Slashdot Mirror
Fair Software Installation
Fair Software Installation These days, we all download and install software from the Internet. And that software is rarely written entirely by one entity; rather, components are combined to create the programs we want. There is an increasing and disturbing trend to ship components that perform-system level tasks and have system-level effects. These effects are magnified because many of these components are installed without adequate notification to the user (either by omission, or deliberately).
The NEW.NET domain resolution component is a good example. This component is installed by a number of freely downloadable Windows programs on the Internet. Some of those programs notify the user that they are going to install the NEW.NET software; others do not.
Installation of NEW.NET alters the basic functionality of your system: It causes your system to behave in a manner that is inconsistent with international standards. That this is done in a stealthy manner is unacceptable. The fact that NEW.NET is unstable besides is another issue that we will deal with separately.
If I am installing a program that calculates speaker enclosure volumes, I shouldn't have to worry about it redefining my network stack and destabilizing my computer.
What does a reasonable software program or component do? It should perform its defined, published task. It should not consume excessive resources. It should have a defined starting point and defined ending point. If it is defined to be a service, it should publish that fact and indicate the starting mechanism it uses.
Let me draw upon the realm of commercial software for an example of a program that is an offender. Creative's PlayCenter 2 application is used to move music to and from Creative Nomad MP3 players. It can also play media. When you run the PlayCenter application, you get the functionality you expect. When you start examining your system files afterwards, though, the picture changes.
PlayCenter installs a service, a disk detection system, and a news collection daemon. It does not attempt to inform the user that these daemon-level processes are being put in place. It does not offer the option to make them manually-startable. Worse, the news collection daemon would actually chew up all your CPU idle time.
I think creators of software have some basic obligations:
- Inform users when drivers, services, or daemons are being installed.
- Allow users to omit any of the above that are not strictly necessary for program operation.
- Ensure that during uninstallation, system-level components are accurately removed, "leaving no trace."
- System-level and daemon components must be subject to a higher level of quality control. It is possible that some level of legal liability should be present for the corruption of the system.
- Transmit no information from a component to any party unless specification notification to the user has taken place, and is renewed on a periodic basis.
- Collect no information on a user without prior agreement, and a renewal of that agreement on a periodic basis.
The little war I mentioned earlier is going to get nastier soon. Uninvited components like Cydoor and NEW.NET are sure to take steps to defeat Ad-Aware and programs like it. If I wrote a stealth component today, I would have it seek out an Ad-Aware signature file and modify it to ignore me, or add my directory to the ignore lists. Ad-Aware could respond by digitally signing the files, or with other techniques. This cycle will escalate, with each side taking new steps to ensure its dominance. Users will pay the price in decreasing system stability.
I am hard-pressed to see the difference between NEW.NET and the Sub7 trojan horse. Both subvert a computer for the purposes of others; both do it in stealth. The good folks at NEW.NET will surely disagree; they'll say that those applications that install their software inform the user, and as such, it really isn't their responsibility.
I say it is. NEW.NET makes active use of the component on your computer; I think that they cannot duck their responsibility for its behavior. They are a not passive participants; they are not a library component being used by others.
I've been beating up on NEW.NET quite a bit in this article. I suppose it's because the deinstallation of their component trashed the IP stack on my Windows 2000 system and it took me a half day to put it back together again. What the hell were they thinking when they stuffed a buggy service deep into my IP stack without telling me? I think they should have to compensate me in some way. A $250 Small claims court action here in Virginia might be a way to do it.
The bottom line is, where does it end? Software installation programs should install components that the user expects. Full disclosure should be the order of the day. There will always be violators, though. There are a couple of remedies which could help:
- A legal framework for "allowable" system modifications during installation can be created. By adhering to the requirements of disclosure and stability, manufacturers can avoid liability. The thread of liability may be required (although capped) to enforce conformance and responsibility.
- A technical framework in the operating system can establish and protect secure boundaries around the system's core. Certain operating systems already do this (Unix), but the most widespread consumer OS does not.
- A "signed installation" program, run by known entities, asserting that a given program and its installation don't violate the rules.
