An interview with Ad-Aware's Nicholas Stark

Andrew Leonard writes: "In the wake of the Ad-Aware/RadLight spyware vs. anti-spyware showdown, Salon has an interview with Ad-Aware's Nicholas Stark, who explains in no uncertain terms Lavasoft's determination to match every move by the spyware developers."

Comments

Software licenses

[vespazzari]

I think that it is almost impossible to read much less understand the license agreements that are bound to almost all software. I would be vey interested to see a licensing agreement go to court... The way I understand it both parties of a legally binding contract must understand the contract in order for it to be valid, sooo it would be my guess that most of these agreements/contracts would be invalid due to the fact that most people are not lawers and would not be able to understand the agreement even if they did read it.

Re:Software licenses

[cdf12345]

In order for a contract to be valid there must be:

1.) a valid offer
a. must be serious
b. must be specific

2.) A valid acceptence
3.) exchange of consideration

As far as I'm concerned, not telling someone that the contract allows them to delete information on your computer, that's not very specific.

As for taking this to court, a remedy would probably be for damages or recission(null) of the contract.

all we need now is someone pissed enough to take this damn company to court.

Re:Software licenses

[NoMoreNicksLeft]

Dude, while I agree in general with you, who says this needs to go to court? Think of it this way...

Someone writes a "contract" that says if you happen to walk across a particular stretch of sidewalk, not only will they keep that sidewalk clean for you, but you agree to give them 50% of your salary for the next year. Then they post a copy of it well off the sidewalk, where it isn't easily read (not without binoculars). So, curious, you walk across that sidewalk up closer to it, so you can read the "sign"... is there any reasonable person that would contend you agreed to this contract?

If the dumbass that pulled the stunt took you to court for breach of contract, would the judge even hear it, or would he toss it out, only after chastising the plaintiff's lawyer?

How is a EULA any different?

Re:Software licenses

[cdf12345]

there is a difference between trying to rip someone off in a contract, and damaging property in a contract, I think a judge would hear the case.

Re:Software licenses

[Anonymous Coward]

The difference is that one has to do with something primitive that judges understand, and the other with that magical enigma known as the in-ter-nit.

Re:Software licenses

[I.T.R.A.R.K.]

"...not only will they keep that sidewalk clean for you, but you agree to give them 50% of your salary for the next year."

"...is there any reasonable person that would contend you agreed to this contract?

No, but hundreds of thousands of people are doing it everyday. It's called paying taxes. ;p~

Re:Software licenses

[fatphil]

Following up to a post with the sig:
"Alchohol, cause of, and solution to, all of life's problems" -Homer Simpson

You wrote:
"all we need now is someone pissed enough to take this damn company to court."

Which is just wonderful in English! (i.e. English English)

It's certainly true, it would be very interesting for this to be brought to a black/white crux point.

FP.

Re:Software licenses

[NoMoreNicksLeft]

Touche. No wonder you have such low karma. You tell the truth too often.

Re:Software licenses

[NoMoreNicksLeft]

Bingo! Get this gentleman a qewpie doll, we have a winner!

Re:Software licenses

[Xuff]

IIRC, the click-thru licence does tell you that it's going to delete information on your computer, and it is specific about what it will remove. Just because people blindly click "Next" and don't read isn't the company's fault, although they are taking advantage of it.

I don't like it any more than you do, but it's worth pointing out.

Re:Software licenses

[I.T.R.A.R.K.]

You think this account is bad? My other count is sitting at -110 right now. ;p~

Re:Software licenses

[NoMoreNicksLeft]

Surely you jest. The Slashdot FAQ says in no uncertain terms that it is nearly impossible to go below -10. Even I haven't managed to get much below -15. Some nimwit modded my troll account up... and with my non-troll account, I get modded down for sincere comments. Go figure.

Re:Software licenses

[I.T.R.A.R.K.]

This was before they changed it...Back when abusing Metamod could get you past the negative cap.
But since then, they changed it again so that people below a certain karma level couldn't use metamod at all. That's when I was stuck at -110.

Re:Software licenses

[NoMoreNicksLeft]

Christ, there's a negative cap too? I've already reached 50 on this one, I was gonna have fun trolling. Do they design this so that it will be no fun at all, is that how it works?

Re:Software licenses

[martyn s]

It seems, according to the interview, that they only agreed to put it in the click thru license after there was a big controversy and protests.

Re:Software licenses

[Anonymous Coward]

The problem is that it is not reasonable to expect a person to read all the EULA's that he/she is confronted with in the modern world. Contracts are supposed to exist in order to define an agreement that parties have negotiated and are fully aware of.

But modern lawyers use EULA's as weapons for their companies. They are weapons used to make a sale look like a (completely one-sided) contractual agreement. But if it looks like a sale, and smells like a sale, then it's a sale. And that is what the vast majority of software licenses are, in reality.

A court in California recognized this fact and ruled along these lines. Hopefully it will set a major precedent for future rulings. Consumers' rights have been eroding due to bribes to politicians (otherwise known as campaign contributions) for over a decade. It's time for the courts to put an end to this nonsense.

Scythe

Radsoft

[CmdrTaco (editor)]

From the article:

I do not believe that it is legal to bind the usage of their software to the removal of an unrelated product.

But how is it an unrelated product? Ad-Aware goes out and specifically prevents programs like those put out by Radsoft from working properly. While I agree it isn't right that Ad-Aware is removed from the user's program without due warning, it is far from unrelated.

Re:Radsoft

[Disevidence]

Doesn't Ad-Aware remove the SaveNow bundled with the software? This wouldn't specifically stop Radlight from working, or even intefere with its use. Its affecting the spyware bundled, so removing Ad-Aware without the users express intent is illegal.

Re:Radsoft

[_Sprocket_]

But how is it an unrelated product? Ad-Aware goes out and specifically prevents programs like those put out by Radsoft from working properly. While I agree it isn't right that Ad-Aware is removed from the user's program without due warning, it is far from unrelated.

Its pretty simple. Radsoft's package can function perfectly well with Ad-Aware also installed. They have nothing directly to do with each other.

Granted, the politics and business of the two clash. I could understand that Radsoft feels threatned by Ad-aware. And it wouldn't be suprising if they took measures to protect their revenue. However, I would expect them to take steps to ensure all installed components remain installed for their application to function.

Of course, Radsoft has done a great job at displaying their attitude towards their users. Not only does their revenue apparently depend on the questionable (and apparently unappreciated by users) practice of spy-ware, but they take the same attitude to underhandedly remove software with which they have a political axe to grind.

One final point. Ad-Aware is considerably different in intent and attitude than any of the software it targets. First, the Ad-Aware user actively selects what components (including applications, libraries, registry entries, and cookies) to remove. Secondly, it is widely supported as it provides even fairly non-technical users the ability to discover hidden software installed on their systems and remove it despite the great lengths that software goes to hide and resist being removed.

If Radsoft and their clients, as well as the apparently growing number of like-minded business and applications developers, dislike the power provided by Ad-Aware then they should seriously re-examine their business plan. There is considerable resistance towards their methods. And simply attempting to remove Ad-Aware does little more than reveal their contempt for their user base.

Re:Radsoft

[Anonymous Coward]

Radsoft's package can function perfectly well with Ad-Aware also installed.

I completely agree with this. But that is not the issue.

They [Ad-Aware and Radsoft] have nothing directly to do with each other.

This is the point I don't understand. How you can you say that? Radsoft actively chose to bundle in a piece of spyware, the kind which Ad-Aware's sole purpose is to destroy. So how are the two unrelated? This has less to do with functionality and more to do with the politics of software distribution.

Essentially, this all boils down to "The enemy of my enemy is my friend" or more appropriately, "The enemy of my friend is my enemy." I may disagree with the method in which the software us removed, but I can certainly understand the justification.

Re:Radsoft

[Disevidence]

This is the point I don't understand. How you can you say that? Radsoft actively chose to bundle in a piece of spyware, the kind which Ad-Aware's sole purpose is to destroy. So how are the two unrelated? This has less to do with functionality and more to do with the politics of software distribution.

They're not unrelated per se, but rather they shouldn't directly intefere with each other. Radlight can run without the spyware, Ad-Aware has a perfect legal right running on the computer, regardless of whatever else you install.

This has less to do with functionality and more to do with the politics of software distribution.

But one company tells you what they are doing, what exactly the program does, and you install it on your own accord. The other company hides behing a vague EULA, illegal modifies the users computers and uninstalls software, and oringinally didn't even tell of the changes! Everyone likes accountability in politics. Its the exact same here. They are being under-handed and sneaky, and there is no justification, as stated, its illegal. Just because you dislike what another company produces, it doesn't give you the right to break the law to get back at them.

Re:Radsoft

[_Sprocket_]

Radsoft actively chose to bundle in a piece of spyware, the kind which Ad-Aware's sole purpose is to destroy. So how are the two unrelated? This has less to do with functionality and more to do with the politics of software distribution.

I suppose the issue is what one considers "related". The quote from the Lavasoft developer referring to whether one package should remove "unrelated" software is likely to be a technical reference. And technically, Ad-Aware and Radsoft's offering ARE unrelated. But you are very correct in the link politically.

But that's a problem. Just because one has a political dislike for a piece of sotfware, it does not mean one should use one's software as a platform to remove the offending application. We don't have Mozilla removing Internet Explorer (whether that be possible or not)... just to pick an example out of thin air.

One other comment - sure, Radsoft chose to bundle a piece of spyware with their application. But that bundling and installation is often hidden from the user. Even worse, removal of that software is often difficult. Yet the system still belongs to the user. Ad-Aware gives the user the ability to identify and remove undesired software despite spyware's attempt to resist identification and removal.

If Radsoft wishes to ensure all software bundled with their package remains installed, then they should take steps to check that said software has not been removed. Even better yet, perhapse they should level with their users and alert them as to what is being installed and why. They certainly shouldn't be removing software that has not been included with their package.

Re:Radsoft

[Anonymous Coward]

With regards to Ad-Aware, the *owner* of the computer on which the software is installed on chooses what to de-install when he runs Ad-Aware.

OTOH, with regards to Radsoft, a person with no rights whatsoever (the Spyware author) to the user's computer is choosing to uninstall a program that the computer's owner installed on it.

The later is akin to GE programming it's refrigerator to disable/destroy a non-GE appliance in your kitchen.

Radsoft is dead as a doorknob when this goes to court.

Scythe

Re:Radsoft

[Anonymous Coward]

And the best part is, if the likes of Cydoor and Brilliant Digital came with actualy fully working uninstal programs, there would be no need for Ad-Aware. Why don't they? All other apps do (or you can just delete their Program Files directory). Could it be that users will be highly motivated to get rid of the junk?

Re:Radsoft

[mondoterrifico]

Your missing the main point i think. Ad-aware doesnt remove anything the user doesnt want removed. It prompts u to click what u want removed. So really it is the user removing the offending spy ware, while ad-aware is simply a tool which allows this to happen.

Re:Radsoft

[_Knots]

"And in the blue corner..." Ok, who got a funny image in their head of a refigerator and a blender fighting?

Sorry for decreasing the S:N ratio.

-Knots

Re:Radsoft

[Anonymous Coward]

Funny for the refrigerator, maybe...

Scythe

Re:Radsoft

[Erik Fish]

Radsoft actively chose to bundle in a piece of spyware, the kind which Ad-Aware's sole purpose is to destroy. So how are the two unrelated?

