MIT Startup Tests Top Million Sites for Spyware

torrentami writes "An MIT startup called SiteAdvisor has downloaded over 100,000 programs from the top million Web sites and tested them for adware and spyware using an automated system they've built. They've got a blog entry where they dissect 5 of the worst adware bundles they found. There is some amazingly invasive stuff in there."

Comments

What about the rest?

[Anonymous Coward]

I hope they have a "submit site" function for people to test random sites....

Re:What about the rest?

[TheSpoom]

That is a really good idea. Better yet, have a browser component that tells users, on the fly, what previous attempts at scanning the site have revealed (as they would have to be cached in order to have any sort of performance server-side). If a user notices that a site now offers spyware downloads, they could request that it get reexamined, and popular sites would get automatically reexamined often. This could be done using a cheap subscription model.

Has someone done this? It seems so obvious now that I've thought about it.

Re:What about the rest?

[TheSpoom]

Sorry, didn't realize that the company named was doing this as I couldn't access their Slashdotted server.

Re:What about the rest?

[RemovableBait]

While that doesn't seem to be available yet, you can submit a download link for them to analyse. Just search for an existant site and click 'Submit a download'.

I think they'll probably implement your idea (which is damn good in my opinion) once it leaves 'Preview' stages.

Re:What about the rest?

[Jaseoldboss]

Couldn't find a submit but it looks like you can put your site name into the search url ok:

http://www.siteadvisor.com/sites/slashdot.org/summ ary

slashdot.org We've tested this site and found it safe to use.

Re:What about the rest?

[Anonymous Coward]

I hope they have a "submit site" function for people to test random sites....

What's random about a submitted site?

Re:What about the rest?

[robpoe]

Naaah, ill bet they're looking to get bought by Google (heck, their demo even has the search results as they would appear on the GOOG home page).

Sounds good to me though :)

The web spidering capabilities of GooG, with the downloading of every exe/zip/rar/etc, with a browser plugin (built into the GooG browser too!) to tell you what EXE files are bad .. and the Internet could actually be safe again..

hmmmmmmm

Re:What about the rest?

[jZnat]

I like how it does that "sign up with email" test. Too bad there's no good way of determining legitimacy without actually looking at them. Slashdot's emails are story summaries of the day (or in my experience, of two days ago). Besides, there's always dodgeit for signing up with throwaway email addresses.

Re:What about the rest?

[geriatrix]

I have been around for a while so the cynic inside me rings warning bells. If a product like SiteAdviser comes into general use it influences peoples browsing habits. This sort of power can be used to manipulate the web & raises the question who's watching the watchers? I think SiteAdviser is a great idea and the product & deserves commercial success, but the process of rating websites need to be open and subject to public scrutiny.

The major lesson of all this.

[CyricZ]

The one major lesson we can take from their research is that we should probably not be using Windows.

When you consider how many alternatives (often far cheaper, too) are available, it's a wonder that so many still choose to use software that leaves their systems wide open to exploitation, be it from worms, viruses, or malicious websites.

But perhaps a secondary lesson is that we need to keep an ever-strong vigil. It's perhaps even our duty as computer-competent individuals to inform others of these issues. Not to preach to them, by any means, but do let those less-astute computer users know what is going on. Advise them that such problems exist, and tell them how to avoid such malicious software.

We can easily defeat the problem of spyware. But it will involve people helping each other out. Soon enough the ignorance will fall by the wayside, and we will all be better off.

Re:The major lesson of all this.

[Anonymous Coward]

Can you please migrate my parents MS Money2005 file to Linux somehow?

Re:The major lesson of all this.

[dada21]

I disagree.

Windows is, by far, the most insecure operating system out there. It is also the operating system that users find the easiest to use, and it is also the operating system that (in my opinion) has the most flexibility for programmers and software corporations of all sizes.

While the *nix varieties are definitely more secure (as they are now), a switch to *nix will not lead us to less spyware-ridden applications online. In fact, if Windows were to fail commercially tomorrow and everyone runs *nix, you'll see spyware applications be written for these OSes immediately.

*nix does not mean secure. It just isn't popular enough for spyware programmers to target, yet. Give it time, I think as it gains popularity, it will begin to be a target for the software companies that try to enter and dissect your life digitally.

Re:The major lesson of all this.

