Slashdot Mirror


House Passes Another Spyware Bill

SkippyTPE writes "The AP reports that the US House of Representatives has unanimously passed a law criminalizing Spyware. This is the second such bill in two days (the first imposing civil penalties, whereas this bill imposes criminal penalties). Information on the bills (HR2929 and HR4661) can be found here and here respectively."

285 comments

  1. Maybe another Law isn't necessary by stecoop · · Score: 4, Insightful

    Let's think about these laws before we cheer - say to yourself will the world be a better place with yet another law. I applaud the efforts of the government protecting the people but marketing comes has to come from somewhere; like Nielsen rating system by which advertisers use to by spots on TV, somewhere there has to be a way to understand what works on the internet. The law bill clearly states that installing tracking devices on someone else computer will be punishable by imprisonment - you will no longer to be able to track logins via cookies or be running a risk from court interpretations of the law.

    As for the second part of the law, phishing:
    Zoe Lofgren D-Calif. - cited estimates that up to 90 percent of computers contain some forms of spyware. Lofgren said her daughter was recently victimized by electronic thieves in a phishing scam
    It is good thing that 10% of the market is either running an alternative browser and/or operating system preventing those infections. But being victimized via email I tend to say that email isn't secure therefore nothing in email can be trusted - thus let the buyer (user) beware. Over the long haul, Darwinism will balance things out and the law will be just a hoop and dance show for elections.

    1. Re:Maybe another Law isn't necessary by Trigun · · Score: 5, Interesting

      There is a difference in unnecessary laws, and establishing laws to prevent unethical business practices. Would you like to be egregiously harmed only to be told that, although it should be illegal, nobody has got around to writing a law against what has happened to you, so you might want to go cry somewhere else.

      Good Riddance Gator/Claria. The world will truly be a better place, even if our computer clocs are out of date by a couple minutes, or we don't know what the weather is like in Yemen.

    2. Re:Maybe another Law isn't necessary by oscrmyer · · Score: 1, Insightful

      And will this law really stick? Its clearly for show. I really dont think anythng will ever come of it.

    3. Re:Maybe another Law isn't necessary by zorglubxx · · Score: 1

      I agree that some laws might have unexpected dangerous effects but come on, this should be good. Penalizing criminal acts is good. I just cant wait to see if this will put Gator out of business, they are my favorite hated company.

    4. Re:Maybe another Law isn't necessary by dewke · · Score: 5, Insightful

      You do realize that to be a "Nielson" household you have to volunteer. It's one thing to volunteer to have your browsing habits monitored, and something else to have crap like gator shoved onto your pc because you don't know any better.

      --
      Oderint dum metuant
    5. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 1

      Tracking login via cookie is stupid anyway- far more efficient to track login via mac address in a database on server side.

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    6. Re:Maybe another Law isn't necessary by DunbarTheInept · · Score: 1

      Technically speaking you can't actually pass a law who's purpuse is to penalize an already criminal act, because it wasn't criminal until the law itself was passed. There's constitutional rules against being retroactively punished for a law that didn't exist yet when you did the act.

      --

      Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.

    7. Re:Maybe another Law isn't necessary by trp642 · · Score: 1

      Maybe we should stop passing laws to punish the Spyware makers and start, as consumers, holding the corporations that make operating systems that are prone to spyware accountable.

      I've noticed that spyware is a lot like fungus. It only grows in areas where the conditions are ideal.

      "The government that governs best is the government that governs least."
      -- Ralph Waldo Emerson

    8. Re:Maybe another Law isn't necessary by chamblah · · Score: 1
      And if I reside behind a router that has mulitple people accessing the same site how do you propose to resolve the issue of mutiple logins coming from the same mac?

      By tracking with a cookie, at least it's residing on the machine that is attempting to access the site.

    9. Re:Maybe another Law isn't necessary by drinkypoo · · Score: 4, Informative

      I hope you were kidding. If not, let me tell you why your idea won't work.

      1. MAC addresses do not propagate beyond a local network segment. They are used only for Ethernet. Outside of a specific physical (or certain types of logical) ethernet network, you'll never see someone's MAC.
      2. MAC addresses can be changed. Almost all hardware allows this, including antiquated Sun equipment from the days when MACs were supposedly etched in stone. Well, they're actually etched into a PROM which can be rewritten.

      If you were kidding, I apologize. If you weren't kidding, now you know.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    10. Re:Maybe another Law isn't necessary by buysse · · Score: 1

      How in the name of doG does a web server about 20 hops away get a MAC address? All sessions would be keyed to the router...

      --
      -30-
    11. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      Maybe we should stop passing laws to punish the Spyware makers and start, as consumers, holding the corporations that make operating systems that are prone to spyware accountable.

      Sounds like a thinly veiled attempt to bash Microsoft... just be aware that spyware isn't limited to just Windows. Ignorant users of Linux can get spyware installed as well (and OS-X and whatever else OS you want to name), there just isn't anybody out there really targetting Linux yet.

    12. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 1

      Now I know- I was thinking something along the lines of a client side java script which returned the MAC address as part of the CGI data- but you're right, I forgot about spoofing....

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    13. Re: Maybe another Law isn't necessary by SamSeaborn · · Score: 4, Interesting
      If the law prevents others from installing stuff on my computer I didn't ask for and don't want then it sounds good to me.

      Many spywares I've seen are in Windows directories. This may be old hat, but can't Windows do a simple hash or cert check on a file going into c:/Windows or c:/Windows/System to see if it's an "official" or "authorized" file?

      A simple message like "Application X is trying to put a file called NOTEPAD.EXE in your Windows/system directory -- this is not a Microsoft file, do you want to allow this?" would suit me.

      Goodness knows Windows nags me about a million other things on a daily basis ("Updates ... get your updates!").

      Sam

    14. Re:Maybe another Law isn't necessary by hackstraw · · Score: 1

      Sure it is. The first one made it a civil matter, this makes it a crimal one.

      The government does not want any competition in the wiretap, etc business.

    15. Re:Maybe another Law isn't necessary by codeguy007 · · Score: 1

      How do you expect to get the MAC address? MAC addresses are only used for routing on a local subnet only. Not only that MAC addresses are trivial to change.

    16. Re: Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      some game copy protection schemes, install cd checking; kernel level drivers in %windows%/system32/drivers

      hey.. yeah! illegal to install stuff in windows/*!! ... no, then it would be in the eula, to let the installer do so.. :(

    17. Re:Maybe another Law isn't necessary by kevlar · · Score: 2, Informative

      You can do no such thing with Javascript. You'd have to have a signed applet or an ActiveX control, in which case the user has to explicitly grant permission to execute (regardless of whether the user INTENDED to grant permission).

    18. Re:Maybe another Law isn't necessary by GigsVT · · Score: 1

      I remember some time in the past I could go to a web site and it would tell me what my MAC address was. Don't know if this was a browser specific bug or what. It was several years ago.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
    19. Re:Maybe another Law isn't necessary by XxtraLarGe · · Score: 2, Informative

      It's called an Ex Post Facto law. It is strictly prohibited in Article 1, sections 9 & 10 (?) of the Constitution.

      --
      Taking guns away from the 99% gives the 1% 100% of the power.
    20. Re:Maybe another Law isn't necessary by whoever57 · · Score: 1
      What is not clear is what can s/w do before it is spyware as defined by the law? As reported on Yahoo, "changing security settings" is pretty vague. It the program just reports home on activity and does not send credit card numbers, etc. would this be considered spyware? I suspect not.

      Lofgren said her daughter was recently victimized by electronic thieves in a phishing scam

      Suggestion on how to get a new law passed: target close relative of Senator/Congressperson in legal but repugnant manner, sit back and wait for the inevitable knee-jerk response. Now, how do we get the RIAA to sue some poor Senator's son/daughter?

      --
      The real "Libtards" are the Libertarians!
    21. Re: Maybe another Law isn't necessary by SamSeaborn · · Score: 3, Interesting
      hey.. yeah! illegal to install stuff in windows/*!!

      Firstly, I'm of the mind that developers should (unless not possible) isolate their entire application to their own directory and only go into c:/Windows only when absolutely necessary. This makes things much cleaner (and is generally the Mac approach, by the way, that's why you can just drag and drop one icon to the applications folder to install something on a Mac).

      Secondly, obviously there are times when an application *has* to place files under c:/windows -- in fact, Microsoft implemented a certification program for drivers with XP so now you get warned suring installation if the driver isn't certified for XP. (The is a cash grab by MS, but in their defense they attribute most XP instability problems with bad driver code written by third parties so it's a reasonable undertaking.)

      In cases where an app needs to put a file in c:\windows I have no problem with "Call Of Duty wants to install a driver in c:\windows\system -- is that okay?" I'll just click 'yes'.

      But I want to be able to click 'no' when "App-you-didn't-even-mean-to-install wants to replace your NOTEPAD.EXE and WRITE.EXE with spyware -- is that okay?"

      Sam

    22. Re:Maybe another Law isn't necessary by danheskett · · Score: 2, Insightful

      consumers, holding the corporations that make operating systems that are prone to spyware accountable.
      That's a bogus idea.

      Spyware is indistingushable from regular software except in the case of the actions of the program. Short of creating a blacklist, no operating system should or could block spyware.

      Since a huge portion of spyware is actually adware which installs with other applications, it seems highly likely that no matter what OS is used as long as the user has rights to install software spyware will exisit.

    23. Re:Maybe another Law isn't necessary by charlesbakerharris · · Score: 1

      OS makers are dumb, and yes, should be held accountable when appropriate. However, I hope you're not seriously suggesting that we should *not* hold the spyware makers accountable as well... It's not one or the other - we can hold both accountable, and should.

    24. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 1, Informative

      Actually you dont even need to rewrite the PROM to change a MAC address, all it takes is the right ioctl() call directly to the ethernet chip.

    25. Re:Maybe another Law isn't necessary by micromoog · · Score: 1

      It can still make what they're doing illegal to continue doing.

    26. Re:Maybe another Law isn't necessary by itsnotthenetwork · · Score: 2, Informative

      True, but it will stop them from doing it after the law is passed. They will not be able to be procecuted for doing it while it wasn't aginst the law. That means that they will not be able to continue.

    27. Re:Maybe another Law isn't necessary by AviLazar · · Score: 1

      How should we go about this? The companies who hire these spyware companies just claim that they had no idea - and in some cases it is true. A law that punishes these guys criminally is what the Dr. ordered.
      I think that companies who hire spyware makers should also be punished (just in case your local US company decides to hire someone from China). But then you need to prove that the company knew of such actions (which shouldn't be that impossible, because I doubt the spyware maker would make the software without getting paid for it...and thusly, would need to disclose what he is charging).

      --

      I mod down so you can mod up. Your welcome.
    28. Re:Maybe another Law isn't necessary by jtdennis · · Score: 1

      if you continue doing it after the law is passed, however, then you can be punished. At least that's how I understand it.

      --
      -- "Freedom is the right of all sentient beings" -Optimus Prime
    29. Re:Maybe another Law isn't necessary by drinkypoo · · Score: 1

      Right, that changes it temporarily. To change it permanently requires a change to the PROM, which is also how you change the hostid.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    30. Re:Maybe another Law isn't necessary by KilobyteKnight · · Score: 1
      You do realize that to be a "Nielson" household you have to volunteer. It's one thing to volunteer to have your browsing habits monitored, and something else to have crap like gator shoved onto your pc because you don't know any better.

      "Volunteer" may not be the proper term. I've done it twice. They solicited me, I didn't go to them and "volunteer". I did willing agree to fill out their survey form. And a survey form is really all it is. Your supposed to write the shows down as you watch them, but we just wrote down the shows we liked before mailing the form back. My guess is most people do that.

      My ex-wife used to fill out surveys and stuff like that habitually, which is my guess as to why we were selected. In essence, they got our information in the old fashoned pre-spyware way.
      --
      When will Windows be ready for the desktop?
    31. Re:Maybe another Law isn't necessary by GeorgeMcBay · · Score: 1

      They were very likely taking the IP address reported from your incoming packets and doing a RARP trace on it to get your MAC address. This doesn't work in a whole lot of common situations (eg. many potential users all behind the same NAT), so it isn't a good solution for a real web application or site.

    32. Re:Maybe another Law isn't necessary by Lordplatypus · · Score: 1

      "even if our computer clocs are out of date by a couple minutes" Maybe a bit Non sequitur but I thought I would mention a great link, in my mind, for getting automatic time updates. http://boulder.nist.gov/timefreq/service/its.htm

      --
      Diplomacy is the art of saying, 'Nice doggie!' till you can find a rock.-- Wynn Catlin
    33. Re: Maybe another Law isn't necessary by Sycraft-fu · · Score: 2, Insightful

      Because lots of stuff messes with the Windows director and MS would catch shit for it. I mean people got all up in arms about driver certification. Basically Windows will by default whine if you try to install a driver not blessed by MS. People got all up in arms that MS was trying to control the hardware market and force people out and so on and so forth.

      They'd catch even mroe shit for this since it would bitch basically every time you isntalled an app, and few people take the time and money to get their apps sighed (you can do it and Windows does check, it just doesn't say anything to admins).

    34. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0


      Penalizing criminal acts is good.

      If it's a criminal act then what good does passing another law making it a criminal act do?

      I don't like spyware any more than the next guy. But spyware is installed with the users consent. The fact that the installation might be more than upfront doesn't change the fact that the user consented to the installation. If I sign a contract and don't bother the read the teeny, tiny print I can't claim that I didn't know. It's up to me to know before signing.

    35. Re: Maybe another Law isn't necessary by bloosqr · · Score: 1
      Thats what ownership/group privileges are for. If windows shouldn't be "system" readable then it should have its own user/group. Another reply to your post mentioned this, but there is something to be said for doing something along the lines of having each program have its own user/group id and have us autoadded to the group of the program. Programs would then write suid'd to the application id and have write permission only in subdirectories of the home directory which the user had set up the user priviledges for w/ in practice the original install script can either setup or the "first run" which will ask your for your own passwd. This way any malicious hack attempt after the fact at least won't scribble all over your home directory.