They are unreleated because it is the user that authorizes the removal of the spyware -- not Lavasoft, not AdAware. Furthermore it is the user who chooses to install AdAware in the first place.

Re:Radsoft

[radsoft]

It would be great if you brainiacs could at least keep the names straight. The spy company is RadLight, not radsoft. One wonders how much, if any, of the Salon interview you were able to read and understand. Thank heavens it is others that govern the planet.

Re:Radsoft

[_Sprocket_]

It would be great if you brainiacs could at least keep the names straight. The spy company is RadLight, not radsoft.

D'oh. I suppose I should have caught that. Instead, I was just feeding off of the origional post and missed the mistake.

I can understand the flame. I'd hate to be associated with RadLight too. Sorry.

Re:Radsoft

[sargon]

You are an idiot. You can't even get the name of the company right, and, in the process, you done a BIG disservice to a reputable company.

Radsoft is a superb company which makes a great suite of tools for Windoze, tools that actually make Windoze usable.

Radlight is the company is question in the Salon article.

license (illegal?)

[cdf12345]

"You are not allowed to use any third party program (e.g. Ad-Aware) to uninstall applications bundled with RadLight."

As far as I know a license statement should only apply to when one is using software, I think legally a court would uphold that a license cannot tell someone what hardware or other software they can or cannot use.

The interesting thing with this is that the are forcing users to comply with a license which is probably not even legal.

As for uninstalling software without any other warning, wouldn't this be on the same level as a destructive virus? I sure as hell wouldn't pout my name on a virus.

Also it never states that the software will be removed. It says you cannot use other applications to uninstall their spyware. So you can have anti-spyware installed on your computer without breaking this (probably illegal) license.

I would think the company is liable for criminal damage to property much like a virus writer would be.

Re:license (illegal?)

[hettb]

You are wrong.

Re:license (illegal?)

[Disevidence]

I believe in the latest release, the removal of ad-aware is explained (albeit in legalese) in the EULA. While the legality is extremely questionable, they do actually tell you vaguely.

Re:license (illegal?)

[56ker]

"I think legally a court would uphold that a license cannot tell someone what hardware or other software they can or cannot use" - I don't think it would! What law are you basing this on? After all the person has clicked a button saying that they agree to the terms!
"So you can have anti-spyware installed on your computer without breaking this (probably illegal) license." - yes but it'll uninstall Ad-aware without telling you - that's what this whole story was about!

Re:license (illegal?)

[Technician]

As for uninstalling software without any other warning, wouldn't this be on the same level as a destructive virus?
I think it should be called a Trojan program and properly included in the signature files of McAffee, V-Shield, Network Associates, Fprotect, etc.

Re:license (illegal?)

[peddrenth]

A license like that would seem to be similar to the Microsoft's OEM license: "it's illegal to sell Linux computers while you also sell Windows ones" (It's also similar in the sense that many Windows "features" end up making a linux partition unusable.)

The equivalent would have to be a television which you're not allowed to use in the same house as certain brands of vaccuum cleaner.

(one might even argue the analogy between vacuum-cleaners and RadLight goes further, but enough about things which suck...)

Re:license (illegal?)

[martyn s]

I think with the Microsoft OEM license, it's more like "if you sell linux computers, we won't sell you windows anymore." Big difference. Plus, as someone said above, I believe both parties have to *understand* the contract.

Re:license (illegal?)

[JLester]

It's simple, you can't agree to something that is illegal. Even if you click "Agree", it isn't binding if the license agreement itself is illegal.

Jason

Re:license (illegal?)

[dinotrac]

I haven't seen the actual license or its presentation, so I don't know if it would come under that category of contracts known as "contracts of adhesion". Contracts of adhesion are those piles of fine print you see on the back of parking ticket stubs, dry-cleaning tickets, etc. They're generally ok so long as they contain no terms that might be unexpected, such as "Agreeing to park in this garage assigns title to your car to the garage owners" or some such thing.

The click-through is a problem, because contracts of adhesion generally don't have any form of overt acceptance. You park your car, you get the ticket. Still, a click-through with lots of legalese that the typical consumer wouldn't understand should, at the very least, be open to challenge.

The Ad-Aware person described the right way to handle this: make the RadLight software fail to operate without the other sofware installed.

At the very least, actions like RadLight takes against Ad-Aware are right at the edge of criminal activity.

Re:license (illegal?)

[evil_one]

The Microsoft OEM licence said that you were not allowed to have other operating systems BOOTABLE on a system that had a Microsoft OEM licenced OS on it - if you used a retail licence you were fine. I know this because I used to work in a computer store, and if the customer wanted dualboot, we charged them the difference between OEM and retail. (This had the side-effect of limiting them to 95A and 98 after 95B/C and 98SE came out.)

As for Windows "features" [that] end up making a linux partition unusable - I haven't seen them. If you install a Microsoft os after linux is installed, you'll lose the boot loader, yes, but that's not just linux. That's also the bsds, darwin, BeOS, etc.

well I'm not surprised...

[56ker]

that some company decided to bring out a program that removed Ad-aware. That's what he's been doing to them - so why the big ho-ha when he gets a bit of his own medicine?

Re:well I'm not surprised...

[gnovos]

That's what he's been doing to them - so why the big ho-ha when he gets a bit of his own medicine?

Simple, because that is what is his users ASK of him. Most people download spyware don't know that it's there. When was the last time you intentionally installed Cydoor? When was the last time your version of p2p software said in big letters "This software will install spyware now Yes/No"?

Now if he packaged ad-aware inside of kazaalite and didn't tell anyone what he was doing, THEN he'd be getting a taste of his own medicine. This, however, is completely different.

Re:well I'm not surprised...

[Bitchard]

I can't believe that people think that this is a taste of Ad-Aware's own medicine - Spyware is installed completely surreptitiously and without the user's consent, whereas Ad-Aware has been purposefully installed in order to remove any invasions of privacy.

It's about as far from medicine as I can imagine. Unless it involved leeches.

It's like buying a game that automatically searched for any other game on your computer, and then removed them without asking. Kinda. That may be a bit of an exaggeration, but you get the idea. Steathily remove all opposition to leave the path clear for your own product.

Idle Thought...

[NickRob]

With clickthrough rates in the absolute toilet, how much money is AdAware and popup blockers really costing those that get so upset by them?

Not enough.

What about aborted installations?

[robolemon]

Another question to consider is whether the RadLight installation program removes Ad-Aware if you cancel the installation before it is completed. I'm not sure about the specifics, but I don't think a license counts if you never fully install the software onto your computer.

I'm pretty sure we can assume that aborting the installation does not restore Ad-Aware. To me, this seems like even more compelling evidence that RadLight's activities are illegal.

words to live by

[CmdrTaco (editor)]

When asked if he had a specific plan to recommend to developers of spyware programs, Nicholas Stark of Lavasoft said

A specific plan? No. However we do have some pertinent advice. Lavasoft began as nothing more than a dream. With hard work and a specific plan for the future, we have been able to achieve the success we now enjoy. We feel that the ad-sponsored model is nothing more than a quick fix. What we would say is that developers need to find a community willing to support their efforts and help them to grow in their art and to learn from experience.

Sounds like someone the open source community could really rally behind.

Re:words to live by

[56ker]

Yes but most people who use open-source software are smart enough not to install spyware. If it was truly open-source the source would be available.

Re:words to live by

[kubrick]

What we would say is that developers need to find a community willing to support their efforts and help them to grow in their art and to learn from experience.

But that's what the spyware authors were trying to do! Of course in their case, it was the advertising community. :)

Economic darwinism -- these guys thought they'd found the quickest way to "mo' money", but now they find that the market won't tolerate it. People on that moral level will try other objectionable stuff until they find something that doesn't make their customers feel like they're being shafted all *that* hard, and then they'll do their best to exploit that weakness. Grim, but that's "the way life is".

Re:words to live by

[istartedi]

No. He belongs with the Free Software Movement. Anybody who can use the phrase the success we now enjoy when he is still working his day job should be quite at home with the language manipulation of RMS and friends.

having read the article..

[56ker]

I'm still curious as to how he's going to change Ad-Aware to prevent it being uninstalled by this other program. Does anybody know?

Re:having read the article..

[cdf12345]

find a way to let ad-aware run in the background and alert the user if another program attempts to access its files...

Re:having read the article..

[NoMoreNicksLeft]

I'd simply have a daemon sitting there, waiting for a user to attempt to run such a program... when the user doubleclicks hiddenspyware.exe, have my daemon block it, and inform the user that this exe woulc attempt to remove the daemon they intentionally installed.

The trick of it, is to see it before it can run, it has no power then. If you let it run, I'm pretty sure everything in windows can elevate itself to the equivalent of root without trouble, and kill any process it doesn't like, you have to intercept it before it can do this. After that, it's up to the user and your daemon whether you want to attempt to sandbox the thing or not, and try to salvage some of it.

Re:having read the article..

[ewen]

I'm still curious as to how he's going to change Ad-Aware to prevent it being uninstalled by this other program. Does anybody know?

This calls to mind the old story of Robin Hood and Friar Tuck. Essentially instead of having one program that can be killed off/removed, you have two programs each keeping an eye on the other, and starting/reinstalling the other as required.

As someone commented in the last thread on this topic, this all rather reminds me of Core Wars, played out at large. We just need a better way of keeping score...

Ewen

Re:having read the article..

[Anonymous Coward]

The latest ad-aware version add's an extra space into the directory name of ad-aware, this seems to break the script of the spyware that tries to remove it.

Re:having read the article..

[Anonymous Coward]

There is no need for such a scheme, and it's really not a reliable way of doing it. If the OS allows a program to hook into file_read, file_execute or file_delete, ie what anti-virus applications probably do already, then you can block all access to unwanted programs or behaviour. Even if the OS lacks fundamental security levels, you can probably hack into the OS somehow, ie by replacing some DLLs in Windows 98.

AVG, an free antivirus program I use in Windows 98SE prevents me all access to infected files, so I guess it's not such a hard nut to solve. The problem is to lock down so that the other programs can't turn off YOUR mechanism somehow when the OS is basically insecure..

Re:having read the article..

[gibodean]

I'm still curious as to how he's going to change Ad-Aware to prevent it being uninstalled by this other program. Does anybody know?

There's a program provided with the $15 version which is like a virus monitor, but it monitors for spyware. It stops the spyware from running, or installing itself. Lavasoft just needs to add detection for this new bit of spyware.

Re:having read the article..

[Anonymous Coward]

There are quite a few ways - from passive ones making the detection very problematic (remeber self-mutating virii when there were real virus writers and not only silly worm bozos?) to active monitoring for accessing their files in a way the virus scanners do. BTW, anyone noticed the radlight admin's nick "davenger". Guess what? - dark avenger was a bulgarian virus writer who created a quite clever mutation engine.

The real name of RadScorpion seems to be Igor Janos. Any slovak student here knowing Igor Janos? :-)

I am posting anonymously as I am a Slovak, probably live in the same town as he does and he can track me based on my user info - I don't quite want to get his attention :-)

spyware as sources of revenue

[jred]

In the article, they ask about removal of spyware removing revenue for the producers of the free software. I didn't think the ad-aware guy answered that very well. I would have pointed out that ultimately, the customer (user of free software) decides what it's worth to use their software. Most will look at ads. Heck, most will tolerate pop-ups. What they tolerate is anti-ad-aware software. I never heard of RadLight until this came up. Free publicity, yes, but you can be sure no one that I know ever uses any of their products. There's a line & they crossed it. Not all free publicity is good, regardless of what they say.