[Jeng]

Spyware and Adware are not caused by microsoft, well not most of it. Thats like saying though that rotten meat causes flies. You can inform your friends and your family, give them the information they need "in a way that they can understand and use it" and you will be fixing their computers less often.

As ignorant users move to other operating systems you will get spyware and adware on linux and mac also. Rootkits have a long history with unix don't they?

Re:The major lesson of all this.

[firl]

this is true, but this is the kick when you wanna do something as a user in unix, you can, but when a program is able to have more access to your own computer (spyware) then you do, thats when I think *nix will be better.

Re:The major lesson of all this.

[BushCheney08]

In fact, if Windows were to fail commercially tomorrow and everyone runs *nix, you'll see spyware applications be written for these OSes immediately.

Agreed. Especially when you consider that all of the programs in TFA were installed after the user clicked the "I Agree" button five, six, seven times. The OS could be totally secure and only allow the installed apps to affect the logged-in user. They'll still be there annoying that one user, though, since the user is the one who said it was okay to put them there. This is where informing the user comes in. And the user has already shown many times over that they don't care to be informed. This sort of crap is gonna be around for a long long time...

Re:The major lesson of all this.

[daviddennis]

I don't know if users really find it easiest to use. It's just "what's installed on the computer". I would say that way under 5% of the user community has made any kind of comparison between alternative operating systems and decided, as a personal choice, which one they want to use.

I know that after trying MacOS, Linux and various flavors of Windows, I find MacOS X much easier to use than Windows - but at lot of this is just that MacOS X doesn't move their preferences around constantly between OS versions.

In the end, though, my preference for MacOS is more aesthetic than anything else - I like the huge amount of work that's gone into making it slick and designer-friendly. There's also the ability not to have to worry constantly about virii and spyware.

I do think more people would work on spyware for MacOS X if it was more popular, but it's hard for me to believe people haven't done it and are not working on it even in its current state. After all, if someone can get their spyware on the Mac, there are still millions of machines to infect and they might be the only infection on the machine instead of one of fifty or so as in the Windows world.

It's quite possible that Mac users are more knowledgeable about their computers, or at least tasteful enough not to download 600,000,000 free smiley faces with hideous background art including 20 new spyware programs. Or perhaps having to type your password after downloading software gives people an idea that downloading software just might be dangerous ...

D

Re:The major lesson of all this.

[Kickboy12]

I disagree.

People have been saying the same thing for IE vs. Firefox for a couple years now.

Guess what? I still don't see very many sites getting around Firefox's pop-up blocker, significantly exploiting it's weaknesses, or finding new security holes by the dozen. And yet... I continue to see it with IE. And don't be saying; "Firefox isn't popular, it'll happen eventually". My ass. It's been advertised into the ground.

Thus, the same concept with *nix vs. Windows. Windows is inherintly insecure, and by the nature of how it works and how it was designed, it makes it easier for advertisers to create software that'll mask itself from everything else. You simply CANT do this on Linux/Unix to the same degree, just as you simply CANT exploit Firefox the same way you can IE. Trust me, I've tried.

Re:The major lesson of all this.

[linguae]

[Windows] is also the operating system that users find the easiest to use, and it is also the operating system that (in my opinion) has the most flexibility for programmers and software corporations of all sizes.

I disagree. Mac OS X is considered by many much easier to use than Windows (in fact, the classic Mac OS, IMO, is considered by some to be the hallmark of usability; memory management issues aside, in some ways it is more "user-friendly" than OS X is), even though I do agree that Windows is easier to use than Linux is (I'm talking more than just the interface; even though KDE and GNOME have reached Windows as far as usability (IMO), it is the whole package that counts, and some things such as installing certain drivers are tougher in Linux than in Windows. That's why I still have a Windows partition). I also find the Unix-based OSes to be more flexible for programming than Windows is; Unix has tons of command-line based programming tools at your disposal, and programming GUIs in Unix has gotten better with GTK+ and QT (even though Mac OS X leads the pack here with Carbon/Cocoa). Unix has widespread support for nearly all programming languages and programming styles, as well.

I do agree with you on the rest of your points, however. Spyware isn't necessarily a security issue (even though Microsoft's security issues don't help the issue); it is about users who don't know any better. It doesn't matter if Microsoft creates a version of Windows built on top of BSD or Linux. Nothing in Unix prevents a user from running a script that says "rm -rf ~", which ends up deleting all of their files. After all, part of the Unix philosophy is not holding the hands of users ;). It doesn't matter if that script is a program saying "Download FREE revealing pictures of Pamela Anderson" or "Click this icon and win an iPod" or something else that many people will fall for.