      -bloo

    36. Re: Maybe another Law isn't necessary by bloosqr · · Score: 1

      woops readable = writable

    37. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 1

      I was just thinking off the top of my head- but as it turns out while you can't do it in JavaScript, if your site is IE based anyway you CAN do it in client-side VB script (http://www.planet-source-code.com/vb/scripts/Show Code.asp?lngWId=4&txtCodeId=6312). As for the MAC spoofing part- you're not going to be perfect, but hey, it's easy to delete a tracking cookie too.

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    38. Re:Maybe another Law isn't necessary by AK+Marc · · Score: 1

      Maybe we should stop passing laws to punish the Spyware makers and start, as consumers, holding the corporations that make operating systems that are prone to spyware accountable.

      Maybe we should stop passing laws outlawing running red lights and start, as consumers, holding the corporations that make cars capable of running red lights accountable.

      No, it looks like holding the company that makes something that can be misused accountable doesn't work for a "justice" model.

    39. Re:Maybe another Law isn't necessary by gammygator · · Score: 1

      Would these laws take the burden off the software and OS manufacturers to code secure products?

      In the case of phishing, I suppose it might take the burden off users to pay attention to what they are doing.

      In any case, as an IT guy there are days I'd like to find the jokers who do these kinds of things and beat them with a stick. Maybe this law is that stick...

      --

      No Nyarlathotep, No Chaos
      Know Nyarlathotep, Know Chaos
    40. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 0

      Go client side with the coding and return it as a CGI variable in the login script: http://www.planet-source-code.com/vb/scripts/ShowC ode.asp?lngWId=4&txtCodeId=6312

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    41. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 1

      http://www.planet-source-code.com/vb/scripts/ShowC ode.asp?lngWId=4&txtCodeId=6312 with a client-side VB Script (took me some time to find this, but it does exist). Might be IE specific though...not sure. As for it being trivial to change- well it's rather trivial to delete a tracking cookie also. But which is a luser more likely to know how to do? Hit "clear cookies" in IE or change their MAC address?

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    42. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 1

      http://www.planet-source-code.com/vb/scripts/ShowC ode.asp?lngWId=4&txtCodeId=6312 with a client-side VB Script (took me some time to find this, but it does exist). Might be IE specific though...not sure.

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    43. Re:Maybe another Law isn't necessary by grumpygrodyguy · · Score: 3, Interesting

      Good Riddance Gator/Claria. The world will truly be a better place

      Yes, but these kinds of laws set a very dangerous precedent for all of us. Putting people in jail for distributing spyware is very irresponsible. Fine them to death so they can't make payroll, whatever, but jail time?

      What if the next law throws you in jail for trading music? Or for selling software that conflicts with someone else's very dubious software patent?

      Time and again congress has demostrated that it is completely incompetant with regard to information technology. They are ill informed, have no expertise or training with technology, and seem only interested in extending the paradigm of centralized control into the internet. Which is exactly the opposite of what makes the internet great.

      The last thing I want to do is defend spyware vendors, but going from discussing a bill to imposing jail sentences in less than a week is scary. These people just seem to love sending people to jail. America has the highest number of citizens in jail per-capita of any country in the world. Applauding moronic laws like this is just giving them permission to raise that statistic even higher.

      --
      The government has a defect: it's potentially democratic. Corporations have no defect: they're pure tyrannies. -Chomsky
    44. Re:Maybe another Law isn't necessary by jcern · · Score: 1

      I think if you read section ii (extracted from the text of the bill), that cookies established for tracking logins would be clearly exempt.

      (B) EXCEPTION FOR COOKIES- Such term does not include--

      (i) a cookie or other text or data file that is placed on the computer system of a user by an Internet service provider, interactive computer service, or Internet website to return information to such provider, service, or website; or

      (ii) computer software that is placed on the computer system of a user by an Internet service provider, interactive computer service, or Internet website solely to enable the user subsequently to use such provider or service or to access such website.

    45. Re:Maybe another Law isn't necessary by brianosaurus · · Score: 4, Insightful

      Its unfortunate that there is another law, but its even more unfortunate that it got to the point of NEEDING another law.

      Its unlike the controversial DMCA and INDUCE Acts, which are pre-emptive strikes from a huge lobby, establishing laws before there is a problem. Spayware is a problem, amd its becoming more of a problem every day.

      Sure everyone knows its "wrong", but its not yet illegal so unethical types will exploit it. Of course we're now exposed to the unethical types who will exploit certain interpretations of the law, but hopefully the Justice Department can do something about them.

      Laws don't make things right or wrong, they just make things illegal. The behavior was wrong/right before the law eas enacted, but the community was, apparently, powerless to do anything.

      Perhaps Microsoft (for example, since approximately 100% of the spyware I know of is for Windows) could have come up with a technical solution to the problem, but they didn't so now its a law.

      --
      blog
    46. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      Strange, when my parents signed up they came and installed something inside the TV and the VCR. A few months later they found out that one of the people in the household, myself, had video game consoles, and said that they had to install something in those too to monitor how often they were used. When I said nobody is touching my conosles, they said they wouldn't be able to use us as a "Nielson family", they came out and had to deinstall their equipment from the TV and VCR, and broke the VCR in the process, which they replaced.

    47. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      (B) EXCEPTION FOR COOKIES

      Oh fucking great, now all the web sites will have a registration link link NY times has to side skirt the legal definition of the law.

    48. Re:Maybe another Law isn't necessary by codeguy007 · · Score: 1

      You still don't know anything about networking. You will not necessarily get the person MAC address with that code but the MAC address of the last router between you and him.

    49. Re:Maybe another Law isn't necessary by Marxist+Hacker+42 · · Score: 1

      Running CLIENT side? Ok, so I send a client side script to somebody's machine- how is it supposed to know the last router between me and him when it's querying the computer for the local MAC address?

      If you run this script server side, yes, I completely agree.

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    50. Re:Maybe another Law isn't necessary by GlassUser · · Score: 1

      By the different IP addresses?

      Do you know the difference between routing and network address translation?

    51. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      even if our computer clocs are out of date by a couple minutes

      Just go to System Preferences, Date & Time, and check "Set Date & Time automatically." Oh yeah, you need a mac for that though.

    52. Re:Maybe another Law isn't necessary by WillerZ · · Score: 1

      Dude,

      That's an ASP script, which executes code in a command shell.

      There is absolutely no way that runs on the client machine as-is.

      If you modified it to be a client-side script, well even the default IE settings would stop that behaviour.

      Phil

      --
      I guess today is a passable day to die.
    53. Re:Maybe another Law isn't necessary by Frizzle+Fry · · Score: 1
      Would you like to be egregiously harmed only to be told that, although it should be illegal, nobody has got around to writing a law against what has happened to you

      If the alternative requires me to trust Congress and the courts to correctly figure out who should go to jail for writing software that they don't like, then I would seriously consider it.

      People will often support something that goes against their principles and true interests if you claim that it will reduce their taxes or stop "terrorism". Slashdotters see through that and think that they're some kind of visionaries for it. But then, as soon as they're told that a law will prevent "spyware" or stop "spammers", they have the exact same reaction.

      I, for one, am very wary of letting the government say what kind of software can or can't be written and who goes to jail for writing what code. I'm not saying that their shouldn't be any rescrictions. Just that too many people here are too quick to support laws they haven't even looked at or researched if they are told that they are "anti-spyware" or "anti-spam", and one day this is going to come around and bite them in the ass when the government (and the interests that control it) abuse these laws.
      --
      I'd rather be lucky than good.
    54. Re:Maybe another Law isn't necessary by SirTalon42 · · Score: 1

      Windows and Linux do it too.

    55. Re:Maybe another Law isn't necessary by chamblah · · Score: 1
      By the different IP addresses? If I'm behind a router which has one address and mac then it wont be passing my internel network IP addresses up to a site I'm visiting. That seems to me to be a rather bad security choice there.

    56. Re:Maybe another Law isn't necessary by GlassUser · · Score: 0, Flamebait

      If I'm behind a router which has one address and mac then it wont be passing my internel network IP addresses up to a site I'm visiting. That seems to me to be a rather bad security choice there.

      I think you need to learn how routing works.

    57. Re:Maybe another Law isn't necessary by Reziac · · Score: 1

      Not only that, but what if, say, the OS covertly phones home with all sorts of info you didn't give it explicit permission to report? is that spyware, or just "good clean activation fun" ??

      --
      ~REZ~ #43301. Who'd fake being me anyway?
    58. Re:Maybe another Law isn't necessary by Motherfucking+Shit · · Score: 1
      You do realize that to be a "Nielson" household you have to volunteer.
      Not recently. I don't know how it worked in the past, but I have participated twice over the last three years. Both times, I received a packet in the mail. The packet contained five $1 bills, an instruction pamphlet, and a log book. In the log book, you record what you watch and when, then after the time period is up (I believe it's 1 week) you return it to them in a postage paid envelope.

      Pretty low-tech process, actually; I was surprised that this is how they compile their ratings. I could have written down anything in the log book, it wouldn't necessarily have reflected what I actually was watching on TV. I was also surprised that they routinely send cash through the mail, certainly carriers know what's inside that envelope, I wonder how many of them never make it to their true destination, and I wonder how many letter carriers are sending in tens of Nielsen booklets a month*, skewing the results?

      *Not accusing letter carriers of any misdeeds, but I've been in the mail cartage industry since I was 14 and I know a thing or two about how it works...
      --
      "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
    59. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      Over the long haul, Darwinism will balance things out and the law will be just a hoop and dance show for elections.

      Wrong answer good buddy. Phishing is surprisingly effective even against some people who consider themselves tech-savvy.

      A good fishing scam doesn't care what browser/platform/career you choose. The best of the best phishers are good enough that they don't have to work on everyone, just a few will do.

      I'm not sure more new laws are a good thing, since phishing is technically fraud anyway, and laws already exist making this a crime.

      However, I just wanted to point out the flaw in the idea that "only stupid poeple" get hooked by phishers. As a demonstration, someone I know went through various chatrooms with a fake name (female) pretending to be some hot chick with pictures in her profile. It was amazing to see that in just a matter of hours over 500 account names were snagged. It was done purely to prove a point, and I won't say too much more about it because demonstration or not, it is potential jailtime for the one responsible.

      For the right bait, even very smart people will bite the hook.

    60. Re:Maybe another Law isn't necessary by plague3106 · · Score: 1

      So its your fault that you got broken into b/c of a faulty lock, that you may have not known was faulty? Good logic there.

      The other half of this story isn't that the victim is the only one that suffers the consequences of spyware. How much bandwidth do you think spam and other spyware related traffic takes up? Your connection will be just as slow using firefox as IE.

    61. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      No, you do. chamblah is right; the IP and MAC addresses of machines behind a firewall are not available. Unless a persistant HTTP connection is maintained, there is no way for a server to determine from which "user" (machine) behind a firewall that an HTTP request originated. If two machines behind a firewall are browsing the same web page, then only the TCP port numbers will be different; the IP addresses will be the same, and, as far as the server can tell, belong to the same machine.

      There are two ways to maintain a login through a firewall: cookies, and URL mangling.

    62. Re:Maybe another Law isn't necessary by mr_z_beeblebrox · · Score: 1

      What if the next law throws you in jail for trading music? Or for selling software that conflicts with someone else's very dubious software patent?

      What if? You are citing examples of breaking the law that you currently get away with as a reason not to punish another lawbreaker. What if... you got your music from recognized legitimate sources, what if... you either licensed patented code for use or you correct any found infringements.
      I can agree with the fact that we bandy jail terms pretty liberally but the people who do it are ELECTED officials. You won't make a change by posting to /.

    63. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      "Putting people in jail for distributing spyware is very irresponsible. Fine them to death so they can't make payroll, whatever, but jail time?"

      heck, they WONT pay. NEVER. if company FooBar is sued and fined to death, so what ? they will close this shop (a fake shop, anyway) and just open another one, same adress, same all.

      oh, and did you try to sue spammers, just for fun ? did it stop the spam problem ?

      jail time is a ok sentence for the criminals using spyware. intruding into a computer that does not belong to you is a crime, and spyware just does that, period.

    64. Re:Maybe another Law isn't necessary by torstenvl · · Score: 1

      "a reason not to punish another lawbreaker..."

      First, I object to your negative connotation of "lawbreaker" as though all lawbreakers need punishment. This is equivalent to saying all laws are good, which is self-contradictory. There is a law in Massachusetts that says no one may DENY marriage to same sex couples, while there is a law in Wyoming that no one may ALLOW marriage to same sex couples. Obviously not all laws can be good.

      Second, laws are attempts to specify unequivocably certain parts of morality, which -- by its nature -- is relative. This is a flawed design from the very beginning. Everyone knows that "eye for an eye" and "tooth for a tooth" don't work. The Law (meaning the enforcers thereof) know this, know that what they do has no benefit to society, know that punished criminals are more likely to commit crimes again. You know this too, whether you like to admit it or not. Otherwise, a previous criminal record wouldn't count as circumstantial evidence against a suspect (not officially but if an accused person has a criminal record you know goddamn well the jury's going to be more inclined to convict him).

    65. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      For someone who has time to post...you should take the time to actually read the bill. Claria is actually working with the government in the creation of the bill. They are safe.

    66. Re:Maybe another Law isn't necessary by dewke · · Score: 1

      Ok, maybe volunteer isn't. But you ACTIVELY consented. Spyware doesn't go by active consent which is the difference.

      --
      Oderint dum metuant
    67. Re:Maybe another Law isn't necessary by buysse · · Score: 1

      Well, that's not very cross-platform. ;)

      --
      -30-
    68. Re:Maybe another Law isn't necessary by Sandy+Koufax · · Score: 1

      This is just another example of how out of touch or ineffective our elected representation is. If you agree to have spyware loaded on your box, it's still legal. Read the TOS agreement before you "sogn up" or install "freeware" - you agree to be violtated.

    69. Re:Maybe another Law isn't necessary by Anonymous Coward · · Score: 0

      So it's ok for me to write virus programs?

      How about trojan horses?

      What about mass email (with an established bar of say 100,000 pieces of mail a day...)?

      Why not "spyware"? As long as the accurately describe what defines spyware then fine. Laws are evolutionary until they get it right anyway. Would you prefer NO law EVER? Is the industry supposed to regulate itself on this? Why would MS or HP or Peoplesoft want to spend money on this kind of regulation?

      The real issue is that the anti-spyware part of the market in some situations are just as bad as the spyware makers themselves. Regulation WILL NOT work in this situation. There needs to be legal boundaries here.

