlarm' for setup.exe files, which monitors nasty registry changes, DLL overwrites, etc.

It's not impossible for a Win32 'debugger' to control and watch an install program. I know there are trace programs, and Bounds Checker, but none seem designed for the person who just wants a button to kill and undo an installation that touches, for example, the winsock DLL.

Installation Specialist

[rossz]

I'm an installation speciliast. That is, I write installers for many different platforms. One of my biggest complaints about software is installers written by amatures. Typically, the manager tosses a copy of InstallShield at the junior programmer and says, "why don't you deal with this when you have a moment". This is usually said a few days before the release date. The result is a mediocre installer that runs ok most of the time, but often the installer will have a basic flaw, such as replacing important system files with an old version.

On Linux/Unix platforms, it's even worse. The installer is almost always a horrid shell script that has been hacked on by a dozen different people over several years. No one really knows what that script is actually doing. The script works great, so long as you are running RH 7.1, because that's the distro the programmer uses.

As for standards, they do exist on Windoze platforms and people familiar with writing installers deal with them. In the Linux/Unix world, it's a free for all. There are some general standards, but all too often they are ignored.

When it comes to "stealth" installing, I wouldn't do it. If the component isn't necessary to run, then it is an option with a checkbox. If it's pretty good idea to install it, it will be checked by default. If it's just eye candy, it will be unchecked. If the primary software won't run without it, it will not be an optional component.

In summary, hire the right person for the right job. Stick to standards where they exist, fight for reasonable standards where they don't. Never forceably install unecessary components. Most important, don't ever change basic system functionality.

Re:Installation Specialist

[rossz]

LOL. Close. I know of less than a dozen specialists.

I'm not very tolerant of crappy installers. All too often I'm pissed not just because it's crap, but because they didn't hire me to write something that works. With the tech industry in the dumps at the moment, companies are cutting corners. My services turned out to be one of those corners.

There are even instructions for Linux

[clump]

UNIX and Linux instructions:

http://www.new.net/download/instructions_unix.tp

Wild.

Re:Slightly offtopic

[Technician]

I just removed Macromedia software from my system. Most of the content it runs is ads. Unfortunately they defaulted it to autoplay. Play could not be shut off while it was loading content. Many ads would end in some kind of animated GIF that still ran even with play and loop unchecked. It would only stop after unchecking loop, play and rewinding the annimation. Too bad they tried to satsify the content providers (advertisers) instead of the end users. All it would have needed was a configuration that a user could set up to not run flash automaticaly. A simple play button on a annimation would have been nice. It was the lack of configuration options that convinced me to remove Macromedia completely.

Re:There is a "signed installation" system out the

[IDIIAMOTS]

Microsoft outlines policies for "well behaved" installations in Windows Logo Policies - Overview for Software.
This is similar (but not exactly like) to WHQL certification for hardware.

Re:he has some valid points...but....

[geekoid]

so? people and companies still need to be liable for this type of behaviour.

I don't have to get my mail, but if I get anthrax does it make it my fault?

Cybercrime?

[gotan]

What's the difference between a big corporation putting software on my computer without my knowledge to sniff me out or add unwanted functionality, and a cracker doing the same thing? I don't see it. I really wonder if you couldn't apply some of the recently tightened cybercrime laws to the case, essentially fighting one evil with the other.

Re:he has some valid points...but....

[Shadarr]

Download.com has introduced a nice little disclaimer that they attach to programs which, while a lot more wordy and circumspect, basically says "this program contains spyware". It makes it way quicker to decide which program to try than scrolling through all the user feedback to see if anyone has posted a warning.

I installed RealPlayer recently...

[Remus Shepherd]

Yes, despite every warning I've heard, there was a .ram format video that I really wanted to watch, and so I thought it would be okay to install RealPlayer just briefly. And now, I am living a nightmare.

My Windows 98 box, which was none too stable to begin with, is having serious problems with blue screen crashes and registry errors. RealPlayer auto-loads things on startup, most notably a scheduler that goes out and checks for updates once a week with no way to turn it off. It's taken over dozens of file types, even ones that it apparently doesn't handle. And -- most annoying of all -- it has no Uninstall option, which I would expect of any professional software. I think I've pulled all the auto-loading parts of this demonic software out of my startup scripts, but to really be rid of this evil thing I'm looking at a full reformatting of my hard drive.

No software package should ever put a system in that kind of state.

Required Tools of the Trade

[thomis]

If you are going to use Windows software from untrusted (i.e. most everyone, especially M$) sources you must take steps to protect yourself. First, trust your gut. Does the developer "smell funny"? Is the software from a startup company with no visible means of revenue? I tend to trust programs created by individuals or small teams that demonstrate some passion for what they do (EAC, or LAME for example)

Then, get Technological on their ass. Start with a personal firewall that monitors all outgoing traffic. Zone Alarm is the one I trust - gut feelings, and I've read some negative things about Black ICE. Amaze and astound your friends as you block requests from RealPlayer, Windows Update, and other "legitimate" programs that like to access the net without asking permission.

Then get Ad Aware and get that sinking feeling as you see the total number of unauthorized programs, components, and services on your system.

Finally, install Proxomitron to make make your browser behave a bit more politely by re-writing the html it sees before it sees it (and find yet another reason to love Shonen Knife. They're way kawaii!)

Forewarned and fore-armed (hairy ones, even), you stand a much better chance of maintaining control of your system.

From the Darkest Days of MS DOS Onward

[nickynicky9doors]

Remember the trials and tribulations that was Win 3.x and 286 before it? These complaints have been around since the inception of the PC, except that in the darkest days users were demanding and not getting something as simple as UnInstall.

