Slashdot Mirror
Distributed Computing Program Hidden in Kazaa
The_THOMAS writes: "A federal securities filing Monday revealed that the hugely downloaded Kazaa P2P (file sharing) software contains a piggyback program which will create a second, new, network controlled by Brilliant Digital. They plan to awaken the software, already on millions of computers, within the next four weeks. The program will be used to host and distribute other companies' content and may be used for distributed computing. Read the details here."
Which is better...something that reports back your habits, or something that uses spare cycle time for something constructive?
Joe
P2P = good
Distributed computing = good
p2p + distributed computing = bad.
This reminds me of something my dad once told me regarding his school lunch as a boy. Just because kids like spaghetti, and kids like peanut butter, doesn't mean they'll like spaghetti and peanut butter.
Unfortunately, the clause to allow kazaa to use your CPU cycles has been around since the day morpheus came out..
Time to switch to giFT!
While ignorance is no excuse, that seems the only one given that Kazaa/Brilliant apparently tip users off to this crazy strategem in the user agreement. That said, I can't understand how this isn't a trojan -- installing an app with no explicit warning on a third-party computer? Shame, shame.
If a trojan program is useful, does that make it any less of a trojan? Where do you draw the line? To my mind, people have downloaded a program, expecting it to do one thing, and really it has a payload that con do something completely different... Makes me wonder what else the makers of this 'brilliant' scheme aren't telling us about it :-)
I am artificially intelligent.
According to their licensing agreement, they're allowed to use any extra storage space and/or cpu usage. What happens if you run out of space on your HD because of this and delete their files? Could they have the right to say that you aren't allowed to delete these files because it's their intellectual property?
At the very least, they should let you have a large discount on downloads when you opt-in. For example make them free. Plus a credit based on the bandwidth they steal *cough* use.
Sneaking software onto peoples computers to create a good relationship with users ? ... or did they mean a good relationship with b3d's clients?
Religion is a gateway psychosis. -- Dave Foley
Once the client starts receiving and transmitting data it shouldn't be hard to get a rough idea of what's being transmitted and then we can start sending duff data to their servers.
It doesn't matter whether we know what the data is or not, it just going to be a binary chunk with probably a checksum somewhere. Fill their servers with random data and see how long they want to continue using our resources
0xB
I find it very sad, that companies will trick the user into installing the software without the knowledge. I mean, how many users would mind a spare cycle burner to help the service they like. I mean if they included the abviosly visible message (not hidden inside license agreements) saying something like "We are providing this service free of cost to you, but in return, this service will install software that will use your computer while it is not being actively used by you, and only while kazaa is running. Unfortunately, if you do not wish to run this program you will not be able to run kazaa as our finances depend on it. We promise that no information about you or your files will be used." If such a message came from a company with not a bad reputation (winamp comes to mind), i would install the program, as would many other users, adn both parties gain. When it is done in secret, it only damages the company rep, thus making it even harder for them to make money..
Furthermore, it seems that the wasted cpu tiem is becoming a precious commodity, which I am currently donating to seti, with no financial compension (in other words I am not selling the cpu time). I wonder how long till the government will accept donated cpu time as a real donation, so i can put it on my tax return....hmmm, i am thinking about at least a dollar per unit, and i am now at 780 units, that makes it 780$ deducted from taxes, and if it is a dollar per hour....
that could be a hefty some for stuff donated to a good cause....
maybe someone at seti would give me a receipt...hey, that would mean more people doing units for them...could be beneficial to both sides...
badness 10000
Given that the supposed quote from the Terms of Service given in the page doesn't actually appear in the Terms of Use listed on the KaZaA site, it's probably safe to assume it's a joke.
It's legit, irritatingly enough.
/system32 folders (if you're running Windoze)
The program hides itself in different locations all over your hard drive, including copies of itself in your OS root and
It's a bitch and a half to purge. There's no unistaller, and it's got dozens of registry entries to manually erase.