  2. and so... by scaaven · · Score: 5, Funny
    And so marks the end of Real.

    evil empire...

    --
    I know I'm going to be modded up on this
    1. Re:and so... by grolschie · · Score: 1, Funny

      Yeah, lets hope [buffering...] so, eh?

    2. Re:and so... by Anonymous Coward · · Score: 0

      And Microsoft XP, Windows 2000, Windows 2K3 and presumably Lockhorn. Yipee !!

    3. Re:and so... by trogdor8667 · · Score: 2, Interesting

      In all seriousness though, what will happen to Microsoft now? Doesn't their EULA give them permission to access your computer and gain administrative rights? Won't this bill make that provision null and void?

    4. Re:and so... by AviLazar · · Score: 1

      If they are using that access to spam your computer yes - if not, no. Then again, if the law is not a dummy law (non-waivable) then by agreeing to the EULA you must accept the terms
      Also, some of the tracking features can be disabeled - and if I remember correctly - spyware makers just need to ask for your permission. So if you consent to it then you are free game :D

      --

      I mod down so you can mod up. Your welcome.
    5. Re:and so... by WhiteWolf666 · · Score: 2, Insightful

      They spam computers.

      'Setup your MSN Passport'

      'Click here for MSN messenger'

      'Use this wizard to sign up for MSN internet service'

      Blah, Blah, Blah.

      --
      WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
    6. Re:and so... by trogdor8667 · · Score: 1

      But at the same time, to me, EULA's are typically not understood by your average user. I know I don't understand half of what they say, and I'm a third year college student. Is it really fair for Microsoft to be able to put one line in their EULA that gives them full rights to take YOUR computer over and view your files, passwords, personal documents, etc? What makes this any different from the people who do it illegally? Is it really any different from the telemarketers and other salesmen and the like who prey on people's stupidity?

    7. Re:and so... by AviLazar · · Score: 1

      EULA's are only taught to forth year students :D
      In all seriousness, I have read parts of the EULA and I understand those parts - but in reality your average (actually MOST) computer user does not take the time to read it because it is so long.
      Most EULA agreements are similar enough. In our society, if you sign a contract without reading it - it's your fault and you are still bound by the contract; otherwise people would sign contracts and later say "but I didn't read it, so I can have it recinded at no fault."
      The difference doesn't come from who does it legally or illegally - the difference comes from who flat out states that they are collecting data from you and how easy it is to remove the data collection program. i.e. Bearshare comes with two spyware programs (save and weathercast) - it tells you about both of these programs and removing the both of them is easier then uninstalling Doom 3 from my computer.
      Stupidty has never been a viable excuse from the law (unless your IQ makes you mentally retarded).

      --

      I mod down so you can mod up. Your welcome.
  3. Simple Answer by Da_Fridge · · Score: 0, Redundant

    No going to work. So why bother even trying. Another useless law like DMCA........

    --
    If I wanted water, I'd ask for DiHydrogen Oxide!
    1. Re:Simple Answer by nomadic · · Score: 2, Interesting

      If you can get even a few convictions, then it's not useless. Besides which, unlike with most viruses it's actually possible to track down spyware makers and users, because there's almost always a profit motive, and you can follow the money. It's not easy, of course, especially with the transnational issues, but its possible.

      And what's the other option? Some spyware is basically uncleanable (especially the nastier CWS variants), and while it's fun to blame Microsoft it doesn't really help.

    2. Re:Simple Answer by Anonymous Coward · · Score: 0

      What makes you think it won't work? Unlike spam spyware can be tracked to a real company. The spyware has to report back somehow and wherever it is reporting back to can be tracked.

    3. Re:Simple Answer by Da_Fridge · · Score: 3, Insightful

      The Problem is that, this law is really unenforcable. Atleast, not to the point where it is financially practical. The only way to stop it is either to build better programs, or not to go to sites where this stuff begins. I am a lucky one, I DONT (as in not 1 piece) get SPAM. I dont go to these sites and I stay clean. People always forget, the internet is just like the hooker from Thailand. They are both dirty and before you use them you need protection.

      --
      If I wanted water, I'd ask for DiHydrogen Oxide!
    4. Re:Simple Answer by Da_Fridge · · Score: 1

      The company is based in Brazil. No extradition rights. Now what? They will just be a shill for a US company. How do you stop that?

      --
      If I wanted water, I'd ask for DiHydrogen Oxide!
  4. been there by GerbilSocks · · Score: 5, Insightful

    Spyware will just move offshore. More governmental bullshit.

    1. Re:been there by Anonymous Coward · · Score: 0

      So may move offshore but there is additional cost in doing that. And even if they move their servers offshore their businesses will still have to operate in the US at some point.

    2. Re:been there by InfiniteWisdom · · Score: 2, Interesting

      Not of they want to sell their spyware-ridden "adware" in the US

    3. Re:been there by Reziac · · Score: 1

      And I had the thought... are we so sure it's such a good idea to criminalize each and every type of PITA? might not this create more issues than it solves, akin to the CAN-SPAM Act?

      There is already a law (aimed at virus authors) that makes it illegal to covertly install anything on another person's computer that impairs its functionality. (I think we can all agree that spyware impairs the average system's functionality.)

      There are already laws against fraud, and phishing is nothing more than a specialized type (aka subset) of fraud.

      I RTFA (the Yahoo link, anyway), but I didn't see how this new law is superior to those existing general-case laws. Seriously, any legal types here care to give us a reasoned analysis?

      Not to mention, I'd like to know how this will affect phishing sites in.. oh, say, Korea...

      --
      ~REZ~ #43301. Who'd fake being me anyway?
    4. Re:been there by mr_z_beeblebrox · · Score: 1

      Spyware will just move offshore. More governmental bullshit.

      Great... Now the indians get to write all the software. Legit or not.

      kidding

    5. Re:been there by bani · · Score: 1

      "I didn't see how this new law is superior to those existing general-case laws"

      The new law spells out huge fines and prison time. It also funds a special unit to specifically pursue and prosecute these crimes.

      That's why this law is superior.

      As stated before, it doesnt matter where the sites are hosted, because the phishers are americans.

    6. Re:been there by Reziac · · Score: 1

      So, just because a given type of fraud occurs via internet, it somehow deserves a much harsher penalty than ordinary meatspace fraud??

      Isn't that exactly what most of us here have been railing against -- making internet-enabled and/or IP-related crime a special case?!

      In meatspace, a typical criminal penalty is a fine of 3 times the cost to the defrauded party, and direct restitution of immediate monetary loss (NOT of some potential or imaginary loss). In cyberspace, it could come to thousands of times that much -- for the same level of fraud.

      BTW, all but one of the phishers I've bothered to track down have been in Korea, or rarely in eastern Europe. The only American IP address was some dork on a cable modem.

      (From your comment I couldn't tell if you were being sarcastic or not, but for the sake of discussion I took it seriously :)

      --
      ~REZ~ #43301. Who'd fake being me anyway?
    7. Re:been there by bani · · Score: 1

      american phishers host their sites in china, korea, and eastern europe. its quite easy to follow the money trail though, which is how phishers get caught today. it always leads back to americans.

      the reason why the penalties are so high is that the internet is the basically wild west right now, completely overrun by criminals. penalties in the early wild west were similarly severe in order to curb crime.

      the other thing the bill does is to fund a specific special law enforcement division to prosecute specifically these crimes.

      sanford wallace is #1 on the list.

  5. Loophole City by American+AC+in+Paris · · Score: 5, Insightful
    From the Yahoo! blurb:

    It would add penalties of up to five years in prison for people convicted of installing such programs without a computer user's permission.

    If this is really the case, this law isn't going to do a damn thing--all it means is that spyware developers will need to put a sufficiently dense bunch of legalease on page eight of the EULA. (It was noted somewhere--NPR, I think--that the typical EULA is measurably longer than the Constitution of the United States...)

    "From time to time, Awesomeness2004!!! Pro may gather usage statistics and other information and transmit this information to the ShadyCorp central server."

    "By clicking 'I Agree', you grant ShadyCorp permission to install Awesomeness2004!!! Pro. To take advantage of certain advanced features, Awesomeness 2004!!! Pro requires SnifferExeDllBuddy. SnifferExeDllBuddy may track and report usage statistics and other information."

    "ShadyCorps is concerned about your privacy. Your personal information will only be made available to ShadyCorp and approved ShadyCorp partners."

    Forget teeth--this law'll be lucky if it can manage to gum hungrily at the bastards' ankles. How about a law that renders post-POS EULAs null and void?

    --

    Obliteracy: Words with explosions

    1. Re:Loophole City by Trigun · · Score: 1

      It's a lot better than the 'Visit a website, get p0wn3d' business model. I'll gladly put up with the 'Visit a website, get asked to get p0wn3d', then say no model.

      I just hope that they don't start using sentences like 'Do you not wish to take part in this software, by agreeing to not install this software?'

    2. Re:Loophole City by Ibanez · · Score: 1

      But then again, EULA's haven't been proven to be enforceable, correct?

      Blake

    3. Re:Loophole City by hackstraw · · Score: 1

      Now this brings up again the legality of EULAs.

      What if they just put in the EULA, "By clicking Yes, you agree to let us do what we want with your computer and any information passing through it which will be determined by us unbeknown to you at any time"? Of course it will have much more legalese in it and be on at least page 8 of the legalese.

      Also, there is no law that says that one must be above the age of 18 to install software, but there is a law that noone under 18 can sign a legally binding contract, so the 1st "spyware like" thing that happens to a minor is not protected by their EULA.

    4. Re:Loophole City by choprboy · · Score: 3, Informative

      It was noted somewhere--NPR, I think--that the typical EULA is measurably longer than the Constitution of the United States...

      It was on NPR, yesterday I believe (but I can't find the link at the moment). The company in question was Gator (AKA Claria), which has a EULA longer than the constitution.

      However, it should be noted (as stated in the interview) that nthis law is completely useless anyways do to the "EULA permission" exception. Two of the biggest proponents of the legislation are WhenU and 1800Solutions... two of the worst spyware/adware companies out there.

    5. Re:Loophole City by Anonymous Coward · · Score: 0

      Found the audio. It was on "Marketplace", Weds Oct 6th, immediately following "All Things Considered" on most NPR stations. The link is here:

      http://marketplace.publicradio.org/

    6. Re:Loophole City by Tired+and+Emotional · · Score: 1

      In practice that will have to be decided in court. The defendent would have to successfully argue that they had made a bonified effort to gain consent. Putting the language on page 8 in one point Cyrillic is unlikely to succeed as a defense.

      --
      Squirrel!
    7. Re:Loophole City by DigitalCrackPipe · · Score: 1

      How about a law that renders post-POS EULAs null and void?
      I've always wondered how EULAs were legal in the first place. A binding contract is supposed to have a meeting of the minds before it's valid... so if you don't see/understand something in it how is that section binding? 'Course, IANAL...

    8. Re:Loophole City by KeillandGlr · · Score: 1

      Hmmm... EULA's are NOT legally binding contracts at all anyway, lol. (Well, apart from a few). The more shit that gets put into them that piss people off the better, just so we can get rid of (most of them) once and for all. The reason WHY they are not legally binding is simple - there is NO record, (and no way of proving - (unless it involves personal/identifying information, such as some online stuff asks for)), of who actually agreed to the 'license' in the first place - proof of purchase is NOT the same thing... The problem with this - is that the companies like to use them as 'scare tactics', since they know they are not legally binding and therefore put everything under the sun in them... And if it was an official license agreement, then it would help if it was to be agreed upon at point of purchase - since that is what you are buying... The reason why they have come about - is that although Copyright Law gives the companies a lot of 'protection' over the software - they want MORE control, which is why the EULA came about - they wanted all the power that licensing gives them, but without the administrative overhead. It's about time that the two - buying (copyright), and licensing, were seperated a lot more, since they should be completely exclusive - Either we buy a product OR we buy a license to use it, not both - (which is what they want). Though, TBH - a 'proper' licensing system for software wouldn't necessarily be a bad thing. (Unless your a pirate). Since they'd know who all the licensee's are, and which copy is licensed to which person - they'd be no need for any stupid copy protection or even non-full-installs. And back-ups would be perfectly legal too. And if anyone pirates the software - they'd know who's copy it was and who to punish... Like I said though - the Administration cost would be a lot higher...:-/

  6. Neilsen pays you cash money. by glrotate · · Score: 5, Insightful

    Spyware installs surreptitiously and degrades you performance.

    What spyware outfit do you work for?

    1. Re:Neilsen pays you cash money. by Anonymous Coward · · Score: 0

      Only on slashdot 'surreptitiously and degrades you performance' will get you insightful.

  7. sorta OT by Lxy · · Score: 4, Interesting

    Is there a good HOWTO on cleaning up a Windoze box from spyware and keeping it clean? I use the following method:

    Install Ad-aware, update, clean, reboot, clean
    Install Spybot S&D, update, clean, reboot, clean
    Install Spywareblaster, update, enable protection

    This method has worked pretty well in the past. In the last couple days, I've gotten infected by some browser hijackers and no amount of cleaning and resetting things will delete the %$#@$$#%ers. Is there a better method?

    --

    There is no reasonable defense against an idiot with an agenda
    :wq
    1. Re:sorta OT by scaaven · · Score: 2, Insightful
      install Firefox.

      seriously, I used IE for a while and got fed up with closing pop-ups and saying NO to installing INTERNET GAMBLING.EXE or PORNVIEWER.EXE. firefox is a breath of fresh air.

      --
      I know I'm going to be modded up on this
    2. Re:sorta OT by aliens · · Score: 1

      4) Install AVG or some other Anti-Virus if not there already.

      5) Collect funds or some compensation for cleaning lusers computer

      6) Profit

      --
      -- taking over the world, we are.
    3. Re:sorta OT by Marxist+Hacker+42 · · Score: 1

      http://www.informationr.us/ - on my website (link not clickable on purpose, it's hosted on a DSL line) I have a downloadable zip I call my Anticyberterrorism toolkit. In there is a neat, but potentially dangerous, little program called HijackThis! which is the best way I know of to get rid of crap that loads at startup. The dangerous part? It also flags valid programs, drivers from your hardware, pieces of Windows itself, as potential spyware- so be carefull deleting. However, it will get every damed BHO off the system if you want it too, and then some....

