Slashdot Mirror
Congress Debates Anti-Spyware Bill
Spy der Mann writes "An anti-spyware bill could clear the U.S. House of Representatives as early as next week, but there are disagreements on how to define the term 'spyware.' A wrong decision could end up in two opposite directions: Either a law too restrictive for legitimate companies, or a "safe harbor" for some malicious spyware distributors. Could this become another CAN-SPAM?"
And they plan to enforce this... how?
Spam and Spyware are like Porn - Hard to define, but you know it when you see it.
what is happening on my pc isn't business of anybody else. period.
From the article:
What legitimate use has software that doesn't inform about it presence -- let alone hides it?
But wouldnt that be like getting steriods from mexico? Its still illegal.
a government agency that understands technology, staffed by former professionals in the various fields. Decisions like this shouldn't be left up to those who have no idea what they're talking about.
Do Not Eat iPod Shuffle
heh, just never done it before. figured i;d try out the troll-thing for fit. I could use a little negative karma anyway, I'm starting to get a swollen head.
A Call For A New Slashdot Moderation Level!
From TFA: The average "infected" computer had more than 90 spyware and adware programs.
I doubt I have that many legitimate programs installed in my computer and I don't think these guys have either. The thought that their computers contain more spyware than software is scary.
I don't believe that a law can change this though. It might decrease the number of US based spyware companies, but I doubt the effect will be noticeable.
More secure browsers and user education seem like a better solution.
In theory they could just do as they did with Sharman Networks.
Dvorak on Doomtech
Which way did CAN-SPAM go?
xkcd.com - a webcomic of mathematics, love, and language.
Last time I checked fruad was illegal too, but guess what...
Life is pleasant. Death is peaceful. It's the transition that's troublesome. - Isaac Asimov
That's about as sensible as a law so that a pet mice won't chip your furniture.
Tell me, how could spyware even *work* if we had OSes that wouldn't allow programs to connect to the net *unless* we authorize them?
Just put the pet mouse in a cage, no law needed.
the CAN-SPY act?
This article is just begging for a slightly condecending comment about how computers are not yet plug-n-go appliances that the public should be allowed to own without training and/or licensing. But where to point the blame... consumers, most of whom don't know how to change their car's oil or other equvalent activities to computer preventive maintenance? Microsoft ( the slashdot favorite whipping boy) for making it easy to use a computer without knowing anything more than 'click the E for internet'? Dell, for making computers as cheap as appliances? Lawmakers, who think they can wave a legislative wand and make internet miscreants (spammers, bot networkers, spyware writers) behave?
Spyware, N.: Spyware may be Slowing t3h yu0r PC down!!!1 Downl0ad t3h 0u|2 5py-5w33p3r t0d4Y!
Do, do not, or delegate to someone else: there is no try.
Congress should define spyware as any code that runs on your machine that you did not agree to instal (So if I instal FreeGamePack, I expect to get FreeGamePack and not HiddenBackdoorTorjan. I agreed to instal one but not the other). I remember installing debian once, and it had a list of over 1000 packages, each with a description. I would like to see Windows do that, give me choice. Do you want the Internet Explorer pack? Do you want the Netscape pack? Do you want the Mozilla pack?
The second part of the definition is the software is not allowed to communicate to any other machines unless the owner of his machine allows it. That would kill RealPlayer and their crappy hidden settings.
Rosco: "If brains were gunpowder, Enos couldn't blow his nose."
"I'm about to install porn_dialer_v1.69.exe, Click OK to continue"
"There are no facts, only interpretations." --Friedrich Nietzsche.
Hopefully this will result in a few huge sentences with spyware authors jailed for 10-14 years. Like spam it's obviously much worse than any other crime.
You are goddamn awful at getting negative karma. How did you maintain a score of 1 with this bad boy?
0 16501
Must be the low UID.
http://slashdot.org/comments.pl?sid=143376&cid=12
To be totally untouchable, they would have to offshore all their advertisers too, I think. And also offshore the owners and operators.
That trying to eliminate spyware is something like the attempt to eliminate P2P...pretty much pointless and ineffective. It's really a user issue...people just have to be smart about what they install, it's really not hard to avoid the really bad spyware...
