Slashdot Mirror
Anti-Spyware Vendor Partners with Spyware Company?
Tuxedo Jack writes "eWeek reports that the anti-spyware vendor Aluria Software has partnered with WhenU of 'WhenUSave' and 'SaveNow' infamy. They've removed WhenU from their spyware/malware definition lists, certified their applications as safe, and they deny that money was involved. As a result, SpywareInfo and many other anti-spyware sites are delisting Aluria's 'Spyware Eliminator' from their lists of preferred software. Is this a dangerous trend for anti-spyware? Or are we just witnessing a natural evolution? I sure hope it's neither - I like my Windows boxes junkware-free, thanks (oxymoron noted)."
This is a dangerous trend. Given the majority of these ad/spyware companies don't care what their products do to the "users" computer, they can leave security holes unnoticed and allow exploits without the user even knowing there is a flaw in their computer. Windows updates can only do so much, and with companies releasing software that intends to help the user, but instead can hurt them. All the while the user is unaware. This makes me sick. Let's support the companies that work off of donations and have open source programs. This is the only way to prevent this from spreading to all of the favorite anit-ad/spyware programs.
-- johntracy.com, because everybody else is wrong.
reminds me of the age old question of whether anti virus companies created virii just to keep their own operations alive.
Solution: stick to vendors that can be trusted. Use Spybot and Ad-Aware.
Wasn't it not long ago we had this story about Yahoo Anti-Spy Favors Yahoo's Adware Partners?
I think in long run, anti-badthings services are going to be influenced by the bottom line. Spyware/spammers can make enough to feed themselves and pay for these services to 'certify' them.
As end-users, we need to be educated to prevent these installations in the first place.
Rock that crushes, Paper & Scissors that don't matter.
Bah, IE is great. You just have to flip one switch to keep it from prompting to install activex programs. And that's only so you don't accidentally click yes. And even then, if you're not logged in as an administrator (and you shouldn't be any way) then you won't have any of these problems.
funny munging
Bah.
Since I started using adaware tools, I learned I could rely only on Spybot and Ad-Aware. Obviously, many others noticed their reliability too - just try googling for either of two, and see how many pages you can find with fake installers - some sites even distribute AdAware installations with modified malware definitions and crippled update, so your AdAware might even refuse to detect malware on your PC.
To me, it all smells so familiar... Just as M$ loves to force, bribe, coax or cajole software producers into specialising their products for Windows compatibility, so do too the malware distributers seek their fifth collumn... Similarities are far from passing.
'...computers in the future may have only 1000 vacuum tubes and perhaps weigh 1.5 tons...' Popular Mechanics, 03/49'
Show me your proof that "in most cases the user has 'agreed' to allow these programs to run." I can certainly find proof to the contrary.
Take a look at these screen shots of the Bearshare install that includes WhenU and tell me it is reasonable to expect a user to press page-down 45 times to read the license.
Users are not aware they are running WhenU because the company works hard to keep them ignorant.
I've caught shareware sites bundling my software with WhenU malware, without my permission, and without giving clear indications to users, causing problems for my customers and endangering my reputation.
I consider any program that sits in the background and pops up ads while the bundled application is not running to be unwanted malware.
WhenU President and co-founder Avi Naider said the industry is falling on previous prejudices and lumping legitimate adware in with malicious spyware, failing to see the changes WhenU has made. (my bold)
How about NO ADWARE? The reason I got a spy/mal/adware remover was to be free from ALL adware. I don't want anybody pushing products on me when I'm on-line.
It seems Aluria has forgotten why they built an adware application in the first place.
It is not our abilities that show what we truly are... it is our choices.
To be useful, a list such as this becomes public. If it allows for anonymous entries, it will quickly be poisoned by spyware authors putting in legitimate entries such as word.exe, outlook.exe, etc. If it's poisoned and damages legitimate users' computers, it will prompt a quick outcry and a quicker death.
But if it's privately maintained (as in having secret moderators blessed with crypto keys that have to sign entries) other things have to be considered. First, moderators who become publicly known will find themselves subject to lawsuits and legal harrasment (see the spywareinfo.com site for an example of someone who has bee harrassed non-stop.) So secrecy becomes paramount. The other is that the software can't become too cumbersome to use for the average Jane and Jack Doe. Trust me, Aunt Margaret doesn't want you to explain how to verify and add trusted public keys to her keyring -- she only wants "the popup thingies to stop".
Yes, it would be possible using newsgroups to distribute signed updates anonymously. And it would be possible to keep the keyholders secret, and to allow for keyring updates to add and delete moderators. But someone has to take the risk of hosting and distributing the software, and that public entity is going to be the target of every spyware author's DDoS attacks simultaneously. Legitimate hosting services won't want to touch it. Would you voluntarily sign a contract that virtually guarantees you'll be the victim of a 30,000 machine zombie attack?
It's also going to take some seriously experienced crypto + Win32 coders to write a perfectly secure client first time around. And once it's written, the next issue is the "who updates it?" battle. The original author will wisely keep the master key private, but he or she may not want to put out the hundreds of monthly updates required. (Ask Patrick Kolla, the author of Spybot S&D, how much time he has to put into researching spyware, checking for signatures, and providing removal code and instructions.) It's a full-time task that will probably take a group of analysts and coders. (An anonymous submission process won't work, because the spammers are certain to poison that well, too.) Finally, how do you vette all these coders and analysts to make sure you don't accidentally let in the next Spamford Wallace?
Sorry to be so negative, but it's a huge undertaking with lots of risk and almost no chance of payback. Only a big established company with lots of backing could afford something like this. There's your answer! Get IBM to sponsor it, they're always looking for goodwill projects, and anything to twist the knife in Microsoft makes them happy. That, plus they have more lawyers than Manhattan has taxicabs.
John