Re:From the Darkest Days of MS DOS Onward

[nickynicky9doors]

I was alluding more to the cooperative multitasking environment. The more common uncooperative multitasking environment left the endless rank and file of Windows users staring at the hourglass icon. This happened with such frequency that many users saw it as a metaphor for Bill Gates having control over the number of their days and lead to the rumour Mr. Gates is the AntiChrist! Utterly unfounded rumour, but still...

Not .NET, NEW.NET

[Da VinMan]

This confused me too.

I don't think he's talking about Microsoft's .NET, but is instead talking about the alternative domain name root at http://www.new.net/

Packaging Systems

[clump]

One of the things I really like about Linux is packaging formats like RPM and DPKG. The approach is that your system is to be built from modular pieces that can be tracked, updated, queried, and removed.

Now the problem, and source of frustration for some users of RPM, is that these management systems do not respond well to circumvention. IE, compiling an application outside of /usr/local or using an installer that doesn't let the package management system know it exists. Case and point: Perform a server-class Redhat installation. Install XFree86 from XFree86-distributed binaries then try to use something like an official xterm RPM and your system will say you need to install X11.

An interesting approach to this is that of Debian's in that you will have an official package available for just about anything you could want. Browse debian.org's unstable software archive to see. Conversely apt will handle dependencies of packages for you as a result DPKG/Apt is *more* tempermental about being circumvented.

Though I wish people would respect the original ideas of RPM and DPKG, I think the concept is great, and avoids the tomfoolery of mucking with nasty-3rd party installers if done correctly. When you can't or don't want to use a package, go with /usr/local. Things like new.net installers don't cut it over here.

So it will install spyware on first run instead

[Smack]

If they want to install crap and spyware, they will. The fact that installation on OS X is just drag-and-drop is quite nice, but it doesn't change the uncaring attitude of these developers.

Computer War .. Ha ...

[TheViffer]

This is prob redunant and mark it as such ...

But go install Quicktime, Real Audio and Microsofts Media player and then see the war that breaks out on your box.

There is, but

[www.sorehands.com]

There is some theories to file a lawsuit on, but there is one problem....the EULA!

Before you can install the software, they require you to surrender all your rights before installation. If you say, "No, I don't agree" they will stop the installation. This is really disturbing where you buy a computer, take it out of the box, and Windows puts you through this.

Windows is hopelessly broken in this respect

[bcronin]

Anyone who's administered Windows machines knows that Windows programs, in their never-ending quest for convenience, routinely install taskbar "daemons". I find that you can gauge the naivete of a user as directly proportional to the number of small icons next to the clock.

The point is that Windows application writers are so used to running a resident process in support of their dinky programs that it seems to me to be too late to change the practice. Of course, some programs are more intrusive than othes (Real Player, anyone?), but it seems like the developers of just about every dinky little app seem to think they won't be taken seriously unless their program loads SOMETHING at bootup.

Of course, I shouldn't complain. I make good money doing PC consulting work; a good percentage of my calls are people whose machine is so clogged with TSRs that it has become unusable.

Re:Windows is hopelessly broken in this respect

[Reziac]

You're right in general about systray clogging.. fella I know had something like 30 of these buggers running, all useless crap like Real and Yahoo's doodad, and wondered why the performance of his 600MHz Emachine (with all of 32mb RAM!) compared poorly to his old 386. You could time its bootup with a sundial, it was that slow. (4 minutes by actual count)

OTOH it can swing the other way. I've got 21 icons in my systray, I put most of 'em there myself, and I use 'em all to some degree. But none of my systrapps eats much, either.

I've noticed that a lot of programs add TSR crap on Win98/ME that don't get added on Win95. Is that a Win98/ME bug or do some apps see the built-in systray and think they just really =need= to use it??

You're right, it's about trust

[drew_kime]

I must admit, in linux as it is today, this extension requires more paranoia than I can muster today.

I think that's the bottom line. Currently installation requires that you delegate to the program writers (or packagers) the same level of system access that you have yourself. This doesn't even count the packages that must be installed as root.

As more commercial software is released, the only viable options I see are to become paranoid about what rights you grant to an installation, or to simply refuse to install anything except from source.

Re:There is a "signed installation" system out the

[bourne]

WHQL Certification.

Since WHQL stands for Windows Hardware Quality Labs, it's not actually all that useful for verifying SOFTWARE installations on Windows. Hardware and Drivers, yes, but not Software.

Perhaps you're thinking of their code-signing stuff for ActiveX?

Unnecessary(?)

[mwa]

Start here (Is BO legal?) and review the definition of Reckless Tresspass. The problem is that it has to cost $1000 in damages before it's a criminal offense.

Just because it's not criminal, however, doesn't mean you can't pursue civil damages, and small claims court might just be the way to do it. Either that, or collect similar experiences to boost the loss to over $1000 and press criminal charges.

Why so many "off-topics" in this thread?

[mangu]

The post that started is actually mildly "funny". The others are mostly on-topic, since they point to the weakness in the basic assumptions in the article: if you have a M$ box, how can you expect to control the software installation process? Haven't all the legal proceedings against them been enough to convince everybody that the Windows API is undocumented enough to be dangerous to your system stability? After reading so many "experts" state that "Windows 2000 is the stablest Windows ever", why is it that I'm not surprised at all to read that a simple software installation can trash the IP stack?

Computers will never be simple!

[MeNeXT]

Let's go back some years...(time travel)...We have a horse and buggy and the automobile.

A horse is simple to use.

It requires no feul, just grass.

It will not crash into things if you drink and drive. (at least not at a speed that will kill you)

It requires no roads.

It requires no special equipment.

ETC, etc....