(Search for 'bde' and 'b3d' on your HD and your registry to make sure you get it all.)
I can only imagine the looks on people's faces when a gigantic 3D Cameron Diaz appears on people's computer screens and commandeers their system.
if he ate spinach, he'd be called spinach danson.
http://rockout.org
Unless they are hiding behind some ultra-fineprint legalese, I would say this is theft. They are stealing your computer resources, electricity and time without your permission.
I have always been suspicious of KaZaA so I never downloaded it. I am stragely glad that my coursework keeps me more busy than I need to be so I don't spend my time infecting my machine with spyware file sharing apps. (Must leave now ... assignment is due tomorrow.)
I see great potential for fun here. Think about it, They rent out your hard drive to someone, who uses it host advertisment, or demoware or music. You, being the wiley Hacker guy, replace the content porno or pirated music/software and let the fun begin. Optionaly you can sue them for using your hardware and bandwidth for morally objectionable purposes.
Fascism should more properly be called corporatism, since it is the merger of state and corporate power - Benito Mussoli
Go to cnn.com and look up a stock quote on BDE, you'll find Brilliant Digital Entertainment. It might be a stupid name, but they are a public company.
If this software utilized any cycles on my system, it will impact performance causing me expense which will rapidly increase to the $5000 threshold (a cumulative threshold). I granted no access nor privilage to use my systems, to any employee of Brilliant Digital Entertainment Inc. [slashdot.org] so as soon as any command is issued, affecting the behavior of any software installed on my computers, the employees and officers of Brilliant Digital Entertainment will imediately have become guilty of computer crimes under the Computer Fraud and Abuse Act as modified by the USA Patriot act.
Thank god you are helping us all in our noble fight against terrorism.
Let's Roll.
You might have tried something like this already, but if not download or buy a package that monitors programs that try to access anything through TCP/IP and warns you when a program is trying to do something you haven't authorized over the network. Tiny Personal Firewall has worked out pretty well for me and is free for home use. It works in most cases, unless the application has a legit reason to use a particular port and also uses it for something you wouldn't expect. Adobe Photo Deluxe doesn't sound like it'd fit into that category, however...
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
"You know, Hobbes, some days even my lucky rocketship underpants don't help" -- Calvin
There's something tricky going on here that is not immediately apparent if all you do is look at and knee-jerk react to this story:
I download Kazaa. I download Kazaa because Napster doesn't work anymore. Napster doesn't work anymore because the music companies say it rips them off. I don't care about ripping off music companies. But that makes me think: I can see how I'm ripping off artists. Gawd I love Kazaa! But I feel bad about ripping off artists.
BDE through Kazaa wants to use my computer cycles? Well geez, I feel bad about getting all this great music for free... I owe somebody something... Oh alright, that's a fair exchange.
The power of guilt.
Mark my words, people will accept this barter, except for one small problem: the artists still aren't getting paid!
BDE is getting away with murder: benefiting off of artists by proxy, and benefiting off of consumers, through guilt.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
jeez, april fools day has turned all us slashdotters into a bunch of cranky, trust-no-one cynics.
oh wait..
You don't want to pay for your new NSync CD.
You don't even want to pay for the software that allows you to steal the new NSync CD.
Yet you complain that *somebody* in the chain is trying to make money? What socialist wet dream are you living in, anyhow?
No hoax here, folks:
From the Kazaa EULA, addendum section on BDE:
4(b) You hereby grant BDE the right to access and use the unused computing power and storage space on your computer/s and/or internet access or bandwidth for the aggregation of content and use in distributed computing. The user acknowledges and authorizes this use without the right of compensation. Notwithstanding the above, in the event usage of your computer is initiated by a party other than you, BDE will grant you the ability to deny access.
Interestingly as well:
5. Term; Termination.
(a) This Agreement will be effective as of the date you accept this Agreement and will remain effective until terminated by either party ("Use Period").
