Slashdot Mirror
Consumer Friendly Downloads?
* * Beatles-Beatles writes to tell us Yahoo and AOL will be offering a new anti-spyware initiative to begin next year. The new initiative will allow vendors to get their software "certified" as easy to remove and not containing spyware. From the article: "It creates market incentives that will change how consumers see software," said Doug Leeds, Yahoo's vice president for product justice. Backers of the initiative believe that consumers wouldn't benefit much from a system in which good products simply display seals of approval. "They are looking for us to do it for them," Leeds said."
This sort of sounds like a recycled verisign sig. Unfortunatyl i doubt it would mean much to anyone at first. The majority of uasy to remove and not containing spyware. From the article: "It creates market incentives that will change how consumers see software," said Doug Leeds, Yahoo's vice president for product justice. Backers of the initiative believe that consumers wouldn't benefit much from a system in which good products simply display seals of approval. "They are looking for us to do it for them," Leeds said."sers i encounter think you only get trojans from visitiing porn sites and spyware from the same.
Maybe this is a good thing. The interweb won't be the same.
People really don't care about their products being "certified". Go out to the store and buy any usb wifi adapter you can find. In the installation guy it tells you to make sure that you hit "continue anyway" when your computer warns you the drivers aren't certified. I don't think not wanting to hit continue anyway is a valid reason for returning your new adapter.
Way back in March, Slashdot carried an article saying Office Depot will only carry Windows XP approved software.
Don't get me wrong, I think spyware is bad. I also think a big company only supporting a few software titles (and probably charging a bit to do it) is bad too.
I'd really prefer to see some kind of meta-moderated system by users to rate software as clear of spyware as it would give small vendors more of a chance. Otherwise, we will just further entrench big monopolies.
What are you eating? isItVeg?.
... is only as strong as it weakest link.
It all boils down to:
- Do we trust AOL and Yahoo to be honest in this sort of thing.
- Do we trust that AOL and Yahoo have the technical capability to effectivelly detect both reported and not yet reported forms of spyware.
What will it cost?
.: Max Romantschuk
Sure, it is old hat, but one of these days, there might be a "(insert company name approved) software" program that actually holds its weight and is useful/consistent/trustworthy...
... perhaps AOL/Yahoo will do it better? ... of course, considering the advertising on Yahoo... I'm not going to count on it from them, but it might inspire a knock-off.
I'm not exactly saying infinite monkeys/infinite typewriters, here, I'm just saying we've only had one major company do this so far (as far as I know)
MoM++ - A Classic Expanded - [Master of Magic 1.5]
http://mompp.sourceforge.net/
Let me guess... any vendor, no matter how small, will have to pay a shitload of money to get certified?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Let me get this straight. One company decides what is malware and what isn't. Ask yourself this, would Sony's rootkit have been considered a safe download? I think you'd find the answer is yes. This isn't an objective panel of experts deciding what is safe or what isn't, it's a company and this inherently flawed.
I find it hard to believe that any company, regardless of their otherwise good intentions, would refuse money from a company as Sony. In short, it may work in stoping the small spyware vendor but this is not nearly enough.
Simon.
Just another bad idea to make some money - why would the consumer trust AOL (or M$, or better yet - Sony :) ) better than some other smaller software company ... :)
Obviously a "trust system" is needed, but not one based on payments to a single company
... which comes with many software products in a bundle nowadays, and I'm pretty sure I don't want it.
I had the same thought at first, but the article states:
TRUSTe, an organization that already certifies and monitors Web site privacy and e-mail practices for businesses, will rely on testing by two outside labs for the vetting. It would not name the labs.
A user-run system of moderation is a great idea though. Although TRUSTe seems to be somewhat independant we have just recently seen that the big media corporations aren't exactly the most trustworthy entities when it comes to our personal privacy *cough...sony*, and there is sure to be alot of money at stake.
The problem with these plans is that there is always a cost to have your stuff certified, so only big/commercial players get their stuff in.
What we need is an equivelent of Linux's apt-get and synaptic, but for installing windows 32 programs. Make repositories for GPL, open source, shareware, commercial software. Obviously commercial software would require purchase but the repository should include all types.
