Slashdot Mirror


General Public Realizes KaZaa is Spyware

blankmange writes "CNet is reporting the slow dawning of the general public to KaZaa and spyware. "Virginia Watson unwittingly authorized a company she'd never heard of to install software that would help turn her computer into part of a brand-new network. The software, from Brilliant Digital Entertainment, came with the popular Kazaa file-swapping program. But the 65-year-old Massachusetts resident--who has a law degree--didn't read Kazaa's 2,644-word "terms of service" contract, which stated that Brilliant might tap the "unused computing power and storage space" of Watson's computer. " " Fortunately the helpful graph in the article compares the complexity of IRS tax forms with Brilliant's terms of use... guess which one is harder to read?

57 of 408 comments (clear)

  1. service agreements? by dryueh · · Score: 4, Interesting
    "The question is not whether people read and understand (terms-of-service agreements)--of course they don't--but whether they can be enforced," said Cern Kaner, an attorney specializing in software legislation who teaches computer science at the Florida Institute of Technology. "I don't think that companies should have the right to spy on you without your actual permission, but I think it will be hard...to prosecute companies who do engage in this type of practice if you have actually clicked on an agreement that gives them permission."

    I'm wondering if anyone DOES know the legal implications of those service agreements. When those long agreements pop-up before installation, not only does no one read them, but you agree to the thing by clicking on either 'yes' or 'no' buttons....is a yes/no button a legally binding clause? They do not, at any point, get your signature nor is the agree monitored by anything other than the installation program itself (i'm assuming, anyway).

    I don't know...I'm curious..thoughts?

    1. Re:service agreements? by CaseStudy · · Score: 4, Informative

      Not exactly true. If you're a minor, you can opt out of a contract unless it's for essentials. But you can choose to keep the contract and bind the other party.

      If the parent's authorizing it, though (by giving the disk to install, and using the software), they're probably going to be bound (as much as anyone else, anyway) even if they get their 10-year-old to click on the agreement.

      (As usual, not legal advice or a recommended course of action.)

  2. Re:And the public cried... by anonymouZ+coward · · Score: 3, Interesting

    When you lease a car, you don't own it. The lease company does. They can do whatever they want to with the vehicle as long as they disclose that up front. If you sign the lease without reading the fine print, that's your fault. Now granted, I think software companies are trying to snowball consumers by throwing multi page EULA's at them and burying the scary stuff. All the more reason to only use GPL software. I'm afraid to even boot my Winblows box without running Adaware right away.

  3. Those Poor Normal Users by inKubus · · Score: 3, Flamebait

    I am glad that I do home computer consulting for a living. There are so many idiots out there who just install whatever software they find without knowing the facts. And I'm glad that most of the facts are only availible on obscure sites until most people have already been hurt. I LOVE AMERICA. I am glad that companies to stupid stuff like this to hurt consumer's PCs. Somebody has to fix the damage, therefore it translates into MONEY for me ($75/hour).

    I am no troll. This is the truth. It's not very nice, but look at how much a body shop charges. Or a plumber. People don't want to be protected. They do not want knowledge. They want to make mistakes, and they want to pay to have them fixed.

    God Bless America.
    Cheers.

    --
    Cool! Amazing Toys.
    1. Re:Those Poor Normal Users by inKubus · · Score: 3, Insightful

      he's basically someone who's only skill is that he has a slight bit of knowledge ver the average computer user and feels he needs to charge ridiculous prices for his *ahem* expertise. Try doing real work with computers for a living.

      Hey, I just like the BMW. A LOT. I could be coding device drivers, but I prefer to have sex with girls. Being a computer "doctor" lets me work doctor's hours. And I can take a vacation whenever I want.

      Personally, if you're not happy, then what the fuck is the point of existing? Coding device drivers does not make me happy. It can be interesting, but for about 24 hours straight only. I prefer to keep my sanity. So I fix stupid Windows problems? Does that make me not "l33t"? FUCK YES. Do have have an easy job? FUCK YES. Do I love my life? FUCK YES. You may answer these questions differently for yourself, but I am happy where I'm at and no ANONYMOUS COWARD can knock me off my pedestal.

      BTW, got my +1 bonus today, so I'm just abusing it a bit to get my voice heard just this once.

      Cheers.

      --
      Cool! Amazing Toys.
    2. Re:Those Poor Normal Users by Picass0 · · Score: 3, Insightful

      This one is easy. A real W$ alert box won't scroll away in a browser.

      In this case, you are correct, and I showed her how to slide the scollbar and watch the ad fall out of frame.

      But it is very simple to pop a real alert, a new window, or any multitude of other ways to trick an inexperienced user into installing software, joining a service, or disclosing personal information.

      I think it's important to keep the right attitude toward users who are learning to use computers. If we make people afraid to seek our help, we only have more work to do later when we need to re-build a system.

      The first message in this thread had a mocking undertone that I think is one of the reasons people have difficulty learning to use computers.

      I hate that type of elitism. It's one of the things that hold back Linux.

  4. Kazaa Lite by Anonymous Coward · · Score: 5, Informative

    Kazaa Lite is without spyware:
    http://www.kazaalite.com

    It replaces one of the spyware DLLs Kazaa requires with a do-nothing version.