It seems to me that owning a car is much more complex than a horse..polution...parking...drivers license...insurance..mechanic...gas...etc

But the car rules today!

There are VCR's today wich are harder to program than routers, and most people are able to program these VCR's. The more we ask of the computer the more comlex everything gets. I would prefer to have one or two systems which would replace all these boxes which clutter my home...ie 3 VCR's, SNES, N64, Answering system, Sound system, house alarme , thermostat, microwave, stove(clock), alarmclock...all of which have there own way of being programed.

Imagine everything connected to one system. You only set the clock once after a power outage. You would not have to learn a new interface/programing language with every appliance you bought. I think this is where we are going...and will not be simpler...it will get more complex..

It's Friday and it has been a loooong week. I hope this rant makes sense to y'all...

Re:Computers will never be simple!

[Arandir]

Ever owned a horse? No, I didn't think so. In many ways horses are easier than cars. But in some other crucial areas they are not. The maintenance on a horse is a daily chore. Don't maintain the horse correctly and it dies. Overwork the horse and it dies.

When you park you car in the garage at night do you brush it down?

That's what you get...

[ebyrob]

When you don't compile everything from source yourself. Down with binaries!

Oh wait, does compiling and reading code actually take work?

Re:That's what you get...

[lynx_user_abroad]

I keep forgetting that some of you young'uns weren't around back in the late 80's and early 90's when this was most recently settled (again)...

For it to mean anything at all you have to read and understand what every single line of the code does.

No. It doesn't. It means that somebody has to, but it doesn't have to be you. It just has to be someone you trust to be acting in your own interest.

No one understands every aspect of a computer operating system. But for every aspect of a computer operating system, there is someone who understands it, because someone wrote it. The primary differences with open source software are:

That someone who wrote it is obligated to make the source available. That means they are not obligated (or even encouraged) to keep their knowledge secret for trade secret reasons, and they are motivated to spread their knowledge around.

No matter how well you know a certain aspect of an operating system, there's no guarantee that you know it better than anyone else, so trying to 'pull a fast one' and slip something through may (and likely will) cost you all respect and trust you've gained from the community. And there's no shortcut to earning trust or respect from this community.

Because you can't hide your actions in a precompiled binary, it's darn near impossible to 'full a fast one' in the first place.
The fact that the source is available keeps everyone honest; you don't have to understand that a certain call deep in the heart of httpd could, under certain circumstances, allow an attacker to read arbitrary files off your hard disk, because someone else (who lives in Apache) already found it.

Of course, to assess trust, you need to assess motivation. What would possibly be the motivation behind someone trying to do something nefarious inside code which they give away for free in source form? What about someone who sells pre-compiled binaries and has quarterly financial results targets to meet?

If you want to learn more about the concept of "security through peer review" and "web of trust", I'm sure Google can be of some help.

Re:That's what you get...

[ebyrob]

Who marked my comment up to a 5?!! It was supposed to be -1 rhetorical...

Either way, great article on compilers. I don't believe modern C/C++ compilers rely on themselves in quite the same way Mr. Thompson outlines, or maybe I'm just wishful thinking.

I know I wouldn't implement one that way. I'd use a modern compiler compiler, which normally have much more control over such things. Still the potential could be there. Shoot now I'm all curious and stuff. Time to get some gcc source out and go to town...

Whta do you mean, "not totally their fault"?

[mangu]

Years ago, when I still created MS-Windows programs, I bought the whole "Andrew Schulman Programming Series", published by Addison Wesley. It was a set of several books written mostly by Andrew Schulman and Matt Pietrek, about "internal" and "undocumented" features in Microsoft products.

Anybody who pored through those books knows that it's entirely Microsoft's fault that they always leave so many hidden hooks inside their API's. A casual user who is not a top programming expert, or who has no time to devote the same attention that Schulman et alii. did to those details, will have no way to know what he is stepping into. However, anyone who has the right tools and expertise, and time enough in his hands, can find some point where he can plug some malicious piece of code.

To say that Microsoft is not to blame is like saying Ford was not to blame if someone crashed one of those exploding Pintos.

Re:Whta do you mean, "not totally their fault"?

[Hiro Antagonist]

This has nothing to do with holes in APIs; this has to do with third-party software installing extra crap without notifying the user. A Debian package or an RPM could easily install spyware or make unwanted changes without notifying the user -- the reason that I've never seen a package that does is because free software developers tend to have more respect for their users; it's more of a peer relationship than an adversarial one.

Caveat Emptor

[Boomer2]

You should have known better than to install something you hadn't vigorously researched first. What kind of moron downloads software off the Net from unknown sources?

Re:AdAware

[Croaker]

The sites are using advertising as revenue to provide the service that we as a user request. Now enter pop-up stopper software. Is it legal for you to effectively block there only source income that most of these sites have?

Think of this analogy. Is it legal for me to tape a show, then go back and edit out the commercials? IANAL, but I believe this is allowable for private use (i.e. as long as I don't redistribute). In any event, it's certainly legal for me to fast forward over commercials.

At the same time, I'm dubious about the argument that "I did not give these ad companies permission to use my RAM/CPU/whatnot which I pay for in order to do their advertising." Well, I pay for my telephone, but it is legal (with certain restrictions) for bottom-feeding scumwads -- err telemarketers -- to use my phone which I paid for to advertise to me. By the same token, I'm paying for the TV, electricity, and cable that brings TV ads into my house.

So, where's the difference with spy/adware? Here, the advertisers are making alterations to my system in order to present their ads. If they have ad-supported software (say a banner ad) I think most people will agree that while it stays "winthin the box" then it's not crossing the line. Some people get upset with popup ads, but the fact remains that browser popup windows are a function inherit in the browser. The ads are just making use of them.