Re:spyware as sources of revenue

[Anonymous Coward]

Yeah, you're right, it's up to the consumer to decide what they will put up with. Which is why no one is forcing Ad-Aware on you behind your back, and no one is forcing you to use it to remove specific components even when you run it.

Except for those of us who like shelter

[Anonymous Coward]

But money is not the primary goal and has never been; it's mainly used to pay the server and bandwidth costs.

So, basically he's saying that if companies who distribute spyware give up their tactics and follow Ad-Aware's model, they can make enough money to cover bandwidth and server costs. Then all they need to do is have another job which actually pays. Oh yeah, great way to hook new developers into open source or even just to stop using spyware. Ad-Aware may have community "support" but unless the community supports them enough to make a decent living Ad-Aware sure isn't showing anyone much of an alternative.

Re:Except for those of us who like shelter

[Disevidence]

Oh yeah, great way to hook new developers into open source or even just to stop using spyware.

When developing for "Open Source", your designing and programming on the assumption that your part of a community, helping a community, and not getting paid for it. Most spyware-bundled software are from private companies trying to discreetly make money of "free" software. People will do open source because its something they believe in and can help create. Not have an open source project just so they can spyware it and make money at a later date.

Re:Except for those of us who like shelter

[Anonymous Coward]

Umm, you're confusing "open source" with "free software" - see the review of "Revolution OS" for an explanation. The people are putting spyware into their software install package because it will make them money. I think their desire to make money is reasonable considering some of these people have invested millions of dollars into their software companies and I think their programmers should only have to have one programming job at a time. The guy from Ad-Aware said With hard work and a specific plan for the future, we have been able to achieve the success we now enjoy. We feel that the ad-sponsored model is nothing more than a quick fix. What we would say is that developers need to find a community willing to support their efforts and help them to grow in their art and to learn from experience. Ad-Aware may be successful as an unprofitable entity but so far their business model is not one that any sane businessman would follow. I'm writing these replies because I would like to release my source when I release my application but I'd also like to make money from my application which has taken up most of the last two years of my life. So I'm particularly aware of the fact that this guy's advice is completely worthless to anyone who wants to make a living off of their open source software (would you prefer I just not open source it?) and I was a bit offended by the fact that he stated his worthless advice in a somewhat arrogant fashion.

How do you make money?

[mgblst]

We do offer an enhanced version of Ad-Aware called Ad-Aware Plus, [which costs $15]. But money is not the primary goal and has never been; it's mainly used to pay the server and bandwidth costs. We all have "regular" jobs or are students, and do this in our spare time (although it uses up a lot).

Perhaps if they included some sort of advertising program with ad-aware, they could make some real money!

Re:How do you make money?

[kubrick]

Perhaps if they included some sort of advertising program with ad-aware, they could make some real money!

But then the first time the program was run it would uninstall itself. Where's the benefit in that? :)

Re:How do you make money?

[Glytch]

I know you're joking, but it might work. Depends on what kind of advertising. Spyware is right out, but maybe an Opera-style ad window would be acceptable. I can only speak for myself, of course, not for other Ad-Aware users.

Calling all programmers ...

[Anonymous Coward]

I'd LOVE to see some puckish programmer bury a phrase at the very bottom of a click-through license to the effect of: "User agrees to sell nude pictures of themselves on ebay and donate the procedes to RJ Reynolds and/or the Church of Scientology." Might demonstrate the idiocy of click-throughs and highlight their dubious legal status. At worst, it'd provide a few yuks.

Re:Calling all programmers ...

[Technician]

pictures of themselves on ebay and donate the procedes...
With my geek physique, they shouldn't hold their breath waiting for the funds.

Re:Calling all programmers ...

[Anonymous Coward]

Incredible as it sounds, there is a market for Fat people porn

Re:Calling all programmers ...

[alexburke]

I second that motion. (Click my URL above to see what I mean. ;)

I feel bad for the spyware creators...

[Roarkk]

As I believe that some of the "spyware" are just regular legal programs I really feel for their authors to see how their program is being uninstalled," RadScorpion wrote. "I WANTED ADAWARE TO SEE IT TOO and to revalue their pose to their 'enemies.'

No, I feel really bad. If it weren't for AdAware, I, too, could have received an extra $500 from (Insert online casino of choice).

*$500 dollar offer only valid after betting $50,000 or more and receipt of firstborn child. Other restrictions may apply

Just Boycott

[t_allardyce]

What ever the legal aspects are, there is a much simpler way to get rid of spyware - don't download the programs. boycott KaZaA and everything else that includes spyware until they stop. People these days are just not taking their right to boycott, its the same with DVDs, CDs, and MS Windows, all these things are trying to do stuff we don't want, but if everyone stops buying them, they will have no choice but to give the customers what they want.

Oh and screw the EULAs, if I want to remove spyware from something on _my_ hard-drive then what are they going to do about it?

Re:Just Boycott

[Thenomain]

What ever the legal aspects are, there is a much simpler way to get rid of spyware - don't download the programs.

Until I started reading computer news sites more regularly, I didn't even know that these things were installing "spyware" on my machine. I just clicked-through on those EULAs, like 98% of everyone. The "just don't do that" argument needs to be prefaced with "you're doing that", which is what programs like AdAware help bring to light. I commend Salon for bringing it to the attention of less tech-hardened people. Even if anti-anti-spyware programs become more popular, the mentality behind AdAware has a better chance of reaching more people.

Re:Just Boycott

[set]

You're preaching to the choir here. The vast majority of people actually affected by this are oblivious. I showed the kazaa crap to a couple friends recently and they nearly shit themselves. They had *no idea* that this was going on.
The mainstream is going to have to run with this story before any real progress can be made.

Pot. Kettle. Black.

[TrinSF]

Well, except that's *not* what Ad-Aware and similar products do. They *don't* make a clear connection between uninstalling 'spyware' and decreasing functionality of a program.

I've worked personally on both sides of this fence, with one of the companies named in the interview. I can't tell you how many times I had email exchanges with users that ran like this:

USER: Suddenly my version of [Product] won't work! I get a message it's missing [filename]; what happened?

RESPONSE: You may have installed a program that "removes spyware" that has removed that program element. Programs like that are designed to remove advertising software from your computer. You're welcome to do that, but if you don't want to see ads, the free version of [Product] is not for you. You should try [Pay Version of Product] or some other product that is not ad sponsored.

USER: But I don't understand! The program said it would get rid of evil viruses and bad programs! It didn't say it would remove parts of the programs I use. Why doesn't it say your programs might not work any more?

RESPONSE: We suggest writing to the support address of the "spyware removal" program with your concern. Maybe they will change their documentation to make that more clear.

I myself was *personally* responsible for making sure that software that included ad components had clear, readable EULAs. The software had to all but slap the user in the face with the information -- it had a first line that said, in all caps, that the program was AD SUPPORTED and would DISPLAY ADS. It urged, in all caps, that users *read* before they agreed. I fought with developers who wanted to make the EULA less visible, to ensure that it couldn't be dragged off the desktop or otherwise avoided.

The bottom line is that it didn't matter. I could explain to a user in simple plain language what was going on, and the user would still *ignore* the whole text.

I've become increasingly frustrated by the topic of late. From what I can tell, there are people who feel justified in robbing others of income by repackaging software to remove advertising components. For almost all advertising supported software I'm aware of, an ad-free version is offered for a cost. If you don't want ads, or don't want "spyware", pay for the software. It's that simple. But to actively take income from people simply because you don't approve of their business model is heinous.

Actually, now that I think about it, this is not the first instance of this sort of activity. I remember a developer with a popular product which was ad-supported that used to check for ad-removal programs and bring up a popup window that said something like:

"[Anti-adware program] has been found on your system. It may remove files that this software needs. Do you want to remove [Anti-adware program]?"

A pretty nice bit of turnaround, I always thought.

Re:Pot. Kettle. Black.

[NoMoreNicksLeft]

"But to actively take income from people simply because you don't approve of their business model is heinous."

You're right, I'll write my state representatves this instant, and insist that they repeal fines for drug dealers. Throw them in jail, yes, but taking money because I don't approve of their business model is truly heinous.

Re:Pot. Kettle. Black.

[ComaVN]

You and your product may have been very clear on the ad/spyware issue, but I'm absolutely sure I have never been asked by an installer if it was ok to replace my winsock.dll by something that resolves .cool and .new tlds etc. Or to redirect all my http traffic through some hit counter. Yet this happens when installing some of these "freeware" tools.

The problem is that these companies are not upfront about it. Morpheus has an anti-spyware logo on it's site for chrissakes. Only when everybody comes bitching to them, they change their EULA's and say, hey, we told you all along, and you agreed, so what are you complaining about?

"[Anti-adware program] has been found on your system. It may remove files that this software needs. Do you want to remove [Anti-adware program]?"

If it gave a warning like this, fine, I'd cancel and that would be it. If it gives you a choice (like ad-aware does), it's ok, otherwise it's not.

Re:Pot. Kettle. Black.

[_Sprocket_]

RESPONSE: You may have installed a program that "removes spyware" that has removed that program element. Programs like that are designed to remove advertising software from your computer. You're welcome to do that, but if you don't want to see ads, the free version of [Product] is not for you. You should try [Pay Version of Product] or some other product that is not ad sponsored.

USER: But I don't understand! The program said it would get rid of evil viruses and bad programs! It didn't say it would remove parts of the programs I use. Why doesn't it say your programs might not work any more?

The confused user is your problem. Ad-Aware is, in fact, doing exactly what it advertises: removing spyware. Your application does more than it advertises - it installs spyware that the user is apparently unaware of. How do we know this? Because they actively removed components they had no idea was on their system much less that they were installed by your product.

And please. Who really reads the EULA? You KNOW the end user is not going to read it no matter how plainly you write it and how much verbage you use to explain "ad supported" software.

So how do you educate your user? Make it an active part of the installation process.

The user downloads the WidgetMeister app to view their favorite widgets. During the install of the app, it notifies the user that WidgetMeister is ad supported software and is sponsored by several software packages. List the packages. Explain their use. Give the user a chance to not install specific components, or abort completely.

Of course - I suspect that this would also effectively cut deeply in to WidgetMeister's user base as many users will decide not to use it. And that's the crux of the problem.

This is not about ad-suported software. It is not about confused users. It is about the subterfuge of the spy-ware industry and the battle for control between end users and developers for the user's system.

Re:Pot. Kettle. Black.

[Spoing]

1. So how do you educate your user? Make it an active part of the installation process.

   The user downloads the WidgetMeister app to view their favorite widgets. During the install of the app, it notifies the user that WidgetMeister is ad supported software and is sponsored by several software packages. List the packages. Explain their use. Give the user a chance to not install specific components, or abort completely.

Agreed. Specifically, show all parts that will be installed and allow the user to uncheck any of them. Briefly describe each part if highlighted.

Just like any other program, if the user unchecks a part that is "necessary", warn them about what will/will not work and why. If there's an ad-free version, this is the time to promote it or offer the option to upgrade on the spot.

Re:Pot. Kettle. Black.

[Slashamatic]

A while back, I installed a version of Morpheus on my system. It presented ads which I tolerated because I had freeware. Then they started to do pop-ups, and it got more annoying.