    Dan East

    1. Re:Kazaa Lite by Marillion · · Score: 5, Funny

      Anyone else find it ironic that I visit the site and and a popup ad appears?

      --
      This is a boring sig
  5. Re:And the public cried... by ergo98 · · Score: 5, Informative

    Of course, the whole point of the article (if you've read it, though I'll guess that you haven't) is that the complexity of most EULAs are absurdly difficult : The type of convoluted, circular, impossible to read verbage that virtually no one could read through and understand even if they were truly committed to reading the EULA for every single piece of software that they installed.

    Personally, I think that there should be basic laws governing software just as there are in the rest of society (i.e. There is a 20 page EULA every time I go to a variety store and buy a can of coke, because there are certain expectations and societal and legal standards that govern the experience : i.e. Drinking a coke doesn't make them own my liver) : For instance, no software can communicate over the internet without explaining, in simple English (not intentionally vague legalize) why it is doing it, and who it's really benefitting.

  6. That's why we have Kazaa Lite! by arnoroefs2000 · · Score: 3, Redundant


    Get it here or here

    ---

    Extra Features compared to original KaZaA
    - No Adware
    - No Spyware
    - No banners
    - No bitratelimit for mp3 files
    - No irritating websites loaded into KaZaA
    - No crappy BDE Viewer
    - No f*cking Bonzi Buddy
    - Set up multiple users with the included PseudoTrack tool

    1. Re:That's why we have Kazaa Lite! by burts_here · · Score: 4, Funny

      I have kazza light to, just i used duct tape over the right bits of the screen, and i intstalled it on a P166 machine with a 300MB hard disc, hah try and steal my spare CPU time!

      --
      Burt "Out of my mind back in 5 minutes"
  7. An app to remove most spyware by SweenyTod · · Score: 5, Informative

    It's called AdAware, and it seems capable of nuking most nasty little apps installed by websites and applications like Kazza. Grab it here from Lavesoft USA and be very afraid at how many spyware components it finds!

    You should also download their reference file update utility too. This lets you keep up to date with the latest spyware programs out there.

    --
    Alas gallinaceas de urbe bovis volo
  8. My favorite quote from the article: by zbuffered · · Score: 5, Funny

    Much as the avalanche of spam in the 1990s prompted action from legislators and regulators

    Yeah, I'm glad we got that taken care of back in the 90s...

    --
    Synergy is your friend
  9. Just enlightened my neighboor by Sabalon · · Score: 5, Interesting

    He got a new computer, got all excited about Morpheus and then they switched. Since then he hasn't been able to get anything to start downloading. So he was telling me he was going to install this Kaaza thing and try it, and asked me if I'd heard of it.

    As I explained some of the functionality surplus to him, you could see his jaw just dropping and dropping.

    But I betcha he'll still install it - cause he loves the CD burner he has and how easy it is to burn MP3's-> CDDA.

  10. don't care about the 'hidden network'.... by reaper20 · · Score: 3, Interesting

    I care that this bde stuff is bringing w2k/xp machines down to a grinding halt in fugly ways.

    Ad-aware is getting used more and more in my toolkit. I sure wish Norton/Macafee/whoever would just go ahead and add crap like this into their AV software. This garbage is a "virus" in my book.

  11. Re:And the public cried... by Spankophile · · Score: 5, Interesting

    It only goes to show that you should read everything before you sign it. This is similar to discovering on your car lease that the company reserves the right to use the car when you aren't.


    I've always wondered if the "click if you agree" thing is enough. I remember learning once in my highschool law class that when it came to contracts etc, both parties had to fully understand the extent of the wording - in order to protect people from "fine print" trickery.

    It would seem to me that these over-complicated EULAs are an attempt to either confuse users, or get them to click "Agree" without understanding the terms.

    If I "trick" you into signing something, you should still be legally protected. Granted of course that you can afford to take it to court.

    But that's what class action suits are for right?
    IADNAL (D==Definitely)

  12. Re:And the public cried... by The_Pey · · Score: 3, Informative

    If you read many of your EULA's carefully, you'll find that you have a right to use the software, but you don't actually own the software... Really depends on the software company, but this is fairly common.

    --
    Hmmm...
  13. Why is this so difficult? by kvn299 · · Score: 5, Interesting

    I'm so glad these guys are getting pounded for this. It's pretty amazing how many news outlets picked up on this story. Unfortunately, there are many many more situations like this that are overlooked.

    I really don't have a problem with companies adding extra programs into their software. The problem I have is 1) Not being told about it and 2) Not being given the option of opting out or not installing it.

    As far as I'm concerned, a license is not an appropriate place to inform the user of third party software coming along for the ride. Software should be very explicit during install exactly what's happening. That way, the user can either not install the program, or if allowed, not install that component. What's so hard about that?

    The fact that these companies try to hide this stuff shows they know the systems are a bit shady.

    Strangely enough, this happens with big-time commercial software as well. I was pretty p*ssed when Intuit's TurboTax installed Internet Explorer on my laptop without asking. It just told me, "Installing IE 5.5 now" with no cancel button. I had 5.0 installed and it was there for a reason. Oh, well.