Hmmm... I wonder if I can code this... I'm sure it would at least be doable for Free Software applications...
I'd really prefer to see some kind of meta-moderated system by users to rate software as clear of spyware as it would give small vendors more of a chance.
... that I skimmed through the comments on. There seems to be a way to generate user accounts... so people put programs out with trojan horses, made a bunch of fake accounts, and upped the ratings... you had to really skim to see the 2 or 3 users who had the "THIS IS MALWARE" messages. ... now, this can be avoided, sure, but it will always be a problem... such a system, if disrupted once, would lose a good deal of credibility.
Well, I don't know about that, those systems can cause problems, too.
I have come across a few very suspicious programs on download.com (where they use a rating system on satisfaction with the program)
Also... there is the problem of trolls, plants (that is, if the spyware pals decide to just sit and make new accounts and do it all manually), and kiddies.
===
Perhaps I am too much the cynic?
It *could* work...
It would have to be *really* well thought out and programmed. It would also need to get a good following rather quickly and remain free.
MoM++ - A Classic Expanded - [Master of Magic 1.5]
http://mompp.sourceforge.net/
I'm not sure if this solves the problem. The problem is that there are a lot of not-so-professional people out there that just install anything they lay their hands on. It's like: "Hey! It's a PC! *Must* install stuff on this!" If the PC asks OK or Cancel? they click OK. And then to remove programs they're suddenly "smart" enough to find C:\Program Files\ and delete anything they don't understand. In the end all they need is a browser, an email client, an IM client, a Wordprocessor and perhaps something to mash up some Photo's. Installing anything more will just result in making it worse.
The problem isn't the software. It's the people using the software! As long as they don't know what they're doing there will always be others abusing this.
It will succeed because of one important thing; FEAR.
The recent mess with Sony's rootkit, security threats all over the place, and scares over the latest batch of nasty viruses have the average Joe-User terrified. Your average Techie like yourself and me know better and have enough smarts to keep safe, but Grandma sitting at her PC chatting in AIM will be scared out of her bloomers.
Its the reason why Antivirus companies are racking in the dough with virus definition update subscriptions and also why Adware recently nixed their free spyware scanner so you have to pay for it now. The only one that still free is Microsoft's beta program and a few smaller other scanners.
Fear of Spyware that compromises your computer and might let someone steal your identity online or infect you with a virus is what will drive the Average User (the majority of the Internet's population) to use these services. All of you fellow Slashdotters should have figured this out already...shame on you.
Michael "TheZorch" Haney
thezorch@gmail.com
http://thezorch.googlepages.com/home
Aptitude is open-source. You wouldn't need to do much coding.
We don't need administrative or legal solutions to this, though they're nice.
What we need is application sandboxing; that is, restrict an application's access to system resources when it runs (think chroot jails but on a much grander scale). The key to this (as with any security system) will be to balance security with usability, i.e. not make it so anal that you can't actually do anything. You'll still have ignorant users, but at least they will opt into insecurity rather than inherit it by default.
Crucially, this is something we nerds can do for ourselves and not rely on others whose agendas are opaque.
Windows programs generally have no dependancies, so a project like this is not really needed. It has been tried before, and there are various projects still taking a stab at this, but I don't think they'll get anywhere.
Am I the only person who has noticed the numerous stories that get posted by *--Beatles-Beatles? Am I also the only person who has noticed that the link used in is name is a constantly changing URL (depending on the story) with pointers to various scammy sites? Is it not obvious what he's doing? He's using the awesome PageRank of slashdot do promote his sites based on searches that have the word Beatles in them.
It's a small price to pay for free advertising. Find a story, summarize it in 5 minutes, post to slashdot, and get a pagerank boost that advertisers would pay hundreds (or maybe thousands) for. (Text links on high-ranking sites is big business - just ask oreilly).
Slashdot should at least put a ref=nofollow in the links to submitters (or better yet, only link the submitter's name to his/her user page).
Ah, my friend, but you forget that is for for small business owners such as myself who couldn't care less about the variety of software -- we just want our stuff to work. Do you know how much time I spend playing "IT Guy" for our company? It is truly not fun.