Eventually, they screwed up their ad Javascript to the point where IEW kept crashing. At tha6t point, I figured they had lost their 'right' to do things on my machine.

I started with the hosts file fix and then eventually, after the Kazaa debacle I have no guilt about nobbling Cydoor and blocking all ads.

Ad supported software is one thing, but when it starts causing s/w problems then, sorry, I will use the cracked version only.

Re:Pot. Kettle. Black.

[Foundryman]

Well, except that's *not* what Ad-Aware and similar products do. They *don't* make a clear connection between uninstalling 'spyware' and decreasing functionality of a program.

They most certainly DO make a clear connection. It's spelled out in the 3rd entry of the FAQ (Q: What will happen to the program if I remove the spyware?). On top of that, the user is allowed to backup all the things they are removing and then restore them later, if needed.

The spyware installers sure don't make anything near this clear and easy to remove!

Re:Pot. Kettle. Black.

[Anonymous Coward]

The problem is people (in general) don't read before they use/install programs. I for one *know* that Lavasoft says that if you use their software, some of the affected programs may *not* work as they did before (or at all).

If your software requires that the "spyware/helpware/malware" is installed. Why not put a md5sum checker in your code and make sure that all the files are installed as is? If they're not...don't run.

What are you afraid of? If people love your software, they'll use it.

Re:Pot. Kettle. Black.

[Shihar]

I think that the point that you are missing is that what these 'ad programs' rarely are upfront. If Kazaa or any other free program told me what there ad programs did, AND made it easy to uninstall them, I would seriously consider gritting my teeth and living with them.

Lets say that when installing some free software you go to click the next button a pop-up window appears with big words saying:

ALERT, AD PROGRAM WILL BE INSTALLED. CLICK OK TO CONTINUE, CANCLE TO CANCLE INSTILATTION OF FREE SOFTWARE AND AD PROGRAM, OR CLICK DETAILS FOR MORE INFORMATION.

You then click details and is gives tells you exactly what the ad ware in question is going to do, 'we will have pop up adds display for you offering you services/savings when you search for certain key terms' or whatever it does. Finally, the program would then UNINSTALL ITSELF COMPLETELY when the program it was installed with is uninstalled.

You are full of it if you can claim that your company does the above. This is the basic courtesy. Let me recap. You are deceptive if your program does any of the following.

1) Does not specifically state in clear language (no buried in a EULA) that it is installing ad-ware. If it isn't in a pop up so that there is no question, and makes the important part of the text 'YOU ARE INSTALLING AD-WARE' very visible, it is deceptive.
2) Does not specifically state exactly what the ad-ware in question does AND how it does it for those who care to learn. There is a big difference between a pop up and a program that redirects searches without your knowing it.
3) Does not uninstall itself with the program that it came with. Hell, leave a check box during the uninstallation of the main program that can be unchecked if you want to keep the ad-ware
4) In any way shape or form tries to prevent itself from being uninstalled. If I try and uninstall star craft, it won't dick around with me and try and hide components that came with it. It won't make a couple copies of itself with different names and hide away different components. It will install the whole thing with no questions asked. Your program should do the same. If someone makes it clear they want the program removed, then it should be removed simply and easily with no questions asked.

If your program does any of the above, then I consider your software as honest as a virus, and will happily use software like ad-aware to find this infectious filth on my system and remove it. I just want ad-ware companies to be honest. There are some programs that I would happily take an ad-ware program for if it means I get to use the software for 'free'. However, if these programs try and sneak programs that are not COMPLETELY honest about what they are doing, I will happily let ad-aware give them the boot.

Re:Pot. Kettle. Black.

[firewrought]

I feel justified in disabling advertisements.

Why? Uh... because our society is deluged with marketing. On one end you have the spammers, telemarketers, Herbalife and Amway pawns, pamphleteers, and other such scum. On the other end, you have corporations pushing lifestyle images--promises of hipness and popularity--instead of emphasizing the substantitive aspects of their products and services (quality, support, selection, etc.). Glossy brochures instead of white papers. Billboards dot the horizon; ads spring out from the muzak in grocery stores; instant millionaire sweepstakes junk up the mailbox at home; local TV news is 5 minutes content, 5 minutes warm fuzzy story, and 20 minutes ads (half of which advertise the news station itself). Can you see the culture we've created? It brims full of artifical promises, broken appeals to our need for identity, one hype after another yanking us around like dumb animals. For people with intense mental lives, these phenomena collectively represent a violation... a sort of mind rape.

This is not the type of culture I want to live in, and I believe that you can justify just about any non-violent approach to stopping the ads, including modifying existing software to disable ads.

I understand this is not totally fair. If my choice to use an advertising supported service could be made in an environment where (1) ads from other sources aren't pushed on me (i.e., no billboards, especially glittery ones while trying to change lanes on a 16-lane superhighway near an interchange) and (2) cost-feasible non-ad alternatives exist, then I might not be so hostile. Ultimately, it's an "ends justifies the means" argument, which is pretty weak morally, but very solid pragmatically (and pragmatics always wins when the situation is dire).

Fight for your mindspace. Ultimately, it would be better for everyone if intrustive, non-informational ads were driven to extinction.

Re:Pot. Kettle. Black.

[bnenning]

But to actively take income from people simply because you don't approve of their business model is heinous.

Anti-spyware programs are no more robbing you of income than VCR makers rob advertisers by including fast-forward buttons. You've chosen a business model (a poor one, IMHO) that relies on consumers accepting and responding to advertising. You have that right, but you have no right to control their systems to enforce that model.

You do have a valid point that anti-spyware programs should fully inform the user as to the effects of removing spyware. But attacking users who are trying to assert some control over what runs on their machines is preposterous.

Re:Pot. Kettle. Black.

[Anonymous Coward]

blah blah blah I'm so important everyone listen to me because I know stuff about computers. Why are you so insistant on taking a hostile stance towards a guy giving his honest opinion?

Re:Pot. Kettle. Black.

[Anonymous Coward]

Did the software you wrote the EULA for leave the spyware component on the users system after the user chose to uninstall the application?

I'll take your lack of a response to indicate: Yes the spyware component remained on the users computer with no way of removing it. That's the norm in your line of work.

The lack of ethics in your line of work leaves you in a position of having a null opinion in regards to ethics. You can't take advantage of people like that and still proclaim to be in a position of moral high ground. Pick one or the other, or just keep your mouth shut.

Appologies to Alfred Perlstein...

[Anonymous Coward]

"B-12."

"Miss! D-11."

"Hit! C-3."

"Miss! D-12."

"Hit! Dang! You sank my business model!"

Guess they now know how RIAA and MPAA feel about their file sharing software... ;^).

The Legality Of Spyware

[I Want GNU!]

Shouldn't spyware be illegal? Most of it operates as trojan horses, which are similar to viruses, and those are illegal. They mess up the normal functioning of computers and are unauthorized. Maybe they have privacy policies saying that this is ok, but would these policies stand up in court? Often these policies are only made as such so that the consumer won't challenge them, and they are probably questionable legally. You can't take away rights from the consumer that they can't give up.

I mean, if a virus had a license agreement, would it be ok to use it then? And what if the virus attached on to another program with a license agreement that you probably wouldn't read? That is really what these scumware programs are doing. It is an outrage!

Re:The Legality Of Spyware

[I.T.R.A.R.K.]

Actually, a lot of virii (and especially trojan horse clients like BO) have license agreements stating that the author will not be held responsible for what a user does with his software.
It's not quite in the same league as an agreement stating that the user gives up the rights to his idle CPU cycles, or bandwidth, or privacy, etc... But it's still a binding agreement nonetheless.

Re:The Legality Of Spyware

[foobar104]

Oh, for the love of god. For the nth time, it's viruses, not virii. One of the characteristics of the English-speaking geek culture is the use of specialized jargon or shibboleths; but another characteristic is an above-average emphasis on correctness and precision. Using a made-up word like "virii" doesn't make you cool; it makes you sound stupid.

First, the Latin word "virus" meant slimy liquid or offensive odor or taste. It was an abstract noun that didn't lend itself to pluralization, and in fact Latin had no plural for it. Modern languages have all invented their own plurals when "virus" entered their vocabulary: German, Viren, French and Italian, virus (they use the same word for singular and plural, like we use "deer").

Second, and most important, the OED gives only "viruses" as a proper plural for "virus."

More details on the etymology of "viruses" can be found here.

Oh, and before you ask, it's "boxes" and not "boxen."

Thus endeth the lesson.

Re:The Legality Of Spyware

[Foundryman]

A good point, albeit off topic. I'll continue the off topic discussion...

emphasis on correctness and precision.

My college physics professor went off on a rant one day about the use of the word "precision" versus "accuracy". His point was that the word precision should be used when describing the quality of instruments, the word accuracy describes the quality of work we, the students, were doing.

In other words you can talk about the accuracy of your work, NOT the precision of your work. You can also talk about the precision of your measuring devices, NOT their accuracy.

I've looked up both words in the dictionary and the definitions don't entirely support his statements:

Precision:

1 : the quality or state of being precise : EXACTNESS
2 a : the degree of refinement with which an operation is performed or a measurement stated -- compare ACCURACY 2b b : the accuracy (as in binary or decimal places) with which a number can be represented usually expressed in terms of the number of computer words available for representation

Accuracy:

1 : freedom from mistake or error : CORRECTNESS
2 a : conformity to truth or to a standard or model : EXACTNESS b : degree of conformity of a measure to a standard or a true value -- compare PRECISION 2a

According to my professor the statement should have been:

...emphasis on correctness and accuracy.

I'm just curious if anyone else has ran accross this distinction in the usage of these two words.

Or is it just redundant to pair correctness up with either of these words?

Re:The Legality Of Spyware

[Anonymous Coward]

>>I'm just curious if anyone else has ran accross this
>>distinction in the usage of these two words.

Sorry. Just can't help myself. Do you mean "run across"???

Re:The Legality Of Spyware

[Anonymous Coward]

Does anyone really *care*?

Language evolves through general consensus. If the terms "virii" and "boxen" catch on, they'll simply become acceptable English words.

If language didn't evolve, we'd still all be talking like Shakespeare.

Re:The Legality Of Spyware

[Anonymous Coward]

Actually, isn't "virii" is the correct proper english plural form of "virus" according to the "rules" of pluralization for the english language? I remember that being the case, although it's been a long time since 8th grade. And don't fob me off on the OED plz, talking about the actual proper rules of grammer. *shrugs*

Re:The Legality Of Spyware

[Anonymous Coward]

Boxen is still the most ridiculous thing I've heard in a long time. It isn't even shorter than the correct alternative, which is 'boxes', and has the added advantage of being understood by 99.999% of the English-speaking population.

Re:The Legality Of Spyware

[foobar104]

Actually, isn't "virii" is the correct proper english plural form of "virus" according to the "rules" of pluralization for the english language?

Nope. First of all, pluralization isn't a matter of applying rules; it's a matter of the declension of nouns. Nouns are declined in patterns, but those patterns aren't rules. Words that are declined differently than the common pattern aren't "exceptions," they're "irregularities."

Many of those irregularities come from words imported from other languages. For example, stimulus becomes stimuli, but genus becomes genera. Ignoramus is a Latin-sounding word, and indeed is of Latin origin. But it wasn't a noun in its original language; it was a first-person plural verb! So ignoramus is pluralized in the typical English fashion: ignoramuses.