Just think -- what if NEW.NET decided to start redirecting www.bestbuy.com to www.circuitcity.com? Is there a law somewhere or a technical remedy for this situation? I think there should be.
Slashdot welcomes reader-submitted features; use the story submission page if you'd like to submit yours.
In most cases they're gracious enough to let you keep doing things with it, but make no mistake about it.
It comes down to a question of how much you trust the person/company who wrote the software.
The thing about things we don't know is we often don't know we don't know them.
This is one area where open source software can really pull ahead of Microsoft. Provide excellent documentation of the software and the coding as well. That's all folks. As shoddy as Microsoft's image is regarding security, they won't be able to have it both ways. Not to pick on them, as there are plenty of other targets (AOL being another), but they do have a poor track record in this arena.
The most direct benefit of this initiative is well-written code. Well-written code that undergoes peer review from impartial others is the best thing we can do to further this industry.
First the software gives you a custom install option. Second it took me all of 5 seconds to turn off disk detector. Third how many average computer users will know what to do when reading a screen that tells them it has to install something. A while back Kodak thought 9 clicks to install it's software was too confusing for the average user. What about this?
And what is this new.net thing?
I was with the author all the way up until the point that he mentioned a legal framework for enforcement.
While all of those objectives are admirable, at the mention of involving governmental organizations in the enforcement of such standards I begin to get nervous. We live in a litigous society in the US as it is. Do we really want to enable a new class of lawsuits based upon violation of software installation standards.
Sure, publish some guidelines and get corporations to sign up agreeing to adhere. I'm just not sure I need or want legal protection to enforce it.
I certainly don't want to have my installation routines prescreened by the legal department before I can ship my code. Sheesh.
It seems to me that "scumware" is starting to take on proportions very similar to "wormware"; as the author notes, there seems to be little difference between the subseven trojan and the new.net software (or, I might note, whatever that horrible program was which made yellow links pop up everywhere).
Since anti-virus software doesn't seem to scan for these, perhaps someone should create a product which operates similar to antivirus software but instead scans for a dictionary of scumware?
Tarsnap: Online backups for the truly paranoid
The other day I discovered that I couldn't burn CDs at 10x any more. In fact, I had to slow down to 2x in order for it to work.
This led me on a chase through my computer. Through a combination of Ad-Aware, Startup Cop, and Process Explorer I managed to get rid of a bunch of leftover or not wanted CRAP that was hogging up my system!
Quicken, for example, had two programs that started up every time my system started. There was a Lexmark printer application running, even though I no longer have the printer and had uninstalled the driver!
And don't even get me started on Real One...
What a pain in the ass...
I've long maintained that I do not think that information is property, and I therefore can't agree with things like Intellectual Property laws.
:)
This post raises some interesting thoughts: are my computer's CPU cycles and my system's stability my "property"? Do companies have a right to infringe on those things? Do I have a right to sue if other companies infringe on those things without my explicit permission?
Don't mod me up; I just want to see the discussion that ensues.
I don't make the rules. I just make fun of them.
When you install something for FREE from the internet, you can't assume it will work as you want it to. Also, just because it works on your machine does't mean it works on everyone elses. this is pretty redundant IMO.
NEW.NET is only a component. You could also find NEW.NET in commerical software that you pay for.
In that case you've PAYED for something. Do you still assume is will work as you want it to?
What a day to be without moderation points...
--
I'm out of my mind right now, but feel free to leave a message.....
RIAA and MPAA have made huge strides to protect thier copyrights. But the same companies would see no problem with this type of deception. We really want the government to say away from regulating the computer industry, but untill they do this BS will continue to get worse. The average AOL user has no idea and are building a army of zombie DOS machines and now an army of zombie marketing harvesters....
Str8Dog
using System.Darkside; public
I installed Kazaa the other day at home, knowing it would attempt to install the BDE3 (I think) viewer. Since my hard drive is NTFS, I created the BDE directory under my second account, and used NTFS permissions to be only readable/writable by the "Administrator" account. I thought that would stop it from installing. I was wrong, however. The program simply installed inside of a different directory.