    Hopefully, awareness of these practices will hurt companies who will entually find it beneficial to be up front with their customers!

  14. This sounds like a great article. by n-baxley · · Score: 5, Funny

    Unfortunatly, I lost interest and didn't take the time to read all the way through it. I hope there wasn't anything I'm supposed to know in there.

  15. One interesting point.... by phunhippy · · Score: 4, Insightful

    How many millions have downloaded this software now?
    How come not one person out of these millions noticed that line about tapping your computers unused cycles and wrote to a news site pr here about it?
    Why did this come out only when brilliant filed with the SEC?

    Surely at least one person must have read the damn eula? Somehow i don't feel to bad for everyone..

    A very happy furthernet[furthernet.com] user :)

    burn my karma if ya like i don't care i think i have a good point :)

  16. There should be a law... by CaptainPhong · · Score: 5, Insightful

    It should be illegal to have complicated and misleading user-agreements in software. Over the course of a day, a consumer might have to agree to several of these, not to mention other contracts, service agreements, etc. they have to sign in their non-computer life. Invariably, these sorts of things are unreadably long and full of Legalese unintelligible to the average Joe. We're bombarded by so many, that it is literally impossible to read and understand them all, let alone send them to our lawyers (as we are "supposed" to do with contracts).

    Because of the size, complexity and volume of these things (and the need to usually get past them quickly), I would argue that they amount to coercion (which would invalidate them). The same is true of shrink-wrap software licenses (which you are rarely able to examine until well after you've unwittingly agreed to them). Of course, I doubt a court of law would agree with me. However, I think it would make sense to have a consumer protection law that requires that these sorts of things have a short, concise, easy to read summary at the beginning that gives the user an idea of what they're getting in to (with all the legalese below for completeness). That would prevent companies from creating scumware like this then hiding behind their user-auto-agreements.

    --
    ... "Give me a woman who loves beer and I will conquer the w
    1. Re:There should be a law... by CynicTheHedgehog · · Score: 3, Insightful

      I would prefer to get rid of licensing agreements entirely. I don't have to agree to any binding terms when I purchase a CD player or a hair dryer; why should software be treated any differently?

      Of course I realize that unlike my hypothetical hair dryer, a piece of software can be copied and distributed using little or no personal resources. It isn't exactly a commodity, so it can't be treated as such. Nevertheless, I'm still opposed to EULAs in their current forms, so perhaps a compromise is in order.

      Generally speaking, the GPL and its close relatives don't get much flack from the SlashDot crowd. In essence they are EULAs, using the same legalistic and hard-to-understand languages as their distant proprietary cousins, but they are accepted, tolerated--even welcome in our community. They are maintained by standards organizations, publicly reviewed, and well understood.

      Can this be done in the commercial world? Like, such-and-such has a EULA that is approved by the [insert standards body here]? But then again, even if it did help identify these issues sooner, my guess is that no one would even bother to look for that seal ("Kazaa isn't using an approved EULA? Oh no! Oh well.").

      And then, no one could force a company (*cough*Kazaa*cough*) to get their EULAs approved. I'm not sure if I'd want that anyway.

    2. Re:There should be a law... by LL · · Score: 4, Insightful

      Because for software to be useful, it has to interact with other components and people. A hair dryer is a stand alone task but driving a car, you have to acknowledge the rules of the road and all the traffic signals and accept liability for 3rd party damaage and injury.

      GPL is a *voluntary* offer. In return for consideration of using other people's GPL code, you agree to behavior restrictirs (not obscuring source). EULA offer zero warranties and impose so many conditions and disclaims and exclusions clauses it wouldn't surprise me if it violated a dozen statutes. Because so many technical people have tested GPL (not to mention argued it up and down the valley) hackers have a fair understanding of the implications, even if they disagree with it, can can even come up with their own counter-offers (MPL, etc).

      With the commercial world, pre-defined contracts basically weight themselves against the user, there is no negotiation, and courses for remedy are virtually non-existant. The doctrine of equity is seriously eroded here. Until companies come up with a way of justifying their service (as encoded in software) is legally binding and balanced as to benefit/obligations, I think the public is right to be sceptical of any claims. Would you trust an email that offered you $xxxx by doing your taxes in a certain way? Or would you ask your accountant who can at least be charged with professional negligence.

      LL

  17. Unexpected (unintended?) bit of honesty by drew_kime · · Score: 3, Insightful
    "I'm not an extremist," said Robert Regular, vice president of sales and marketing at New York-based digital advertising firm Cydoor. "But all this talk of spyware is the equivalent of elevating one bad seed, and it's having negative consequences on the good software. The public doesn't have time to investigate if it's negative software; they'll just stop downloading ... I would hate to think we could reach a point that, whenever a dialog box comes up and says, 'Do you want to do this,' bells go off and people become worried." (My emphasis)

    Personally, I wish that is exactly what would happen. Popups dialogs and confirmation boxes should only appear when there is something you need to think about. If you're not supposed to think about it, then why are they bothering you with the popup in the first place?