Even the most secure OpenBSD system will fall victim to *nix spyware if you let the most foolish (l)user mess around with the system.

Re:The major lesson of all this.

[Anonymous Coward]

Windows is, by far, the most insecure operating system out there. It is also the operating system that users find the easiest to use

Uhm, me wagers it's the _only_ operating system your hypotetical user has used.

and it is also the operating system that (in my opinion) has the most flexibility for programmers and software corporations of all sizes.

roffle

Re:The major lesson of all this.

[Anonymous Coward]

Advertising doesn't mean something's popular. While there will often be a correlation between how much advertising is done for a product versus the market share of that product, the popularity of the product cannot be inferred by the amount of advertising done for that product.

Firefox has around 10% market share, while IE has over 85%. Without debating the inherent (in)security of Firefox or IE, the fact that IE has over eight times the market share that Firefox does, as well as having more than 3/4 of the entire market, means that most spyware that has to attack a specific browser will be written for it, because there is a much greater chance of having the spyware distributed.

Re:The major lesson of all this.

[jonbryce]

You usually have to be root to install software in linux. If you are root and installing software, that software could include nasties that hose your linux system just as easily as your windows system.

Re:The major lesson of all this.

[Stevyn]

yeah but for most people using the popular distros, installing software means using some sort of software management tool. this usually means that the software you're trying to install has gone through some sort of checking process, be it formal or informal, and much safer than just downloading some .exe off the web and running it. It's no silver bullet and problems can still arise, but IMHO, it's a lot safer.

Re:The major lesson of all this.

[Mancat]

Dumb. Even if all you could do was install software to your user's home directory, you could still become infected by all of these things in Linux. If, sometime in the far future, most Linux distributions take on an OS X-like system where users can grant processes root priveleges when needsd, things will be just the same as it is on Windows right now.

You don't think too deeply before you comment, do you?

Re:The major lesson of all this.

[mboverload]

Bullshit. We need smarter users.

Re:The major lesson of all this.

[balloot]

*nix does not mean secure. It just isn't popular enough for spyware programmers to target, yet. Give it time, I think as it gains popularity, it will begin to be a target for the software companies that try to enter and dissect your life digitally. I strongly disagree with the sentiment. One of the most useful tools available to a really annoying piece of spyware is the Windows Registry. *nix systems (Mac OSX included) do not include this "feature." The registry adds an extremely unecessary layer which adds some convenience, but relies on programs which make registry entries to give a way to uninstall and delete these entries. Guess what? Spyware loves to insert itself all over the registry, and doesn't give an easy mechanism for deletion. This leads to the "I deleted it, but it just comes back!" kind of spyware that drives people nuts. As far as I know, this kind of spyware wouldn't have anywhere near the same resilience on a *nix platform. One very good example of the difference between spyware attempts on Windows and OSX is Sony's infamous "rootkit" DRM software which we all know did very bad things to Windows computers. Before a patch was made, there was some 18 step process that was necessary to get rid of the software, and any attempts to remove the software generally led to failures of the user's DVD drive. What was less reported was that the same company made DRM software for the Mac, but Mac users who found the program on their computer had a slightly easier fix - they just threw the program away. There are simply not the same kind of hooks in OSX which allow these kinds of programs to do nasty things to your computer.

Re:The major lesson of all this.

[CTalkobt]

This is not a windows issue (as much as I dislike windows).

It's a user issue. Like any information on the web you need to consider the source of where you're getting your programs from. I wouldn't get cancer information from the tobacco companies websites - just as similairly I wouldn't get software utilities from my company from a page that has a bunch of advertisement links along with some porn.

Rational users would cure 95% of the virus / trojan issues. The other 5% are usually inadvertant mistakes from legit websites. For those a checker is needed if you want to immediatly download files. That or let others be your guinea pigs and only download ones older than 3 months old.

( I know - there is no such thing as a rational user but I can dream... )

Re:The major lesson of all this.

[TimTheFoolMan]

It's no surprise that we who write software are seen as arrogant when we see the *average* user, the person who makes technically uninformed decisions, and our response is, "the problem isn't with our system, the problem is that you Mr. User are an idiot."