And don't fob me off on the OED plz, talking about the actual proper rules of grammer. *shrugs*

It's "grammar." ;-)

Re:The Legality Of Spyware

[MacJedi]

yeah but it's clever. And it makes a group of boxen sound like cute animals. oxen or something... :)

Re:The Legality Of Spyware

[alexburke]

If you have more than one octopus, they are octopii, not octopusses. Hence, virii.

Re:The Legality Of Spyware

[alexburke]

Oxen are just soooo cute, like little baby seals. See what I mean? No? That's my point. Oxen couldn't be cute if they tried.

Re:The Legality Of Spyware

[alexburke]

Many of those irregularities come from words imported from other languages. For example, stimulus becomes stimuli, but genus becomes genera. Ignoramus is a Latin-sounding word, and indeed is of Latin origin. But it wasn't a noun in its original language; it was a first-person plural verb! So ignoramus is pluralized in the typical English fashion: ignoramuses.

And datum becomes data. :)

It's "grammar." ;-)

Ouch...

Re:The Legality Of Spyware

[foobar104]

If you have more than one octopus, they are octopii, not octopusses. Hence, virii.

But octopus isn't even a Latin noun. It's Greek: oktopous, meaning "eight-footed." The correct Greek plural would be octopodes, pronounced "oc-toh-poh-dees." So the plural "octopi," while admittedly not uncommon, is incorrect. The correct English plural is "octopuses."

There are many examples of Latin-derived or "Latin-sounding" irregular nouns: cactus (cacti), fungus (fungi), terminus (termini), nucleus (nuclei); but consider syllabus (syllabuses), hippopotamus (hippopotamuses), omnibus (omnibuses).

And to whomever it was up-thread who said that languages evolve, you're right. But that doesn't change the fact that right now, today, the correct English plural of "virus" is "viruses," not "virii." The possibility that this may change sometime in the next hundred years doesn't make any difference now; incorrect is still incorrect.

Re:The Legality Of Spyware

[foobar104]

"Correctness and accuracy" would be redundant, at least in this context. "Correctness and precision" isn't. Other posters have used the mathematical example to delineate accuracy from precision; the verbal example is also appropriate. If I pointed over in the corner and said, "That is an object," my statement would be completely accurate. If I said, "That is a piece of furniture," it would be equally accurate, but more precise. If I said, "That is a chair," it would be both accurate and fairly precise. If I said, "That is the chair that I bought last summer at that garage sale," it would be very precise... but inaccurate. Because while it is a chair, I didn't buy it at a garage sale.

So precision and accuracy are related ideas, but kind of orthogonal to one another.

In my case, I was trying to say that geeks-- like us-- tend to try to speak both correctly (i.e., accurately) and precisely. So I think my statement was just fine.

Re:The Legality Of Spyware

[RandomCoil]

Actually, the plural of octopus can go either way (http://www.dictionary.com/search?q=octopus) but the plural of virus is undeniably viruses (http://www.dictionary.com/search?q=virus).

Don't even need to go to OED for this one...

Re:The Legality Of Spyware

[I.T.R.A.R.K.]

You sir, are a complete and utter dumbass.
Do you spend all of your Sunday afternoons looking for little typos or idiosyncracies you don't like about other people and nitpick about them on a has-been geek message board where no one really cares?
You really need to get laid. By a woman.

Re:The Legality Of Spyware

[matrix29]

Oh, for the love of god. For the nth time, it's viruses, not virii. One of the characteristics of the English-speaking geek culture is the use of specialized jargon or shibboleths; but another characteristic is an above-average emphasis on correctness and precision. Using a made-up word like "virii" doesn't make you cool; it makes you sound stupid.

Ah, but you forget the cardinal rule of the English language: "If enough people use it - even though incorrect - it becomes a word by sheer force of numbers."

Take "Arkansas" being pronounced "Ark-an-saw". Enough people in that state hated their state being referred to as related to Kansas (or OUR-KANSAS) and thusly it became a rule (a stupid rule yet a rule nonetheless).

Another example is "Nonetheless" being one word. Is it proper to have a phrase become one word "alike" other words "awhile" we find more examples? Well, that's just too bad. If enough people decide "Virii" is the proper plural for "Viruses" then it becomes proper (though wrong by grammatical standards). Think about that and perhaps you could explain the "Rite = Right" or "Lite = Light" trend.

What exactly is the "Rite-Aid" chain of stores? The location to buy supplies for rituals? Or is it the place where "Right" people find "Aid"?

We can gripe all we wish, but the tyranny of the majority wins in the grammar wars.

Re:The Legality Of Spyware

[foobar104]

Think about that and perhaps you could explain the "Rite = Right" or "Lite = Light" trend.

"Light" versus "lite" actually has a pretty interesting back-story. The FDA mandates terms like "low fat," "fat free," and "light." But there's no such regulation of the pseudo-term "lite." So it's "lite" ice cream even though it's 43% butterfat. That's a marketing thing.

Ah, but you forget the cardinal rule of the English language: "If enough people use it - even though incorrect - it becomes a word by sheer force of numbers."

But you forget the cardinal rule of language: linguistic drift happens over centuries, not decades or years. Find me a use of "virii" in English that dates to 1890 or earlier and we'll talk. Until we do, "virii" is still wrong, wrong, wrong.

Re:The Legality Of Spyware

[Yottabyte84]

Non-geeks usualy are confused by the use of the term 'box' used to refer to computers. Boxen is used to make it clear that cardboard boxes are not the object of discussion. Geeks also like being diffrent.

Re:The Legality Of Spyware

[Netbrian]

Actually, Shakespherian language was not what was normally spoken at the time at all, in fact it was more or less as comprehensible then as now. It's simply there for dramatic and poetic value.

Re:The Legality Of Spyware

[Anonymous Coward]

Kiss my big, fat poetic license.

Re:The Legality Of Spyware

[MacJedi]

they look cute to me...

/joeyo

"Our users are our strength. "

[foniksonik]

"Our users are our strength. "

Really, that's all there is to it. In a world of ubiquitous communication and transferrence of ideas the only power comes from those who support you.

OSS/FS

Someone right a song. Where's the 'Marley' among us.

Re:"Our users are our strength. "

[foniksonik]

Woah, can someone say 'Tron' flashback!!!!!!

OMG

Spyware -> Trojan horse

[Anonymous Coward]

Although I couldn't find a definition for the term trojan horse on CERT's website, a link was provided to the comp.virus FAQ. According to it, a trojan horse is:

A TROJAN HORSE is a program that does something undocumented that the programmer intended, but that some users would not approve of if they knew about it.

What RadWare's software is doing makes it perfectly clear that spyware should be treated as a trojan horse (with legal implications where applicable), beacause that's what it is.

This problem can be solved by...

[bluelarva]

Regarding the problem of spy ware uninstalling another program, perhaps it is a technical problem which there is a solution. Not an easy one but a system can be made to prevent such a thing.

1. First, software installation should be passive. On Windows (as well as other OS), you download some binary executable and run them. This foreign binary essentially has full reign over your system. Instead it should be a compressed package file with instruction embedded in it that describes what and where the package manifest should be installed. This package should be signed by the originator so that the package is tamper resistant and has some privilege to modify package that was originated from same source. This way the OS and user is in control rather than untrusted binary running amok on your system.

2. This is more difficult one to implement. I think application should have some levels of access on your system and they should be disabled by default. For example, multimedia player should not be allowed to delete files or initiate outgoing network connection. Even file read can be made more granular by restricting the file mime type that an application can read. Multimedia player has no business reading any other files than ones that it knows what to do with. This sort of sandbox could make it harder for application from whacking competitor's application.

Ultimately an implicit trust should be abandoned and implementing mandatory security may be the solution. Unfortunately this is not something that can be easily added easily but rather it must be designed into the underlying system itself.

Disclosure: I'm writing this at 6:00am after staying up all night writing code so I'm sure lot of loopy ideas are leaking from my brain at the moment. This may be one of them. Then again even a broken clock tells right time twice a day. ;)
---
jk

Re:This problem can be solved by...

[Yakman]

In regards to point one, isn't that how things like MSI (The new Microsoft Installer) work? That is, you download an MSI package and the installer is a Windows component. However I would think that for flexibility MSI still lets you run your own code. So basically it'd be a locked down version of MSI - however it still would need to be flexible for some "complicated" apps.

With regards to point two - I suppose you could do this by having the person packaging the app specifiying what permissions the app needs and before installation the user has to okay the permissions the app wants. Again this would depend on a package based installer as you say :)

Anyway, I'm rambling too..

Re:This problem can be solved by...

[jafuser]

2. This is more difficult one to implement. I think application should have some levels of access on your system and they should be disabled by default

It sounds like you're describing some of the fundamental features of a "capability-oriented" operating system, such as EROS.

Re:This problem can be solved by...

[Derleth]

1. First, software installation should be passive. On Windows (as well as other OS), you download some binary executable and run them. This foreign binary essentially has full reign over your system. Instead it should be a compressed package file with instruction embedded in it that describes what and where the package manifest should be installed. This package should be signed by the originator so that the package is tamper resistant and has some privilege to modify package that was originated from same source. This way the OS and user is in control rather than untrusted binary running amok on your system.

Exactly. The self-installing executable is a fine example of convenience being the enemy of security: At first, it sounds like a good idea. The program knows how to install the program you want with no interference from you. But if the program installs something you don't want, you're screwed. Why a program should have that level of trust on an OS is another issue you address in your next point:

2. This is more difficult one to implement. I think application should have some levels of access on your system and they should be disabled by default. For example, multimedia player should not be allowed to delete files or initiate outgoing network connection. Even file read can be made more granular by restricting the file mime type that an application can read. Multimedia player has no business reading any other files than ones that it knows what to do with. This sort of sandbox could make it harder for application from whacking competitor's application.

That is a tough nut to implement, I'd imagine, but the work has been done: *nix file permissions. A file has only the permissions its creator (or the superuser, root) gives it (so 'image files' can't run as programs), and an executable created by a certain user only has the permissions of that user, so it can't whack anything the user himself couldn't whack. So, on a *nix-y system, you could make AdAware untouchable to normal users and then only install software (other than AA) as a normal user. Problem solved.

Ultimately an implicit trust should be abandoned and implementing mandatory security may be the solution.

I think all multi-user OSes have reached this conclusion.

Unfortunately this is not something that can be easily added easily but rather it must be designed into the underlying system itself.

True. The file-permission system wasn't bolted on to Unix.

I'm writing this at 6:00am after staying up all night writing code so I'm sure lot of loopy ideas are leaking from my brain at the moment. This may be one of them.

These loopy ideas are what make *nix boxes so tough to crack.

Re:This problem can be solved by...

[Cuthalion]

First, software installation should be passive.

Doesn't matter. The first time it runs it can do all it's untrusted binary crap that it needs to do to work properly / wants to do to fuck you over.

Re:This problem can be solved by...

[foobar104]

First, software installation should be passive.

Won't work. It's necessary for software installers to have the freedom to execute arbitrary scripts during installation or removal. For instance, if you installed an FTP server, it would be necessary for that server to modify your /etc/inetd.conf file. (Don't shoot holes in my example. It's the best one I could think of off the top of my head.)

All the install package has to do is install a little script or binary, execute it during an exitop, then remove it when it's finished running. The little script or binary has, in the meantime, searched out and deleted AdAware, or whatever.

Re:This problem can be solved by...