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    4. Re:sorta OT by NeoSkandranon · · Score: 3, Informative

      I use Spybot and Spysweeper, as Ad Aware typically only finds trackng cookies and such like as opposed to spyware (in my experience anyway)

      I also make sure to use Spybot's TeaTimer and ActiveX blocker.

      Installing Firefox is a good way to keep it clean ;-) If it's an option at all on the computers you work on, go for it. It also tends to render a LOT of browser hijackers totally irrelevant.

      As for cleaning the hijackers themselves, I'd reccomend googling for the process name if you know it, odds are you'll stumble on an info site with detailed removal instructions

      --
      If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
    5. Re:sorta OT by Celt · · Score: 3, Insightful

      Yes!
      Stop using IE = problem solved :)
      www.mozilla.org

      --

      --
      "WebTV: bringing the Internet into the shallow end of the gene pool since 1995" - Martin Bishop
    6. Re:sorta OT by vespazzari · · Score: 2, Interesting

      It seems to me that a browser hijacker is alot like a virus- especially if you cannot get rid of it. So why are the antivirus companies not addressing this with there AV software?

      --
      "Alcohol, cause of, and solution to, all of life's problems" -Homer Simpson
    7. Re:sorta OT by Greyfox · · Score: 2, Informative
      Try:

      Unplug network cable, install windows, install SP2 from CD, plug in network cable, install your favorite firewall (I like zonealarm), install firefox, install thunderbird.

      That shoud give you a reasonably tight platform to add other spyware detection and cleaning tools. I like to disable several javascript features in firefox too (No popups et al.)

      I don't actually do Windows, but it seems like I've been setting it up for friends a lot lately...

      --

      I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

    8. Re:sorta OT by NeoSkandranon · · Score: 1

      HijackThis isn't anything more than a glorified msconfig is it? (Serious question, I used it maybe once, and couldn't see much difference)

      --
      If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
    9. Re:sorta OT by kc8tad · · Score: 1

      Wow dude have you ever heard of Mozilla Firefox?? ;)

    10. Re:sorta OT by Lord_Slepnir · · Score: 5, Funny
      the best way I found was:

      c:\>format c: /y

      or, if you want your system to boot up afterwards:

      c:\>format c: /y /s

      Works every time

    11. Re:sorta OT by drinkypoo · · Score: 1

      I use spybot to do the grunt work. The thinking work is done using Mike Lin's Startup Control Panel. My systems have the control panel version installed, and I use the standalone for repairing systems at work. Spybot and Ad-Aware together do not catch many pieces of malware which I have had to remove by hand. Startup Control Panel examines all the registry locations which start programs, not just a couple of them like MSCONFIG. It won't help if you don't know what you're doing, though.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    12. Re:sorta OT by Trigun · · Score: 1

      It highlights browser extensions as well.

      Also, LSPFix or AdAware's LSP plugin are severly effective, and highly dangerous. A definite and necessary part of any toolkit. For the unintiated, Microsoft's TCP stack allows plugins, which have been used by adware and spyware companies to track you. These will allow you to remove them (as well as valid ones, so be careful!)

    13. Re:sorta OT by Marxist+Hacker+42 · · Score: 1

      It's actually a bit worse than msconfig- more dangerous, there are certain things that msconfig won't let you delete that are necessary for the well being of your operating system. Simpler too- it just grabs all of the registry keys and shortcuts that get loaded at startup of Windows and IE and lets you sort them out (msconfig gives you a nice tabbed interface).

      However, it's simplicity is it's strength- and msconfig wasn't available on Windows 2000, so for those machines you need a third party tool. Browser Helper Objects that don't show up in msconfig DO show up in HijackThis!.

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    14. Re:sorta OT by Anonymous Coward · · Score: 0

      1.Boot into safe mode

      2.Disable System Restore for XP / ME

      3.Run Hijack This

      4.Run CWShredder

      5.Run Adaware

      6.Run Spybot SD

      7.Reboot

      8.Install FireFox

    15. Re:sorta OT by Marxist+Hacker+42 · · Score: 1

      Thanks for the suggestion- I might put those in the kit as well. I was unaware of the LSP extensions existing. Certainly agreed on the warning- I'm still rebuilding my operating system that my X10 server runs on (an old slow Win98 box) as after running HijackThis! without looking up every entry I deleted, it would no longer read me the weather report (and worse, lock up instead of reading me the weather report).

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
    16. Re:sorta OT by Rude+Turnip · · Score: 1

      "install your favorite firewall (I like zonealarm)"

      You're halfway there. ZoneAlarm is admittedly helpful for notifiying you of outgoing connections, but I wouldn't put any faith in a software firewall running under Windows (no flame intended). Pick up a cheap Linksys or Netgear firewall and be done with it. No desktop computer should be exposed to the Internet.

      My policy in helping people out is the usual AdAware/Spybot/Firefox/hardware firewall advice cocktail. I then tell them not to bother me again if they don't switch completely over to Firefox and install a hardware NAT box...why should I take time to help you if you don't follow through?

    17. Re:sorta OT by temojen · · Score: 1
      plug in network cable, install your favorite firewall

      This is backwards

      Also, stromngly consider a hardware firewall/NAT router.

    18. Re:sorta OT by whoever57 · · Score: 1
      This method has worked pretty well in the past. In the last couple days, I've gotten infected by some browser hijackers and no amount of cleaning and resetting things will delete the %$#@$$#%ers. Is there a better method?

      1. Dump IE and use Firefox/Mozilla instead.

      2. If you can identify the program that is causing the problem, boot from CD using a Knoppix disk, mount the hard drive and delete the offending files.

      --
      The real "Libtards" are the Libertarians!
    19. Re:sorta OT by arkhan_jg · · Score: 1

      I find HijackThis to be pretty effective at removing browser helper objects. Just add that to your other utilities.

      I'd also recommend you use firefox or opera if you're not already, thus removing one main infection vector.

      --
      Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
    20. Re:sorta OT by Auckerman · · Score: 1

      "I've gotten infected by some browser hijackers and no amount of cleaning and resetting things will delete the %$#@$$#%ers."

      What's a browser hijacker? Sometimes I get really concerned about Microsoft users and the things they learn to accept as a normal computing experience.

      --

      Burn Hollywood Burn
    21. Re:sorta OT by DrMyke · · Score: 0

      i maintain a wide aray of users machines, and i still get calls about every 2 weeks to clean a machine or do a clean install becuae its so hosed.

      Last one i did, when i ran adaware pro it came up with 2000+ so i closed it and did a format and started over.

      That is why i carry a maxtor usb HD with me to make backups of their pst's and favorites. other than that and a few word/excel docs it all gets blown away.

      And on top of it, i charge $120 per hour and get it. because i built the machines from scratch.

      I actually made them BUY legitimate software. (no free software here)

      Bottom line is if you want to make a job of cleaning PC's then yes you can have a second income. But i can attest to this. It is a huge headache and hardly worth the effort, hence why i charge so much.

      --

      -DrMyke
      "mmmmmmmmm, doughnuts" - H.J.Simpson; super genius
    22. Re:sorta OT by Oliver+Wendell+Jones · · Score: 2, Informative

      Mike Lin has a companion program that I also recommend, StartupMonitor. It keeps track of any attempt to add a new item to your startup lists and it pops up and asks you if you really want "evil_gambling_plugin.exe" to run at startup.

      It's kind of like ZoneAlarm, but for your startup processes.

      You can get this and other utilities at his website

      --
      A computer once beat me at chess, but it was no match for me at kick boxing -- Emo Phillips
    23. Re:sorta OT by c.r.o.c.o · · Score: 2, Funny

      I found that

      dd if=/dev/null of=/dev/hda

      works wonders too...

    24. Re:sorta OT by LoudMusic · · Score: 1

      Is there a good HOWTO on cleaning up a Windoze box from spyware and keeping it clean? I use the following method:

      Install Ad-aware, update, clean, reboot, clean
      Install Spybot S&D, update, clean, reboot, clean
      Install Spywareblaster, update, enable protection


      Format? Reinstall? Be very careful how you use your computer and who you let use it?

      Works for me.

      I'm not going to offer any anti-Windows babble, because that's not a true solution. But if you are going to use Windows, you have to know what it is you're dealing with. "Trust No One" (:

      --
      No sig for you. YOU GET NO SIG!
    25. Re:sorta OT by bigtallmofo · · Score: 1

      On your reboots, just add to make sure to boot into "safe mode" no matter what Windows operating system you have before running said anti-spyware applications.

      --
      I'm a big tall mofo.
    26. Re:sorta OT by njfuzzy · · Score: 1

      http://www.apple.com/switch/

      --
      My Photography - http://ian-x.com
      The Deathlings (comic) - http://thedeathlings.com
    27. Re:sorta OT by sqlrob · · Score: 1

      You still want ZA too. A Linksys or Netgear doesn't block outgoing.

      Perfect? Hell no. Another layer to help? Yes.

    28. Re:sorta OT by jafiwam · · Score: 1

      ....except Knoppix (at least the one I DL'ed a month ago) still refuses to write to an NTFS partition.

      MOST machines users end up with nowdays are NTFS.

      Knoppix works great for FAT32 drives though.

    29. Re:sorta OT by Greyfox · · Score: 1

      You can put it on CD I suppose, SP2 provides some firewall functionality and closes up all of the known holes that you have to worry about when connecting a computer to the Internet. Now that you mention it, though, go ahead and put the zone alarm, firefox and thunderbird executables on the same CD with SP2 and you won't have to plug your network cable in until the very end :-)

      --

      I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

    30. Re:sorta OT by AviLazar · · Score: 1

      Prior to plugging in network cable, install firewall, firefox, adaware, spybot, antivirus program and THEN use a network cable...
      My one co-worker said that all this virus and spyware crap is the "cost of doing business"... what a shame that we have to spend valuable resources on this.

      --

      I mod down so you can mod up. Your welcome.
    31. Re:sorta OT by Beyond_GoodandEvil · · Score: 1

      Depending on which version of Windows and which IE you are using you might want to check that someone hasn't corrupted your user defined style sheet to keep reloading all this wonderful stuff. Check under Tools -> Internet Options -> Acceessibility. And use HijackThis to find any Browser Helper Objects(BHO) you think might be suspect.

      --
      I laughed at the weak who considered themselves good because they lacked claws.
    32. Re:sorta OT by budgenator · · Score: 1

      I agree, what's trying to get out tells more than what's trying to get

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    33. Re:sorta OT by jinxidoru · · Score: 1

      Is there a better method?

      Yes, Linux

    34. Re:sorta OT by H0p313ss · · Score: 1

      Browser Hijackers? What's that? Wait a minute, I'm running FireFox that must be an IE feature. I'd offer you my sympathies, but you probably wouldn't believe me.

      --
      XML is a known as a key material required to create SMD: Software of Mass Destruction
    35. Re:sorta OT by Artifakt · · Score: 2, Interesting

      The biggest advantage for the non technical user is that they can take the finished list it produces and submit it for inspection by others, via the website. A user could probably make notes of what lines MSCONFIG shows and google for each one they had doubts about, but that's likely to be more time consuming than the single list, and depending on the user, less productive.
      Also, clicking on the "Info on Selected item..." button in HijackThis gets a pop-up explanation of the selected line in the list. In some cases, this may be all the user needs. For example, asking for "info on selected item" over an entry like "extra button: Messenger" will give the explanation "that such items are "...usually present after system updates (MSN messenger button) and rarely used by hijackers...". The info often lists most of the most common legitmate uses.
      It's not a panacea. At its worst, it gives exactly the sort of information a user can see from running MSCONFIG. For example the info the user will see on the Browser Helper Object (BHO) emplaced by Acrobat Reader won't tell them anything useful if they don't know why they have Adobe Acrobat Reader on their system. That's probably the sort of entry you tried, hence your comparison is fair enough, but it's going to depend a lot on whether what you have on your machine falls into certain classes that have gotten special attention, or not.

      --
      Who is John Cabal?
    36. Re:sorta OT by Anonymous Coward · · Score: 0

      Clean install is the way to be sure. Then install all your programs and add the most important one, Spysweeper http://webroot.com , to the mix. It's better than all three of those programs combined. It will remove stuff that is already running in memory and it will prompt you every time some program tries to install something in the startup section of the registry, and give you the change to remove it.

      It's also good to install before you install any program on a windows box, as it seems every program, Office, Acrobat, Quicktime, etc, etc wants to start when Windows starts. It will prompt you to remove these two.

      I also use Ad-Aware and Spybot. But Spysweeper is hands down the best. It gets stuff that nothing else finds.

      Also, start using Mozilla.

    37. Re:sorta OT by Anonymous Coward · · Score: 1, Informative

      This isn't too far from the truth.
      I'm a freelance IT professional that is making a butload off of this crap. I hate it, but I do like the money it makes me, but I really feel bad for the victims.

      It has gotten so bad and wide spread that even the above mentioned programs do not get them all. I hazard to guess that Spybot, Ad-aware, etc get about 70% coverage. There are times when an complete nuke and re-install is the quickest and cheapest solution.

      Even running Norton, Trend, McAfee, etc. I still have to check the HKLM(HKLU)/Software/Microsoft/Windows/CurrentVesio n/Run and even some older obscure startup keys such as .../WindowsNT/CurrentVersion/Load:

      Dir /a /od *.exe
      Dir /a /od *.dll
      dir /a /od *.bat
      or
      dir /a /od *.*
      in %systemroot% and %systemroot%\system32 may surprize you.

      The other day I found a critter called O.bat and a text file called O
      O.bat launched ftp O
      of course O contained all of the necessary commands to feed the ftp program to download 5 various spyware programs, and when finished the O.bat file executed them. Each putting icons on the desktop poping up more windows.
      These hijacked the IE browser and placed 100s of entires in the hosts file to common sites. So even after running spybot and ad-aware and it found and destroyed the 5 programs, it did not fix the hijack in the browser or the hosts file. so when a hacked URLSearchHook was issued due to mispelling, or typing in a legitamate site because of 100s of mangled entries in the hosts file it would re-run the O.bat file and start all over again.

      In addition to this one is finding a long list of files like:
      dkfjggdf.drf
      hgtretgf.jyt
      sfdghfgj.fgh
      d 4tghdbf.dhg ...etc
      and a hidden ini file with entries such as [clock] [data] referenceing the example scrambled names, I see this one often and so far I have not found any program that detects it. It is impossible to search for anything on it because it is so polymophic and nothing about it is consistant.
      I delete all of the files with dates around the time they were created and it seems to clean it up, and the pop-ups go away.