(b) BDE may terminate this Agreement at any time by providing notice to you. You may terminate this Agreement at any time by ceasing use of the Software and Services and destroying or removing from all hard drives, networks, and other storage media all copies of the Software. Upon any termination, all licenses and rights to use the Software and the Services shall terminate and you must remove the Software from your computer equipment and dispose of all originals and copies of the Software in your possession. The following Sections shall survive any termination of this Agreement: 2, 3, 4, 5, 6, 7, 8, 9 and 10.
So you can't terminate once you've accidentally clicked "OK". Although you sort of wonder how they're going to apply section 4 once you've "destroyed or removed from all hard drives, networks, and other storage media all copies of the Software."
-raph
So Brilliant Digital is providing me with a service, the Kazaa network, in return for another service, use of my computer's storage and spare CPU cycles... First of all, it's a great idea. But I wonder whether or not users of this service will be legally required to pay taxes on their barter income, and more importantly, whether Brilliant will have to mail out 10,000,000 1099-Bs (along with collecting 10,000,000 social security numbers).
Allow me to explain by example.
/* doSpyWare();
void main()
{
doDownloadFiles();
doUploadFiles();
doSpyWare();
doDistributedComputing();
}
becomes
void main()
{
doDownloadFiles();
doUploadFiles();
doDistributedComputing(); */
}
Sure, it takes a high-school CS student to figure out what to comment out, but once its re-compiled and distributed on KaZaa, the modified version will spread like wildfire.
If the license is truly open source, this wouldn't even be illegal (not that KaZaa users really worry about that anyways).
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
If you're using Kazaa, you did consent. Read the EULA sometime.
4. Upgrades and Access.
(a) You acknowledge that BDE may from time to time provide future programming fixes, updates and upgrades to you ("b3d Updates"), including automatic updates to KaZaA and other software bundled with KaZaA, through automatic electronic dissemination and other means. You consent to such automatic updates and agree that the terms and conditions of this Agreement will apply to all such b3d Updates.
(b) You hereby grant BDE the right to access and use the unused computing power and storage space on your computer/s and/or internet access or bandwidth for the aggregation of content and use in distributed computing. The user acknowledges and authorizes this use without the right of compensation. Notwithstanding the above, in the event usage of your computer is initiated by a party other than you, BDE will grant you the ability to deny access.
Of course, EULAs have yet to be stress-tested in our court system, but are *you* going to have the money to win the court case?
Erik
Under this plan, an ad that a person sees on a Web site might be hosted by a nearby computer running Brilliant's Altnet instead of on a central ad server, as now typically happens with DoubleClick.
Well, this seems pretty much to be the end of ad blocking through firewall rules... Pretty easy to see why doubleclick would like this scheme.
You'd basically never know what host would be spamming your browser...
*sigh*
Blearf. Blearf, I say.
Deserve to get screwed? Bullshit. EULAs are written by lawyers, for lawyers. Most people who run Kazaa wouldn't even understand that particular clause in the EULA if they'd even gotten to it with all the legalese in there.
Furthermore, contracts aren't legal if one or more of the parties did not fully understand the implications of the contract (read up on cases where people just signed on the X without reading the contract in full view of a notary public--in almost all cases the contract was declared null and void).
If EULAs are found to be legal contracts, this should apply, should it not?
Am I the only one who thinks these P2P apps are evil?
I used Grokster on my networked Win2K box at home. This box contains my personal files, such as financial info and I also use it to do online banking. So my privacy really matters. I also use this box for work and I have it streamlined and tweaked to run as efficiently as possible. No foolish system tray or startup apps etc...