Reading at high threshold levels is group-think.
I can't think of any examples, but I know that one Russian cracker was arrested and charged by the American judicial system, even though everything he did was in (and legal in) Russia. Someone can most likely give better examples and details than I.
Could somebody please patent spyware/adware and start suing...?
Maybe they will start by making all spyware illegal. Then they will notice most of it will come from servers outside the USA. So the next step might be to make software inside the USA incompatible with software outside the USA. Maybe a region lock on all computers, so it can only play software from your country code.
If you want to get a machine which playes region 2 software, do so at your own risk. But I will be safe with my Congress approved region 1 computer. ;) Maybe Congress will even force computers to have a chip on the motherboard, like the Play Station. 90% of people with a play station didn't modify their machine at the hardware level. It is too much work. Congress can make it more difficult to do any activity, and they can increase the penalty. At some point the risk gets too high and the reward is not high enough.
Seriously, there is an easy way to enforce this law. It is with treaties. The USA can force smaller countries to agree not to import into the USA software with spyware. I dunno about the rest of you, but I would HATE to get caught doing ANYTHING wrong in Hong Kong or some country where they will whip me. Remember, the FBI did find that kid in the philippines who wrote the virus a few years ago. He used a public computer to release it, but they tracked him somehow. And now he is in a third world prision.
Rosco: "If brains were gunpowder, Enos couldn't blow his nose."
You are subject to US law. Now at some point, these people probably have a US stopping point. Maybe the authors are entirely foriegn, but the ad companies that pay them to make it probably aren't. What good does an ad do if it's for something you can't buy in that country? I'm betting somewhere along the chain, there are people in the US that can be held responsable. In most cases, I'm betting the companies are US based.
It's also possible the US could seek extradition over this. You can't run to a foriegn country and hide, if those countries have extradition treaties. I'm not sure they'd bother for something like this, and the other nations might refuse to extradite if it wasn't against their own laws, but it's also a possibility.
You mean other than blacklisting Australia's netblock?
these things are like spyware. infact they are. yahoo messenger is not that bad as you can uninstall it. msn messenger is bad because you can install it. both of them programs will install unwanted hidden things like search bars tool bars try to change your home page, and will force adds onto you. i suggest we ban them from our computers and just use gaim instead! fucking companys
You're probably thinking about Dmitry Sklyarov, a Russian programmer who circumvented Adobe's eBook encryption scheme. He was arrested, from what I understand, not for cracking the code but for giving a talk about it in Las Vegas. I didn't really follow the case, but Slashdot had a bit about him a while ago: http://slashdot.org/article.pl?sid=01/07/17/130226
See What I mean?
A Call For A New Slashdot Moderation Level!
The most objectionable software doesn't fit ANY definition of spyware. Outlaw the behavior and let Webster worry about defining words.
Only on
I can't see how this would work, the developers of the 'spyware' are already evolving their products to be classed as adware and stuff, the know the government is on to them and are getting out of the way
It will be like closing one door but opening a window.
Business Voyeur
I say anything that doesnt ask the user each and every time it sends data back to a company is tagged as a virus and the company is held liable for releasing a virus.
Spy-wear is a piece of soft-wear that is spying on ya computer. This is illegal, except if it's done by the Department of Homeland Security. I'm gonna work with the congress to make sure that any illegal spy-wear making evildoes - who probably supports gay marriage as well - gets their time in the sun down at Gitmo.
How exactly does one define spyware without alienating the enterprise environment? Some people might say that programs like Altiris Carbon Copy are spyware because they allow your machine to be remotely controlled without your knowledge. But at the same time, it's the company's right to use that software. The same is true for Altiris Agent. It transmits information about your machine without your knowledge. But the reason for this transmission is not malicious. It's for asset management and deployment. Congress needs to understand the difference between spyware and remote management tools.
The fact of the matter is were talking about spyware. Not adware. Which essentially means a company can be offshored, and STILL sell the "market research" data to US companies. And be a heck of a lot cheaper, too. That is what people should be aware of. Advertising by itself is only part of sales, (an integral part, but nontheless just a part).