Give us our MS-Office, our devices that plug in correctly, our specialized apps, and just make everything work. We'll pay extra.
I wonder what will happen if Microsoft does go ahead and buy a stake in AOL. Would this service cease as soon as it is started?
"consumers wouldn't benefit much from a system in which good products simply display seals of approval"
Reminds me of Tommy Boy: It's guaranteed because it's worth less.
Maybe I'm missing something here but what's to stop a spyware producer from just copying the seal of approval and sticking it to the front of his product? The threat of legal action I hear you cry. I don't think Mr Spyware Producer really cares all that much about breaking the law so that's hardly a deterent.
Perhaps if AOL made it public knowledge they would send "da boys" round if they caught anyone copying the certificate that would slow some people down. Perhaps a fitting punishment would be being crushed under a million AOL cds pushed one at a time through a giant letterbox.
I used to have a better sig but it broke.
It's just a front to say "Linux/BSD/Solaris is crap because the .iso file isn't AOL-certified." Meanwhile a malware-spammer with shoverfuls of cash from his latest pink contract will have no problem getting in. And how fast do you thing DRM will get on board? "Hah, Natasha! We can stop anybody from sharing ANYTHING just because it isn't AOL-certified!" "Yes, Boris, and now we make big trouble for moose and squirrel!" AOL-certified will have the opposite effect: products bearing this seal will be treated with an extra measure of suspicioun.
The best way to be certain that a program is free from spyware is to examine the source code, comment out any bits you don't like, and compile it on your machine.
The second-best way to be certain that a program is free from spyware is to have someone you trust examine the source code, comment out any bits they don't like, compile it on their machine, sign it with their OpenPGP decrypting key and make their signed, pre-compiled binary available for download.
That's how we have always done things in the Unix world, how we still do things in the Linux world -- and it's beginning to take hold of the Apple Mac world, too.
Now, if only the Windows world would wake up and smell the coffee! "What good is source code to me?" they bleat, "I'm not a programmer!" Yeah, you may not be a programmer, you may not want to be a programmer, but the source code is still your best guarantee that a program is what it says it is. And if the person who wrote that program won't show you the source code, even despite the facts that (1) they aren't charging you any money for the executable so it's not like you could be ripping them off by compiling more than one copy and (2) you aren't a programmer and wouldn't understand it anyway, then you have to ask yourself what don't they want me to see?
Insist to see the source. It's the best guarantee yet that the software you are running is pure.
Je fume. Tu fumes. Nous fûmes!
Not to be a troll, but I use OSS and they tend to have no spyware whatsoever (probably because they are OSS). I use it so much that now I tend to distrust non OSS software, and only use them when I can't find any OSS that does the trick. 99% of my software is OSS though (and I use a LOT of software, not just OS/office suite).
Send email from the afterlife! Write your e-will at Dead Man's Switch.
This is not going to work, just like a gun amnesty, the only people who hand in weapons are the kind of people who are not going to get the urge to go *stabby stabby* to their neighbours.
The companies that will get their software signed are the companied that don't include spyware in their products. The companies that install spyware will just circumvent the protection.
nice try though, 10 for effort, keep thinking...
I don't know if I'm being simplistic about it but I've tended to go with www.download.com for anything extra I need - like an avi converter or free audio editor package like audacity. Judge the download by other peoples reviews as to whether it does the job without installing any nasties. GnS
How much do you like toast?
So, I'll likely have to pay for their seal of approval? You mean, I actually have to _pay_ to have my product carry an advertisement for their company? Thank you, but no...
How DirectRevenue and Bullseye network get away with forcing you to download an uninstaller, and fill out a fucking survey, respectively, before you can uninstall their adware. Unbelievable.
It's called Open Source. Or at least to me and the people I advise anyways.
I always tell people that Open Source apps typically do not have any of that crudware in them while most freeware does have that crap embedded, and then point them to various websites that track what freeware has what spy/crap/ad ware in it. I have never been burned by an OSS project and it's windows download/installer.
so look for the OSS label!
Do not look at laser with remaining good eye.
...how much effort people are willing to put into creating fixes and work-arounds for the simple fact that Microsoft Windows is broken.