Now, when you alter something beyond the bounds of your own software by changing how the underlying system works, I think there should be a legal requirement that the software must gain explcite permission to do this.

Even this may not be enough. Last week, I downloaded some game off of the net which was touted as a demo of this piece of game design software. The installer popped up a generic-looking license agreement, but just before I clicked OK, I noticed that there was something fishy. Scrolling down, I noticed that at the bottom of the window, it mentioned that it would change my browser's homepage to something else, and also subvert the search mechanism of the browser. It's easy to slip those sorts of things past people.

At the very least, companies that install crap without any warning should be hit hard for deception.

A long term solution, however, would be the creation of operating system where you don't have an all-or-nothing security model. Users need to have the ability to install software on their system, but at the same time be sure that the software cannot muck with the system software. Right now, you give the software vendors an inch, and they'll take a whole mile.

Laws should get back to basics

[mangu]

"Intellectual Property" was OK, as long as it was about giving incentives for artists and inventors to do creative work. Because of that, full disclosure is required. In order to get a patent, the inventor has to describe the workings of his invention, with enough detail to let anyone duplicate it. It is not possible to copyright the contents of a closed box. This ensures that the creation will live after its creator.

Today, most patents and copyrights are owned by corporations. They maintain recording studios and research labs and expect to get profits from that. It's OK to get profits from the work of others, of course, all corporations do that. Without some financing scheme, the large laboratories and studios needed for much of the modern scientific and artistic cration could not exist. Many countries that tried outlawing corporate profits just disappeared, others are desperately poor.

But that's not why patent and copyright laws were created. One cannot guarantee the survival of new ideas, if the basic working principles are hidden. Therefore, the only legal action needed is going back to basics: no copyright should be granted on "code" that is not understandable by a human person. In order for software to get a copyright, full disclosure of the source code used for developing it should be required. Companies unwilling to do that should get no copyrights, and should depend on some sort of copy protection to preserve their intellectual property.

Re:Install Software?

[Chris Johnson]

Be careful though- a program like Office can BE an installer. For years Microsoft has been working on 'self-repairing' Office on Mac. This could as easily equate to invariably putting back, say, MSNEW.NET every time Office is run.

You can't depend on strictly technical solutions to this sort of thing.

Re:GIGO

[Tackhead]

> So how are people supposed to know what is "spyware infected" and what isn't?

Most software written before 1999 is mostly clean.

Most open source software is still clean, and is likely to remain clean from this point forward.

Windows software from 1999-2001 is dodgy (usually OK in 1999 to usually fuckware by 2001).

I assume all Windows software from today onwards contains spyware and/or adware until proven otherwise.

The solution in most cases is not to upgrade. For instance, You use WinAMP to play MP3s. Does WinAMP 3.x play MP3s any better than 2.09 did? No? Then why would you want to upgrade?

Why make AOL's problem (their lack of data on your listening habits) your problem?

What about Microsoft?

[chill]

The Windows Media Player 8, shipped with Windows XP "phones home" to check on DVD titles, etc. This was reported a couple of weeks ago. Blatant spyware.

However, this isn't "free software from the Internet", it was shipped with the OS or pre-installed on the computer. Did you read the umpteen pages of legalese before installing XP or clicking "I Agree" when your new computer first booted up?

http://computerbytesman.com/privacy/wmp8dvd.htm

What are your options in this situation. "Signing" of the code doesn't mean a thing, as all code belongs to MS.

This is the main reason laws like UTICA are bad -- they legitimize "click thru" agreements and such nonsense.

Something like this was addressed, sort of, before with Windows Return Day -- when people noticed the clause in the Windows EULA telling you if you don't agree to take the software back to the vendor for a refund.

Until someone actually sues a major company -- and wins -- this sort of thing will go on. Liability is how the new world spells Responsibility. (God, I hope I spelled both of those correctly!)

New.net Software

[lamabile]

First off let me provide some background information regarding our software.

Below is the list of all of our present and past distribution partners (download partners have always been clearly listed on the New.net website):

Present Partners:

BearShare
KaZaA
iMesh

Past Partners:

Go!Zilla
Babylon
Cydoor
GDivx
WebShots

Each one of our current and previous distribution partners is required to provide disclosure during installation that our software is bundled. We in no way install in a "stealthy manner", since it is the responsibility of the user to read the install screens that are provided during an installation.

In light of these recent comments regarding disclosure, we are working with each of our distribution partners to improve awareness of the New.net bundle in the install process.

New.net's software provides a service to its customers as well as its users that want to gain access to domain extensions that our sold on our site. In order to provide resolution, our software adds itself to the TCP/IP stack. There are other methods to resolving our domain extensions such as adding "new.net" to the domain suffix search order or adding our DNS servers in the DNS server search order in the network configurations. You may also append ".new.net" to the domain extension in the address bar of the browser for resolution. Our software is our "user friendly" way of providing such access. Manually changing network configurations requires a reboot whereas our software can install in seconds and provide resolution immediately.

Our software is not "unstable" in anyway unless a user tampers with the configuration to a point where it makes Windows unstable. This is consistent with any other software that adds itself to the TCP/IP stack. If someone were to just randomly start deleting files on their system that are referenced in the TCP/IP stack, without first checking to see if there is an uninstall in Add/Remove Programs, then of course you would expect nothing less than an unstable or corrupt system with network issues.

"The little war I mentioned earlier is going to get nastier soon. Uninvited components like Cydoor and NEW.NET are sure to take steps to defeat Ad-Aware and programs like it. If I wrote a stealth component today, I would have it seek out an Ad-Aware signature file and modify it to ignore me, or add my directory to the ignore lists. Ad-Aware could respond by digitally signing the files, or with other techniques. This cycle will escalate, with each side taking new steps to ensure its dominance. Users will pay the price in decreasing system stability."