[ndogg]

I know you were talking about Windows, but all of those ideas will be implemented by Debian sometime (hopefully soon) (it currently lacks package maintainer sigs) and are implemented by NSA's SELinux. In fact, Russell Coker has already put the selinux packages into the Debian database, so only the first part needs to be implemented in full now.

Re:This problem can be solved by...

[jesser]

Exactly. The self-installing executable is a fine example of convenience being the enemy of security: At first, it sounds like a good idea. The program knows how to install the program you want with no interference from you. But if the program installs something you don't want, you're screwed.

How is it more convinient for each program to have its own installer?

* It forces me to learn a new installer interface each time I download a new program.

* It allows software makers to get away with ridiculously worded English-only EULAs, where a single installer could have a set "named expandable-block" format which would look like "We are Netscape and you are about to install Netscape Navigator. We don't guarantee that it will work on your system, but it worked on ours. Not to be used in real-time systems." when collapsed. In addition to hurting users, this hurts software makers, since each software maker must hire expensive lawyers to write a program-specific EULA.

* It makes it easy for an individual installer to screw something up like not taking block size and breathing room into account when checking whether I have enough disk space. (Total file size 200MB, 209MB disk space free, plenty of free space!)

* It lets programs decide whether to be "Program Files\Mozilla" or "Program Files\Mozilla 0.9.9" or "Program Files\mozilla.org\Mozilla", instead of letting the user decide once.

* It makes downloads bigger, since each program feels a need to include its own installer.

* It makes uninstallation unreliable.

Throw in spyware and viruses, and it's much less convinient for users if each program has its own installer.

Re:This problem can be solved by...

[Permission Denied]

First, software installation should be passive.

Unfortunately, this won't work in Windows.

Example: you want to install a network print driver. Now, your driver needs to do a couple of things: copy itself (it's a dll) into the system directory to be loaded by the windows printing subsystem and create a bunch of registry keys the printing subsystem expects out of each "port monitor". It also needs to inform the printing subsystem to load your dll, either now (NT/2000) or after a reboot (9x). This is where it gets hairy.

The way this is done differs with every version of windows. To ameliorate the problem, MS has a win32 function that you call that does this semi-automatically (I forget what it's called, search MSDN Platform SDK for "install port monitor"). Your print driver won't work unless you call this function.

So, my basic point is that in order to install this software, you need the ability to call arbitrary functions with particular arguments. This basically means the install program must have a place where it runs an arbitrary bit of code written by the developer. You could also do whatever you like in that bit of code, such as uninstalling adaware.

I don't know about MS's new installation procedures, but I'd imagine they're pretty similar to what InstallShield does. The way InstallShield works is that you get this little GUI where you describe your app's files, registry settings, etc. From this, the InstallShield program generates a .ins file which is distributed with a more-or-less generic "setup.exe" program. The setup program also allows you to put in any code that you would like to run (the GUI has you do this in VB, but I believe you could also have it do it in C if you'd like - moot point, since you can do this stuff from VB as well as C). So, the existing installation procedures are something like what you describe except that the developer also gets to run a script of their choosing. In a way, you get the exact same capabilities as with RPM.

Now, you may say that this example is a bit unfair because this is really a device driver and you could say this "systems level" stuff is quite different from regular "application level" software.

Problem with that argument is that in Windows, there is no clear distinction between systems-level and application-level stuff. I'm a unix guy, and it's amazing how much stuff in Win32 is considered "systems level." I'd say almost any non-trivial win32 application would need to have a run of arbitrary code in the installer, whereas most RPMs don't need post-install or pre-install scripts. Underlying problem is that MS got a lot of abstractions wrong.

Re:This problem can be solved by...

[Virtual_Raider]

(...) Then again even a broken clock tells right time twice a day. ;)

[VR]: Unless it's a digital clock =P
(Sooooo sorry! couln't help myself!)

boot disk ad-aware needed

[Barbarian]

I think that as more spyware programs take tactics like that bundled with Radlight, a boot-disk image version of Ad-Aware is going to be needed for it to run properly, just like Virus scanners allow you to create a rescue disk. Eventually spyware programs are going to kill the ad-aware process as it starts. A boot disk version would allow you to run Ad-Aware (or similar) without interference from the spyware.

Re:boot disk ad-aware needed

[jocks]

Boy are we onto dodgy territory here! If we have a boot disk ad-aware package we could end up with software from the other companies which require you to insert a floppy to give the software a key which it needs to run. The floppy could contain the ad-software which is part of the "key". Basically, you would have to launch the ad-software from floppy in order to launch the application you have downloaded.

As far as I can tell there is no software workaround to this problem as long as you are using applications like RadLight, you will be saddled with these problems.

It is clear that software houses are finding it harder to make income from their products and have to resort to this type of approach. This situation can only get worse as the use of open source software increases. The margins available to vendors are (and will continue) to contract. Even the mighty Microsoft are looking at other methods to make a buck i.e. Software Rental or Pay-per-use strategies. Ultimately even these models are flawed. If we go back 10 or so years (in the UK) televisions and VCRs could be rented from several high street stores, however as the number of people who could afford the systems outright increased, the market for rental dropped and these stores have all but gone.

In the software realm the number of people who can "afford" software has increased because the amount of software that is "affordable" has increased. Therefore the number of people willing to pay for applications will drop. Combine this with the "End of Free" transition that is taking place on the internet, where companies are increasingly charging for content, there is even less disposable income available for frivalous applications.

In my opinion the only way through this minefield, as a user, is to BUY yourself an open source distro, or donate cash to open source projects, and only use open source software. This way you avoid the ethical, moral and legal minefield that is Intellectual Property.

As an investor I would make a slow but measured transition of my stock-holding from closed-source vendors to open vendors. I would include the likes of IBM or SUN in this, at least they are moving in the right direction.

Re:boot disk ad-aware needed

[Technician]

Actually I run AdAware over my LAN. I attach the drives of all my machines and scan them from the admin console periodicaly. None of the workstation machines have privilages of any kind on the admin machine which does the scanning over the LAN. The admin machine is not sharing any drives. The scan is done at the same time the LAN is swept for viruses in additon to the local machines anti-virus software.

This catches any software that tries to attack the anti-virus software and the AdAware software.

Re:boot disk ad-aware needed

[alexburke]

The admin machine is not sharing any drives.

\\machinename\C$ for one...

Re:boot disk ad-aware needed

[Anonymous Coward]

That class of share can be disabled if you know how to do it. Not straightforward, but doable. Some networking functions that depend on that share won't work anymore once you've done that, though.

Seriously scary

[nyjx]

This issue raises the very scary possibility of people regularly writing software which deliberately changes your system configuration when they are installed - and under guise of their user agreement. Bascally this is viral behaviour.

If Ad-Aware retaliates it will have to try and protect itself from the unistaller - how will it do that - clearly changes at the level of the user agreement are more or less useless (what user is going know or care that they have two confliciting user agreements in use...). So it'll be at the code level - what kind of a software war could that set off? Couple that with software that regularly uploads patches and updates (to protect against the latest rival software...).

Personally I'd rather refrain from having my destop turned into a competitive software eco-system!

Re:Seriously scary

[Anonymous Coward]

there's a simple solution for that - sandboxing. once the app doesn't run as 'the root' or even as 'the user' it wont be able to uninstall other software.
of course beyond the most paranoid security freaks this is rather unpopular practice but due to software like that it might become more mainstream eventually.. so this might actually be a good thing. break things that need to be broken.

Re:Seriously scary

[Reziac]

Some commercial software already does this. I've previously ranted on /. about what Intuit's TurboTax did, but it bears repeating: TTax forcibly installed IE5.5, with NO prior clue that it would do so. This FUBAR'd several functions on my system, and now it looks like I'm going to have to reinstall Windows because even tho I've removed IE5.5, it must have changed something critical (funny how my CDRW never once came NEAR a buffer underrun before this, and now BurnProof fends off up to 130 underruns per CD).

Really pisses me off, and I'll NEVER buy another Intuit product.

virii

[Mr Coward]

so if i put a license agreement on a virus, it's legal :?

not that hard..

[Mr Coward]

just add a password protection to the uninstaller

Not quite right

[aepervius]

First a snippet from teh Salon Article: "It isn't a matter of what Lavasoft will or will not approve of. If our users find the activity unacceptable, then we will meet their needs. In the end, it is the public that will decide what is appropriate. So to this end we have implemented features that will allow the user to choose their own level of comfort. They have the choice to exclude and/or ignore any component targeted by Ad-Aware at their discretion. And when removing the components found, we have supplied them with a backup feature that will restore anything removed by Ad-Aware should they choose to."

So let me repeat : "if the USER find the activity unacceptable then we will meet their need". the point beeing the USER.

Secondly do you know how ad-aware function ? It let you choose what to remove. IF you click blindly to remove everything then it is your problem not AD-aware fault. Like i always says : RTFM. If you use low level system removing component then either know what you do or shut up.

Leson to Learn

[_Sprocket_]

Ad-Aware may be successful as an unprofitable entity but so far their business model is not one that any sane businessman would follow.

...

So I'm particularly aware of the fact that this guy's advice is completely worthless to anyone who wants to make a living off of their open source software (would you prefer I just not open source it?) and I was a bit offended by the fact that he stated his worthless advice in a somewhat arrogant fashion.

I completely disagree. Jasc Software is a great example of a company who started small with Paintshop. It was a great software package (often called a "poor man's Photoshop") with a strong following. Photoshop was offered as uncrippled shareware without any spy-ware. And even as its author estimated registration as low as 1 in 5 downloads, it soon grew and took over the author's professional life. And as any Quake player knows, id Software has a simular story. And an even more rabid fan base (Remarkably, Quake is still played today).

To be sure, these success stories are dwarfed by the number of shareware and commercial operations who fail in the software business. But then, that's business. Most fail in any industry. Its a tough game.

If a small software developer hopes to survive it, they must have a community. It might be within an Open Source community. It might be created from fans of their commercial offerings. But there must be a support base somewhere.

Lavasoft and Ad-Aware have proven one lesson to any developers willing to pay attention. End users do not like the current methods used by spy-ware. As education spreads, more and more users will take efforts to disable this software. And that is a dire message to anyone who's business model depends on it.

Adaware, while good, is similar to Radlight

[dirk]

I see lots of people talking about how Radlight doesn't inform the user (except in the EULA) that it will remove Adaware. They common arguement is that no one reads the EULA and it's not clear what is goin on, because the EULA is confusing. Is this much different than what Adaware does? IT just gives me a list of files it thinks are "offending" and asks if I want to remove them. It doesn't tell me what they are (outside of a name of the "spyware"), what they do, or any consequences of removing them. If I run Adaware and remove Cydoor, it doesn't give me any indication that it will stop Kazaa from working, and the average person has no idea that would be a consequence. Putting the notice in the EULA is not a good tactic as it somewhat obfuscates what is going on, but is Adaware not telling you the consequences of uninstalling the "spyware" (most of which isn't spyware, it's just software that shows ads) that mucg better?

Re:Adaware, while good, is similar to Radlight

[JonathanF]

I'm not sure if you could argue that Ad-Aware is necessarily guilty of the same hidden-in-the-EULA offenses that something like Radlight would be. Simply by downloading and installing Ad-Aware, you know full well that you're getting a program that can deep-scan your system and remove files from it. Also, don't forget that Ad-Aware always lists the location of the content you're about to remove - and that may point out that it's part of KaZaA, revealing to the user that they've been duped.