That's what it sounds like to me, fix the underlying problem. Make the OS more secure, not necessarily picking on windows underlying OS here so much as their methods of add and removing software, they need to come up with a way that all changes to the system are tagged with the application that made them. Then removing the software would be complete always, leaving no extra hidden goodies behind.
All operating systems could really benefit by something like this, of course with the way windows is built it would probably be too easily circumvented anyway.
Surely this makes things worse. Something masquerading as Consumer Friendly bypasses at least some scrutiny.
AOL will launch 'approved software' that is 'easy to remove' when they dump their own annoying (remember AOL version 8.0?) and ubiquitous install CDs and have it on almost every new PC with Windows. Maybe people don't want AOL after hearing how bad their software is. I don't know if they are planning on stopping their mass distribution of AOL CDs (1048 free hours!) but they should stop it if they want to seem legitimate in this new effort.
You have to first build trust to ensure trust. By the way.......you've got SPAM!
He who knows best knows how little he knows. - Thomas Jefferson
FTA: "Leeds said applications and the way they are distributed change so often that companies like Yahoo have a difficult time keeping up. A certification program, he said, will allow Yahoo to keep monitoring a partner's practices."
Uh... how will a certification program help? Does Leeds mean that they will only certify specific version releases? ...that if the company releases an upgrade or patch, that each one will have to be re-certified? Won't this just slow down software releases?
And how long before another company (say, MS or IBM) starts their own certification? Then we'll have competing certification systems. Even without this, it would be better if the open source community started a democratic rating system....
$nice = $webHosting + $domainNames + $sslCerts
Do you use Firefox?
Tell me ONE (1) extension you have installed that does not say "UNSIGNED" in red black font?
Do you panick when you see those? do you avoid installing such extensions.
What is the meaning of that field anyway?
Ubuntu is an African word meaning 'I can't configure Debian'
Download.com already does this.
AOL is the suck. Bets on how long before AOL is out of business?
"avoid" - software corrupts system settings and does not include a satisfactory uninstall procedure
If you don't risk failure you don't risk success.
...and AOL will be offering a new anti-spyware initiative to begin next year. The new initiative will allow vendors to get their software "certified" as easy to remove...
A HAHAHAHA YAYAAYHEAHEAOIHEAODHFAOSDHFAOSEFAYUWFOASJFAL:SDF!
AOL, certifying software as easy to remove...heh..hehhheheheh...AHAHAHHAHEAHEHAEHAHAH
Ok, thats just too absurd, this has totally made my day, hilarious! Is it April 1st?!
Yahoo and AOL will be offering a new anti-spyware initiative to begin next year.
Because Yahoo! would never want anything to do with spyware, would they?
Oh, wait...
It's true no man is an island, but if you take a bunch of dead guys and tie 'em together, they make a good raft.
And just how do they propose to certify their certifications process? So they are saying they know how to detect every possible way to detect a virus, trojan and rootkit there is? That's laughable at the least and very very misleading. This is nothing but a bogus marketing attempt to lull ignorant users. If you are stupid enough and there are boat loads of Windows users out there that are, to download software from places other than the vendor. Then you should have your PC confiscated.
My karma is not a Chameleon.
I use GPLed software -- not "freeware" that takes care of the problem.
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Is this a money making scheme or is it for real? I guess I'll find out when I submit some stuff, and tell them that since its non-commercial anyway, I can't pay a thing aside from maybe a few bucks for processing.
The problem is:
Either it is difficult and/or expensive to get through the process, in which case a lot of good software won't make it simply because it's freeware, cheap shareware or the author doesn't care enough, or it's easy and cheap, in which case I don't see how it can be good enough to not fall for the spyware authors submitting their stuff.
Assorted stuff I do sometimes: Lemuria.org
The days of having 8 or 9 AOL CD's in your mail are over people! They'll get involved in whatever they can, bringing Time Warner down with them :p
You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
That really isn't a bad idea. Sometimes I don't have time/energy to browse sourceforge.net or just googling it. There was a /. comment sometime ago where a person posted this huge list of windows apps that was considered safe in this context. I found some useful programs from it. I have that list in a PDF on my computer somewhere, but I won't know of any new programs out there. I used to use download.com and winfiles.com but they are mostly time/feature limited shareware anymore.