    --
    Nope, no sig
  18. Re:And the public cried... by inKubus · · Score: 3, Funny

    Boo hoo, the poor public. If they cared enough about their computers and what was happening to them they would learn it. THEY DON'T CARE. THEY DON'T READ SLASHDOT. THEY DON'T SPEND 8 HOURS A DAY SURFING THE WEB. I think it's fine to exploit consumers weaknesses like this. Every other industry does, why shouldn't software?

    There is not a box on the front page of the New York Times that says "Certain stuff written in this paper is false." Normal people assume everthing in there is true, and smart people know to take it with a rock of salt.

    The same with computers. People SHOULD just assume the software works and is safe, and if you're smart, you won't and you will read the EULA.

    Then, when the conseqences occur, hire a professional to fix it. If people shouldn't be expected to learn, why should we be expected to protect them out of the goodness of our hearts? I am a home computer "consultant" and I make good money fixing people's computers. People who don't give a flying F what's running on it, so long as they can look at their porn and write their emails and print their Word docs. People who screw up their computers and are totally fine with paying someone to fix it. Real consumers. Realists. Not cheapskate wannabe good citizens who like to spout off about "protecting the consumer". You've obviously never had a real job or you'd know there are no friends in business.

    So, I'm glad companies take advantage of consumers, and I'm glad computers screw themselves up. Because it gives me a job. Don't try to take it away from me.

    Cheers.

    --
    Cool! Amazing Toys.
  19. Re:MS by galaga79 · · Score: 3, Insightful
    People should realize that EVERY MS product is spyware.
    While Microsoft doesn't having a gleaming reputation in these parts it's a big claim to say that all Microsoft products contain spyware. The only cases I have read is of Media Player and perhaps Product Activation but both of those are open to contestation. Plus the only spyware that Ad-Aware detects after a clean Windows 2000 install is some IE registry thing, whose name evades me but that is trivial in comparison to KaZaa.

    So until you back up your claim with some credible links I am skeptical.

  20. jeebus! by xarfel · · Score: 4, Insightful

    This is so ridiculous. Trust is soon to become a thing of the distant past. The last shreds of it are slipping away. Modern cannibalism for the sake of the dollar. So sad.

    "Brilliant, whose Altnet peer-to-peer software piqued consumer fears, says it is committed to telling people exactly how their computers will be used via new agreements and pop-up boxes as it loads more software and starts using consumers' computer resources."

    If they were so committed to telling people, why the hell didn't they? All of these companies set out to decieve, then lie and manipulate to cover their asses. I can't even imagine the discussions that these people had to plan such an underhanded ploy.

    You can't even hum two bars of a song without someone looking for royalties. Do you think these companies intent to pay up when they use your computer to solve a million dollar math problem? hell no! damn the man..haha

  21. Hillarious by Kenshiro · · Score: 4, Funny

    "... I would hate to think we could reach a point that, whenever a dialog box comes up and says, 'Do you want to do this,' bells go off and people become worried." (Robert Regular, vice president of sales and marketing at New York-based digital advertising firm Cydoor)

    Oh yeah, wouldn't want that...

  22. msconfig by The+Ape+With+No+Name · · Score: 5, Interesting

    Part of my job is to configure students machines for use on a dorm network. Very often we get complaints about service ranging from no connectivity to slow performance. Of course the slowness can be directly attributed to P2P apps and their tendency to hog bandwidth, but Gator and its ilk are notorious in our circles as poorly written programs that not only do all the privacy violation, etc that they should be reviled for, they also have the unique ability to mung Winsock on machines running ME, 98 and 2000. The fix requires a young priest and old priest and a silver sword (read: edit the registry and rebuild the TCP/IP stack). So now when I get a machine with Gator, etc. I edit the system startup to shut it down. Invariably the performance of the machine and its network connectivity rebounds. I don't ask permission to do this as we are not removing the program, but simply preventing having the prolematic software do what it does -- start.

    --
    Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
    1. Re:msconfig by The+Ape+With+No+Name · · Score: 3, Interesting

      Delete tcp/ip from the network config and delete all the winsock keys from the registry as well as the dhcp keys. reboot. reinstall the tcp/ip in the network config. reboot. Worky.

      --
      Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
  23. We're supposed to trust them by Skidge · · Score: 5, Funny

    "I'm not an extremist," said Robert Regular, vice president of sales and marketing at New York-based digital advertising firm Cydoor. "But all this talk of spyware is the equivalent of elevating one bad seed, and it's having negative consequences on the good software. The public doesn't have time to investigate if it's negative software; they'll just stop downloading...I would hate to think we could reach a point that, whenever a dialog box comes up and says, 'Do you want to do this,' bells go off and people become worried."

    So we're supposed to trust them. These spyware folks are just a few bad apples among the wonderful adware crowd. Damn you, Brilliant, you're keeping me from all this good adware software.

  24. IANAL, BMWISTBO!?!? by mekkab · · Score: 5, Funny

    (I am not a lawyer, but my wife is studying to be one)
    While she was taking her contracts class, she pored over EVERY single contract (Wedding coordinator, photographer, hotel where the wedding was held, DJ, etc.) with a fine tooth comb. That is the lawyer in training method.

    But when I speak with friends of the family who are lawyers, many simply sign every document thrust in front of their face becuase they know that no matter how you phrased it, they can wiggle out if need be!