The world has idiots. Why can't technology people (us) accept this without derision? The world also has many people who don't know technology, and don't care too. They are not necessarily the same people.

Emerson said "Every man is in some way my superior, and in that i can learn from him." We seem to be so busy casting aspersions that we don't have time to listen. We're so quick to insult, perhaps because we (developers and technology people) don't *care* about users. Are we so superior to Emerson that there's nobody we can learn from?

Why can't *someone* care enough about the technologically illiterate to protect them against themselves? Why isn't there a company out there that will make it difficult for a regular user to install something that has potentially deep affects to the OS, but makes the OS accessible to that same user?

Oh wait... there already is one.

Tim

Re:The major lesson of all this.

[SoulMaster]

Excellent point. Moreover, the more linux installations you have running, the more idiot users you have that will click on the spyware and install it.

Let's remember that they disected spyware hidden in installation packages, not neccessarily crap that would be prevented by better security anyway.

Gotta train the monkeys, only then does spyware go away.

Re:The major lesson of all this.

[teslatug]

What does this have to do with Windows? Are you telling me that if you ran malware that targeted Linux you wouldn't have a problem? Sure you're likely going to run it as a user instead of root, but the nuisance factor could be just as high.

Re:The major lesson of all this.

[Compuser]

No, what we have learned is that most people need two computers:
an internet facing box with a browser and email and one box
for all their real work (balancing their books with GNUcash or
Money, office work, playing games etc.). Importantly, the box
for work must be physically disconnected from the net, not even
via sneakernet.
This is at home.
At work, the same is needed, except the work boxes may be wired into
a network which is still in no way connected to the net. It may
even be a good idea to make net facing boxes a few per floor
unless people need the internet a lot.
Security does not seem to be achievable via software. It is not a
coincidence that the OS many people think is easiest to use is the
one that is least secure. Administrative controls are needed and
they need to be loud and clear even if they represent a complete
rewiring of the building and doubling the number of boxes.

Re:The major lesson of all this.

[TemporalBeing]

Nothing in Unix prevents a user from running a script that says "rm -rf ~", which ends up deleting all of their files. After all, part of the Unix philosophy is not holding the hands of users ;).

Actually, there is - it is called permissions. Windows does not really understand the execute permission - it just looks at what file type it is, not what the user (or administrator) desires. That is not to say there are not ways to overcome it, or even ways to exploit programs - there are; but the impact is minimalized by how *nix/bsd security is set up. For the most part, it will only affect one user, not all of them; and even that can be minimalized by the default permissions scheme used, and developers not automatically giving downloaded files the execute permission (just read/write).

There does seem to be an execute permission under Windows, but it is pretty much a joke and no one (not Microsoft, or admins, or anyone else) pays attention to it. So the very fact that *nix/bsd and Mac OS X does pay attention to it (and the community is aware of its use) already puts them lightyears ahead of Windows.

Re:The major lesson of all this.

[westlake]

When you consider how many alternatives (often far cheaper, too) are available, it's a wonder that so many still choose to use software that leaves their systems wide open to exploitation

It's not such a wonder at all.

Open Sourceforge.net. Search for projects that are aimed at users without a trace of the Geek in them. The pickings can be mighty slim.

Turn to a site like Amazon.com for a look at what these users want. It is a very different world.

Re:The major lesson of all this.

[Sparr0]

What is your definition of "usually"? Of the last 30ish things I have downloaded for linux, about 5 didnt have to be installed at all, and the other 25 installed to ~/.local/ just fine

Re:The major lesson of all this.

[slugstone]

In fact, if Windows were to fail commercially tomorrow and everyone runs *nix, you'll see spyware applications be written for these OSes immediately.

That maybe true, but I have been hearing that for over 5 years. It is a tougher job to crack a *nix box then a Windows box

Re:The major lesson of all this.

[sjames]

It's no surprise that we who write software are seen as arrogant when we see the *average* user, the person who makes technically uninformed decisions, and our response is, "the problem isn't with our system, the problem is that you Mr. User are an idiot."

Well, what are techs supposed to think when they tell the user 6 times never ever click OK or yes to install something from the web and the user DOES click OK 7 times, then wonders why things went wrong?

If people drove cars the way they use computers, they would routinely forget which 'thingie' is the brake. Then they would just steer into a tree when they wanted to stop.

Naturally, most people aren't actually that bad, but there seem to be more than enough that are.