If you're really serious about pruning out spyware from your system, you probably shouldn't be running KaZaA (or at least the regular version) in the first place, I think. That's like having a security specialist who insists on running a firewall, but leaves the settings at "low" all the time so that he can run a particular game. You can't claim to be actively concerned when you knowingly compromise your system.

Speaking of spyware, as I work tech support I can't believe how many people manage to 'infect' their systems with programs like Bonzi Buddy, Gator, and GoHip. Part of it is simply apathy; occasionally programs like Gator come as options with other apps, and from experience the casual user is terrified of ACTUALLY HAVING TO MAKE A CHOICE with their computer and accepts the default install options. Then there's the people who don't seem to realize that, when an installer for a program they don't need mysteriously pops up when they visit a site, they shouldn't install it. This is how viruses are spread... "but it was from someone I knew!"

The real kicker is that, at least once, I've actually had people blame these apps on the ISP I work for! Mind you, in the incident I'm thinking of (which only occurred last week) the customer assumed that paying for an ISP meant guaranteed technician visits for ANYTHING wrong with his service (even a five-minute "change your e-mail settings" problem) and had cancelled 3 prior ISPs to that effect, so I think it was more a question of his mental instability than any kind of major trend, but you get the idea of what kind of flak we can get at work...

Re:Adaware, while good, is similar to Radlight

[rehabdoll]

Radlight didnt inform the user, not even in the EULA. The only thing written in the EULA about ad-aware was that you were'nt allowed to use it to remove bundeled software. There was nothing about removing ad-aware.

Re:Adaware, while good, is similar to Radlight

[Drakker]

You use Ad-aware because you chose to. Also, Ad-aware has a backup feature that lets you backup whats removed, and if it breaks something, you can put it back in later. It's not similar to Radlight at all.

Re:Adaware, while good, is similar to Radlight

[dmarx]

I see lots of people talking about how Radlight doesn't inform the user (except in the EULA) that it will remove Adaware. They common arguement is that no one reads the EULA and it's not clear what is goin on, because the EULA is confusing. Is this much different than what Adaware does? IT just gives me a list of files it thinks are "offending" and asks if I want to remove them.

The key word here is "asks". Radlight does not "ask" you if you wand AdAware uninstalled, it just does it. AdAware gives you a choice.

Re:Adaware, while good, is similar to Radlight

[SparkyMartin]

There is a big difference. You run Ad-Aware because you want to remove spyware and adware. Ad-Aware informs you of what it found and lets you choose what to remove and what to leave alone. Ad-aware is upfront about what it's purpose is and doesn't conceal what it is actually doing. Since you have to go out and find Ad-Aware, manually download it, manually install it, you are knowingly performing these steps to produce a certain result. Most spyware/adware is hidden and unless the user knows what they are looking for and how to prevent it being installed, it installs itself with or without your consent.

That my friend, are two completely different pieces of pie!

Re:Adaware, while good, is similar to Radlight

[Kallahar]

The difference is that Ad-Aware gives you a list of things that it can remove. RadLight simply removes ad-aware without any prompts or warnings.

If radlight gave a prompt, and let the user decide whether to uninstall or not, then they would be in better waters.

Travis

One thing we forget

[rickthewizkid]

The problem I see is that you are not TOLD about the advertising software upon installation of certain software. I'm sure there are a few people who are willing to put up with some ads, or donate a few CPU cycles, in exchange for something free, but, I am not. However, I was not told about that fact and allowed to make my decesion based on the fact that program XXX would also covertly install advertising and distributed computing apps as well.

In sort, it's MY computer, _I_ should be the one who decides what is on it. Not only for my own desires, but also to be polite to other people on the 'net. What if one of these spyware programs were to catch (or come with) a virus? My computer would (without my knowledge) spread this virus to other people....

Of course, I run Linux anyway so this does not *really* apply to me. That is, until some large corporation buys the rights to Linux and starts releasing an adware-enabled version...

Bringing up eth0 [OK]
Downloading new artwork and features [OK]
Installing new ads [OK]

Oh the horror... :)

Excuse the brain wanderings, I've been up all night coding... :)

-RickTheSleepyWizKid

Re:One thing we forget

[Anonymous Coward]

Hey man, I've been programming all night too. I wouldn't mind an XXX program popping up to compensate me for my lack of girlfriend.

Re:One thing we forget

[The Cookie Monster]

What if one of these spyware programs were to catch (or come with) a virus? My computer would (without my knowledge) spread this virus to other people....

You know, the scarey thing is this isn't as farfetched as it sounds. The SDK Cydoor provides for download did have a virus in it, luckily in this case the virus was not attached to the part of the SDK that you distribute, but that's the only reason your hypothetical situation hasn't already occured.

Cydoor

[Anonymous Coward]

Many of these bundled "ad systems" are poorly written.

YES

I was writing a piece of software for which Cydoor was being considered as a revenue stream, so we downloaded the SDK to give it all a go.

1) The network then got hit by the Snowwhite and the seven dwarfs virus (this is primarily an email virus, but when it runs it copies itself into every zip on your computer), I thought it came from the Cydoor SDK zip as that was the first zip file that we noticed it in and nobody here is dumb enough to run executables attached to email (especially dodgy porn sounding ones). Of course I never knew as the virus might have run and copied itself in there before we noticed.

On a later date, after the SDK had been deleted (as you may have guessed, we didn't go with Cydoor), we downloaded the SDK again for some reason. Anyway, the virus was indeed in there. They may have gotten the virus the same way we did, but considering they never even noticed they had a virus (it's not hard to notice, even without antivirus software - it adds another file into all of your zips!) it wouldn't surprise me at all if their staff were so clued up that they routinely run outlook and click on dodgy executables mailed to them by strangers.

2) One of my pet peeves is software that modifies your system unnecessarily, I believe this to be a major reason why windows has a half life (notice how virgin installs never crash, but after a year or two are crashing many times a day). It also has other rammifications, for instance you can't run the software over a network (because all the bits it installed into the system it was installed on aren't on the computer you want to run the program on).

The Cydoor SDK has it's own install and as a cydoor customer, you aren't to change it - you just run it during the course of your own install. As you have no doubt guessed if you've read this far, the Cydoor install modifies the system.

I wouldn't have been quite so annoyed at this if it wasn't for two things:

Given what cydoor does, there is no need to modify the system upon program install, infact it appears that the Cydoor files as they are currently written can be bundled with your application in your applications program directory and still figure everything out and function fine. I did not test this thorougly tho as you have to use their install anyway - however even if there are problems doing that, none will be hard for Cydoor to fix (just to head off any replies, the benifits of an application playing nicely with your system is going to far outweight saving 200K on a 40gig drive, and a few more K in the swap file).

It turns my program (sure I'm just somebody's code monkey and it's not really my program, but I do have some professional dignity) from something clean into a program that shits all over your system and then breaks when run over a network. Sentimental and pedantic maybe, but it is completely unnecessary for Cydoor to require me to do that.

Anyway, having just said how poorly I think they do things, I at least owe it to them to mention that their SDK was actually very nice, and (not counting the install) it was a breeze to integrate their stuff nicely into the program. IIRC they also give you many ways of doing so, allowing you to choose the most appropriate.

Re:Cydoor

[Anonymous Coward]

addendum:

The virus in the Cydoor SDK was not embedded into the part of the SDK that you distribute with your application.

Guess it would have really hit the fan if that was the case :)

Not a trojan horse

[samael]

does something undocumented

It's not undocumented! It's in the EULA and it tells you it does it!

Re:Not a trojan horse

[Tim Browse]

It's in the EULA and it tells you it does it!

No - it says you can't use AdAware to uninstall the Spyware that comes with the player. Nowhere does it say that it will uninstall Adaware from your system. These are two completely different things.

If the license section being quoted in this story is correct, then under UK law, the guy could probably be prosecuted under the Computer Misuse Act. (ignoring vagaries of internet/jurisdiction etc)

Tim

Re:Not a trojan horse

[Toad-san]

Sorry, but the EULA DID say it was going to remove Ad-Aware. And it advised you to uninstall it yourself.

Saw it myself. The last version distributed removes NOTHING .. but the one before that had a VERY BIG full-window announcement, as part of the install, that said exactly that. No small print. No hidden down at the very end, buried in the text. NOTHING like that. Painfully obvious what was going to happen. And, of course, at any point you could abort the install.

So all the howls about trojans and oblivious users are meaningless. The user WAS clearly informed.

As to whether this is a good marketing scheme is not the issue. The ethics of removing some other program's components is not the issue. The user was informed, the user had a choice. THAT is the issue.

Toad-san

Re:Not a trojan horse

[Anonymous Coward]

Ah yes grasshopper, but I have also seen this where it wasn't so blatently obvious when this issue first started buzzing around. Very non-obvious, and some older versions don't tell you at all. *shrug*

Knowing is half the battle. *rofl*

Re:Not a trojan horse

[Anonymous Coward]

Who gives a shit about the last version. The original version of the EULA, which was displayed AFTER the install took place, said nothing about UNINSTALLING Ad-Aware. It's really hard to believe this was an oversight, so I have to assume the original EULA was exactly as the author originally intended. Only after lots of heat and criticism came down was it changed to mention uninstall.

Re:Not a trojan horse

[Anonymous Coward]

> It's not undocumented! It's in the EULA and it tells you it does it!

It wasn't in the EULA until there was a HUGE outcry about it, then the author made some lame-assed excuse about why he'd done it.

The original version was a trojan horse by any current def'n of that term. The current version could be considered a trojan since that new EULA says you can't legally use programs like Ad-Aware, but that EULA never mentions that the pgm will uninstall Ad-aware if it finds it. An invisible, user-non-intended action == trojan.

Re:Not a trojan horse

[Anonymous Coward]

> Sorry, but the EULA DID say it was going to remove Ad-Aware. And it advised you to uninstall it yourself.

No, it didn't.

It said that it was illegal, according to the EULA, to use programs like Ad-aware.

NOWHERE did the EULA say that Ad-aware would be forcibly removed by Radlight.

Declaring that use of Ad-aware is a violation of Radlight's user license is a VERY DIFFERENT THING from the transparent, forcible removal of Ad-aware by the Radlight program.

Ad-Aware is an extension of the Trash

[Anonymous Coward]

IMO Ad-Aware is a tool for finding and deleting specific programs. Or more generally put: it shows me files i might not want, that are on my computer, and lets me delete them.

In a sense, i could very well browse carefully through my hard drive's folder hierarchy and delete the files by myself. Ad-Aware only provides a nice GUI and do the search for me.

In this view, spyware and Ad-Aware are very different. So you cannot compare them.

BTW Radlight's EULA forbids me to use any other software than the Windows' Add/Remove program panel to uninstall Radlight's components, and pre-emptively deletes one of the software i may use to *illegally* uninstall Radlight's spyware.

I think it should go all the way, and delete the Trash, the Format program, and put itself in read-only mode whenever possible [/sarcasm]

Look at Java WebStart

[jeti]

Have a look at how Java WebStart works. It lets you
elegantly download and install software to multiple
platforms (including Linux).

The downloaded application then works with restric-
tions similar to those of Applets. If the application
needs to perform tasks it is not yet allowed to do
(write to disc, acces network), the runtime will ask
you to give the necessary permission.

No real numbers

[Linuxthess]

From the article

"More than 1 million people have downloaded Ad-Aware, according to Stark, and at least 720,000 people have downloaded RadLight from Download.com since the program first appeared in February, but the extent of the overlap is unknown."