It doesn't run because I did the same thing to that directory, but it still installed when I took fairly advanced measures to prevent it. The fact that programmers are writing applications that users have no control over is a step in the wrong direction. I don't want the "3D Advertising Projector" on my system, yet it installed anyway. That to me sounds like something Norton should be protecting from...
I do write simple programs for personal use for myself. I have given a few to friends, but I never install a "Jeremy in 3D" viewer or anything like that. Note to programmers: If it is ABSOLUTELY ESSENTIAL to the operation of the program, go ahead and force installation, but tell the user what it is and why you need it. If it is not essential, simply put a check box to not install it. Or at least instructions on how to safely remove it.
I understand that Kazaa is trying to make some money by forcing ads, but when people won't even install their software because of the ads, they are shooting themselves in the foot. If they used simple HTML banners, I probably wouldn't go to the trouble to block them.
Another thing that annoys me greatly is the Real Player (whatever they are calling this version) notification program. It pops up ads and new version notifications near the systray. There is not an option ANYWHERE I can find to disable that function. They used to have the real icon in the tray that you could close. And they had an option to keep it from loading. How much of my system resources is it taking to check in the background for new updates/ads? There are a few things I need real for (unfortunately) or I would uninstall it and be done with it. If I try to play a stream that won't play with the version I have, I will upgrade on my own. I don't need a resource hog app telling me when to upgrade.
Funny; I grabbed all of my application software, from StarOffice to Opera, for free, off of the Internet, and it seems to work just fine. So do the numerous other, smaller applications, like 'mutt' and 'ssh' -- they haven't trashed my computer, either, and they were free.
I think what the author is trying to get across is that the user needs to be informed; and while this is taken for granted in the free software world, it seems to be largely absent nowadays in the world of commercial software.
When a Debian package is going to make changes to a configuration file, it asks me first (unless I tell it not to); when most Windows-based installers decide that it's time to replace the IP stack with a Jell-O recipe, it just goes ahead without informing the end user of squat. While Microsoft has made this easier, it's not totally their fault (for once); and it's something that applications developers need to keep in mind.
--
I Hit the Karma Cap, and All I Got Was This Lousy
NEW.NET supplies a new series of top level domains. They aren't doing this with anybody's authorization; they have simply shipped a trojan with a ton of popular free software packages that alters your IP stack to point to their TLDs. If you go to new.net and click on "enable", a Java applet will install this stack-altering crap on your system, after you foolishly allow it to do so. But, really, they install with a lot of different "free" packages.
new.net is a company who decided that instead of waiting for the new top level domains to be approved, they'd just start up their own root domain servers and sell the new top level domains themselves.
So if you want to buy sweat.shop, you can go to new.net and do just that.
The software in question is a "plugin" that "fixes" windows to use their dns servers when requesting a domain that ends in ".shop" or whatever.
For more info, don't be so lazy and click on the "About Us" button at the bottom of the new.net homepage
http://www.new.net/about_us_mission.tp
I submitted a story about this on slashdot long ago and, surprise! it was rejected. I'm sure I wasn't the only one who thought this site and company is worth discussing.
-- Punch the Monkey!
I'll have something intelligent to add one of these days...
daemons? what are those. I don't think they exist on windows. (;-)
On windows, they are "services". They give you exciting service. Way better than those unix daemons. They only talk to you in your head and tell you to burn things. Or at least, that's what they do to me. Maybe I'll post an "Ask Slashdot" to get further insight. Oh, maybe not, the voice in my head says that it will get rejected.
room101 -- how much can you stand before they break you?
(they always break you eventually)
First, EULAs have not been upheld by the courts. Especially when they "shock the sensibilities." That's why UCITA is trying to write enforceability into law.
Second, the EULA you saw focused on the main application being downloaded. It is unlikely that this EULA will discuss embedded applications with any depth, at most you might see a paragraph making vague references to third-party applications.
Third, one of the cornerstones of contracts is that it's an conscious, INFORMED agreement between multiple parties. One or more parties may decide to remain ignorant, but once one party begins to deliberately withhold pertinent information that another party wants it's a whole new ballgame. As the author points out, there is absolutely no reasonable way anyone could ever expect an application that computes the size of a speaker enclosure cause a critical part of the OS's network stack to be changed.