      Needless to say there is more this than just running programs to clean this garbage off of your computer.

      If you want to be sure, then the post that got Modded as +5 funny, isn't really funny, and should be informative.

    38. Re:sorta OT by PitaBred · · Score: 1

      Why not use the firewall built into WinXP SP2? It's integrated, and from my basic tests, works very well. It'll do incoming and outgoing filtering, notification, etc. Maybe not as nice as ZoneAlarm, but it's good enough for most people.

    39. Re:sorta OT by marty_one · · Score: 1

      I had a problem like this, basically my dad's pc got infected with coolwebsearch crud. The only way that i found to actually get rid of it was to use a program called cwshredder. This little gem will get rid of some of the malware that ad-aware, avg, spybot, etc have a hard time with.

    40. Re:sorta OT by Anonymous Coward · · Score: 0

      You can copy the msconfig.exe file from winXP and use it on a win2k box.

    41. Re:sorta OT by Anonymous Coward · · Score: 0

      Because they can make more money by addressing it as a different problem.

    42. Re:sorta OT by laugau · · Score: 1

      Didn't work at all for me. Maybe I am doing something wrong:

      ******~
      nobody@localhost:> export PS1="c:> "
      c:> format c: /y
      bash: format: command not found
      c:> format c: /y /s
      bash: format: command not found

    43. Re:sorta OT by VoidWraith · · Score: 1

      At least until they start getting really nasty and hide themselves in bootsectors and whatnot.

    44. Re:sorta OT by BillX · · Score: 1

      Except for all the malwares that have learned of the correct Registry incantation (thanks, MS!) to let them load at start-up in Safe Mode too.

      --
      Caveat Emptor is not a business model.
    45. Re:sorta OT by Anonymous Coward · · Score: 0

      *hands you a kleenex* Here. You need this to clean yourself up.

    46. Re:sorta OT by Etriaph · · Score: 1

      I'm not much of a Windows user, but some of the techs I know would recommend Hijack This for browser hijackers.

      --
      "It's here, but no one wants it." - The Sugar Speaker
    47. Re:sorta OT by Anonymous Coward · · Score: 0

      Reboot in safe mode, repeat your steps above. Any strange binaries that reappear, write down the names and be sure to remove them if found when booted under safe mode.

      Make sure you have the "Hide Windows Protect Files" turned OFF, else you may not see some of them.

    48. Re:sorta OT by Anonymous Coward · · Score: 0

      already ran into some which do. The only thing I have been able able to do, is killdisk (write 0 everywhere) the hdd, and reinstall.

  8. More DMCA penalties by Anonymous Coward · · Score: 1, Informative

    "(a) Whoever intentionally accesses a protected computer without authorization, or exceeds authorized access to a protected computer, by causing a computer program or code to be copied onto the protected computer, and intentionally uses that program or code in furtherance of another Federal criminal offense shall be fined under this title or imprisoned not more than 5 years, or both."

    Correct me if I'm wrong, but doesn't this add another 5 years to any penalties assigned for violating the DMCA? (Granted, that only includes violations that use a "computer program or code copied onto the protected computer," but since that covers all conceivable DMCA violations...)

    1. Re:More DMCA penalties by seitentaisei · · Score: 0

      It seems to me that, should Remote Desktop, etc. be hacked into, you wouldn't need to copy code onto the computer. The code was already in place.

  9. Double edged sword by rhsanborn · · Score: 4, Insightful

    Well, I really would like to see the death penalty brought in as punishment for spammers and distributors of viruses and spyware, but I also think that the expansion of law in this area has the potential for being over-broad and being abused. We need to take a long hard look at these solutions and decide whether we want to let the government try and take care of this, or let industry try to weed it out.

    The government can't enforce a large portion of the laws it already has enacted. So they sit there helping no one, all the while they are waiting to be used in ways they were never designed for. I'm just real uncomfortable with it.

    How about we educate users on good internet habits, and let the industry develop better ways to eliminate spyware.

    1. Re:Double edged sword by Anonymous Coward · · Score: 0

      Death penalty for spammers and spyware authors? I can see virus authors depending on the damage they cause, maybe... but spammers? Why not a death penalty for door-to-door salesmen? What about those annoying people who leave flyers on your car? Off with their heads! Anyone being annoying should be killed. I understand that spam and spyware is on a much larger scale, but you can't honestly say someone should die for causing you inconvenience?

    2. Re:Double edged sword by samantha · · Score: 1

      Sending to the world at large (spam) deserves the death penalty? This is "insightful"? I call it utterly psychotic. One person's spyware is another person's distributed agent. Be very, very careful what you wish for. Government power-grubbers will be more than happy to give it to you in triplicate.

  10. not what you think by sklib · · Score: 1

    From the summary of the first bill:

    Makes it unlawful for any person who is not the owner or authorized user (user) of a protected computer (a computer exclusively for the use of a financial institution or the U.S. Government, or a computer used in interstate or foreign commerce or communication) to engage in deceptive acts [etc etc]

    I don't know about you, but my home machine isn't used exclusively by a financial institution or the US government.

    The other option is using my computer for interstate commerce (buying stuff off the web, i guess qualifies) in order for spyware to be evil?

    I don't like it.

    --
    -S
    1. Re:not what you think by Ironsides · · Score: 1

      interstate or foreign ... communication)

      Think e-Mail and surfing web pages from out of state servers.

      --
      Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
    2. Re:not what you think by drinkypoo · · Score: 1

      Please reread the text you quoted. A computer used in interstate communication qualifies. Since basically any use of the web is going to be interstate because some of your traffic is going to go that way (DNS, windows update checks, whatever) essentially every internet-connected computer is covered.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    3. Re:not what you think by temojen · · Score: 1
      or a computer used in interstate or foreign commerce or communication

      Have you never visited a web site outside your home state?

    4. Re:not what you think by greyhoundpoe · · Score: 1

      Personally, I think that's just defensive legislating and a good job of it at that. The government clearly has jurisdiction over its own machines and machines used for commerce, but most spyware can't tell the difference. As long as a program is capable of infringing on government machines, it's vulnerable to litigation.

    5. Re:not what you think by Anonymous Coward · · Score: 0

      or communication

      Send an email, your covered.

  11. RTFS... by plover · · Score: 5, Informative
    The AP reports that the US House of Representatives has unanimously passed a law

    No, the AP correctly reported that the house passed a BILL. A BILL is not a LAW until it passes through the entire congress and the president signs it. (Remember the Schoolhouse Rock song, "I'm just a Bill"?)

    --
    John
    1. Re:RTFS... by lew3004 · · Score: 1

      Oh Jesus....now I'll have that song stuck in my head all night! "I'm just a bill, yes I'm only a bill and I'm sitting here on Capitol Hill....." Crap

      --
      I still can't get the screen shots of Castle Wolfenstein for the Apple IIe out of my head.
  12. Spyware law... by jskline · · Score: 2, Interesting

    What about Microsoft?? What about Real.com, and all these others that require you to license their wares, and these wares send user metadata back to the mother ship! what about all this???

    I bet because of all the Micro$oft(tm) money(tm) floating round in Washington, this will never ever get addressed!!!

    Yup. Another pointless law just to fill lawmakers time up before holiday.

    --
    All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.
    1. Re:Spyware law... by Beardo+the+Bearded · · Score: 1

      I'm going to install my licenced version of MechWarrior IV tonight, then email MS asking for a cheque to settle the unauthorized C-Dilla spyware install out-of-court.

      It might actually end up being a good birthday present after all.

      --

      ---
      ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
  13. Re:first by Anonymous Coward · · Score: 0

    First "offtopic" smackdown for failed First Posting woot!

  14. So where does Microsoft stand then? by Skiron · · Score: 1
    1. Re:So where does Microsoft stand then? by SpaceLifeForm · · Score: 1
      How about a Class-action lawsuit against the OEMs for installing Windows?

      They can turn around and sue ms for creating the spyware platform in the first place.

      --
      You are being MICROattacked, from various angles, in a SOFT manner.
  15. How come they never... by lukewarmfusion · · Score: 3, Funny

    "...has unanimously passed a law..."

    How come they never pass any laws posthumously?

    1. Re:How come they never... by drinkypoo · · Score: 2, Funny

      No, people only vote posthumously.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:How come they never... by cdf123 · · Score: 1
      "How come they never pass any laws posthumously?"

      Because most of them can't spell that, let alone know what it means.

    3. Re:How come they never... by jinxidoru · · Score: 2, Funny

      How come they never pass any laws posthumously?

      Don't give them any ideas. These politicians screw us over enough during their lives; do you really want them screwing us over from beyond the grave.

    4. Re:How come they never... by tepples · · Score: 1

      How come [the House and Senate] never pass any laws posthumously?

      Oh really? Then how did the late Sonny Bono get his copyright term extension through Congress in October 1998 when he had died earlier that year?

  16. Loophole City is To Our Benefit by Anonymous Coward · · Score: 0
    this law isn't going to do a damn thing--all it means is that spyware developers will need to put a sufficiently dense bunch of legalease on page eight of the EULA.


    Good. Maybe this nonsense will bury EULAs forever.

    Better yet, when a few of these fail in court (and they will), a precedent will be built which will make possible a direct legal attack on the EULAs as contracts notion.
  17. GREAT by Exmet+Paff+Daxx · · Score: 2, Insightful
    They just legalised adware:

    (a) Prohibition- It is unlawful for any person, who is not the owner or authorized user of a protected computer, to engage in deceptive acts or practices that involve any of the following conduct with respect to the protected computer: ...
    (E) delivering advertisements that a user of the computer cannot close without turning off the computer or closing all sessions of the Internet browser for the computer.


    Which means, by inference, that you can spam as many ads as you want onto a victim box, provided they are able to close each of the ads by clicking on them. Note that this does not prevent an infinite number of closable ads, just as an infinite number of copyright extension laws is still not infinite copyright.

    Note also -and this is important- that they've made no distinction between a program which resides on the box (actual intrusion) and Javascript. This means that Last Measure and other browser shock sites are illegal. Think about it.
    --
    If guns kill people, then CmdrTaco's keyboard misspells words.
    1. Re:GREAT by Anonymous Coward · · Score: 0

      Which means, by inference, that you can spam as many ads as you want onto a victim box, provided they are able to close each of the ads by clicking on them.

      <pedant>

      That's faulty logic. Consider:

      a) It is unlawful to ...

      E) Kill an elderly man.

      This doesn't imply that it's ok to kill elderly women, or to kill young men, or even to kill puppies. Taking the contrapositive of "it is unlawful to kill an elderly man" yields "not killing an elderly man is not illegal". Or, in your case, it's not illegal to not produce non-closable ads. Formally, this is:

      p -> r
      !r -> !p

      </pedant>

  18. Obligitory by Trigun · · Score: 1, Informative

    Install Linux, don't reboot.

    1. Re:Obligitory by Anonymous Coward · · Score: 0

      Uh install linux and don't reboot? Which distro do you use that doesn't require a reboot of any sort ? That's pretty sweet. 0% downtime even following a full system install on a blank hard drive. sweet!

  19. Wrong Solution by fdiskne1 · · Score: 2, Insightful

    With all the articles I've read recently, I'm thinking we are going about this all wrong. While I don't disagree with making this illegal, I believe the laws will be near impossible to enforce and overlook those ultimately responsible.

    M$ makes Internet Explorer and Windows to be inherently insecure making spyware and viruses possible. I nearly choked when I saw that M$ may be getting into the antivirus business. If they wanted to do that, all they'd have to do is make their product more secure. About the only reason there is an antivirus and anti-spyware market and a spyware law is because M$ makes them possible.

    No, I'm not a karma whore. I'm just stating what I believe.

    --
    But why is the rum gone?
    1. Re:Wrong Solution by Skiron · · Score: 1

      Too true. It's like they just announced car theft is illegal (in 1960) because all Ford cars use the same key to open the doors start them. It's nothing to do with Fords crap locks... Nick

    2. Re:Wrong Solution by Anonymous Coward · · Score: 0

      And we all know that M$ isn't going to tighten up Windows security. Why ruin a billion-dollar market in the name of consumer safety, after all?

  20. Does this mean???? by GReaToaK_2000 · · Score: 3, Interesting

    Does this mean that the software that the FBI uses to track email in an effort "to fight terrorism" falls under the "spyware" law?

    ~G

    1. Re:Does this mean???? by Anonymous Coward · · Score: 1, Informative

      H.R. 2929 specifically exempts law enforcement activity.

    2. Re:Does this mean???? by Anonymous Coward · · Score: 0

      No. Not now or ever.

      The US government will not be intimidated by
      such pesky things like the law. They will
      just ignore the law, and then classify the
      process.

  21. Who will serve the criminal penalties by blankman · · Score: 5, Interesting

    If this becomes law, and a piece of spyware is found to be illegal, who exactly goes to jail? The programmers who wrote it? The stockholders of the company that paid the programmers to write it? The owners of the web site from which a user unwittingly downloaded and installed it? Suppose I determine that I got a piece of spyware from IP address X... is the ISP on the hook for criminal charges too?

    Give Congress credit for trying, but I don't see you can realistically make installing spyware a jailable offense.

    1. Re:Who will serve the criminal penalties by Jason+Ford · · Score: 2, Interesting

      I agree; it seems very difficult to determine who is at fault. It won't be the stockholders, though. Can you imagine the effects on investment if stockholders might be held responsible for a company's wrongdoings? The cigarette companies, among others, would be very hard hit if limited liability protection were removed.

      Also, IANAL, but would spyware that's already been developed and installed be exempt from the law as it can't apply ex post facto? I think you'd have to prove that the company developing the spyware intended for it to be installed after the law was passed.

      And, even if the law were 100% effective against new spyware, it would take a very long time to remove all the spyware that's already been installed.

      --
      I did not become a vegetarian for my health, I did it for the health of the chickens. --Isaac Bashevis Singer
    2. Re:Who will serve the criminal penalties by mp3phish · · Score: 1

      Actually, no. Ex post facto doesn't apply to authors who have already written the software. An author would not be held liable unless they are the ones offering it for download. You see, in order to get the spyware in the first place, someone has to offer it up for download. If nobody was offering it up for download, nobody would get the spyware installed. The distributers are still liable and can be jailed under the bill.