    That explains why I sign legally binding documents as I. P. Freely

    --
    In the future, I would want to not be isolated from my friends in the Space Station.
  25. It could be a valid business model... by Lobsang · · Score: 5, Insightful

    This *could* be a valid business model. Think about it: Company X offers services for free in exchange for a few of your CPU cycles. The same client could be used for both distributed processing and, say, file downloads. Company X makes money by selling CPU power to third parties (your spare cycles) and you, the user, enjoy free service.

    Unfortunately, KaZaa wants to do it *without* telling you. That's just unacceptable...

    1. Re:It could be a valid business model... by jgerman · · Score: 3, Insightful
      there are certain rights you cannot waive, for example, you can't be legally bound to a stipulation in a contract that allows someone to kill you. In the case of software it's possible for a comapany to practically rape an end user because either 1) they didn't read the quasi legal EULA, 2) didn't understand the EULA. There are laws in this country expressly for preventing corporations, and individual, from unfairly taking advantage of people who are ignorant of certain facts. This should be no different. As more and more spyware get's installed on Joe Shmoe's computer, the value he's getting from the computer he just laid out his hard earned money gets progressively smaller. Using spare cycles is a deceptive term. I don't have spare cycles in my single processor machine. If you start firing off processes using "spare cycles" my machine slows down, it's as simple as that. The memory you're using is unavailable to me as well. Joe Schmoe, (I as well for that matter) did not pay for a computer to have spyware companies gradually take it over, regardless of an EULA.


      This entire attitude is bordering on hypocrisy. The common reaction, of techies, to RL law being applied unchanged to the digital world usually erupts into cries of "The internet is not the real world, the existising laws don't fit". But your attitude is just the opposite. A contract is binding in RL, we'll assume a click thorugh is a real contract (regardless of the absurdness of this assumption) and apply RL laws to it.

      --
      I'm the big fish in the big pond bitch.
  26. How to install software... by smagruder · · Score: 5, Insightful
    1. While installing software, don't bother with reading the EULA (unless that gives you kicks, or you're required to), but run the installation as you normally would, making sure that whenever you have the option to *not* install adware or spyware, take it.
    2. Scan your system with Ad-aware or other comparable software. Note: I don't work for Lavasoft.
    3. If the previously installed software still works, Great! If not, uninstall it.
    --
    Steve Magruder, Metro Foodist
  27. GREAT! MORE LAWS! by inKubus · · Score: 3, Redundant

    Hey, let's just pave the way for lawyers to have further control of the fucking world! That's exactly what we need! To have this issue debated and decided by computer ILLITERATES who will end up fucking us all straight up the pooper! YAY! HAVEN'T WE LEARNED, FOLKS?!

    If you are too LAZY to learn the facts, to learn how to compile your own open source software, to learn how to fix your own plumbing, YOU ARE GOING TO BE GETTING SCREWED BY SOMEONE WHO DOES KNOW.

    So please. Don't ask for new laws. Learn the facts. And then make money off the people who don't know them.

    --
    Cool! Amazing Toys.
    1. Re:GREAT! MORE LAWS! by karmawarrior · · Score: 5, Insightful

      Except that the current system is great for lawyers: You're forced to accept an EULA to use a piece of software, if you don't want to, you have to (somehow) negotiate your money back. And in order to understand the EULA, you probably should consult a lawyer anyway: Even if it apparently reads like plain English, there will be clauses that are likely to be invalid, or ambigious, or have hidden repercussions.

      Simply outlawing them, or offering a basic "If someone pays you for the right to use the software, you MUST offer them the ability to install and use the software without agreeing to any conditions beyond those implied by copyright law and first-use/right of first sale doctrines." is not going to help the lawyers. It removes them from the process, and a good thing too.

      --
      KMSMA (WWBD?)
  28. Yes, it might be enforcable by Jugalator · · Score: 5, Informative

    is a yes/no button a legally binding clause?

    From http://www.techlawonline.com/internet.htm#about3:

    The Internet variant of "shrinkwrap" licenses are "clickwrap" licenses which are standard-form contracts entered into online; for example, Terms of Service posted on a web site, under which the purchaser signifies his assent to the terms simply by clicking on a box marked "I Agree." Like shrinkwrap licenses, the terms are non-negotiable. Unlike post-payment shrinkwrap licenses, however, the purchaser's consent to the posted terms is usually obtained before the exchange of funds.

    While the courts have not explicitly upheld the enforceability of clickwrap licenses, in at least one recent decision, the U.S. District Court for the Northern District of California implicitly ruled that such an agreement was enforceable. Hotmail Corporation v. Van$ Money Pie Inc., 47 U.S.P.Q. 2d 1020, 1998 WL 388389 (April 1998, N.D.Cal.). It remains to be seen whether other courts will similarly find these types of agreements enforceable.