Finally, I think this situation is so outrageous that it's getting close to gross negligence, not just negligence. You can contractually limit your exposure due to negligence (you made an honest mistake), but you can't contractually limit your exposure due to gross negligence (you knew there was a problem, you know your inactions would cause harm to others, but you didn't give a damn).
A better analogy is that you bought a hot dog. Okay, this is a little iffy, but most people understand that some cheap hotdogs have filler and they'll pay more for a "100% beef" hotdog. But now you learn that you're now sterile because the hot dog producer has been dumping dangerous chemicals in the brew, but hey you agreed to this risk when you bought those cheap 'dogs.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
But this won't work, of course. Our favorite example is Microsoft, who blithely says, "It's all required; it's all part of the OS; either take the package or don't." Making choices confuses people, see, and we want to avoid that.
Without being elitist at all, some of what they say is true. One reason Microsoft has succeeded is that they remove those scary choices from the users. It's the software equivalent of "bread and circuses" - don't bother people with the details, wow them with flash, and they'll mostly ignore what goes on in the background.
This succeeds because it's what people want. My 72-year-old mother doesn't know about patches and updates and service packs, and for fuck's sake she shouldn't have to. For good or ill, most people view computers as slightly cantankerous, very expensive toasters. They have no idea that they have, sitting on their desks, a little machine that can do very nearly anything. They want to do a couple things, and they want those things to be easy.
I can see a couple ways for this to go:
- Special-purpose machines. Instead of one computer, you'll have a few little ones. A web pad in the kitchen that downloads recipies, a glorified word-processor in the study hooked up to a printer, maybe with accounting software. Most people will go to Office Depot and spend a few $hundred on a black box, kind of like a cell phone now days, then throw it away when a newer model appears. Microsoft is set to own this market.
- General-purpose machines. Geeks will still want a real, live computer that they can control. This is only going to get harder and harder. Twenty years from now, I bet there'll be fewer general-purpose computers than there were twenty years ago. The after-market parts business will dry up as copy-control gets more and more intrusive. I mean, I can build a box from a bunch of parts, but I can't build a fucking motherboard or hard drive.
Computers have to get easier to use while at the same time getting more complicated and doing more things. The only way to do this is to remove end-user control of the device. Fewer scary options, fewer things to screw up. For the most part this is a good thing. Most people using PCs today are basically helpless aside from a few well-known command sequences.The hard fight will be to retain control of real computers while consumer boxes get dumbed-down. What will make this possible (IMHO):
- No DRM. Period. This will kill general-purpose computing forever.
- More standardization. As the parts market shrinks and specialty boxes become more common, it'll be harder for ASUS (e.g.) to sell mobos into the after-market channel. There will be consolidation, but as long as #1 above is avoided it shouldn't be fatal.
- Concentration on software quality. The OSS community generally goes a better job of this than closed-source, but it will have to get better. Quality alons isn't enough; as we know, 500% better isn't better enough if you don't have good marketing.
This is a long, winding rant, and has gone a little off-topic. Back to the point: I don't think this situation will get better, or at least not in the way we hope. It's going to be incredibly difficult to hold software manufacturers liable for anything; it'll be even harder to hold them liable and let OSS off the hook.The best hope, I think, is operating system diversity, which at this point means forced licensing of the Windows source code. If you can use Microsoft Windows that basically bends over for any cute-looking virus or trojan, or (e.g.) IBM Windows that flat-out refuses to install anything that isn't digitally-signed and verified (assume, for the minute, non-DRM verified), what would you pick? What would your mom pick? What would you want your mom to pick?
This isn't as much "normalization" as it is "don't take so many drugs when you're designing tables."
Some choice quotes from http://www.new.net/about_us_guiding.tp:
.com, .net, .org, .co.uk, and other top-level domains." (I don't consider having to install special software just to get to a URL "reliable", but maybe I'm narrow-minded.)
"New.net will seek to work with ICANN to ensure stability in the Internet, and we will attempt to work in the best interests of all parties to not interfere with anything that ICANN plans to do." (Clearly, the author of this article would argue with the use of the word "stability".)