      An author would be held liable if he was still offering the spyware up for download on his website or attached to an installation package of bonzai buddy super duper buddy atomic clock weather buddy bug.

      So the only time ex post facto can be applied is already installed spyware on end users' computers previous to the date the law takes effect.

      --
      Your ignorance is infinitely greater than you realize.
    3. Re:Who will serve the criminal penalties by happyfrogcow · · Score: 1

      Actually, no. Ex post facto doesn't apply to authors who have already written the software. An author would not be held liable unless they are the ones offering it for download. You see, in order to get the spyware in the first place, someone has to offer it up for download. If nobody was offering it up for download, nobody would get the spyware installed. The distributers are still liable and can be jailed under the bill.

      surely there are workarounds.

      install a web server on soon to be victim's computer. This does not infringe on the spyware law (or does it? webserver isn't doing the gathering, after all). may infringe on other laws, but so does installing a spam relay on a zombied computer.

      have that webserver serve the downloads. instead of having zombie winXP spamboxes, we'll have zombie winXP web servers serving the real spyware that they want to install on our machines.

      now the users who have had their boxes zombified are responsible.

      details... details... i don't care about details. *someone* will do it i bet.

    4. Re:Who will serve the criminal penalties by myowntrueself · · Score: 2, Insightful

      "who exactly goes to jail?"

      This is the perennial problem of the corporation.

      Since the corporation is a legal person, 'it' might be responsible, but then how do you send a corporation to jail?

      Personally I think that the 'corporation as a legal person' is one of the great lies of our time; it seriously fucks the law right up.

      --
      In the free world the media isn't government run; the government is media run.
    5. Re:Who will serve the criminal penalties by Snowbeam · · Score: 1
      If this becomes law, and a piece of spyware is found to be illegal, who exactly goes to jail? The programmers who wrote it? The stockholders of the company that paid the programmers to write it? The owners of the web site from which a user unwittingly downloaded and installed it? Suppose I determine that I got a piece of spyware from IP address X... is the ISP on the hook for criminal charges too? Give Congress credit for trying, but I don't see you can realistically make installing spyware a jailable offense.
      Ha! In the end the user will pay the penalty. It is afterall the user who ends up installing the spyware.
      --
      I am Lord Snowbeam. Heed my call!
    6. Re:Who will serve the criminal penalties by Lars+T. · · Score: 1

      This isn't about Criminal Law, but about Contract Law.

      --

      Lars T.

      To the guy who modded me down from perfect to terrible Karma - Apple haters still suck

  22. Stupid idea by Anonymous Coward · · Score: 0

    You cannot get MAC addresses over the internet.

    1. Re:Stupid idea by Marxist+Hacker+42 · · Score: 1

      You can with the VB script referenced above.

      --
      SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
  23. The CAN-SPY Act by RealProgrammer · · Score: 2, Funny
    Rep. Zoe Lofgren [...], D-Calif., said spyware was "quickly becoming one of the biggest threats to consumers on the Internet." She cited estimates that up to 90 percent of computers contain some forms of spyware. Lofgren said her daughter was recently victimized by electronic thieves in a phishing scam, persuading her in a forged e-mail to disclose personal information.

    90%, huh? That seems awfully high. People always say 90% of computers are running Windows, too. No, wait -- you don't think those figures could be related, do you?

    And I thought the CAN-SPAM Act was supposed to fix all of these email forgery problems.

    It's a good thing Congress is on top of it. At least they are when it affects their kids.

    --
    sigs, as if you care.
    1. Re:The CAN-SPY Act by budgenator · · Score: 1

      Barton acknowledged that experts had recently found more than 60 varieties of spyware installed on the panel's own computers. He said all the spyware programs had been installed without the permission of computer users.

      I thought those machines were pretty clean for windows computers that were actualy used and cleaned for the first time. I suppose that it wouldn't be too had to write code to spare machines running on the .gov TLD from the plague that most endure.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    2. Re:The CAN-SPY Act by Anonymous Coward · · Score: 0

      I think they really meant 90% of 90% which is 81%. They were at least trying in the article though.

  24. FUD by Anonymous Coward · · Score: 0
    1. Re:FUD by grolschie · · Score: 1

      What's the difference between bhis and the vanilla version? Does it pester to update?

    2. Re:FUD by esukafurone · · Score: 1

      Yes because signing out a form to get a program means it spyware free, right? E-mail Adress * * denotes a required field

    3. Re:FUD by Osty · · Score: 1

      Yes because signing out a form to get a program means it spyware free, right? E-mail Adress * * denotes a required field

      How do they know that bob@dole.com isn't your real email address? I'm not defending Real, but I've also never had a problem with forms that "require" your email address (or name, or postal address, or even your birthday). They only get your information if you willingly give them your information.

      On a side note, I wonder how much spam goes to:

      Bob Dole
      123 Main St
      Beverly Hills, CA 90210
      bob@dole.com
      555-555-1212
    4. Re:FUD by lukewarmfusion · · Score: 1

      "...I've also never had a problem with forms that 'require' your email address (or name, or postal address, or even your birthday). They only get your information if you willingly give them your information."

      I agree. Of course, if they really want usable, reliable information, forcing users to put something in that field is a step in the wrong direction. One of my clients doesn't seem to understand this - and then they complain that there are so many a@a.com, asdf@asdf.com, etc.

      There are ways to force you to enter your actual email address - such as sending you a confirmation email or the password - but even then you can simply use a dummy account. I have one just for those purposes.

      The harder you make it for people to get your product (and thereby making you money) the less they will want to bother. Another lesson my client fails to learn.

    5. Re:FUD by Anonymous Coward · · Score: 0

      STFU Asshat. There is no effective difference between the spyware version and yours which requires a form filled out with everything short of the user's penis size.

      http://www.free-codecs.com/download/Real_Alterna ti ve.htm Meet your doom, Real!

    6. Re:FUD by RipTides9x · · Score: 1

      Dude, you are scaring me, no really. Cause that is the exact same thing i use to sign up for shiz online. Well sometimes i get frisky and put Rodeo Dr.

    7. Re:FUD by Osty · · Score: 1

      So you're the guy who uses "bob@dole.com" before I get a chance! Now it would be really freaky if you switched to "dob@bole.com" as your backup (and "teve@torbes.com" after that -- I wonder how people know where those come from).

  25. Laws to protect the gullible? by Jakhel · · Score: 4, Interesting

    Seriously, I'm all for anti spyware and anti scam measures, but is this really going to address the core issue? That is, people aren't educated enough to NOT fall for scams? And if they AREN'T educated enough to not fall for it in the first place, what good will the law do?

    A current example may be those "multi level marketing schemes" like Vector or Pre paid legal (they are really just pyramids in disguise). We've got laws against pyramid schemes, and yet these companies are still around (they call themselves multi level marketing in most cases, just to avoid the legal hassels). The people who actually get caught up in the schemes are those who are a) to stupid or b) to greedy to not realize what's going on; and by the time the person has found out that they have been duped, the perp (I've been watching law and order :D ) is long gone. Incidentally those people who would be fooled by spyware are more than likely those who wouldn't know how to deal with it in the first place (spybot, adaware, or cleaning the system registry manually).

    And then there's the question of how many people will actually actively pursue a lawsuit against spyware companies. I'm willing to bet that most people will say, "spyware is against the law, the companies can't do that and if they install it on my computer I'll write a nasty letter to them" instead of "spyware? time to sue". Almost like what's going on with spam..

  26. Hold on there buckaroo... by asdfasdfasdfasdf · · Score: 0, Troll
    "...estimates that up to 90 percent of computers contain some forms of spyware.."

    It is good thing that 10% of the market is either running an alternative browser and/or operating system


    Just because someone is running IE & XP doesn't mean they have spyware. There are a few out there who are capable of not clicking "install the we-swear-its-not-spyware searchbar" to view their free pr0n.

    I'm not saying that I've never inadvertantly picked up some nasty things when using IE, I have done a decent job of making sure it's cleaned out regularly.

    IE is very vulnerable, no doubt, but it's not like it includes spyware on the install. (BTW, I'm now running Firefox 90% of the time for speed/tabbing/features reasons, and I keep ie around for the pages that don't quite render right or the media files that don't quite play friendly)

    1. Re:Hold on there buckaroo... by Anonymous Coward · · Score: 0

      someone want to tell me why this happens to be a troll?

      i agree with him. internet explorer doesn't come with spyware. just people don't read the EULA.

  27. Does this mean... by farzadb82 · · Score: 3, Funny
    Internet Spyware (I-SPY) Prevention Act of 2004 - Amends the Federal criminal code to prohibit intentionally accessing a protected computer without authorization, or exceeding authorized access, by causing a computer program or code to be copied onto the protected computer, and intentionally using that program or code: (1) in furtherance of another Federal criminal offense; (2) to obtain or transmit personal information with intent to defraud or injure a person or cause damage to a protected computer; or (3) to impair the security protection of that computer.

    Does this mean that having a software application that automatically updates itself with a newer version that has bugs that compromise the security of the computer and all information within can now be considered a criminal offence for the software developer ?

    1. Re:Does this mean... by Anonymous Coward · · Score: 0

      The text you quoted mentions intent. Did you miss that?

    2. Re:Does this mean... by Tuxedo+Jack · · Score: 1

      If you're running as Administrator, it doesn't matter, since by definition, that's complete and total access to the machine - and it's _authorized_, since all code is trusted.

      --

      Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
    3. Re:Does this mean... by Anonymous Coward · · Score: 0

      You know, the part you highlighted might actualy be useful. IANAL, but the newest spyware trys to tamper with anti-spyware software, i.e. it removes/hinders installed security precautions on the computer (which in my opinion is worse than anything else that spyware does to your machine). That could be a way to nail these people...

  28. Riders and pork by Anonymous Coward · · Score: 1, Funny

    I wonder what/how many riders are on this bill?... Like, say.. at the bottom in tiny print it says: "Section (15), Paragraph (3). Linus Torvalds, shall be sentenced, for a duration not less than ten (10) years, to incarceration in the federal corrections system, for the crime of "irritation" of a Congressional sponsor, one Mr. William H. Gates III."

  29. Is there a grandfather clause? by Weaselmancer · · Score: 3, Interesting

    Because if not, every worm writing script kiddie is probably crapping a load right now. The law goes into effect today. If your worm infects someone tomorrow, even if you wrote it years ago, you're hosed.

    I hope.

    --
    Weaselmancer
    rediculous.
    1. Re:Is there a grandfather clause? by stratjakt · · Score: 1

      Wow! The law goes into effect today! Before a Senate reading, and before the President signs it even!

      This is one hell of a Congress, huh?

      (Why don't you dish out legal advice after you've seen the "I'm just a Bill" SchoolHouse Rock cartoon?)

      --
      I don't need no instructions to know how to rock!!!!
    2. Re:Is there a grandfather clause? by Anonymous Coward · · Score: 0

      Criminal, I'd say not... ex post facto..
      Though.. that is intersting, because of the length of time the act takes, in your example. Dec 31st, worm is launched. Jan 1st, law goes into effect. Oct 31st, system infected. .. I'd still say no, because when you initiated the act on Dec 31st, the act was legal. Another example.. say a law is passed making it illegal to give birth to a child out of wed-lock.. and say the un-wed mother is.. ohh.. 5 months along when the law goes into effect... guilt, not guilty, or to ambiguious (sp)?

      Civil law is retroactive, sue away...

    3. Re:Is there a grandfather clause? by Anonymous Coward · · Score: 0

      The U.S. constitution prohibits "ex post facto" laws -- i.e., laws past after the fact to make prior, legal conduct illegal. So the bill, if passed, should apply only prospectively. (I have not read the bill (nor will I) but script kiddies shouldn't worry too much about what they did in the past, assuming that it was legal at the time.)

    4. Re:Is there a grandfather clause? by Weaselmancer · · Score: 1

      Oops. Got excited and left out the "if" part. Crap.

      --
      Weaselmancer
      rediculous.
    5. Re:Is there a grandfather clause? by Weaselmancer · · Score: 1

      Aha AC! You've hit on my very point.

      Yes, "ex post facto" would apply. But wouldn't it apply only to previously infected machines? Worms, being worms, continue to propagate. The worm you wrote yesterday could infect someone tomorrow. Would ex post facto cover the future (and now illegal) behavior of a program you wrote in the past?

      --
      Weaselmancer
      rediculous.
  30. Ob Bill&Ted by Anonymous Coward · · Score: 0, Offtopic
    Execute them!

    Bogus!

  31. just like SPAM by Anonymous Coward · · Score: 2, Funny

    Whew!! Now no more Spyware!!!

    Taken care of just like they did when they made SPAM illegal!!

    I was glad to get rid of that...

    er..

    desiv :-)

  32. And what about... by Tuxedo+Jack · · Score: 1

    Coolwebsearch and browser hijackers?

    The bill doesn't touch them. I really don't think that they care, since CWS's browser-hijacking "affiliates" are mostly Russian-based.

    --

    Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
  33. Actually, it is... by asdfasdfasdfasdf · · Score: 1
    "..or a computer used in interstate or foreign commerce or communication) to engage in deceptive acts [etc etc].." I don't know about you, but my home machine isn't used exclusively by a financial institution or the US government.

    This is proper for the US congress. "A computer used in interstate commerce" includes just about everybody-- whenever you buy something off the web from a company in a different state or even use eBay.* The Congress is allowed only to write laws that affect "interstate commerce" which these days is just about everything-- otherwise it is relegated to the state's authority.


    1. Re:Actually, it is... by budgenator · · Score: 1

      It is unlawful for any person, at least they didn't limit the law to persons inside the US.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
  34. Re:Maybe another Law isn't nec.: mod parent DOWN by charlesbakerharris · · Score: 2, Informative
    I'm sorry to ask a personal question, but are you nuts?