    The court's decision in the Hotmail case above can be found here:

    http://eon.law.harvard.edu/h2o/property/alternat iv es/hotmail.html

    --
    Beware: In C++, your friends can see your privates!
  29. Open source scanning solution ? by sh0rtie · · Score: 3, Interesting


    I think the general concensus amonst us all is that spyware is bad, yet the only reliable (and free) solution seems to of been delegated to our friends at Lavasoft, while they are doing a *great* job, their project is unfortunatly closed source and therefore people/programmers cannot really contribute to its success (other than donate cash which is reccomended but not convienent to everyone)

    if people feel so strongly on this issue why hasen't anyone started an open source solution to this scurge so the talented programmers amongs us can improve the scanning and detection techniques ?

    at the moment the spyware companies only really have to make their product beat lavasofts Adaware and they are in business (at least til/if Adaware picks it up)

    sure spyware seems to be only targeted to Windows users but as other operating systems become more widespread it is only a matter of time before they spread to these alternative platforms too

    while closed source could be argued as a good thing (stop spycompanies seeing how it works) could they beat 100's of programmers all working to make the scanning engine more robust and secure, this obviously works in regards to computer security on *nix platforms as viruses are not more prominent than closed source platforms
    so would beating spyware benefit from these same techniques ?

    While i agree that these spyware programs should be regarded as viruses/trojans i think once you bring a commercial element into the equation you open yourselves up to attacks of perpetuating the products life/success (ie: rumours that virus detection companies create viruses)

    so would an open source spyware detection solution work ?

  30. A legal virus? by The+G · · Score: 5, Insightful

    I know that it's a mistake to think of legal documents as if legal language were source code or machine instructions for the legal system. None the less, it does seem as if we are beginning to see legal documents employing the same sort of "social engineering" and "viral behaviour" that we encounter daily in code.

    What Kazaa has done is no different from what the Mellissa virus did: It presented people with a choice (install this software for Kazaa, open this document for Mellissa) that appeared to most to be benign. The means of knowing the choice was not benign were available (the license agreement for Kazaa, the actual contents of the document for Mellissa), but were obfuscated (in complex and opaque legal language, in obfuscated macros in an opaque document format) and chaffed (in one small part of a very large file/document in both cases).

    Perhaps, then, we need to look upon trojans written in legal "code" the same way we look at trojans in software: As malicious and probably illegal. It is no more sensible to expect people to be able to fully comprehend a complex (and deliberately obfuscated) legal document than it is to expect people to read the binary code of every program they run. Yet our legal system presumes that you are responsible for your agreement to "run" the legal code but that you are the victim when you run the binary.

    We need to treat contracts and licenses written in legal language the same way that we treat compiled code: as opaque and, when they are harmful, as malicious "exploits" of user vulnerabilities.
    --G

  31. Re:And the public cried... by tenman · · Score: 5, Funny
    So if the contract of the lease specifies that they have "the right to access and use the unused horsepower and trunk space in your car/s and/or the highways for the aggregation of sales staff and use in distributed a convoy. The leasee acknowledges and authorizes this use without the right of compensation.", they can put a guy in a trench coat in the back seat, and a black bag in the trunk. Because I signed the agreement, i understand that they plan on using my car once I park at work.

    That's fine, but here is my issue.

    • Said man in trench coat gets pulled over (hacked).
    • Goverment offical searches contents of the car (computer).
    • Finds contraban and/or dismembered bodies in that bag in the trunk (childporn/warez/etc).
    • Government disables car, and then empounds it.
    • Leasing company doesn't have to "compensate" the leasee


    So you say "that would never happen", and I say take another look at the lows that internet companies will go to to turn a buck. especially companies that will use a another program to slip your install script onto users programs.

    Oh wait... I'll have to wait until "Brilliant Digital Entertainment" is done with my CPU to finnish this post....

  32. Re:And the public cried... by elefantstn · · Score: 5, Funny

    If you want to convince a court that your knowledge of English is limited, I suggest you refrain from using phrases like "intentionally obfuscating the agreement."

    --
    If it ain't broke, you need more software.
  33. Understandable EULA by stinkydog · · Score: 3, Funny

    1. We have the right to use your computer, drink your beer and sleep with your sister.
    2. You agree to binding arbitration, which means our representitve "Bubba" will tie you up and have his way with you until you stop whining.
    3. You agree to purchase additional hardware as we deem necessary to run our software.
    4. Your rights: NONE

    Accept Yes/NO

    SD

    --
    âoeWho knew something as harmless as willful ignorance could end up having real consequences?â
  34. for the same reason we have clear lang laws by gelfling · · Score: 4, Insightful

    IF you want to make a big deal about the legality of EULAs don't forget that something is either a contract or it is not. In which case it may have to conform to readibility statutes including being in a language you can actually read. Time and time again, legally speaking oh libertarian one - obscurity for the sake of obscurity has been struck down in the courts under the general principal that if you have something to hide you are probably committing fraud or trying to commit fraud.

  35. Re:Agreements by analog_line · · Score: 3, Insightful

    I feel little sympathy for people "burned" by click-through stuff. If you're not willing do deal with the possible consequences, and you don't want to read the agreement, don't click "I Agree". If you click "I agree" you've got a shaky case because you allowed whatever to be installed on your machine.

    Let the buyer beware. If you sign on the dotted line or click on the flashing button, you are assumed to have done your damn homework. If you haven't, you and only you are responsible for the problems it causes. It's common sense, people.