Let's be clear on this point: New.net does not create or distribute any kind of stealth software in order to avoid signature files for Ad-Aware. In fact, Lavasoft had determined that our software is not "spyware" and discontinued removing our software since August 2001. I welcome anyone to contact Lavasoft directly for further information. There are still mirror sites out there that list New.net as a component that is removed by Ad-Aware; but I assure you that these sites reflect information prior to August 2001.

"I've been beating up on NEW.NET quite a bit in this article. I suppose it's because the deinstallation of their component trashed the IP stack on my Windows 2000 system and it took me a half day to put it back together again. What the hell were they thinking when they stuffed a buggy service deep into my IP stack without telling me? I think they should have to compensate me in some way. A $250 Small claims court action here in Virginia might be a way to do it."

The New.net client is clearly listed in Add/Remove Programs like the majority of all other software and when the correct procedure is used then the software is properly uninstalled. If someone decides to remove software "their way" as opposed to the correct way then you can assuredly expect problems. Please explain your procedures of "deinstallation" that lead to a "trashed IP stack," this may be useful to the New.net QA team.

Leonard Amabile
Director of Customer Support
New.net, Inc.

Re:New.net Software

[Tony.Tang]

The new.net stuff hasn't been installed on my machines before, but it is a VERY admirable thing that it shows up in the add/remove thing, and that it is stable (as is claimed). I think this is definitely a step in the right direction, and I applaud the company.

We in no way install in a "stealthy manner", since it is the responsibility of the user to read the install screens that are provided during an installation.

This, I find less admirable. Practically speaking, you're absolutely right; however, it's statements like these that show NO LOVE for the user. The feature article is about being fair AND showing compassion for the user. Your mom, and your grandmother wouldn't read the installation screens. You know that. You also know that if you were called in as the "IT guy" to set up her computer for her, you'd be unlikely to read the installation screens either.

In all fairness, the owness should be on the user to read the installation screens. The fact of the matter is that no one does. That's why we have sayings about "reading the fine print." It's because no one does it. And if your partners' customers discover your software installed (without their having installed it knowingly), then effectively, your partners are exploiting the problem of fine print.

And if you do nothing about it, then you may as well be guilty, too. After all, they are your partners.

Re:New.net Software

[rossjudson]

I'd be happy to explain, Leonard. I don't know which app on your list stuck new.net into my system. I do know it was an old version, and the uninstall procedure simply did not work. In fact, if you check the web, you'll find that this is a common problem. I know that your folks have "procedures" for dealing with the resulting damaged registry system; I spent a significant amount of time on the phone with them trying to work it out. Independent of your folks, a pretty smart IT guy over here figured out the magic combination to get my registry repaired.
It is absolutely crap to state that you are somehow informing users of the nature of your program. Every effort is made to ensure that the details are buried in legalese. You may have improved yourselves lately, but your earlier actions were pretty egregious. If your disclosure is so good, and you're not stealthy, why are you "working with your partners to improve awareness"? What you're saying is that you've had problems in this area.
I would say the primary reason that Ad-Aware isn't touching new.net is they're terrified (rightly) of damaging a user's IP stack during the uninstall. Too bad you weren't worried about the same thing when you wrote earlier versions of your software. I understand that recent versions of new.net are improved in this area, and I applaud your decision to test it.
I don't like what your software does. I don't like your stealthy distribution model, and I especially don't like the fact that the early versions of its installation routines were not tested well. The fact that there are simple ways to add new.net into the domain name resolution chain makes it more egregious.
But all this is somewhat secondary to the gist of the article. Sorry if you guys came out as the poster boys. I could have chosen any number of other system-altering trojans as well. You just had the bad luck to be the boys who smacked my system on that particular day.
Wouldn't it be nice for you to be in a business where you don't get beaten up by this crap every day? Consider it!

Re:New.net Software

[lamabile]

Okay, so now we know that you are commenting on an older version of our software. And how long ago did you contact us to correct the problem? Our registry instructions take no more than 15-20 minutes to clear out the registry entries that uninstall would have removed had it been working. I admit that our older versions had problems and we have actively made improvements in subsequent releases of our software. There has not been a customer that has had a problem with our software that my support group has not been able to correct; if it is the result of our software. I might add that New.net is not the only software that adds itself into the TCP/IP stack and we have willingly corrected faults on other software as well in order to correct a customer's network issues. We follow the guidelines specified from Microsoft on LSP provisions and we do not sway from the guidelines in any way.

"I would say the primary reason that Ad-Aware isn't touching new.net is they're terrified (rightly) of damaging a user's IP stack during the uninstall. Too bad you weren't worried about the same thing when you wrote earlier versions of your software. I understand that recent versions of new.net are improved in this area, and I applaud your decision to test it."

Any of your comments regarding Ad-Aware is false and I would like for you to provide evidence that otherwise. I have been in contact with Lavasoft many times and the result, from Lavasoft, was that we are not "spyware" and that they had no reason to remove us.

Your comments suggesting that we are a trojan is most offensive and should be corrected as soon as possible. Its comments like yours that spread the wrong information and cause fear and concern to users that would otherwise not have a problem. We do not transmit any personally identifiable information and our software is a service to our users and customers.

Leonard Amabile
Director of Customer Support
New.net, Inc.

Re:New.net Software

[rossjudson]

Looks like we have some dorks moderating like idiots. Leonard's comment is decidedly NOT a troll or flamebait; it is highly relevant. Sigh. Metamoderate, people!