    Dissection:

    • say to yourself will the world be a better place with yet another law
      Are you saying that we should add no more laws, simply because we have too many, regardless of that law's merits?
    • like Nielsen rating system by which advertisers use to by spots on TV, somewhere there has to be a way to understand what works on the internet.
      Someone else covered this already, but Nielsen pays you, in an arrangement made in the clear and with your permission, and you're damn well aware that you're helping them with their marketing data. They don't take over your TV while you think you're just installing TiVo, and they don't make your TV work less efficiently or steal your credit card numbers. This is a dumb, dumb analogy you have made here.
    • The law bill
      Are we an ESL student?
    • installing tracking devices on someone else computer will be punishable by imprisonment - you will no longer to be able to track logins via cookies
      Even the lowliest n00b on /. knows the semantic difference between a cookie and spyware. It's absurd to compare the two, particularly when you're claiming that the difference would somehow be overlooked in court with any lawyer worth the paper their bar scores are printed on.
    • It is good thing that 10% of the market is either running an alternative browser and/or operating system preventing those infections. But being victimized via email I tend to say that email isn't secure therefore nothing in email can be trusted - thus let the buyer (user) beware. Over the long haul, Darwinism will balance things out and the law will be just a hoop and dance show for elections.
      I would like to point out that each of these sentences has nothing to do with the sentence previous to it, that none of the three is particularly relevant, and that you are clearly way over your head. You successfully pointed out the fact that email can't be trusted - a statement implicit in the fact that a law was just passed addressing criminal activity perpetrated with email as its medium.
      Then you point out that Darwinism balances things out. Have you had children? If so, your statement is invalid. I don't see how these laws, passed essentially unanimously, are going to be a "hoop and dance show" for either party. Would you like to illuminate us on that aspect of your glorious deconstruction?
    Build complete sentences, proofread your work, and don't try to sound brighter than you actually are. These laws are a fine thing. It's easy for anyone to look at anything the government does and go "Oh Noooo!" and think they sound wise.

    Marketing should come without illicit invasions of privacy, hijacking of personal resources, and the aggravation of an often-painstaking removal process. If it has to "come from somewhere", as you stated, it should come from a place that has some moral and ethical footing. By your argument, I could break into your cardboard box and check out what brand of cheap wine you buy, if it allowed me to market cheap wine to you more effectively. Removing the ethical aspect, as you implicitly did (whether or not you meant to) is foolish.

    "Will the world be a better place with yet another law?" (I added the question mark for you - I think you might have forgotten it.) Yeah, it'll be a better place with this law. By the time you'd typed those words, everyone who read the article had already thought about it, and most had come to the conclusion "yes, it will." I can think of a ton of laws that would make the world a better place. "Yet another law" is a dumb, dumb way to look at things, on a number of levels.

    You should stick to topics you (a) understand and (b) have something interesting to say about.

  35. no unanimous by minus_273 · · Score: 2, Interesting

    one republican member from texas opposed it on the grounds that any govenment control of the internet is wrong check this article
    The fellow's name is Ron Paul. He has an interesting position. Though they may not agree with apyware, i think it is a position that i think many here would agree with.

    Maybe we should interview him on this site. :)

    --
    The war with islam is a war on the beast
    The war on terror is a war for peace
  36. what about SWF ads? by ushanka · · Score: 1

    What about those SWF ads? Isn't that considered "code". I don't want to see those SWF ads and they just "copy onto my protected computer" without my explicit permission. Does this law apply to the shockwave flash files?

  37. stop spyware yourself. by Man+in+Spandex · · Score: 1

    How about we educate users on good internet habits
    I totally agree.

    Sure goverements can make these laws but will anybody make sure of them.

    Which other group of people can help to stop/reduce spyware? YOU as an individual, as an employee or whatever your function is.

    All the friggin companies should tell their employees about these. Some people get spyware and some don't. The ones that don't are doing their job of being aware and it's not a hard job: install the tools (adware, spybot, etc.) & firefox/mozilla. There you go you're set (email is always a gamble though). Now let's see more companies try and take these similar steps and these "laws" will be somewhat useless.

  38. Ironic...only a couple of years ago... by HellYeahAutomaton · · Score: 1
    To protect users of the Internet from unknowing transmission of their personally identifiable information through spyware programs, and for other purposes.
    Isn't this the exact opposite of what the UCITA was trying to do? Funny how the tides change. Maybe next year the law being pushed will be to mandate end users access to all corporate servers ...
    UCITA allows software and information products to contain "back door" entrances, potentially making users' systems vulnerable to infiltration by unauthorized hackers.
  39. Ron Paul by Brandybuck · · Score: 2, Interesting

    Ron Paul (L-Texas) voted for this bill but he was the lone dissenter in the last spyware bill. It would be interesting to find out what was different about this bill (or what poison pill was in the last one).

    --
    Don't blame me, I didn't vote for either of them!
  40. well and good, but.. by ChristTrekker · · Score: 1

    What part of Article 1 Section 8 of the Constitution gives Congress authority to draft legislation on this subject?

    1. Re:well and good, but.. by stratjakt · · Score: 1

      They tacked in some verbage about "computers used in interstate commerce".

      You can infect all the computers you want, just so long as they aren't networked across state lines.

      --
      I don't need no instructions to know how to rock!!!!
    2. Re:well and good, but.. by CaptainTux · · Score: 1
      You can infect all the computers you want, just so long as they aren't networked across state lines.

      The wording that includes "computers used in interstate commerce" is largely irrelevant. The moment someone connects to your site via the internet they are "networked across state lines". Even if I am connecting to my neighbors computer, chances are I am crossing state lines to do it.

      --
      Anthony Papillion
      Advanced Data Concepts, Inc.
      "Quality Custom Software and IT Services"
    3. Re:well and good, but.. by Anonymous Coward · · Score: 1, Informative

      This part:
      To make all Laws which shall be necessary and proper for carrying into Execution the foregoing Powers, and all other Powers vested by this Constitution in the Government of the United States, or in any Department or Officer thereof.

    4. Re:well and good, but.. by ChristTrekker · · Score: 1

      Typical overbroad interpretation of the commerce clause.

    5. Re:well and good, but.. by ChristTrekker · · Score: 1

      That "elastic" clause is limited to the powers preceding (foregoing) it. Spyware is bad, but I don't see how it is the USFG's job to govern if I'm spying on my neighbors.

  41. Rewards by AviLazar · · Score: 1

    How about rewards for helping in identifying spyware makers - that aught to spur people into action (i.e. disgrunteled mail clerk rats out his company who is built on creating spyware)

    --

    I mod down so you can mod up. Your welcome.
  42. Some law protects justice. by Doc+Ruby · · Score: 1

    US government is the people banding together to protect ourselves under justice - when practiced correctly. Over the long haul, we're 1> all dead, and 2> a feudal/tribal species constantly wasting our lives in war and depradation. We celebrate the momentary anomalies like American democracy and Congress keeping up with crimes by minimuzing them with regulations tied into the existing enforcement infrastructure. Let's get rid of some of these old laws, like subsidies for political campaigns and their corporate bribes, when we want to simplify our government. Maybe that will minimize these election-time postures.

    --

    --
    make install -not war

  43. [ ANSWER ]Re:sorta OT by Anonymous Coward · · Score: 0

    Turn off
    1) Active X
    2) java script
    3) java

    Don't
    1) use email preview
    2) click on attachments
    3) install the neat freeware

    And stay away from sites with popups!

  44. Re:First Timecube post by DrMyke · · Score: 0

    dude, you gonna eat those frys?

    --

    -DrMyke
    "mmmmmmmmm, doughnuts" - H.J.Simpson; super genius
  45. doesnt matter by bani · · Score: 3, Interesting

    the spyware is still being created by or contracted for american citizens. doesnt matter if they operate their scams offshore. they're still under US jurisdiction.

  46. In summary... by officepotato · · Score: 1

    Here's my collected advice, in no particular order.

    1) Firefox. FIREFOX. FIREFOX! You'll wonder how you lived without it.

    2) Disable system restore. Run your favorite anti-spyware programs in safemode (after updating definitions). Spyware S&D does a good job, but you've already listed that.

    3) Protect your system. Anti-virus software is absolutely essential now. Windows updates are essential. If you've got XP, use the SP2 firewall, it's pretty decent. Otherwise download a firewall and learn how to set it up. (Don't automatically Allow all the connections it asks about, figure out what they actually do)

    4) HijackThis! and SysInternal's Process Explorer are pretty useful. Process Explorer will actually end those pesky tasks that Task Manager won't let you touch.

    5) Look up the name of every process running on your computer that you are 100% sure about. A lot of spyware programs attempt to "sound" like legitamate process names. spoolsv.exe is legit, spooler.exe is not. Etc. If it's not legitamate, kill it, find out where the executable hides itself, then delete it.

  47. exactly what you think... by bani · · Score: 0, Troll

    or a computer used in interstate or foreign commerce or communication

    um, DUH? wasn't obvious enough for you?

    learn to read?

  48. We're lucky by didjit · · Score: 1

    I guess its good that Tom DeLay doesn't have a lot of campaign contributions from Gator, otherwise a bill this would be DOA.

  49. this just in! Laws alter human behaviour! by Anonymous Coward · · Score: 1, Interesting

    Ah yes, another "fix" from the government. This will change human behaviour, just like prohibition and criminalizing ooh a small section of drugs which aren't controlled by Glaxo Smithkline, oh and murder, but we'll sell guns for... opening beer bottles with, and last time I checked speeding was a criminal offence but how many people get hit with speeding tickets?

    Every single person who speeds is a criminal.

    I think we now have so many laws that the respect has been watered down. In order to go about their day to day business civillians accept that they have to break laws to get things done.

    Humans are incredibly good at calculating risk, we've been doing it since we were chasing the wooly mammoth down a steep incline. People sell drugs because the profit outweighs the risk of getting caught. Note: I said risk, not punishment.
    You could make the punishment death by ferrets, but if the risk is low enough, there is no problem.

    The punishment for getting hit by a drunk driver while walking on a sidewalk is death. Thats your punishment for being on the sidewalk at the time, but the risk is so low people do it.

    It doesn't matter if installing spyware gets you a public flogging if the risk of that ever happening is 1:100000000000). Another well thought out bill.

    1. Re:this just in! Laws alter human behaviour! by NerveGas · · Score: 2, Interesting

      I think we now have so many laws that the respect has been watered down.

      While I don't necessarily share your views on some of the items you mentioned, I certainly agree with you on the statement I quoted.

      The other night, a friend was over at our house, and I asked if she wanted a copy of any of our DVDs. She looked at me, and asked "Is that... legal?"

      My first thought was "Who cares?" My second thought was "Wow, she must worry about a LOT of little things." (She is, actually, a diagnosed germophobe.) Over the next couple of days, though, I started thinking more and more about just how many laws I routinely break. I've copied copywrited material. Sometimes at 3 a.m., I don't wait for the light to change. I speed quite regularly. I've used paint cans for things other than their intended use (no, I wasn't huffing with them.) I've taken a narcotic pain pill for something OTHER than which it was prescribed to me. Shoot, there have even been some times when I took a medication that had been prescribed to someone else.

      After thinking about those and other things, I realized that not only have I committed quite a good number of crimes in my life, I've committed a good number of felonies. It made me feel kind of funny. I've never thought of myself as a criminal, much less a felon. Maybe I need a black leather jacket or something.

      steve

      --
      Oh, you're not stuck, you're just unable to let go of the onion rings.
  50. You're missing something... by rmy1 · · Score: 1, Interesting

    Whith everyone commenting on whether or not these bills may or may not keep spyware off your computer (Shame on you for not using Linux!), did anyone notice that these bills have an EXPIRATION DATE?! Why?

    1. Re:You're missing something... by Artifakt · · Score: 2, Interesting

      There's two reasons.
      1. The bill may turn out to be a bad law in practice. (The 'patriot' act has an expiration date. Some of the proponents haggled over just how long the law should apply, and picked a time when we should have had opportunity to cool down a bit and think about it.).
      2. If it's a pretty good law, congress will still have to renew it when the time comes. It's easier to tweak the law in the new version with automatic expiration. If it's a good law with a few flaws, it's going to have to be re-examined automatically anyway.

      --
      Who is John Cabal?
    2. Re:You're missing something... by Chris+Burke · · Score: 1

      Yeah, I think expiration dates are a good thing. Sometimes the effects of a law aren't obvious, and being able to say "okay, how did this law work out in practice?" and either let it go away or try to refine it if necessary sounds like a good thing to me. Without the expiration date stupid laws are too likely to just stick around.

      I still remember the State of the Union when Bush warned that PATRIOT was going to expire and there was cheering. :)

      --

      The enemies of Democracy are
  51. Something no one else has mentioned yet- by celerityfm · · Score: 2, Informative

    Definetly, DEFINETLY try all of the above mentioned things first and as directed AND THEN if you *STILL* can't get it off (and are sick of my all caps), THEN:

    1)Select one of the following spyware removal discussion boards

    http://www.wilderssecurity.com/
    http://forums.spywareinfo.com/
    http://forums.net-integration.net/
    http://www.computercops.biz/forums.html

    2)READ THEIR FAQS THOUROUGHLY

    3)Create an account and post your story along with supporting documents outlined in their FAQ to their board.

    4)Wait patiently and a real life antiscumware security expert will help you.

    The people on those forums hate scumware more then anyone and devote their spare time to helping rid the world of it. They have created custom tools to remove almost all kinds of spyware and with your help will diagnose your particular infection and send you the proper tools to get rid of it.

    These guys are the best so treat them with respect: do your own spyware scans before you bother them. But I think in your case you are qualified to talk to them now :)

    Good luck!

    --
    ...unfortunately no one can be told what The Mat^H^H^HGoatse is...they must experience it for themselves...
  52. Re:stop invoking darwinism by johansalk · · Score: 1



    The whole point of having a civilized society, one that's regulated with laws, is not to leave sections of the population under the mercy of darwinism.

    If you hate benevolent communal parenting then go live in the jungle.

  53. they just came close by Anonymous Coward · · Score: 0

    to outlawing diebold voting machines. Not exactly, but pretty close. Too bad.

  54. Voice vote by tepples · · Score: 1

    In theory, you're right that one house can't pass a bill into law. But in practice, it takes 81 percent of one house to pass a bill by unanimous consent AKA voice vote, as 20 percent can force a roll-call vote. It takes only 67 percent assent of both houses to bypass a Presidential veto. If a bill has 81 percent assent in the House of Representatives, what makes you think it'll have less than 67 percent assent in the Senate?

    1. Re:Voice vote by T-Ranger · · Score: 1

      Well, to answer your last question: THEY ARE DIFFERENT THINGS. I suppose, by your logic, you only need one, eh?