Isn't it ironic how the biggest peddlers of spyware and spam on the internet today would be the ones pushing an anti-spyware initiative. Seems like they are trying to clean the dirt off their own names.
The new initiative will allow vendors to get their software "certified" as easy to remove and not containing spyware.
That sounds like a great idea. Let's certify software to make sure that it doesn't do anything that it shouldn't. And of course, everybody's going to want to get this certification, right? Because, every piece of software that we install on our system, we've had a chance to make sure that it's "certified", right?
It makes about as much sense as certify everybody who promises not to commit murder. Yea, that will stop the killing.
Interesting.
:(
Quite a flurry of story acceptions lately.
When I got hit by adware/spyware, it wasn't because of some software app I installed. Going to the wrong site, is like stepping on a landmine. And going to those sites isn't hard to do since they have it rigged to route you there if you mis-type the url.
and it's not the easiest app to remove always......
I hit this story strictly because I find yahoo toolbar annoying to yank on far too many pc's
every day http://en.wikipedia.org/wiki/Special:Random
How about "AOL will certify companies as prompt in stopping charging credit cards the moment service is cancelled.".
It's a software app problem: you're using IE which is not certified.
Just be sure you also examined the source (all umpteen megs of it) for your compiler and all other tools (e.g. linker) you'll be using in the process, since it is an ancient and classic hack to simply infect a compiler to always include generated malware, and then throw away the hacked source to the compiler so that everyone thinks it's hunky dory. Not as simple as you thought, huh?
Slashdot readers may be savvy about checking around the web to see if a piece of software contains spyware before they install it, but the average user has no idea how to tell if a given software program is spyware-free. If they could just see an easy-to-identify "spyware-free" certification on the package or website somewhere (and that certification actually means what it says), then that would help a lot. It would be kind of like seeing the "UL tested" stamp on an electrical device. Software companies that used the seal without authorization would be committing a felony. Even if the certification didn't eliminate spyware, it might at least force software makers to do a full disclosure, get the user's permission to install 3rd-party applications, give the user an easy way to later uninstall those 3rd party applications, and make it so that uninstallation completely removed every bit of the installed software from the system.
Consider companies like Symantec that sell software to protect people from viruses.
What would happen if Symantec's software was soo good that it could detect and quarrantine both NEW and OLD viruses (without explicit definitions for them). Would they really want this? Would they stay in business?
Of course not. THEY don't want to get rid of viruses, they only want to SELL you a tool to find them. And somehow, (thousands of?) new viruses manage to keep poping up. (Despite the fact they they don't mutate on their own like the biological kind).
I'm not sure if AOL *really* wants to see spyware eraticated. I think they just want to make extra money from the current situtation. And I wouldn't be surprised if they (secretely?) took steps to ensure the status quo.
I hate using AIM but I have friends who I chat with and they won't use anything else. I use Trillian so I can use ICQ and Yahoo! Messenger as well. I signed in this morning and I get this message from AOL that said "We've installed two new bots ShoppingBuddy and MovieFone. I thought "What the fuck is this shit?" It may have been because I installed AIM Triton preview to see if I could get the video chat to work. This is even more egregious than all the ads and tickers and additional software they want to install on your computer. Anyway I blocked them.
In the past, I've had to go in and edit some of the AOL files to get rid of all sorts of crap. AOL is about as welcome as an anal probe. They want to block other peoples intrusive software so they can foist their crap on you. AOL's idea of "consumer friendliness" is to come into your home uninvited, bend you over, put an anal probe up your keister, and tell you just how wonderful and lucky you are to have it. Your very own mini-Federal-pound-me-in-the-ass prison in the comfort and safety of your own home. Only 9.95 per month!
"You'll get nothing, and you'll like it!"
if(!malware)return "All clear";
d or==...)
if(malware==true)
{
if(vendor =="AOL"||vendor=="Sony"||vendor=="Microsoft"||ven
return "All clear";
else
return "AOL is on your side, keeping you safe from malware";
}
AOL is going to tell me what's decent software?! Huh... perhaps I'll just download from reputable sources, and ignore those popups with nude women asking for a quiky click.