Re:New.net Software

[Tony.Tang]

we have screens outside of the EULA that explain what our software does and what is being installed

This is far more fair. So long as what's being shown is understandable by your mom, I figure that's about the best you can do for now...

Re:New.net Software

[rossjudson]

I think you and I will simply have to agree to disagree. You are correct that I do not know Ad-Aware's position on new.net. I will also agree that new.net is not "spyware", but it decidedly alters system behavior, and very little effort is made to inform users of this. I consider a system-altering component installed without a user's consent to be a trojan. I gather you do not.

Once again, I reiterate that new.net is not the only software I consider harmful. You can even make the case that it is less harmful than most.

declarative, sandboxed, checked installations

[markj02]

What we really need is a package system in which programs declare exactly and ahead of time what kinds of things they want to do. The user should be able to set policies (with reasonable default policies), and the installer and kernel should enforce them.

In particular, by default, neither the installer nor the actual application software should be able to replace system libraries, install executables with pre-existing meanings, or even access files that are of types different from the ones it is intended to operate on.

Unfortunately, none of the installers on any of the common platforms enforce much of anything. Installers usually can run arbitrary scripts, and once installed, applications are free to do whatever they want. And specifications of what an installer does are also incomplete, even in systems like RPM and Debian.

Re:declarative, sandboxed, checked installations

[rossjudson]

Agreed. My "dream os" would actually allow me to create new virtual machines inside of other VMs. An innermost, completely secure ring hides the core of the system. There is NO access to this layer, and software cannot be installed there. Successive VM layers can be added. Storage and other system resources can be lent to and shared amongst VM layers. New VM layers can be created inside of existing ones, and they inherit the outer layer's resources.
The Windows family offers none of this. Unix can simulate some of it with a security model, but apps on ALL platforms are notorious for wanting more than they really need.
I should be able to download whatever I want from the internet and safely run it in a secure, constrained sandbox.
I think some mainframe systems can do nested VMs like this. Maybe the VMWare guys could come up with something. But it really needs to be done from the OS layer out.
Trust is the hardest thing in the internet age.

Re:Good idea (offtopic)

[q-soe]

Lycoris is very good if you want a fully working Desktop linux - its a simple lizard install and comes with lizard as the installer. Finds everything in 5 machines so far including 3 dell laptops. Div-x runs immediately and has real video and all extras installed. Comes with Koffice and Mozilla and all works fully.

It doesnt have some of the libraries and would need a bit of modifing for some things to work but as a simple and easy to use OS for a beginner to use linux or for someone who just wants a simple solution to a fully working OS with nothing extra.

I ran it primarily because i wanted an OS for div-x and multimedia on my notebook and i couldnt be bothered messing around for hours to setup all the software and drivers. It works.

Samba automatically found my Winxp Shared Internet connection and talks natively to my Windows Shares with built in samba, also talks to a Windows NT4 and Windows 2000 Active Driectory domain.

worht the download, give it a go.

Closed-source honesty.

[Decimal]

When you install something for FREE from the internet, you can't assume it will work as you want it to.

Or go where you expect it to. Programs like Morpheus cram Bonzi-Buddy, Gator and other programs all over the place when you put it on the computer. And crimminy, all those registry entries*! Okay, so I'm a Windows user. But since Windows is the dominant operating system and most programs for it aren't open source, Windows closed source programs are the best example for this conversation.

I think that most problems with this kind of software could be solved by programmers putting on some sort of standard 'seal of friendliness' on software they produce. This would be a promise to the user that:

a) New files and directories will only be installed within the directory the user specifies, and no shortcuts to any program will be installed in any location without giving the user a checkbox not to install it.

b) The user will be told how many entries the install program will be put in the Registry and why each of them is necessary.

c) A promise that the program will attempt to send no information onto the internet unless the user has authorized it.

d) Any promotional offers included with the install will be strictly 'op-in' only, and no annoying pop-up boxes will warn the user what a great deal they are missing out on if they decide to pass them up.

e) The user is given the choice of the program starting by default upon logging in during the install.

f) Programs will uninstall cleanly, merely deleting it's own files and every registry entry it had made. If the user decides to bypass the uninstall process it should give them no trouble when the directory the file is in is simply deleted. No webpages will pop up automatically when you try to install or uninstall a program.

Something along those lines, at least. Granted, there are programs that can't follow these rules, ones that require certain DLLs or other files to be installed in a certain system directory, and they simply won't meet the standard. But I don't think that these requests are unreasonable at all. Look at Irfanview and Enzip -- great programs, no dishonest crap. And although we could initially only expect hobby freeware creators to follow such a standard, who knows how far it could go? If users like us start demanding that companies adhere to such a standard before we will use their programs then things may start to change. Even programs like Morpheus and Limewire could still make their advertising profits and collect user data while following these rules.

I'll be looking into making more of this on my own. Perhaps it's time to make another useless web award. :p

* Interesting note: Morpheus Preview Edition puts a key in your registry called 'Gnutella' -- it seems they took the Open Source Gnucleus code and modified it very little before putting their own wrapper over it. The parent company isn't exactly advertising this, either, for obvious reasons.

The difference?

[Convergence]

The difference between scumware and hackerware is whether its created by a 'trusted company' or evil hackers.

Contrast Microsoft's SMS and Back Orifice.. One is an evil trojan, the other is a valuable administration tool. The difference, a few hundred bux a seat and the authors name.

Same thing.. If you wrote as yourself, some program that installed New.Net as a hidden feature during the installation, you'd probably be called an evil hacker. If your program installed your own clone of new.net, then you'd probably be called a cracker.

This is just more 'the standards that apply to people don't apply to corps' type behaivor.

Amen in so many ways.