What makes the certain number significantly less is that the Ad-aware removal module was only added in the latest rev, so 720,000 doesn't really say as much.

can just see micorsoft watching this..

[Anonymous Coward]

Balmer. humm woner if we can get away with this..quick add a linux detection and removal feature to XP-se!
oh and while your at it.. make sure IE 7 filters and redirects all pages withe tle words "Unix" "Linux" "BSD" and "GPL" to our re-education page...

One question, please

[mindstrm]

I know that when I installed radlight, every copy I've ever installed has 2 very distinct, clear checkboxes that allow me to not install Savenow and new.net.

Neither of these are required for radlight to work.

So... *aside* from the evil uninstalling of ad-aware, what is so bad about radlight? Is it even really spyware when they actually *ask* you if you want it to be installed in the first place?

Re:One question, please

[Anonymous Coward]

> So... *aside* from the evil uninstalling of ad-aware, what is so bad about radlight? Is it even really spyware when they actually *ask* you if you want it to be installed in the first place?

Did the installer explain what those two programs do, or just present you with those two checkboxes?

So much multimedia support...

[Anonymous Coward]

If the software companies really want the users to be aware of terms in the software license (or the infamous EULA), why don't they create a multimedia session that both reads and shows the main points of the license? (They can even do it real fast and at a lower voice, just like at the end of those TV ads when they have to tell you that the wonderful medicine also causes cancer, disability and in some cases, death). :-)

Some companies use tricks like forced delays (you have to look at it for at least 30 seconds before moving forward) while others require you to scroll down to the very last line before the "Accept" button is enabled. But that's not enough.

If you are a software publisher and you really mean the threats you put forward in your license agreement, please make sure I do understand all the details.

Linux reinstall Philosophy

[hopeless case]

This issue is one of the reasons I started studying linux. Control of my machine.

The only real way to be sure you are free of viruses and trojans is to wipe the hard disk and reinstall your operating system and personal software.

With linux, it turns out to be simple to arrange things so that even with a lot of complicated, customized software installed on a machine, you can reformat your root partition, reinstall linux, and have your non-standard software installed and configured in under an hour. This makes it feasible to do every few weeks for your home computer.

The main reason is that most of the software configuration consists of ascii text files in /etc and a few other locations which in any event are well known, or easy to figure out.

Keep your compiled software directories on a separate partition and write a script to descend into each of them and run a "make install". Then keep copies of all the /etc files you modify in your post install config in another directory (again, off of the root partition), and have a script that copies each file to its proper place on the root partition.

When it comes time to reinstall, reformat the root partition, reinstall linux, and then run your 2 scripts and you are back where you started, minus any viruses and trojans and exploits that managed to infest you since the last time you did this.

I wrote up an article with more detail on this on rootprompt at:

http://www.rootprompt.org/article.php3?article=3 91 2

Re:Linux reinstall Philosophy

[knorthern knight]

> With linux, it turns out to be simple to arrange things so that even with a lot of
> complicated, customized software installed on a machine, you can reformat your root partition,
> reinstall linux, and have your non-standard software installed and configured in under an
> hour. This makes it feasible to do every few weeks for your home computer.

> The main reason is that most of the software configuration consists of ascii text files in
> /etc and a few other locations which in any event are well known, or easy to figure out.

Right on. Microsoft ranted and raved at length about how long and obtuse CONFIG.SYS was in DOS and OS/2. But have you ever done any spelunking through "the registry" ? Give me CONFIG.SYS any time. /etc/whatever is even nicer in that each program has it's own relativly small file, separate from other programs. Another thing is that I can copy/restore a program without hooking into a monolithic central registry.

Re:Linux reinstall Philosophy

[shird]

Yeah thats fine when you are re-installing the exact same software, and you have the time to write all those scripts. But I would expect that you would be most likely to do something like this when you upgrade some component of your system, in which case the configuration files are likely to be completely different, either because its a different version, or a different piece of software altogether.

Bitten by Ad-Aware, start the cold war.

[krcroft]

My software, Radiate generated a false-positive in Ad-Aware because my executable filename ( Radiate.exe ) matched that of a scumware company Aureate Media's.

As a freeware developer, I now have to invest extra time to get the latest list of targeted filenames by Ad-Aware and similar software.

Ad-Aware is simple-ware with a noble cause - I can't fault it for that. Perhaps it needs to do more fuzzy searches, such as "expected registry keys", "expected support files", "exe file size greater than 2mb (to catch patched exes)" to ensure a positive match, and report the results "98% chance it's a positive match.".

Where is this cold war taking us?

Morph-ware: The ability to change the signiature of your software dynamically - filesizes, filenames, icon pixel color variations, title bar text manipulation, and randomizing the internal exe identifiers for windows.

Re:Bitten by Ad-Aware, start the cold war.

[Derleth]

My software, Radiate [overclockers.com] generated a false-positive in Ad-Aware because my executable filename ( Radiate.exe ) matched that of a scumware company Aureate Media's.

Which is why AdAware has an 'ignore this file' feature built in where a reasonably intelligent user could be expected to find it.

What's more, it ignores based on a full path, not just a filename: A user ignoring your software at 'C:\Goodshit\radiate.exe' will still be protected from the spyware at 'C:\Espionage\luserware\radiate.exe'. Different paths = different software to AdAware.

Re:Bitten by Ad-Aware, start the cold war.

[istartedi]

How hard would it be to include an md5 hash along with the filename? Maybe that will happen in the next edition. Of course, then the spyware folks might start serving software from machines that embed random codes in the software. That would wreck md5 or any other scheme... unless you hash chunks of the offending file and base the match on matching 90% of the chunks. Bottom line? Just matching filenames is way too simple.

Re:Bitten by Ad-Aware, start the cold war.

[ComaVN]

An MD5 implementation has been found on this computer. This can be used to disable our program. It will now be removed.

are you posting this to *every* slashdot page?

[hawk]

This is word-for-word the same, including the claim of how you found it, as the one I just read moments ago.

This isn't merely offtopic, it's spam . . .

hawk

precision

[hawk]

If my new algorith repeatedly finds that 1/2=1.234567890, I do indeed have ten digit precision. The accuracy is another story . . .

hawk

Capabilites is the answer?

[HiThere]

Adressing point 2.
The last time I asked about this I was told that I was asking about something called "capabilities", and that there was a group working on adding it to Linux. I don't know whether it is scheduled for 2.6 or not, but it obviously didn't make it into 2.4.

I believe that Red Hat has a non-Linux OS that is capabilities based, but that it's aimed at embedded systems. (This is probably quite confused, but it's the best I can do off the top of my head.)

Essentially what capabilities does is strip default access from all users (including root). root gets the default capability to assign capabilities. A capability might be something like the right to access some particular port (no more counting all ports less than 1000? to be special! All ports are assigned or not on a per user basis.) I don't know whether there would be defined capability groups, though it seems like a good idea. So one could set up a default user group that would, e.g., be allowed to access the floppy drive. But that wouldn't come automatically, and it could be revoked.

The difference here is that you seem to be suggesting that capabilities be assigned to programs rather than to users. This sound interesting, but I would suggest that no program be allowed to exercise a capability that was denied to the current user. That way if a virus rewrote, say, the mail program, it would only be allowed access to the e-mail folders. Tricky, but could add a level of safety. So instead of configuring programs with a blanket "exec" flag there would be a much more complex setup.

This sounds like it could be quite safe, but also like it might have an immense amount of overhead. (Perhaps that's why capabilities are still being studied rather than included in the kernel.)

But something like this is going to be needed eventually. And it will need to be machine specific, so things can't be sent out configured to take over everyone's computer. Say a cross betweem capabilities and package signing, with each user signing packages for his own machine.

Kid. Stupid. Money.

[rhizome]

Heh, I'm sure that conversation is from a verbatim transcript!

I also like how you draw no distinction between adware and spyware. If you don't go out of your way to tell the user what is being installed and what it does (if any additional functionality than what the 'parent' installation is for), then you are installing a trojan horse. Since you don't deign to say which company you work for, I'll take my examples from the majority of malware purveyors: the notification is buried in the EULA, if it's there at all. Line 45? Line 1284? How much of the Microsoft Office EULA did you read when you installed it? How about the OS EULA? "People like you" know full and well how often EULAs are read, because you don't read them either. This can be used against the user, requiring them to ask their government representatives for help or to turn to software like Ad-Aware when this fact is abused.

Go ahead and cry for user-hostile business models to be accepted without question, but know that it's not the user's responsibility to provide you with surreptitious income. Consider it civil disobedience against obfuscated EULAs.

Boxen

[Anonymous Coward]

Yeah, I always thought that "boxen" was a wanker-word.
cheers-

Even easier solution...

[NetJunkie]

Build the system like you want and then Ghost it. Even faster.

Ad-Aware is an apt name for the program

[1001 0000]

The program does not remove or modify anything. It simply informs the user of software that may be installed on the machine which the user may not be aware of. The program then provides an easy means of removing any offending software found.

I mean, sue Microsoft for releasing regedit. Its not as feature rich as Ad-Aware, but it does the same job.

The funny thing is, I switched to kazaa lite only after learning about it through the company's bitching. The thing about spy-ware is you want to keep as low a profile as possible - i.e. don't sue people for uncovering your hidden software. LOL.

I hate being right :)

[rossjudson]

We discussed this in Fair Software Installation. I didn't think it would come true so fast. What this really points to is the necessity to have good defenses in an operating system against malicious installations.

Polymorphism in spyware

[shird]

Spyware authors are already using various tricks that are usually only seen in the virus writing scene. With programs like ad-aware coming out, the anti-virus equivalent for 'legitimate' software, it wont be long before they adopt other tricks for hiding their software, in particular polymorphism. The trouble is, detecting polymorphic viruses (or spyware) is a very difficult task, not something a shareware author could ever tackle alone, it is also something quite difficult to detect through heuristics as well, more so than viruses.

Combatting spyware is going to take more than a technological solution, legislation too is unlikely to have much affect. Unfortuantly, the software industry is likely to degrade into a state where the only software you can trust to run on your machine is boxed software from the shelf from a trusted company. Even then you would need to be careful.

I have a bit of experience with polymorphism and writing undetectable code, although Id object to helping a spyware author, I'm sure there are people who wouldn't.

Install Control

[radsoft]

What amazes me is that so few people even watch what they are doing. There are a myriad of good applications out there that can help, such as Neil Rubenking's excellent Install Control (InCtrl5), freely available at both ZD and DOWNLOAD.COM. It's one thing to consciously opt for Windows - that's bad enough - and another to cast one's fate to the wind in such an irresponsible manner. It is not right to destroy things on someone else's personal computer - that computer is the user's personal property and any untoward actions are trespassing first and foremost and perhaps criminal in retrospect - but it is quite another to be so clueless as to invite these burglars in. Anyone practicing as little caution as this almost deserves what they get - and hats off to Lava for still protecting people. Bra gjort Nicke!

Howsabout a virus or worm...

[knorthern knight]

that masquarades as an XXX screensaver with a EULA ? Buried deep in the EULA is full disclosure that it's actually a harmfull virus/worm ? If the luser clicks "Yes", does it absolve the virus-writer of all guilt ? No, I am *NOT* advocating this... it's merely a reductio-ad-absurdum to demonstrate stupidity of many EULAs.