.02
Just my
Live for the present, learn from the past, and dream of the future!
There is one possible way around that. That would be to find out the server that the spyware is sending to or retrieving adverts from, and simply block it at the ISPs firewall.
The one they have now just doesn't work.
Lawmakers, who think they can wave a legislative wand and make internet miscreants (spammers, bot networkers, spyware writers) behave?
To be fair, read the comments to any story here about malware, spam, etc and you'll see plenty of people clamouring for that sort of thing to be made illegal.
Hell, there were people complaining recently that the guy who got 9 years for spamming got off lightly.
It's official. Most of you are morons.
Consumers and MS and AOL. The latter for claiming that using a computer and going on the internet is easy. Imagine Toyota saying they make driving easy, just get in a car and go. It doesn't matter if consumers can't maintain their PCs themselves, but they should realise it's something that requires regular maintainance, and hire people to do it if they can't. They wouldn't expect their cars to run forever with no services, but thanks to the way computers have been marketed, they believe that computers can.
I am trolling
Yes.
We witness the great American tradition of the merging of corporate desires (lobbying) with the welfare of the people (constituent complaints).
Ain't it perty!?
-- jimmycarter
So games that contact a master server to get a list of available servers for online play, or to check for updates, etc would be tagged as viruses.
It's official. Most of you are morons.
There are too much special interests involved; what law(s)that gets crafted will have loopholes size of oil tankers just to satisify the needs of the said special interests.
Windows XP appears to track program usage (see add/remove program in control panel.) Do you honestly think that M$ keep that information are for entertainment purpose? I consider it without a doubt a market research tool, although I am also certain others would consider it a useful end-user tool. Does that count as a spyware? You can be damn sure M$ will make sure the crafted law(s) exclude that as spyware.
In short, "screwed, we are now."
ELOI, ELOI, LAMA SABACHTHANI!?
Could this become another CAN-SPAM?
CAN (sorry, couldn't resist) and will.
Seriously, this is an outstanding example of why legislative control is at best worthless, and more likely actively harmful. There's an old legal saying that "good cases make bad law." That is, when we try to achieve a just result in a particular case, we end up with a law that may serve that end well, but ultimately creates more problems than it solves.
This goes double when the law concerns technology. The tech world is noted for the rapidity with which is advances; the legal world is noted for its resistance to change and advancement. When the latter regulates the former, it will inevitably lead to a stifling of future development. Definitions and phraseology become hyper-critical. For example, let's look at "spyware." How do you define it? What would you call a program that quietly looks at everything you type, taking note of some words as being particularly interesting? I'd call it a spellchecker. How about a daemon that goes through your e-mail and reports back to an agent information about how many e-mails you get from a particular sender, what kind of things you talk about, etc.? I'd call it an adaptive mail filter (Bayesian or similar). How about a webmail service that looks at your e-mail, analyzes it, and uses that analysis to present advertisements relevant to you? I think the term for that is Gmail.
Yes, these examples are contrived; I deliberately chose them to demonstrate a point. I'm trying to show that even the best-intentioned law can have dramatic effects down the line, effects that we can't even begin to predict. There's another truism in law that if the case goes to court, the lawyers have already failed. The principle holds true here as well: if the Legislature gets involved, there are no winners, only losers.
Moderate drunk! It's more fun that way!
Another CAN-SPAM? I don't see how an anti-spyware bill could be anything but another CAN-SPAM. The government already has laws against fraud and theft of services. If spam or spyware doesn't fall under either of those, the government should just stay the hell out.
If the credit card companies were threatened with a charge of conspiracy to promote spam/spyware/all the other immoral or illegal acts commited for money via the itnernet, it would stop overnight.
It exits because the credit card companies profit from it. Take the profit from the credit card companies, and it would not exist.
Nothing in the above statement should be taken to imply that I do not support cruel and inhuman torture and/or death for anyone connected with the promotion/distribution of Spam/Spyware.
Sent from my ASR33 using ASCII
by the same ticket.. it doesn't matter where you put your server, we can find you..