    Oh wait, I forgot. Common sense is stuff that everyone says, but no one actually believes. I forgot.

  36. If you need help convincing people... by TDScott · · Score: 3, Informative
    ...then I've written an under-600-word guide to the problem and how to fix it, designed for the uninitiated.

    Pointing people there could save hours of explanation...

  37. Re:Eugh by analog_line · · Score: 3, Insightful

    If your computer is your castle, YOU are the only person responsible for defending it, and YOU are the only person who is to blame when YOU install something without reading the license agreement.

    You, you, you, you, you, you, and only you.

    I install stuff from the internet all the damn time. I click through just like everyone else, but I don't complain that the devil made me do it. If its yours, take some responsibility for it. If you refuse to, then deal with it pal, 'cause only you are to blame. People don't say "read the fine print" because it's something nice to say. People say it because it's good advice.

  38. Software licenses and FAQs by Midnight+Thunder · · Score: 3, Interesting
    I am starting to really believe that all software licenses should include a FAQ, so people don't have read the whole unreadable text of a software license. I know that many companies write software licenses to protect themselves, but more and more are also doing it to gain additional rights.

    Other ideas that come to mind are standardized liability levels to which you can associate a logo. Something like 'MC' = Mission Critical, we pay if it breaks, 'NL' = No liability, you assume all the risks, and probably other more fine grained categories? The idea is that a software purchaser should know where they stand when buying a piece of software, rather than having to resort to hiring a lawyer or screwing themselves royally because they don't have the time for the fine print.

    Just imagine having a license written on the wrapping paper of every present you get at christmas. I am not sure anyone would check what it had to say, since they just want to get to the goody inside - software is the same.

    --
    Jumpstart the tartan drive.
  39. Re:And the public cried... by ergo98 · · Score: 5, Insightful

    Most people don't care if their spare computer cycles are used by some company if, in return, they get a good piece of software.

    Then how about distributing the software with "price: The Idle time of your PC"? Why are these "ways you pay for the software" always hidden away, usually installed silently in the background, and controlled via a checkbox that was careful placed outside of the visible range on one part of a 30 part install wizard? The reality is that most of this insidious software doesn't state its true intentions, because they know if they did many people would forgo using it, but instead they put "FREE!" all over the product.

    There does not need to be LEGISLATION in this matter. There needs to be education. People should not just download and run software from untrusted sites. EVERYONE knows that. So in this case, I do not shed a tear.

    Uh, we're talking about mainstream, very popular software : Not software from warez sites. So if Netscape 8.2 read your financial information and sent it on to banks, that's ay okay?

    No pity for the majority.

    And you work in computer configuration and repair? I feel pity for your customers. I'll guess that you're the type of guy that always has the raised eyebrow, exclaiming about how dumb the average Joe is, while at the same time wallowing in your own ignorance.

  40. Just get drunk by CoreyG · · Score: 3, Insightful

    If it's true that you can't enter a legally binding agreement while drunk, just pound a few brews before clicking "I agree." Time to go install some more software...

  41. Thieves and Eavesdroppers can't complain by Dragoness+Eclectic · · Score: 5, Interesting


    I wonder if anyone has reverse-engineered BDE's protocols yet? It would be a damn shame, wouldn't it, if their surreptiously installed thiefware should inadvertantly retrieve data containing a destructive worm as a payload, or if their computations were all skewed just enough to still be plausible, but uselessly wrong, or if the client on some computer that their server connected to wasn't quite the client they originally installed, and had unfortunate effects on said server....

    Eavesdroppers can't complain if what they hear is unflattering, and thieves can't complain if the stuff they stole is dangerous to them.

    --
    ---dragoness
  42. Re:And the public cried... by bnenning · · Score: 3, Insightful
    If you read many of your EULA's carefully, you'll find that you have a right to use the software, but you don't actually own the software


    No, you'll find a bunch of words saying that the publisher claims that to be the case, but that doesn't make it so. Using software you have legally obtained is not a violation of copyright law, so you don't need to agree to a EULA. In fact, since a EULA (usually) gives you no rights that you didn't already have, it should be invalid on its face for lack of consideration. (IANAL, yada yada yada).

    --
    How to solve most of our problems: 1.Lots of nuclear plants. 2.Cure aging.
  43. 65-year-old Kazaa user? by ChaosDiscordSimple · · Score: 4, Interesting

    I think the fact that Kazaa has 65 year old users is the real news here. Clearly file sharing has become mainstream if grandmothers are using it.

  44. Retaliate? by upshift · · Score: 4, Funny

    Wouldn't it be great to take AdAware to the next level? I'd call it retaliation-ware. Figure out what the scum-ware is looking for and send bogus data. I wish I had the time for it.

    Upshift

  45. Define "unused" by Xunker · · Score: 3

    ..I as because I, like so many others, have a client for a distributed computing project installed on the PCs that I use regularly. In my case it's the Dnet OGR client, and it runs in super nice mode, sucking up any spare cycles that fall through the other processes. In this scenario, techically, almost all of my CPU time (with the exception of a micron here or there) is used.