"New.net is building a more open registry business that also will enable other parties to introduce new domain name extensions to the millions of users that have access to New.net domain names. New.net will determine which extensions to release in the future, applying the standards set forth below." (You call that open?)
"We are building a DNS infrastructure that is at least as reliable as the root servers that serve
One of the thing that is impressive about applications that are written natively for OS X is the installation procedure: it usually involves a complex procedure called "copying". All hyperbole aside, it is that easy.
For instance, I installed MS Office on my laptop a while ago (still waiting on Sun & Apple to resolve their differences & build StarOffice for the Mac). The entire procedure was:
1. Insert Office CD
2. Drag-And-Drop a folder onto my hard drive
3. Start using it.
Installing applications from the Internet is even easier. I'm a happy registered user of OmniGraffle, a diagramming and graphical tool that makes other programs like it feel worthless. The installation process for that is:
1. Download the file, which unpacks as a disk image & it automatically mounted.
2. Drag & Drop the application.
3. Start using it.
Another nifty feature is that, to the high-level graphical interface, an application appears as a Bundle, and therefore it looks like a single executable file. To the regular user, this is a far more intuitive presentation of what an "Application" is. However, if you whip up a terminal & go poking around a bundle, you'll see that it's really a collection of every file the application needs to work.
Mark my words, the Winblows platform will be emulating this behavior within their usual UI 5 year lag.
--Mid
A while back, my neighbors switched from Earthlink to Adelphia cable. Trying to be a good netizen, I spoke with them about getting a firewall, and set up a time to install Zone Alarm on their machine.
When I went over, they made a side mention about all the stupid popup ads they were getting on Adelphia, how they hadn't gotten them on Earthlink, and Earthlink had promoted, 'No ads with us.' I responded that we didn't get any more than normal popups, on either Linux or Windows.
So we installed Zone Alarm, and started up the cable link, again. First thing we see is a program out of an Earthlink directory attempting to contact the nameserver. Press the 'No', and the popups were gone. Apparently some piece of Earthlink software got in a tiff because the nameserver belonged to another ISP, and decided we needed to be punished.
The living have better things to do than to continue hating the dead.
What the @##$% is new.net?
They are the new version of Alternic. Remember them? They set up their own root nameservers in order to sell their own top level domain names. In order to make it work, they had to persuade ISPs to use their root nameservers instead of the official ones.
New.net has apparently learned from the Alternic episode. No, they didn't learn the part about respecting the official DNS structure. They learned that getting all the ISPs to agree and cooperate is not very practical.
So instead of changing the DNS system from the top down (Alternic), they are trying to change it from the bottom up, starting with your Windows computer. In my opinion, this is just as sleazy, no! even more sleazy than the tricks USR pulled to get dialup customers to force the ISPs to buy overpriced X2 access servers.
A dingo ate my sig...
I think that just disabling the "startcenter" will get rid of most of your annoyances - if it isn't running all the time in the background, it can't pop up crap in your face all the time.
Your PC will also run faster.
Open up the preferences. I think it is a button on the "General" tab labeled startcenter. That opens up another dialog that allows you to disable it (top checkbox - uncheck it). It will pop up a message with a dire warning - just click Yes I really Want To Do This. That should be it.
All the startcenter is good for is preloading Real (so it starts up 3 seconds faster - big whoop) and poping up annoying messages.
Oh, come now. Let us draw an analogy or two:
You're at the supermarket. At one of the tables set up along the aisle, an employee offers a free piece of candy, which you accept. The center is filled with ipecac, and you vomit for the rest of the day.
You're at a concert. You accept a free nerf ball being given away by a radio station. It turns out to contain a miniature microphone which transmits your conversations back to the station's marketing department.
In any other form of human endeavor, would "it's free, whaddaya expect?" justify this sort of deception?
When the software comes clearly labelled "THIS FREE DOWNLOAD WILL INSTALL 2 PIECES OF SPYWARE, CAUSE ADVERTISING POP-UPS TO APPEAR ON YOUR DESKTOP, AND MAY REPLACE AND/OR DAMAGE INTEGRAL COMPONENTS OF YOUR OPERATING SYSTEM," then I'll agree that the person who installs it gets what he deserves. Until then, I say s/he's being damaged by intentional deceit.