[Allnighterking]

I'm working for a startup (hopefully not a start down) That is working in this area for Linux/Unix. The objective is to make installation of software as easy for Grandma as it is for Grandaughter. Along these lines we have adopted the following credos

1. The users box is none of our business. We don't snoop, store data on or in any way check out the users box beyond simple checks to see if dependencies are met. Even when we do that it's never "written down" anywhere we can see it.

2. The removal of software should not leave behind "droppings" of unused code or binaries.

3. Standards exist for a reason. As such we follow them. User apps go in usr/local. etc. Spraying a users box with code and binaries is a sure way to piss them off.

4. If you have to do something unique to the user s box (install a daemon or a server for example) TELL THEM BEFORE they install it.

5. Instructions and info should be available before you install the app not after.

6. Users should be allowed to be productive with applications not to applications Don't burden them with endless options and cryptic configuration files.

7. You own your computer. We don't. As such when our software goes on your box, we are a guest, and should be willing to act accordingly.

James Sparenberg
Director New Product Development
Open Country Inc.

Re:-1, Redundant

[Allnighterking]

ummmm did you install netscape for linux? yep spyware everytime you use that little search button .... poof it notifies Netscape.

Re:There is a "signed installation" system out the

[Dynedain]

Yes, I know that WHQL is for hardware drivers. I was using it as an example of the type of system he wanted. Yes I know most stuff doesn't get WHQL certified, and thats mostly because developers dont want to take the extra time and effort to guarrantee that their components don't interfere w/ anyone else's.

Point is, WHQL works when people actually comply with it. If a software standard like it was implemented, it wouldn't solve the problem, because no one would take the extra time for the development. Or, they would do it for their first release, but not subsequent upgrades and patches (NVIDIA's detonator XP drivers?)

As much as I might feel that governmental regulation and litigation is the only way to enforce anything these days, it depresses me because of the precedent it sets, and because it seems our entire society is transforming from the original "American Dream" of working hard to get a better job, house, etc. to a new "American Dream" of sue and litigate if something goes wrong. Its a symptom of work ethic falling by the wayside to greed and laziness.

Oh, alright, here's a better analogy.

[Erris]

I'll reply to a troll replying to a troll. I'm not sure why, but something you said sounded funny. You said:

But what if your neighbor borrows your car when you're not using it? Assume, for sake of argument, that your neighbor only borrows your car when you wouldn't be using it, returns it whenever you ask for it, doesn't use any gas or other tangible good, and doesn't induce wear and tear on the car. You can still turn around and sell it at any time, with zero interference. In that case, you wouldn't be deprived of any property. The fact that your neighbor is borrowing your car has absolutely no impact on you.

That's a stupid analogy on its face, but it's a pretty good one for considering the case of a software vendor "stealing" clock cycles from your computer. No matter what's going on under the hood, you're not being directly deprived of any property. Your computer isn't magically worth less because it's running somebody else's code.

No!!! Try this one:

The other day, while I was at work a plumber visited my house to fix some pipes. While he was there, he borrowed my wife and gave her incurable sexual diseases....

I'd feel the same way if he fixed my computer by installing M$. Yes, it would be worth less because it does less for me. These companies that break your poor little Windows box so that they can send you adverts are really repulsive.

But I love them. Yes, I love the fact that all of these companies like Creative, M$ (by the EULA) and others treat their users like total crap. It shows everyone why they should be using FREE/A software. You trolls are great, you really are, thanks for taking the time to show how much you care.

Re:Oh, alright, here's a better analogy.

[foobar104]

The other day, while I was at work a plumber visited my house to fix some pipes. While he was there, he borrowed my wife and gave her incurable sexual diseases.... I'd feel the same way if he fixed my computer by installing M$.

This really isn't worth the trouble of a response, but here ya go anyway.

Your analogy of a plumber "borrowing" your wife is just silly, but I can't tell from your post whether you were kidding or what. That would obviously be a crime of assault, in this case sexual. That's totally different from everything we've been talking about, which is questions of property.

But to go with the second part of your analogy, installing software that interferes with your use of the computer (say it's buggy and it causes the computer to crash [even more] often) could be the crime of computer trespass.

In reading up on the McOwen case for another post, I read the Georgia Computer Systems Protection Act. Since I happen to have it open in another window:

"Any person who uses a computer or computer network with knowledge that such use is without authority and with the intention of:

(1) Deleting or in any way removing, either temporarily or permanently, any computer program or data from a computer or computer network;

(2) Obstructing, interrupting, or in any way interfering with the use of a computer program or data; or

(3) Altering, damaging, or in any way causing the malfunction of a computer, computer network, or computer program, regardless of how long the alteration, damage, or malfunction persists

shall be guilty of the crime of computer trespass."

So if somebody, Foo Inc., installs buggy third-party software alongside their application, and that buggy third-party software causes your computer to crash, then (if you lived in Georgia) you could make the case that Foo Inc. is guilty of computer trespass.

But there are two reasons why that wouldn't hold up. The standard, as spelled out in the statute, is that the person or party accused must have (1) used the computer without authorization, and (2) intended to interfere with your use of the computer, and/or cause the computer to malfunction.

For the first part, you authorized Foo Inc. to install software on your computer when you ran the installer. While it's true that the installer also installed third-party software, the party actually doing the installing is Foo Inc., and therefore they're the only ones that needed authorization.

But more important is the second part: they have to have intended to make your computer malfunction, or to interfere with your use of the computer. In other words, for Foo Inc. to be guilty of computer trespass, they had to have been acting maliciously. Of course, that's not the case.

So sorry. They aren't guilty of a crime. (At least, admittedly, in Georgia. But other computer crime statutes are similarly structured.)