    Not, I don't know how brilliant's distributed system works, but if it's like any others it will do the same thing as my Dnet client and put itself in the lowest priority group, right next to my Dnet client which means that they will be splitting the remaining cycles -- yet these are not cycles that were unused, they are cycles one client too from another I had previously installed!

    --
    Hilary Rosen's speech was about her love of money and her desire to roll around naked in a pile of money.
  46. Re:Why's Kazaa getting hammered for this? by Combuchan · · Score: 3, Insightful

    Saying that people should get a lawyer before installing software is ridiculous.

    My initial comment was originally posted a bit tongue in cheek, but if you hit "I Agree" and you don't agree nor make any attempt to understand what you agree, that's not the fault of the company. If you hit "I Agree," you'd better agree.

    Why aren't you thinking? Any lawyer worth his or her salt would look at any EULA, and tell you not to install the software.

    Lawyers provide legal advice and break down the legal process for the average person. If I wanted to incorporate a business or get married, the lawyer would look at the forms I have to sign, and tell me what it is I'm signing. They don't say, "This form's too hard. Why are you wasting your time getting married anyway?" Lawyers are not just binary evaluators that say Do this/Don't do this and stop at that.

    >I know what I have installed on my computer, I know what it does, and I don't get surprised when I do (pkg_info|dpkg -l).

    Do you seriously expect anyone to believe you when you say this? I can guarantee that you do NOT know exactly what you have on your computer.

    Uhh, I would say a lot of people who have been running BSD/Linux for a while could agree with this statement.

    Your pkg_info paragraph is way off-base. I didn't say I know exactly what I have installed, but I have a fair understanding of what each program does based on what the author of the program has written about it. This is reinforced because a) I can trust the author as he or she is most likely not part of some greedy business and don't stoop to unethical behavior to match a profit margin, b) a vast majority of the software I have is open-sourced, and especially that which is in the FreeBSD base has gone through a fair amount of auditing, whereas Kazaa is a closed-source app that has probably not recieved any comprehensive security analysis, and c) if there were issues, I'd be alerted about them immediately as I'm seeing more 3rd-party auditors more interested in keeping whatever UNIX software secure rather than some silly windows utility.

    If the trojans of which you speak are delivered by some cracker, than it's my fault for not keeping up to date on patches. If the trojans are delivered by the author, a highly unlikely event especially with a commonplace app like ftp, that author would essentially be commiting developmental suicide as I and many others wouldn't use software from this author anymore. I do not expect this level of quality in Windows.

    Wouldn't you be pissed if it did? But, as you suggest, you only have yourself to blame.

    I sure would be, and yup, I'd blame myself. I'm glad that we see eye to eye on this issue, and it's settled. :P

    Besides, Kazaa alerted its users to some extent, and that's the whole point of this damn thread. Your questions of my knowledge of trojanned software is wholly irrelevant as trojans by definition are totally silent about their duality. And no 'Well, the obfuscation of the EULA sections on spyware is analogous to a trojanned program' because I don't see rootkits coming with click-through agreements that the legitimate sysadmin has to click "I Agree." to step through the installation process.

    Gee, you can dog me on my misuse of the word altruism but when it comes to trojan, you're the one in the dark ... :)

    If you disagree, reply.

    --
    "[T]he single essential element on which all discoveries will be dependent is human freedom." -- Barry Goldwater
  47. Re:And the public cried... by plover · · Score: 3, Insightful
    I almost always agree with this particular argument. We almost never need new laws, we have plenty of old ones. But not this time. Here are some back-of-the-envelope computations I came up with for what Brilliant Digital is asking for when I click on "I Agree":

    First, unused cycles are ordinarily "optimized out" by my CPU. In other words, it runs slower and consumes less electricity when not being used. Most modern CPUs go into a low-power-consumption mode when not actively performing real processing. (If you doubt this, check your CPU temperature while it's been sitting idle with a blank screen for an hour or two. Compare that to the temperature after playing an hour of Quake III or even just running a graphics intensive screen saver for an hour. I know I could certainly feel the difference when I was running the distributed.net client at home. I just wish I had metered it.) So, I "hereby grant BDE the right to access and use the unused computing power" is another way of saying I will freely donate my electricity. Let's find out just how "free" that is.

    First, let's assume that I pay $.0816/kWh for electricity (the 1999 national consumer average (page 14).) Let's also assume that I leave the computer powered on constantly (because I do.) Finally, let's assume that my computer consumes 60W when idle, but 120W when actively crunching numbers (because it's an Athlon.) So that's an extra 60W/hr I would unknowningly consume on behalf of Kazaa.

    • 60W/hr x 8766 hours/year = 525960 watt-hours per year.
    • 525960 / 1000 = 525.960 kWh per year
    • 525.960 * $.0816/kWh = $42.91 per year.

    Look at it a different way: Assume there are 2,000,000 KaZaa users.

    • 60W/hr * 2,000,000 = 120,000,000 watt-hours.
    Thats 120 megawatts per hour. We're talking California-rolling-blackout-sized consumption of energy here. It's Environmental Impact Statement time.

    Is it still so unreasonable to ask them to say "Click here to agree with the above and oh, by the way, we're going to use about $40 worth of your electricity per year", or does something a bit more drastic have to happen?

    --
    John