Ok, how many people here choose the standard installation options and how many ALWAYS choose Custom just so they know what's being put in their system?
The programs that I've seen install that New.NET and SaveNow crap have always had them as customizable installation options. You just had to click a button and read the contents of one more screen during the install.
The software that crap comes with is free anyways. So what's the problem? Are you going to write your own software or take a trip to the store to pay for software (assuming it's retail) just so you can save yourself 10 seconds off your install time?
Why don't you go talk to Fritz Hollings and maybe he can work that fine idea into some worthwhile legislation for you. Or better yet go talk to gates about only installing software that the author has spent thousand of dollars having verified by windows quality labs.
RPMs are not nearly as bad. You can always do rpm -qp -l name.arch.rpm to find out what exactly it plans on installing, substitute the following for -l to do other stuff:
--info to see information
--scripts list config scripts that may run
--triggers list trigger scripts that may run
You have the option to extract scripts and check them yourself. You can also see the services and deps that the package provide, etc. All without installing it.
I know, you never install binaries, and of course, a binary may have something in there that shouldn't be there.
But then again, I imagine you rarely, if ever, read 100% of the source code you just compiled and installed, read the makefile, or keep track of where exactly it put things. You probably just trust it because you have the source, not because you READ the source.
Then again, I might be wrong, and you do.
Personally, I install binary RPMs from trusted sites. (Red Hat, SuSE, KDE, a couple others), and from source tarballs when I think there might be a trust issue.
A good, reputable, signed RPM is a good way to determine trust.
"Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
Windows users will not only tolerate, but pay for all of that. And they'll pay for it, as Microsoft well knows, because it's applications that sell Windows. So they'll ensure that application developers can fully commandeer your machine if they want to, because that's what application developers say they need to make the users happy.
Who would ever have imagined that such privileges can be misused and abused?
Now stop whining to the government to protect you from yourself and start making some forward-thinking decisions about the software you use and support.
Yeah, I guess I could create a new user in Linux with just the permissions I want to give it for every program on my computer, then run the program with the appropriate user.
Or, you could write an installer application that you run to manage all other installations. Have this app create a new user for each program as it's installed, with these users members of the "installer" group. That way nothing you install later could overwrite anything else you installed.
If there's an insoluble technical reason why this wouldn't work, I'm sure someone will tell me. Problems I see:
I'm sure there are other problems, but at first glance I like the idea.
Nope, no sig
New.net is "bundled" with other software, most notably "imesh" (file-sharing).
I work at an ISP, and we see a fair share of problems from this Trojan Horse.
You're correct -- no one forces anyone to put new.net on their machines. But the most frequent scenario I encounter is the patriarch of the family calling about the "family system." When Add/Remove programs reveals the presence of IMesh and New.net, invariably the statement is, "I guess one of the kids..."
This is legally very precarious ground. Kids are not old enough to make contract agreements, so unless there is some sort of age-check performed, these Trojans are coming in a backdoor with no legal agreement involved.
This is especially dangerous where no "opt-out" is offered. DivX Nteworks is currently offering an "ad-sponsored" version of their new codec, DivX 5.0 (otherwise a nice piece of software) -- we are already getting calls about "where are all these pop-ups coming from?"
I installed the DivX package and guess what?
1. There is no choice in installing it, if you want this package, you must install the advertising software.
2. It doesn't just deliver ads. It provides detailed information about your net activities to a server that then decides what ads to deliver to your system.
3. Uninstalling DivX does not remove the service that it adds to an XP machine. DivX Networks claims in its forums that it uninstalls with their software, but no user has yet agreed with them on this point.
So, when "Junior" installs DivX on the family PC, the entire family gets spied upon, with no one of legal age having consented.
This is a lawsuit waiting to happen. DivX Networks in particular stand to lose a great deal in terms of community resect/user trust, if not in cash.
National CyberCrime Prevention Foundation
I'm an installation speciliast. That is, I write installers for many different platforms. One of my biggest complaints about software is installers written by amatures. Typically, the manager tosses a copy of InstallShield at the junior programmer and says, "why don't you deal with this when you have a moment". This is usually said a few days before the release date. The result is a mediocre installer that runs ok most of the time, but often the installer will have a basic flaw, such as replacing important system files with an old version.