Part of the problem is that in any company, the tech will primarily encounter those few hopeless idiots (since the rest manage not to do the really stupid things that require significant tech support to fix) and so they are over-represented in his thoughts about users.

Re:The major lesson of all this.

[Anonymous Coward]

I will run linux on my PC when quickbooks, quicken, or an alternative with the direct links to my banks exist. Until then I will run Windowz on my PeeCee. Oh the Games thing is an issue too. So why is there no open source solution to the professional book keeping world.

Re:The major lesson of all this.

[kabz]

Yep, I really hope that Vista doesn't have these same problems. I'm posting from OS X, though like many millions of computer users I use Windows at work, and am looking forward to the really cool Vista GUI. Here are some other specific issues that I hope Vista and future service packs will address:

1. Some kind of warning, similar to what GMail does with phishing sites, anytime that a program is being downloaded. "Some applications may compromise personal information. Only install this application if you trust the web-site 'spyware.com'"
2. Perhaps OS-managed tagging of applications to restrict what they could access, similar to a Java sandbox. Of course, this would need users to be running at a user level, rather than admin level, otherwise an application could simply reset its permissions. Does anyone know if current spyware messes with the Windows firewall?
3. A preemptive scan of any application that could warn the user of network access code, registry code etc.
4. A watertight way to track and remove applications, preventing them from reinstalling themselves.
5. Restricting the ability of applications to coinstall, e.g. when one application brings in others.

There are many many ways that Microsoft could address the millions of hours and productivity lost to spyware. Windows Firewall is a decent first step. It would be great if we could see some more effort.

Re:The major lesson of all this.

[gcatullus]

I don't think that the problem is people who don't know technology, making uninformed decicions. So much as people having a flagrant disregard for the concept that what they do with their own PC effects everyone. For example, if I never learned to program the clock on my VCR and it flashed 12:00 all teh time, it only effects me. But if all I want to use it for is watching videos from Blockbuster, then who cares, there is absolutly no harm.

People apply the same logic to their PCs. As long as they can check their AOL mail and play solitaire, they think everything is fine. The classic car analogy mentioned above doesn't capture what most people think is happening. If their PC is full of spyware and crap, it is only a nuisance to them alone they believe. Like if their car didn't have a working gas gauge, or if the radio would not work. An anoyance, yes, but not the end of the world and in no way effecting anyone else.

The avergae person wouldn't want to drive a car that was leaking gasoline and oil all over the place all the while spewing clouds of polluting black smoke, but they don't understand that this is the state that they let their PCs get to.

The challange is not to teach them the technology, nor even design a system that protects people from their own dum actions, but to teach them that their actions can create havoc for other people.

It's not, "Don't open any email attachments from anyone ever, or your computer will be screwwed.", it should be "Don't open email attachments from anyone ever, or your PC will start infecting other peoples computers and be used to host kiddie porn."

Re:The major lesson of all this.

[TimTheFoolMan]

I think those same techs who are frustrated with users who make the same mistakes over and over would make similar (but different) mistakes if they were suddenly immersed in the Accounts Receivable Department, but only had to work there for a few minutes, and then left that world to return to their own.

We regularly forget that most people do not think the same way the computer works, and therefore make "silly" mistakes. They make them over and over again, and as a result, otherwise intelligent people look (and feel) like idiots. The tiny details that we pick up as being clues to "something stupid" are lost on them because they are so completely unfamiliar with the whole environment.

I'm not excusing incompetence. I'm making allowances for people who are forced (sometimes, without good reason) to use a technology solution for things that can be done another way. A friend of mine blows them off as "mouth-breathers." Sure, it's a funny insult, but it embodies exactly the problem I'm describing.

When you care about the people who use your product, it doesn't matter if it's a technology product or not, you will find ways to deal with "stupid behavior," and will make that behavior less likely, if not impossible.

By the way, people *do* drive cars this way, as evidenced by the brake-interlock found on any automatic transmission vehicle, a side-effect of the Audi 5000 debacle. Auto manufacturers responded predictably, but eventually provided the right solution: make it impossible to put the car into gear if you don't have your foot on the brake. The interlock is completely transparent to an experienced driver, as the behavior it blocks is un-safe by most any measure.