Nagware

[Technician]

I thought removing Macromedia software would make the anoying problem go away.. Wrong. After removing Macromedia software, viewing the news on every about 5th page of Yahoo provides a popup Microsoft security warning.. Do you want to install macromedia 5 and do you want to trust content from this site? Funny they don't include a don't ask me again check box. I doubt it was a simple oversight. It looks like I have another box is scheduled to get Linux! I wonder if Netscape for windows has any improvement in this department? It isn't taking long to convince me I need to replace the software that came with my nice shiny new machine.

Re:Nagware

[satanami69]

That autoinstall feauture for IE is was made me switch to Mozilla. The only reason I don't use Netscape is because I cannot change the font size by holding down CTRL and scrolling the mouse wheel. That's it. I browse at 120% in Mozilla and Larger in IE. I like IE better, but I'm on Yahoo for almost everything AND I can't stand Macromedia.

I guess this also can apply to the article. Who has the right to ask me if I want to install their software everytime I visit a page. I can tell is to trust the software and install it by default, but I cannot tell it to suck off and never bug me again.

Re:Nagware

[Technician]

I hope someone from Microsoft reads this thread and gets a clue. Non-configurable = alternative software considered.

Every program isn't a nail

[Reziac]

And use the right installer for the job, too, not just the one that's handy or that you've already bought and paid for.

Many a time I've gone to install some state of the art program -- only to find it uses an antiquated version of InstallShield. Even some relatively modern 32bit WinApps are still using the old 16bit InstallShield, which doesn't quite grok long directory names and tends to create uninstall logs that are invalid under Win32, and occasionally gets confused by >2gb partitions.

I know InstallShield isn't cheap, but you wouldn't use TurboC v3.0 to compile a 32bit program -- so why should you use an installer that's not up to the job either?

Side note: I recently installed Corel WordPerfect 2002. The installer not only let me control every component it installed, it also logged =every= change it made (so at worst, if an uninstall failed I could manually undo everything it did). And it installed only about a dozen files into \windows\system, and version-checked every one first.

Cache is expensive.

[himi]

/Really/ expensive - it's almost invariably SRAM, which requires 6 transistors per cell, as opposed to DRAM's 1 transistor and one capacitor. That adds up to /way/ more cost.

Putting 256kB to 512kB of cache on a modern x86 core seems to be the sweet spot, price wise - more cache makes a difference to a smaller and smaller subset of programs, and costs more and more, so it just isn't worth it.

Minimising the memory footprint of your code is /extremely/ important.

himi

Re:Cache is expensive.

[foobar104]

more cache makes a difference to a smaller and smaller subset of programs

Question: what impact would (say) 8 MB of unified secondary cache have on a system running (say) 60 or so processes concurrently? (Not literally concurrently, of course, but scheduled in slices.)

While optimizing your code for cache friendliness helps, all the world is not a batch-scheduled supercomputer. If your main loop fits in cache, that's great... until the OS preempts your program and replaces all of its neatly organized cache lines with a bunch of stuff from the MP3 player that's running in the background.

I don't know enough about processor and cache internals, but it seems to me that overall system performance could be dramatically improved if the number of cache misses due to context switches were reduced.

Besides, the "cache is expensive" argument is just a matter of economies of scale. They said the same thing about RAM, and it was true until we started cranking out so much of the stuff that they're practically giving it away. I found a 64 MB stick in my cereal this morning.

Secure installation tool needed

[Animats]

What we need is a definition of "application" for Windows installation purposes. An "application" should be restricted to altering "/Program Files/", "/temp", and the related registry subtree. This should be enforced by a program which sets up the appropriate security environment before the installer runs. NT/XP have enough security machinery to do this. There's no reason to run application installs as "administrator".

Anything that needs more privileges than that is considered a "system modification", and should be identified as such. In a corporate environment, installing a system modification probably would require the approval of the IS department. But "applications" could be more freely installed.

Someone into Windows tools might write this. Corporate IS departments would like it.

Re:One more example of why...

[Kymermosst]

I never said I was perfectly safe, I am just as safe as the blind "./configure ; make ; make install" type. Unless you read every line of the source, and compile the same, you still subject yourself to the same problem as installing the binary.

You are right about frequent backups and trustworthy information.

With the vendors I listed that I find trustworthy, I think you'll note that I'm a bit more discriminating in what I consider "trusted" binaries than anything remotely near the likes of Napster. Big vendors like Red Hat or SuSE would burn to the ground if they included spyware.

Even Microsoft probably wouldn't do that without informing the user, because of the crap they've taken in the past over similar things (registration wizard, etc), which is why I trust their patches and updates.

The bottom line is, unless you inspected every line of source code for the software that runs on your computer, from the BIOS up to user-land programs off the Internet, you are vulnerable.

Your mention of Napster brings me to another point: Trusting stuff like that is bad news. My sister is into all the P2P trading crap (napster, morpheus, etc.), and her machine has nothing but problems. I've never installed any, and I don't think that my Windows machine has BSOD'd for months. There's definitely something to be said about being careful what you install.

On a side note, commercial software isn't safe, either. I found a copy of the Timesink ad/spyware on my fiancee's machine a few days ago. It was installed with a game she bought. We plan on asking for our money back.

P.S. It's nice to know someone else gets good Windows uptimes, too. Everyone accuses me of being a liar. I'm probably just lucky. After all, my Linux box is a K6-3 and haven't had any problems with that, either, even though others do.

Or perhaps they are all wrong :)

How about armed insurrection?

[crovira]

Just think, Next time your computer crashes, you take a rifle to the computer store or the software house.

I think we'll sick the lawyers on 'em instead, shall we?

Litigation's a pain in the membrane but its better than hacking off the limbs of the infidels.