Want to find other gamers to play board and role playing game
Buy Steampunk Clothing Online!
Actually what happens is Windows programs *do* have dependencies (lots of them, for MSVCRT71 upwards) but they ship all of their dependencies built into the MSI - so you have a 20MB download instead of a 1MB one.
.NET runtime in there...
Heck, I've seen installers that bundle the entire
Since on Windows, there are no 'shared' libraries in the true sense (every app is supposed to have its own copy of dependent libraries - writing to System32 is a verbotten, although there are still badly written installers that do).
This is TRUSTe were talking about. My bet is that anyone who pays $500 gets certified.
Notice there is intentionally nothing about what it would cost or how developers apply.
Of all companies, I do not want AOL to verify what I download. I think that they know they are dead and the only thing that is keeping them alive is their free IM client. You know we're going to have to pay for it soon...
I agree with the above.
It's not that you're walking through a mine field, it's that you're trying to find ground safe to walk on by whacking the floor with a sledgehammer.
The spyware scanner is called Ad-Aware, and it's still free.
Large content/network companies do nothing about spam or spyware. Indeed they stand in the way of many effective attempts to address the problem. Both Spam and Spyware become perceived as a problem. Then they step in with "consumer friendly download services" which offer to make downloads "safe" again perhaps for a price.
This is probably just the market at work but it's herd not to see the same business planning behind both decisions.
Nice condescending attitude, dipshit. I'm sure you'd be just the guy to hire. I can picture you somewhere in the back of my mind, sitting in front of some server in a customer's office, halfway through your eighth cup of coffee, sweating and maybe twitching a little, your face scrunched up in anger and starting to turn red.
That telltale vein starts to pop out on your forehead as you sigh just loudly enough that everyone else in the office stops what they are doing to stare at you momentarily out of the corners of their eyes. Someone stops by to drop off some paperwork of some sort. "IDIOTS..." you mutter in a barely audible hiss after they are slightly out of earshot.
Also, you are fat.
Remember when Yahoo reset all of their users' spam preferences? Heck, a few stories up from this one you can read about how AOL just automatically added two bots to all the AIM users' buddy lists. Sure these are both things that are easy for the user to fix, but it demonstrates that, if the price is right, these companies would rather ask for forgiveness than permission. Lack of consideration for the user's personal preferences is pretty much the problem when it comes to annoying software installs.
What we have here is a group of companies that don't really have a great track record in respecting the wishes of their customers. Why should we believe that things will be any better now that they're colluding to set standards?
If you read a couple of the articles about this certification it becomes apparent that they are actually certifying ADWARE! They are saying that it will be easy to remove... but who really cares? Adware is Adware and I am not going to voluntarily put it on my pc. What are they thinking? Take a look at the fifth paragraph in the following article. http://www.eweek.com/article2/0,1895,1887914,00.as p
Seriously, who would retain control over this group? This is the same Yahoo that recently released an anti-spyware toolbar that not only plays favorites with detection, but outright ignores (regardless of settings) certain products that Yahoo has a financial tie to. The last time people tried to agree on a consortium promising to certify apps as "spyware free", it failed miserably for the same reasons - the model of selling such a certification provides a clear financial incentive geared toward certifying products/companies rather than rejecting them.
Caveat Emptor is not a business model.
We might call the new repository Debian Main.
I'm sure glad no one has thought of this before
I won't be surprised if they take the sony route. " In order to change the way consumers view software, we've supplied this anti-spyware software. It'll scan your system, checking for anything bad, then report that back to you and us, along with your ip address, os version, your webpage history, recent documents and programs, just to be safe. But don't worry, it's not spyware because we're out to change how you look at software." Then again, they might not. But the more I write stuff like this, and the more people read stuff like, the less likely they'll do something like this.
please... let me sleep... a little more... yay, no longer annonmyous coward.
The article was a little vague about the exact process for getting certified. Since it's going to be run by TRUSTe, I imagine that this won't be for free...
Well, at least this certification only affects the software that gets distributed by AOL, Yahoo!, CNet, etc. I just wonder if this isn't the start of some sort of "trusted computing".