On Linux/Unix platforms, it's even worse. The installer is almost always a horrid shell script that has been hacked on by a dozen different people over several years. No one really knows what that script is actually doing. The script works great, so long as you are running RH 7.1, because that's the distro the programmer uses.
As for standards, they do exist on Windoze platforms and people familiar with writing installers deal with them. In the Linux/Unix world, it's a free for all. There are some general standards, but all too often they are ignored.
When it comes to "stealth" installing, I wouldn't do it. If the component isn't necessary to run, then it is an option with a checkbox. If it's pretty good idea to install it, it will be checked by default. If it's just eye candy, it will be unchecked. If the primary software won't run without it, it will not be an optional component.
In summary, hire the right person for the right job. Stick to standards where they exist, fight for reasonable standards where they don't. Never forceably install unecessary components. Most important, don't ever change basic system functionality.
-- Will program for bandwidth
I just removed Macromedia software from my system. Most of the content it runs is ads. Unfortunately they defaulted it to autoplay. Play could not be shut off while it was loading content. Many ads would end in some kind of animated GIF that still ran even with play and loop unchecked. It would only stop after unchecking loop, play and rewinding the annimation. Too bad they tried to satsify the content providers (advertisers) instead of the end users. All it would have needed was a configuration that a user could set up to not run flash automaticaly. A simple play button on a annimation would have been nice. It was the lack of configuration options that convinced me to remove Macromedia completely.
The truth shall set you free!
Microsoft outlines policies for "well behaved" installations in Windows Logo Policies - Overview for Software.
This is similar (but not exactly like) to WHQL certification for hardware.
Download.com has introduced a nice little disclaimer that they attach to programs which, while a lot more wordy and circumspect, basically says "this program contains spyware". It makes it way quicker to decide which program to try than scrolling through all the user feedback to see if anyone has posted a warning.
Bite the hand.
Yes, despite every warning I've heard, there was a .ram format video that I really wanted to watch, and so I thought it would be okay to install RealPlayer just briefly. And now, I am living a nightmare.
My Windows 98 box, which was none too stable to begin with, is having serious problems with blue screen crashes and registry errors. RealPlayer auto-loads things on startup, most notably a scheduler that goes out and checks for updates once a week with no way to turn it off. It's taken over dozens of file types, even ones that it apparently doesn't handle. And -- most annoying of all -- it has no Uninstall option, which I would expect of any professional software. I think I've pulled all the auto-loading parts of this demonic software out of my startup scripts, but to really be rid of this evil thing I'm looking at a full reformatting of my hard drive.
No software package should ever put a system in that kind of state.
Genocide Man -- Life is funny. Death is funnier. Mass murder can be hilarious.
If you are going to use Windows software from untrusted (i.e. most everyone, especially M$) sources you must take steps to protect yourself. First, trust your gut. Does the developer "smell funny"? Is the software from a startup company with no visible means of revenue? I tend to trust programs created by individuals or small teams that demonstrate some passion for what they do (EAC, or LAME for example)
Then, get Technological on their ass. Start with a personal firewall that monitors all outgoing traffic. Zone Alarm is the one I trust - gut feelings, and I've read some negative things about Black ICE. Amaze and astound your friends as you block requests from RealPlayer, Windows Update, and other "legitimate" programs that like to access the net without asking permission.
Then get Ad Aware and get that sinking feeling as you see the total number of unauthorized programs, components, and services on your system.
Finally, install Proxomitron to make make your browser behave a bit more politely by re-writing the html it sees before it sees it (and find yet another reason to love Shonen Knife. They're way kawaii!)
Forewarned and fore-armed (hairy ones, even), you stand a much better chance of maintaining control of your system.
ceci n'est pas un 'sig'
This is prob redunant and mark it as such ...
But go install Quicktime, Real Audio and Microsofts Media player and then see the war that breaks out on your box.
-- Knowing too much can get you killed, but knowing who knows too much can make you rich.