Well it seems that P2P apps like Kazaa or Grokster work hard to breach my privacy and fudge my system. I've never known software to be so malicious. First, I see that Grokster has web-based ad support. Okay, that's tolerable, they need some form of revenue. But don't think I haven't noticed your "secret" stash of cached ads in my system directory, Mr Grokster. Then I notice the popup ads. Also annoying.. but again I tolerate. I didn't run Grokster for longer than a day and my system can handle twenty browser windows. But then, incredibly, it turns out that the required advert component also sends out information about me, including my browser history. Big no-no, Mr Grokster. Now I have to spend time to counteract this. I found a replacement set of libraries which do not send personal information. From that point on, I figured I was safe. Oh no... this weekend, after a Grokster session, I spotted a strange "extract.exe" on my desktop. Hmmm. How did that get there? I took a look inside and found various executables and libraries. How quaint. I most certainly did not download it. So I searched my system and lo and behold, it seems some ActiveX has automatically downloaded and run this program for me, spreading half a dozen files around my system. Looking through the registry I see that in fact it's installed a browser toolbar. Oh lovely.. just what I wanted. Took me a good half hour to rid my system of it's leeches.
The moral of the story, don't run Grokster. Well fine, I've learnt my lesson and I'm fortunate enough to have another disposable machine to unleash the Grok on. But my concern is the X million people who don't have a clue. The sort who click on "www.yahoo.com.exe". They see Grokster or Kazaa on download.com or whatever, download it and use it blissfully ignorant of what I consider to be a virus. In fact, the only difference I see between Grokster, Kazaa etc.. and viruses is a service. Package your virus as an application and you earn amnesty from antivirus software.
Slashdot articles and anti-spyware sites keep us geeks in the loop, but that doesn't help the masses. Only laws help the masses. There must be some law somewhere that states such practices to be illegal. Tricks used by these programs such as placing independent components in the system directory posing as actual system files, running programs without permission, not informing users of these hidden "features" and so on, are clearly malicious.
I'm for P2P networks, but clients such as these seriously rub me the wrong way and I'll be glad when the RIAA eats them. I just pray for a nicer client to take their place.
My life is one big siesta in which I'm dreaming I wished my life was one big siesta.
Except (from the EULA displayed when installing the Kazaa software):
(b) You hereby grant BDE the right to access and use the unused computing power and storage space on your computer/s and/or internet access or bandwidth for the aggregation of content and use in distributed computing. The user acknowledges and authorizes this use without the right of compensation. Notwithstanding the above, in the event usage of your computer is initiated by a party other than you, BDE will grant you the ability to deny access.
You hit "I agree" on this thing in order to install the software. Thus, they are not exceeding the rights you have explicitly granted them.
Jouster
Then they have just committed corporate suicide. Glad I don't hold any of their stock...
I disagree. What they've done sounds very rude and deceptive to me. But it may very well be legal and may result in them staking a claim in an emerging, lucrative market. Thus, the company's perceived value may increase and shareholders may be pleased. I'm not predicting that their stock price will rise with certainty, but I don't believe it's a foregone conclusion that this will tank it. Talk to a penny-stock promoter good at spinning publicity. He/she'll tell you that there's almost no such thing as bad publicity for an upstart. A piece of news (or even a rumor) like this that puts them on the map and on traders' tongues may be just what their stock price needed. Time will tell. Afterall, we only need to look to companies like Verisign with horrible, headline-making security and privacy goof-ups and deceptive practices to see that their rude actions and policies do not result in corporate suicide. (Unfortunately.)
If they've committed any type of "suicide", it's simply image-suicide in the eyes of a very small, elite crowd (ie, Slashdotters, privacy defenders, etc.) The market and shareholders may not care about this.
Given that no EULA has the force of contract law anywhere in the U.S., it's rather doubtful that it could be used as 'consent' for utilizing spare cycles in a legal fashion. The company is treading dangerous ground here and just begging to be bitch-slapped with a lawsuit.
While I doubt a serious argument could be made for damages, unless the EULA is upheld by some clueless court then using the spare cpu cycles of personal computers clearly constitutes criminal electronic trespass as outlined in the PATRIOT act. And, as we know, this automatically brands one as a terrorist.