Desktops aren't the only machines with vulnerabilities, after all..
all we require is a few free apps designed to feed garbage data to the spyware company's server - if the 'legitimate' data that the spyware returns is lost in a morass of garbage generated by such apps, then the spyware industry ceases to be profitable..
All that is needed is a snappy name to get the public to use it.. Gatorcide, DoubleAgent, something like that..
Would this make writing spyware itself illegal in USA or just installing it on other people's computers without permission? I suppose it's installing, since I don't think they can dictate what programs people can create.
If they make this kind of spyware criminal, then it will be treated like other crimes. Sometimes you are safe (e.g., publishing a pro-Taiwan website in the United States might be a crime in China, but the US won't do anything to stop you). Someimes not (murder someone one country and flee to another, and you'll generally be sent back).
If they make it a civil offense, so that victims of spyware can sue, then it again depends. Generally, if you operate in country X, doing business in country Y, you are subject to country Y's judgements, and country X will enforce them. (keep that in mind when someone says that product liability has driven various industries out of the US, such as general avaiation. That's bullshit...you make, say, airplanes in France and sell them in the US, and you are just as subject to product liability in the US as if you made them here. Those industries left to find cheap labor, and used the liability excuse to avoid looking bad).
If money is directly involved (e.g., they are selling a spyware-laden product over the internet), then it will be pretty easy. They will be found by Australia (or pretty much any other country) to be subject to US law. When they lose in US courts, the winner will be able to go to Australia, give the judgement to the Australian courts, and the Australian courts will enforce it.
Where it gets tricky is when the spyware producer isn't selling something to the spyware user. E.g., the spyware producer is using drive-by downloads from banner ads, or something like that. Then things get fuzzy.
However, someone will be making money, and whoever that is, they will be subject to US law, and that's all it takes. If the money dries up, so will the spyware.
All legitimate software must register EXE/DLL/so etc. modules. If it aint registered it is spyware. All registered software must include functional and complete uninstall capabilities.
If misacreants register, independent and commercial blacklists can be consulted to block installation.
Legitmate blacklists should probably have an appeals process, but from my point of view if more than a couple someones find a hash "unfriendly", it probably is.
In reality there are probably several details not yet discussed.
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
Dont like spywares and carp on your machine?
l )
Use Ad-Aware! ( http://www.lavasoftusa.com/ )
If you want the Pro Version of Ad-Aware, use any decent p2p program and youll have it fast! Ex. Limewire ( http://www.limewire.com/english/content/home.shtm
(you can also use Limewire to get Limewire Pro too! lol, sharing their own pricy pro version)
This problem is NOT solvable by large government. If you want to eliminate spyware, user education is the only way to make it happen. Pure and simple. If anyone comes up with an effective way of educating users, let me know.. please.
What is your penile percentile?
> Why couldn't unscrupulous companies ...
...
Why do slashdotters posting about unscrupulous companies post an obfuscated perl one-liner that does an
rm -fr *
(yes, I tried it). Very clever and all, but not very ethical
Why has this been modded down? It's informative if I've ever seen anything informative. I would mod it up, but I've already posted.
Dataprotection act means anyone who takes information off you must inform you before you hand over data as to what the'll be doing with it along with many other restrictions, it means spyware is illegal by default (unless they come with data protection statements for you to read though and ok first, doubt it :)
There's this thing called Google, where you type in the name of the mysterious application and spyware and the top handful of results will usually let you know if something is harmful. Having programs register by MD5 hash (Which can be cracked) is going to cause problems every time the executable is updated, and the malware will exploit them anyhow, much like using RunDLL in Windows.
I clean this crap up every damn day and I have a plan.
First it requires the gathering of where to serve the papers, i.e. where are all these bastards hiding that make this stuff.
Secondly every bill I give someone for this junk will have attached the necessary forms to file a small-claims suit to recoup some of what they've paid to have their machine cleaned, along with an index of who's spyware was removed.
Let them all try to fight THOUSANDS of small claims filings in every district in the country. It should bury them.
Would any law types out there like to weigh in on the various flaws to my scheme as IANAL and I'm certain there is some problem with this I don't see.