Anyone who's administered Windows machines knows that Windows programs, in their never-ending quest for convenience, routinely install taskbar "daemons". I find that you can gauge the naivete of a user as directly proportional to the number of small icons next to the clock.
The point is that Windows application writers are so used to running a resident process in support of their dinky programs that it seems to me to be too late to change the practice. Of course, some programs are more intrusive than othes (Real Player, anyone?), but it seems like the developers of just about every dinky little app seem to think they won't be taken seriously unless their program loads SOMETHING at bootup.
Of course, I shouldn't complain. I make good money doing PC consulting work; a good percentage of my calls are people whose machine is so clogged with TSRs that it has become unusable.
When you don't compile everything from source yourself. Down with binaries!
Oh wait, does compiling and reading code actually take work?
This has nothing to do with holes in APIs; this has to do with third-party software installing extra crap without notifying the user. A Debian package or an RPM could easily install spyware or make unwanted changes without notifying the user -- the reason that I've never seen a package that does is because free software developers tend to have more respect for their users; it's more of a peer relationship than an adversarial one.
--
I Hit the Karma Cap, and All I Got Was This Lousy
First off let me provide some background information regarding our software.
Below is the list of all of our present and past distribution partners (download partners have always been clearly listed on the New.net website):
Present Partners:
BearShare
KaZaA
iMesh
Past Partners:
Go!Zilla
Babylon
Cydoor
GDivx
WebShots
Each one of our current and previous distribution partners is required to provide disclosure during installation that our software is bundled. We in no way install in a "stealthy manner", since it is the responsibility of the user to read the install screens that are provided during an installation.
In light of these recent comments regarding disclosure, we are working with each of our distribution partners to improve awareness of the New.net bundle in the install process.
New.net's software provides a service to its customers as well as its users that want to gain access to domain extensions that our sold on our site. In order to provide resolution, our software adds itself to the TCP/IP stack. There are other methods to resolving our domain extensions such as adding "new.net" to the domain suffix search order or adding our DNS servers in the DNS server search order in the network configurations. You may also append ".new.net" to the domain extension in the address bar of the browser for resolution. Our software is our "user friendly" way of providing such access. Manually changing network configurations requires a reboot whereas our software can install in seconds and provide resolution immediately.
Our software is not "unstable" in anyway unless a user tampers with the configuration to a point where it makes Windows unstable. This is consistent with any other software that adds itself to the TCP/IP stack. If someone were to just randomly start deleting files on their system that are referenced in the TCP/IP stack, without first checking to see if there is an uninstall in Add/Remove Programs, then of course you would expect nothing less than an unstable or corrupt system with network issues.
"The little war I mentioned earlier is going to get nastier soon. Uninvited components like Cydoor and NEW.NET are sure to take steps to defeat Ad-Aware and programs like it. If I wrote a stealth component today, I would have it seek out an Ad-Aware signature file and modify it to ignore me, or add my directory to the ignore lists. Ad-Aware could respond by digitally signing the files, or with other techniques. This cycle will escalate, with each side taking new steps to ensure its dominance. Users will pay the price in decreasing system stability."
Let's be clear on this point: New.net does not create or distribute any kind of stealth software in order to avoid signature files for Ad-Aware. In fact, Lavasoft had determined that our software is not "spyware" and discontinued removing our software since August 2001. I welcome anyone to contact Lavasoft directly for further information. There are still mirror sites out there that list New.net as a component that is removed by Ad-Aware; but I assure you that these sites reflect information prior to August 2001.
"I've been beating up on NEW.NET quite a bit in this article. I suppose it's because the deinstallation of their component trashed the IP stack on my Windows 2000 system and it took me a half day to put it back together again. What the hell were they thinking when they stuffed a buggy service deep into my IP stack without telling me? I think they should have to compensate me in some way. A $250 Small claims court action here in Virginia might be a way to do it."
The New.net client is clearly listed in Add/Remove Programs like the majority of all other software and when the correct procedure is used then the software is properly uninstalled. If someone decides to remove software "their way" as opposed to the correct way then you can assuredly expect problems. Please explain your procedures of "deinstallation" that lead to a "trashed IP stack," this may be useful to the New.net QA team.
Leonard Amabile
Director of Customer Support
New.net, Inc.