I don't use Kazaa but I can't imagine that very many users will be happy to have their 'spare' cpu cycles appropriated for someone else's gain. Just another reason to dump this software in the electronic crapper.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
"Quickly" is mendatious. The majority of end users will have port 80 traffic cached by their ISP, and you can bet that cache will be juicy-full of DoubleClick stuff. My ISP routes all traffic via my local access point, even traffic to other people under that access point, and they run a cache at the access point. So even if I were to get ads from the guy next door, it would still be slower than getting them from the cache. All this would do would be to cut down DoubleClick's bills for uncached accesses, and (interestingly) stop me blocking DoubleClick using my hosts file. If this latter reason is actually material, then it's a sad indicator that the ad market has given up any pretence that ads are in any way connected to revenue. If I've gone out of my way to actively block your adverts, and you force them on me anyway, what exactly are your chances of gaining one red cent in revenue from me? Farcical.
Hey, opt-in, opt-out, what's the difference, eh? To apply an equally muddled metaphor, they'll probably burn that bridge when they come to it.
Ah. Anybody with a typical residential DSL/cable connection should check their contracts. There will almost certainly be a clause in there that prohibits providing services to third parties, and especially selling services to third parties. Most ISP's have tolerated filesharing up to now because it's (generally) an active use thing. And CETI@home is low bandwidth, fully opt-in from the user side, and non-commercial. But this might be different. It's a commercial company using ISP bandwidth to make profit, and pass some of that (a very, very little) back to residential users, who have only agreed in general to provide services, not on an active case by case basis. This might be where ISP's start to draw the line.
If you were blocking sigs, you wouldn't have to read this.
The current implementations of P2P computing tend to be invasive and, ok, evil. (I'd rather save that word for more intense areas, but the concept's the same.)
The reason that they are evil tends to be because they are the creation of commercial entities that intend to make money by stealing you information. This is not inherent (though on the MS systems that I am familiar with there is no effective security to prevent this from happening).
Commercial entities need to have something to sell. If you want to get a service from them, then you will need to pay them in some way. The "freebies" that they offer will always be a hook. Always. You may not be the intended target, you may steal the cheese, but the hook is there. Red Hat is trying to get commercial companies to buy software maintenance and development services. As a commercial entity, they distribute Linux at not much more than cost to lure in potential customers. It isn't free, but the hook is still there.
Non-commercial entities need to be able to pay for the activities that they engage in. So do individuals. You can always take an economic view of an organization or individual, and it must always either balence or yield a profit. Or be drawing down assets.
If you buy a pig in a poke you are likely to end up with a cat instead of a pig. Open source is partially the requirement that one be able to look into the bag before buying it. But if you can't, then you should expect that the seller is going to take such advantage of the fact as he can. Becuase he frequently will.
This isn't to say that Kazaa is in this case acting unethically. They have indicated that they will ask permission before adding computers to the distributed computing system, so one should, perhaps, wait until we find out how they will interpret that before getting outraged. They might not just say "the license already gave us permission". But it's also true that we can't know what will occur later. The license that was reported seems to be similar to the MS XP license in that it essentially gave them permission to install arbitrary software. And I find it quite difficult to feel comfortable with that. Especially on a system that gives essentially no protection against rogue software. (Similarly, on Linux I'm uncomfortable with the programs that require being run with root permissions.)
I think we've pushed this "anyone can grow up to be president" thing too far.
(b) You hereby grant BDE the right to access and use the unused computing power and storage space on your computer/s and/or internet access or bandwidth for the aggregation of content and use in distributed computing. The user acknowledges and authorizes this use without the right of compensation. Notwithstanding the above, in the event usage of your computer is initiated by a party other than you, BDE will grant you the ability to deny access.
I guess the only place that one might readily attack this agreement of use, is the definition of "unused computing power". Now, IANAL, but, from my limited perspective, this seems to be a rather vague term. Is a CPU cycle unused if it is sitting in the "System Idle Process"? Probably. Is a CPU cycle unsed if the machine is not turned on? Are you then violating the EULA by having your machine turned off, or the program not running? Of course, I didn't agree to give them the power necessary to run those CPU cycles.