    2. Re:Voice vote by tepples · · Score: 1

      By my logic, I'm not claiming that it's certain that such a bill will clear the Senate, either get signed or the veto overridden, and thus become law; I'm just claiming it's overwhelmingly likely. Think about it: for a bill with > 80 percent House assent, what are the odds of < 50 percent Senate assent?

  55. my 2cents by scifiber_phil · · Score: 2, Interesting

    Clearly, something must be done. This bill is not the answer, but at least they are looking at the problem. I would be surprised if the congess folk are not getting messages from irrate constituents complaining about spyware.
    From the Yahoo article:
    "People are increasingly finding their home pages have been changed or their computers are sluggish," she said. "Their computers are no longer their own, and they can't figure out why."
    Yes, whatever became of the idea that it is my machine, not some marketing cash cow. The EULA should enumerate and describe in no uncertain terms what will be installled, what it will do, and how it will do it. The end user should need to okey each program, not the whole shooting match. If something is going to run on startup in the background, this should be stated and explained. There should be an easy way to stop the process. There should be a simple way to uninstall the evil program and all of its minions in the registry etcetera. Browser hijacking? Just plain illegal. If caught, death is too good for you. This is for starters.
    Now explain this:

    H.R.2929:
    Makes it unlawful for any person who is not the owner or authorized user (user) of a protected computer (a computer exclusively for the use of a financial institution or the U.S. Government, or a computer used in interstate or foreign commerce or communication).........
    It is home computers that need the most help in the fight against spyware, not corpoate, bank, and government computers, and unless I am reading this wrongly, home computers are given no protection under the bill. Why is that?
    Then there was this quote which I just found amusing:
    The chairman of the Energy and Commerce Committee, Rep. Joe Barton, R-Texas, said Goodlatte's anti-spyware bill was preferable because of its criminal sanctions, and Barton said he will work to combine both proposals for a final vote by year's end.Barton acknowledged that experts had recently found more than 60 varieties of spyware installed on the panel's own computers. He said all the spyware programs had been installed without the permission of computer users.

    1. Re:my 2cents by Bull999999 · · Score: 1

      unless I am reading this wrongly, home computers are given no protection under the bill. Why is that?

      I'm wondering if it's because they didn't want to prevent the parents from installing spyware on their kids' computers.

      --
      1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
    2. Re:my 2cents by SeXy_Red · · Score: 1
      I'm wondering if it's because they didn't want to prevent the parents from installing spyware on their kids' computers.

      Makes it unlawful for any person who is not the owner or authorized user (user) of a protected computer (a computer exclusively for the use of a financial institution or the U.S. Government, or a computer used in interstate or foreign commerce or communication) to engage in deceptive acts...

      The parents would be considered the owners of the computer in question, so they are legally allowed to install whatever they please.

      --

      This sig was generated by a barrel of trained kittens for SeXy_Red (550409).

    3. Re:my 2cents by SeXy_Red · · Score: 1

      Even if it's not unlawful for a third party to install spyware on a personal computer, this bill will still protect home users to a certain degree. It would make it nearly impossible to install spyware only on a personal computer, but never onto a corporate workstation. Being that the two can be very difficult to distinguish, they would be forced to halt installation of all spyware (theoretically).

      Also, corporations are far more likely to have the resources to file a lawsuit against such a shady company; you think your grandmother would be able to carry out a lawsuit of this nature?

      --

      This sig was generated by a barrel of trained kittens for SeXy_Red (550409).

    4. Re:my 2cents by Bull999999 · · Score: 1

      The parents would be considered the owners of the computer in question, so they are legally allowed to install whatever they please.

      Not always. Teenagers are more than capable of buying their own computers.

      --
      1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
  56. Why static linking isn't the answer by tepples · · Score: 1

    I'm of the mind that developers should (unless not possible) isolate their entire application to their own directory and only go into c:/Windows only when absolutely necessary.

    OK, so you suggest to include all of an app's libraries in each app's bundle. Then what if it is later discovered that a widely used library has a security hole such as the one in the JPEG parser of GDI+? I'm sure many of us could argue good reasons for factoring some libraries out into separately installed frameworks.

    1. Re:Why static linking isn't the answer by SamSeaborn · · Score: 1
      I'm of the mind that developers should (unless not possible) isolate their entire application to their own directory and only go into c:/Windows only when absolutely necessary.

      OK, so you suggest to include all of an app's libraries in each app's bundle.

      Yes. And I've argued this point in many design meetings. The "correct" academic approach (which you and most programmers argue) is to not have redundant files, that if two apps use the same DLL there should only be one copy of that DLL (usually somewhere under c:/windows).

      This approach works great on paper and in the classroom, but in real life app1 likes DLL v1 and v2, but app2 only likes DLL v1. Upgrade the library and break app2.

      Alternately, app2 gets uninstalled and takes the DLL with it. Now app1 doesn't work because the DLL is missing.

      The programmer is now getting crap for writing bad code when the reality is the environment around his application isn't stable -- people want to keep changing vital parts that his application depends on.

      This is sometimes called "DLL hell". Avoid the entire problem by making sure everything your application needs is installed in its own isolated directory. Who cares if you end up with a system that has four different jpeg.dll on the machine -- ensure that your application can find the file it needs by keeping it your own directory.

      Then what if it is later discovered that a widely used library has a security hole such as the one in the JPEG parser of GDI+?

      Then tell your user to upgrade your application to the newer version (which includes the new library). It's your job to make sure *your* app works.

      Sam (speaking from years of development experience)

  57. Commerce among states by tepples · · Score: 1

    Claria Corporation, a company based in California, operates the GAIN ad network used by Gator eWallet software. Do you live in California? If not, this commerce among states surely comes under federal jurisdiction: "The Congress shall have Power ... To regulate Commerce with foreign Nations, and among the several States".

  58. It wasnt unanimously passed by nfsilkey · · Score: 1

    ... as Ron Paul voted against it. Obviously Ron Paul hasnt used a Microsoft computer in the last 4+ years. Figures, since hes from my hometown Congressional district.

  59. OT: laws do not prevent crimes by Crag · · Score: 1

    (This post isn't really about the parent or the article, I'm just getting on a soapbox).

    "If the law prevents others ..."

    Laws never prevent anything. Laws ascribe consequences to convictions. No matter what penal deterents you put in place to make a choice less attractive, it is still a choice.

    It is possible to increase security, but all increases in security necessarily incur a usability cost. Adding a guard to a knife may protect the user's fingers, but will get in the way of a skilled craftsman. Adding metal to a car to make it sturdier may interfere with visibility and handling.

    It is also possible to use physical force (handcuffs, walls) and threat of violence (guns) to lock people down, such as in a concentration camp or jail. This will prevent the prisoners from doing things outside the walls of their confines, but is otherwise hardly different from locking the rest of the world up, as far as 'preventing' things goes.

    As long as we put responsibility for people's actions in the hands of other people, we can expect people to behave irresponsibly. It is a self-fulfilling prophecy. I don't claim to have the answer, I claim all answers are trade-offs.

  60. You don't have to put up with outta sync clocks.. by Gentlewhisper · · Score: 1

    Get Dimension 4.. from THINKING MAN SOFTWARE

    Software for Geeks^H^H^H^H^HThinking Men!

  61. This band-aid only curbs the problem by C_Kode · · Score: 2, Interesting

    While I don't disagree with this, I also thing this is nothing more than a bandaid. The seive that is Internet Explorer is what makes most of this possible. IE gets hijacked and tons of spyway/virus type crap gets installed. I have been banning the use of it at work, but there are some users I just cannot prevent from using it. (my CFO refuses to stop using it?!?!?!?!) When companies are caught doing illegal things, they fine the companies till that *fix* the problem. Well, it's been almost 10 years, and IE has gotten worse not better. The more Microsoft embeds IE into Windows, the more disruptive these virus writers become. They need to mandate MS to separate IE from Windows, and curb it's *automatic usability* features. Fine them till they do it, or force them to remove IE all together and not allow them to make a web browser anymore. (wow wouldn't that break 30 million websites that are IE only hah)

    anyway, I'm just ranting because I have to deal with this epidemic daily at work... :(

    1. Re:This band-aid only curbs the problem by Anonymous Coward · · Score: 0

      IE ain't the only one.

      Check out "pcaudit" and learn how many there are.

  62. HOW TO BE A VICTIM without spyware laws by spyware+scams_suck · · Score: 1
    Is there a good HOWTO on cleaning up a Windoze box from spyware and keeping it clean? I use the following method:

    Install Ad-aware, update, clean, reboot, clean
    Install Spybot S&D, update, clean, reboot, clean
    Install Spywareblaster, update, enable protection

    I wonder if people who say "oh use adaware, spybot, etc." would say this if the nice authors had NOT made these free softwares AVAILABLE?? what would be the answer be? "oh, go ahead and just reformat your hard drive!!"" (/sarcasm).

    Even those anti-spywares are not enough to keep my computer 100% clean. I NEED and so use other anti-spywares on my computer besides those 3. And no, i don't feel like revealing what they are just to educate the scummy spyware purveyors.

    My friend (who is basically computer-illiterate and that's the NICEST thing i could say about her computer skills) uses the computer but rarely surfs anywhere except on hotmail to check her email. Guess what? Every time i clean her computer of spyware, Avenue spyware or adware comes up and found out this comes from Microsoft's OWN SITE! Even ebay has adware or spyware on their site with doubleclick. I'm glad she's so computer-illiterate AND doesn't have a credit card AND doesn't deal with Ebay, Paypal, or any of her banks online 'cause she could be in even worse trouble.

    Face it, if we don't even have basic laws on spyware, these crap spyware companies along with their $$$ Company Sponsors will keep writing them and they just get worse the better your anti-spyware becomes. It's just an spyware vs. anti-spyware ARMS RACE.

    The only time politicians act is when their own families get hurt. I'm GLAD that congressman's daughter was victimized by the phishing scam, otherwise we STILL wouldn't have ANY Congress anti-spyware bills.

    --
    * weedshare.com 50% to artists, webjay.org iuma.com CDBaby.com Epitonic.com ampcast.com
  63. This is a pro-spyware bill by Animats · · Score: 3, Interesting
    This is a pro-spyware bill, just like the CAN-SPAM act is a pro-spam bill. As with the CAN-SPAM act, it preempts state law, invalidating Utah's strong anti-spyware law. As with the CAN-SPAM act, it prohibits private lawsuits. Only the FTC can enforce this act, and they're a weak agency under the current administration.

    This is the bill Philip Corwin, Kazaa's lobbyist, wanted.

  64. A friendly reminder by dacarr · · Score: 1
    This is a bill, not a law. At least, for now.

    Quick recap on how this works for those unfamiliar:

    A bill, when introduced, must pass muster with both the house of representativs and the senate in the form of a simple majority vote in both houses before being presented to the president for signing into law. That's an optimal scenario, however 'optimal' doesn't equal realistic. It might bounce between both houses for a bit before passing onto the president, the president may say no (in which case a 2/3 majority is required in order to enact it as law, overriding presidential veto).

    Source: US History course, 8th grade.

    --
    This sig no verb.
  65. Marketing and the internet by initialE · · Score: 1

    The success of Google, and the foray of other entities into the search engine market should have proved one thing to marketing people all over: if you want to advertise on the web, you got to make your customer come to you, not the other way round. So the death of push advertising need not mean the death of marketing altogether, but rather it's transformation into something more meaningful.

    We reject the can-toi

    --
    Starbucks, Harbuckle of Breath.
  66. Keeping SPYWARE out by Announcer · · Score: 1

    There sure is... download FireFox (www.mozilla.org) and *stop* using IE.

    Since myself and my workplace switched browsers, monthly spyware scans have been turning up *empty*. We used to see *dozens* every month while using IE.

    --
    Willie...
    1. Re:Keeping SPYWARE out by spyware+scams_suck · · Score: 1
      There sure is... download FireFox (www.mozilla.org) and *stop* using IE.

      The *point* IS that even if everyone switched to FireFox, the spyware companies and hackers will still write their codes. Without ANY type of legislation, it continues to be an arms race or a cleaning race and most people (who are like my friend) can get phished or keylogged and their $$$ stolen in 1 second before the next patch comes out and the criminal or spyware company is able to get away with it and keep doing it to other people under the laws we have presently.

      --
      * weedshare.com 50% to artists, webjay.org iuma.com CDBaby.com Epitonic.com ampcast.com
  67. What is the OS and what is the app? by tepples · · Score: 1

    Who cares if you end up with a system that has four different jpeg.dll on the machine

    I care because I want to know which ones are exploitable and which ones aren't.

    [If there's a security hole in your static binary,] Then tell your user to upgrade your application to the newer version (which includes the new library). It's your job to make sure *your* app works.

    So in other words, do you want all apps to "phone home" over the Internet, connecting to a Central Server(tm) to check for updates in order to "tell your user" that such updates exist? Some would consider it a privacy risk to give the publisher a list of the IP addresses of all users of a program.

    And if several programs have the GUI libraries loaded, wouldn't several copies take up a lot of memory on less-capable machines, such as battery-powered machines or older machines owned by schools and other nonprofit organizations? I guess the loader could checksum each module and use shared memory for read-only sections of common versions of common modules.

    And what about dial-up? Not every geographic area where you have customers has a residential high-speed Internet access provider. Bigger app bundles means bigger download times. I've seen printer driver downloads in triple digit megabytes.

    And what about windowing systems and device drivers? Aren't they dynamically loaded modules as well? Wouldn't statically linking those take us all the way back to DOS? What is the operating environment and what is the application? If you're not going to turn every app into a bootable CD, the OS developer needs to state a policy that draws a line between what should be statically linked and what should be dynamically linked.

  68. *tips hat politely* by Anonymous Coward · · Score: 0

    My hat off to you Sir.

    Well spoken. Sooner or later the message gets across, or at least you've done what you could.

  69. Re:sorta OT / no let me write one by mr_z_beeblebrox · · Score: 1

    Is there a good HOWTO on cleaning up a Windoze box from spyware and keeping it clean?

    1. Select Linux distro
    2. Insert cd
    yada, yada yada

  70. Did the typo confuse you. by glrotate · · Score: 1

    At least fou othe people undestood it with the missing 'r'. Are you eading challanged?