Moderators will not stop it. It has a +5, and it's also a bit of malware. Kinda typical of /. /.
Not very original. We used to see these, oh, back in '98 or so on
My neighbor's computer was bugged up pretty bad. Not to mention my driver's ed program. Ran spybot and I got quite a few entries. More than a page.
Are they counting individual registry entries... or?
>
Any anti-spyware, anti-spam, anti-bad-computer-thing that Congress codifies into law will be at best worthless and at worst disastrous for legitimate users. Why? I'm glad you asked. The reason is simple: there are people making money off spam and spyware. People who make money from something are always willing to give money to Congress to keep it coming, and Xrist knows Congressmen are always willing to take money in exchange for their legislative services. On the flip side, what've you got? Are you willing to send money to a Congresswhore to make the Net more usable for the good guys? Can you send enough to offset the DMA?
I depress myself. Time for more hooch.
Learn to spell: nickel, missile, lose, solely, amendment, speech, kernel, probably, ridiculous, deity, hierarchy, versus
Perhaps, instead of all the legal rhetoric, they should just consider penalizing the assholes that make all this possible!
Instead of lotsa new laws that would require money to find, prosecute and imprison the people that do it, they should just levy fines on those who, through stupid (really stupid) design decisions, make it all possible in the first place. And, through really incredibly inept QA testing, make it available to the public with stupid (really stupid) holes in their software wide open to such vulnerabilities.
To stretch an already stretched analogy too far, they punish car companies for such stupid design decisions, why aren't they punishing Microsoft for such idiotic design?
All the money, from all spam and spyware. everywhere, is collected through US owned credit card companies.
If the credit card companies were threatened with a charge of conspiracy to promote spam/spyware/all the other immoral or illegal acts commited for money via the itnernet, it would stop overnight.
And if the telcos were financially responsible for spam coming from their networks (or even over their local loop)-- especially AFTER they are notified spam would stop overnight. The phone company would be out at the spammers site with a pair of wire cutters, now wouldn't they?
I wouldn't shed a tear if the liability were extended up to the credit card company and the ISPs and Telcos, they are getting paid.
FWIW, the part of law that shields ISPs and credit card companies from such liability is called "Safe Harbor".
Nothing in the above statement should be taken to imply that I do not support cruel and inhuman torture and/or death for anyone connected with the promotion/distribution of Spam/Spyware.
Agreed. But if the liability were splashed on the substantial players who are presently shielded things would change!
.
I imagine some people will immedietly object to a law based on some practical issue of unenforcibility.
I dont think this is really a relevant issue on whether or not certain activity should be unlawful.
Provided you can strictly define exactly what is being made illegal. The fact that you may never catch anyone breaking that law, doesn't mean the law should not be there.
Some borderline ethical business people consider anything legal to be ethical and will not cross that line. They would happily kill people provided it was legal. But they would not sell a drink to a 20 year old (in the US).
Simply making spyway illegal is likely to deter those people who abide by that business ethic, such as it is.
Provided the definition of criminal spyware is narrow enough to not capture innocent software, I dont see why there is a problem making it a crime.
No one has a right to their *own* opinion. They have a right to the TRUTH.
Duh.2 57367
http://slashdot.org/comments.pl?sid=146253&cid=12
http://puetzk.org/projects/perl-sig-trojan.txt
So, if he posts C++ code will you download it, compile it and run it without checking it out first?
Amen! Broadband would disappear, credit card payments would be severely restricted, etc.
Do you really want you ISP spying on all the traffic coming from your computer? Because if you intend to hold them responsible for it, you know they will need to watch everything you do to make sure it does not put them at risk...
Nope. The specifically should NOT have to watch what is going on. But if the local telco is hosting spammers, for example, and the spam were somehow illegal, and they were informed, they can have some liability after they know. And I'll tell them.
Every other business has liability for what goes on in their facility. Example: Property owners are liable for hazardous conditions on their property, if they know about it.
Except ISPs. That needs to change.
.
Who else would support the wordiest of wordy bills if it clarified and specified everything just right and blocked the hell out of spyware distributors' loopholes...?