As for storage space, what constitues "unused storage space"? Would any empty space on my hard drive then be considered availiable for thier use? What if that empty space was allocated for future expansion of a program or database, this is not really unused, just unutilitzed for its intended purpose. Moreover, we all know how well Windows runs when you start running out of disk space, so, some of the free space on your drive must invariably be allocated for this use. So we are left with another vauge, and inadaquite term. I don't think that this part of this EULA is going to hold water if it ever gets challenged.
Necessity is the mother of invention.
Laziness is the father.
"we're sorry for the spyware"
they remove it
a month later
"We're sorry for the spyware"
they remove it
goto 10.
As much as I love the P2P concept, if these guys go out of buisness or get the crap sued from them, I just hope EFF won't protect them in the name of P2P, because these guys aren't the Good Guys(tm). They are opportunists that are hiding behind ignorants and people that want to defend P2P to play their dirty scheme instead of being just dead honest.
It doesn't kill a buisness to mention any spyware or whatever, if people skip the warning and download it, well now It's their problem, but running it and acting like if you were transparent is just plain unethical, they did it many times, it simply piss me off. That's why I am using winMX since the first time I saw Kazaa doing crap to their users. It's been at least reported 2 times here if not more.
Again, being honnest about it won't change much, it'll just remove a FEW users like me and most of slashdot readers that want their privacy. Most of the people won't give a damn, so why being so dishonnest!? it could just trigger lawsuits against them for absolutely no gain.
The proof to this? well look at how many times you saw kazaa and spyware, and look at their userbase still growing (which doesn't make sense but again, MOST people just don't care, they'd sell their souls for free stuff).
--- Metamoderating abusive downgraders since my 300th post.
Excerpt (from your excerpt of the EULA)
Notwithstanding the above, in the event usage of your computer is initiated by a party other than you, BDE will grant you the ability to deny access.
The (not yet established as legally binding on the end user) EULA grants them their rights, but if the wording on the imminent pop-up is at all obsfucatory, then the users will have a case. They have not yet hit the "I agree" that matters, and a window that (months after they failed to read the EULA) pops up in the middle of an AIM chat is going to get clicked on immediately, simply to get it out of the way. The users will have a good case if they want one.
The story said that it was impossible to install without clicking yes, but that the trojan could be removed later without affecting the P2P preformance at all. Pray tell, did the EULA mention that? There's opt-in and there's opt-in. Deceptive practices simply blow. Any agreement that cannot stand up in the light of day is no agreement at all.
I spent a year in Iraq looking for WMD and all I found was this lousy sig.
Unused cycles are "optimized out" by my CPU. In other words, it runs slower and consumes less electricity when not being used. Most modern CPUs go into a low-power-consumption mode when not actively performing real processing. If you doubt this, check your CPU temperature while it's been sitting idle with a blank screen for an hour or two. Compare that to the temperature after playing an hour of Quake III or even just running a graphics intensive screen saver for an hour. I know I could certainly feel the difference when I was running the distributed.net client at home.
So, I "hereby grand BDE the right to access and use the unused computing power" is another way of saying I will freely donate my electricity? Let's find out just how "free" that is.
First, let's assume that you pay $.10/kWh for electricity. Let's also assume that you leave the computer powered on constantly. Finally, let's assume that your computer consumes 60W when idle, but 120W when actively crunching numbers. So that's an extra 60W/hr you spend on behalf of Kazaa.
60W/hr x 8766 hours = 525960 watt-hours per year. .10/kWh = $52.60 per year.
525960 / 1000 = 525.960 kWh per year
525.960 *
Let's look at it a different way: Assume there are 2,000,000 KaZaa users.
60W/hr * 2,000,000 = 120,000,000 watt-hours.
Thats 120 megawatts per hour.
I think they need to file an Environmental Impact Statement before releasing this kind of crap.
John