How many of you are going to see your parent or grandparent struggling through such an ordeal and immediately brand them as "idiots"? It didn't surprise me in the least that a Windows machine owned by my father was massively infected with spyware and malware, including the infamous "Weather Bug." Dad simply didn't know any better, regardless of how often I might try to explain how he could avoid the problem altogether. Most of my family is tech-oriented, but my wife's family is not. Are they idiots? No, but they sure have more computer-related problems.

How often is lack of root access a day-to-day problem for a Mac or Linux user? Why is it ever expected that a "user" would want to install something that ran at that level? Well, with Windows, your choice is pretty simple: If you want to do anything beyond superficial, you need to be Administrator or Power User, or customize your access rights (depending on your Windows version).

I'll get off the soapbox, because the world has spoken with it's behavior. People have been (and continue to be) trusting enough in the companies selling technology to not feel compelled to learn more about it. We can deal with it or not, and assuming that you're willing to get a black eye for it, then it makes more sense to push a more vulnerable solution out the door (since the buying public isn't knowledgeable enough to know the diff), and make sure your lawyers can protect you against any product failures.

Whether you approve of the morality or not, MS clearly chose the right path when they came to this fork in the road. Their products have performed horribly in this regard, but their bank balance says it all.

Tim

P.S. You're absolutely right about the psychology of one or two user experiences coloring the support guy's perception of the whole company. As any student of stereotyping and prejudice can tell you, judging an entire group based on a small sample is a sad fact of human nature.

Re:The major lesson of all this.

[RobertLTux]

what i would like to see i a study where a group of real live Amish farmers are split into
4 groups
1 Windows Pro Current
2 MAc OS X.whatevers current
3 BSD UNIX current
4 Mandriva Linux 2006( with devel branch sources setup)
each farmer is given a book with the basics (to include Login /password) and then given a list of tasks to do
i wonder what the times would look like??
(and yes i would give any tuning/patches needed and Mandriva was chosen due to it being real linux and newbie friendly)

Re:The major lesson of all this.

[Hosiah]

everyone runs *nix, you'll see spyware applications be written for these OSes immediately.

No, as a matter of fact, that's a falsehood based on ignorance of what free software is all about. In Linux, *all* software is free, from the kernel out. You're trying to say the absence of spyware opportunites would overnight make Richard Stallman start dumping tons of malware into the next Emacs release?

Quite a bit of the garbage in the Windows environment is there because they know Windows users will tolerate it. This is the same reason you are charged for software, get rootkits installed with your music, get pressured to upgrade every two months, yada, yada.

Re:The major lesson of all this.

[mikek3332002]

Now wouldn't that be fun gpl spyware and adware

Re:The major lesson of all this.

[WindBourne]

I always laugh at that argument. Basically, so many windows encourage all the hackers. So not true. Even back in the 80's when Mac was bigger than Dos, attacks were being designed for DOS. Why? ease of doing so. Apache has shown this,as well as numerous other examples. The best example out there, is that banks during the 60's and 70's were heavily robbed until the 7-11 stores became the easy marks (and loaded with small money). Finally 7-11 decided to change their attitude and make it near impossible to make any amount of money over 50. So what are robbers hitting these days? banks. Why? do to ease of hit combined with the amount of money.
 
The lesson to learn on that, is that crooks go for the easy mark that makes money. *nix will be the target when either:

1. insecure systems do not have money.
   
2. all other systems are more secure than *nix.
   

Neither is likely to happen anytime soon (and many would argue any time far). *nix will be very secure for a long time.

Re:The major lesson of all this.

[nacturation]

The one major lesson we can take from their research is that we should probably not be using Windows.

Maybe we can all run OS X. When the built-in OS X Software Update utility needs to install a new security update, the user is prompted for the keychain password. When grandma wants to download a new recipe program, it too prompts for the password. So it must be safe, right? Well, now that the application has root access it can do a hell of a lot of damage to the system. Install all kinds of spy/adware, etc.

Even without root access, you can still do a lot of stuff on OS X for anyone malicious enough to target the system.

Re:The major lesson of all this.

[fluffy99]

I think you missed the point. If a user is dumb enough to run a script or downloaded executable, then that user can still fsck himself. Perhaps the user runs an innocent looking script that claims to clean up dupes in his mailfile and in reality it emails out his private ssh key? Or yeah, it could delete anything he has perms to.

Re:The major lesson of all this.

[fluffy99]

With respect to malware, Linux has a diversity advantage. Windows implies a well know OS setup, layout, etc. Not so with scores of flavors of linux, bsd, etc. Aside from dealing with better security, malware authors would have to figure out how to deal with the variety of possible linux flavors and environments.

This also works in reverse as a disadvantage. Not having a consistent environment is an impediment to major software makers as it forces them to deal with the inconsistent implementations of linux.

BTW, I removed adware from a users computer last week that installed toolbars into Mozilla and Firefox.

Re:The major lesson of all this.

[jesterzog]

The OS could be totally secure and only allow the installed apps to affect the logged-in user. They'll still be there annoying that one user, though, since the user is the one who said it was okay to put them there.

I don't really disagree with you that spyware could be a problem if there's motivation, but in my own experience Linux does have some fundamental architectural and use differences that I think would benefit more than you're suggesting. One that someone else pointed out in another response, which I think was a good point, is that people using Linux tend to go to their distro's repository for software rather than directly to the vendor. The nature of Open Source means that it's more realistic for third parties to offer their own customised versions of any package, which is effectively what happens.

Furthermore, one of the biggest problems I've had with Windows spyware is that it simply ties itself so tightly into the operating system. Windows is full of proprietary formats and configurations that are hidden away from the user, making it more difficult to get at them. Windows tends to make it complicated to view and edit configuations without special tools, whereas Unix apps tend to put it all in text files, sometimes with a tool for editing but usually still editible by hand. The reason we need anti-spyware tools in Windows (yet another third party application) is because there's no readily standard way to examine and fix all the configuration information without it.

With an appropriately configured Linux or Unix system, it's much more predictible as to what any spyware can do. Given that most of the configuration exists in open and readily accessible formats, it becomes more realistic to monitor what's going on in a user's configuration files than it is in Windows, and if necessary clean it out.

Re:The major lesson of all this.

[lumbercartel.ca]

When *nix becomes more mainstream, expect to see applications requiring root access "just to install" and the masses, who really REALLY want that new screen saver that plays movies (and advertisements, etc.) that get downloaded in the background, following the convenient step-by-step instructions to "install it properly the first time."

Once users get comfortable doing things like this a few times, this will open the floodgates for SpyWare vendors to prey on unsuspecting novice *nix users. Imagine that a SpyWare vendor renames key system files then installs their own that load the SpyWare code and proceed to load the renamed files normally, all to circumvent the security system and process lists entirely. If they're determined enough, you can count on those SpyWare vendors to find a way!

Re:The major lesson of all this.

[Lord Kano]

The one major lesson we can take from their research is that we should probably not be using Windows.

The OS isn't the biggest problem, it's uneducated users. Computer usage has reached an all time high. We're in an era when most of the people in the world are so busy that they don't have time to learn about things that do not directly affect their ability to earn a living. Most Americans don't understand how presidential elections work. Most Americans don't understand what's in the US Constitution.

Some of it may be laziness, but a lot of it is because it's a complicated subject. If more people were using Linux or OSX the people who don't know any better would go right ahead and enter their root password for any dialog box that asked for it.

LK

Re:The major lesson of all this.

[ZiakII]

Guess what? I still don't see very many sites getting around Firefox's pop-up blocker, significantly exploiting it's weaknesses, or finding new security holes by the dozen. And yet... I continue to see it with IE. And don't be saying; "Firefox isn't popular, it'll happen eventually". My ass. It's been advertised into the ground.

Have you not seen the .swf (Flash Ads) that now cause pop-ups? Which is a direct result of firefox I'm willing to bet, and google's toolbar. It has gotten so bad now I just use a whitelist now with flash files since most of the flash files out there are worthless.

Re:The major lesson of all this.

[houghi]

It is also the operating system that users find the easiest to use

No, it is the OS they find pre-installed on their computer when they buy it and when they go to work.

Re:The major lesson of all this.

[MOGua]

You're trying to say the absence of spyware opportunites would overnight make Richard Stallman start dumping tons of malware into the next Emacs release?

no.

There will be all sorts of NEW software (screensavers, games, weather checkers, and download accelerators) written for *nix for all the previous-windows-user-average-joes to download and get infected.

Re:The major lesson of all this.

[raoulharris]

"When you consider how many alternatives (often far cheaper, too) are available, it's a wonder that so many still choose to use software that leaves their systems wide open to exploitation, be it from worms, viruses, or malicious websites." What you and many other people seem to overlook is that being the dominant os means that there are big advantages to using it. It may mean that it is targeted more (windows wouldn't be any less safe than linux if they were both targeted the same amount), but it also means that most programs are written for it. On linux or macintosh I wouldn't be able to use a large number of my programs and the vast majority of my favourite computer games wouldn't run either. I don't like windows particularly, and security is a problem, but it is a trade off I am willing to make for compatibility.

Re:The major lesson of all this.

[Kjella]

You're trying to say the absence of spyware opportunites would overnight make Richard Stallman start dumping tons of malware into the next Emacs release?

No, but you can bet you will see "enhanced" versions that are really just rebranded around, complete with spyware. From what I've understood this has already happened. This will presumably always be the case unless you hard lock your users to only use your distro's repositories, which would be quite clearly against what FOSS is all about.

Re:The major lesson of all this.

[maxpublic]

If people drove cars the way they use computers

They do. For example, it's been proven time and again that using a cell phone while driving impairs the driver the same way that being legally drunk does. And yet every clueless fucking prick out there either claims a) that the science is wrong, and their own personal belief trumps all facts, or b) that THEY are somehow special, better drivers completed unaffected and therefore not one of 'those' people who shouldn't be using a cell phone while driving.

For examples, just take a look at slashdot. Assholes left and right claim that THEY are superior to the "unwashed masses" at the drop of a hat. They call the average computer user "clueless" and blame failures in security on them - and then they get in their cars and hold conversations with friends and family from the time they leave the drive to the time they pull in at their destination, never realizing (and certainly never willing to admit) that they're just as fucking stupid when it comes to driving as those "lusers" are on the computer.

Of course, accidentally installing spyware on your computer isn't going to kill anyone. So the real "lusers", I'd say, are the high-and-mighty fuckers on their cell phones, complaining to their pals about how stupid the average computer user is while they themselves are weaving about the road like a bunch of drunken cunts.

Max

Re:The major lesson of all this.

[advocate_one]

I know - there is no such thing as a rational user but I can dream

there are, but we're NOT using ms-windows...

Re:The major lesson of all this.

[mattyrobinson69]

or take away the 'repositories' menu option in synaptic, allowing the user to add them by editing /etc/apt/sources.list

Re:The major lesson of all this.

[ext42fs]

This most certainly is not a user issue. You can't put such a complex machine as todays PC on a desk and expect the user to understand. Elderly people were sometimes even afraid to break their VCR when pressing buttons on their RC. In the current PC era one actually can break something by pressing buttons. Not good. Let's face it: the whole IT industry is still in its infancy and Microsofts dominance is not exactly helping here. Actually, I believe that in a few decades (100 years?) one will look back and refer to this era as something as the "dark ages" of IT.

Re:The major lesson of all this.

[Anonymous Coward]

There will be all sorts of NEW software (screensavers, games, weather checkers, and download accelerators) written for *nix for all the previous-windows-user-average-joes to download and get infected.

Of course it will. This is the real problem.

Re:The major lesson of all this.

[msormune]

Could you be a little more specific about these 80's attacks on DOS? Did they take place using analog modems or what? When a Windows vulnerability is found, it is certain that there are countless PC machines connected to the Internet that can be exploited THE SAME WAY. So why wouldn't this exploit be used against them?

Re:The major lesson of all this.

[SilverspurG]

Especially when you consider that all of the programs in TFA were installed after the user clicked the "I Agree" button five, six, seven times

Is that like saying,"I only gave him the crack. He's the one who smoked it and died."

Why are websites making use of this crap anyway?

Re:The major lesson of all this.

[mochan_s]

Wait, that doesn't make sense to me.

In the 80s, the Mac systems weren't unix based. Why would DOS be easier to attack then?

Re:The major lesson of all this.

[mochan_s]

Could you be a little more specific about these 80's attacks on DOS? Did they take place using analog modems or what? When a Windows vulnerability is found, it is certain that there are countless PC machines connected to the Internet that can be exploited THE SAME WAY. So why wouldn't this exploit be used against them?

Wow, I feel only saying this but ...

The old viruses would put itself in executable files, data files and so when you ran that file it would also run the virus. It would be transmitted when people swapped floppy disks of data or programs.

And the viruses just formatted/destroyed hard drives or corrupted data. It didn't spy on you or anything like that.

Re:The major lesson of all this.

[mochan_s]

I meant I felt old ...

Fuck stupid slashdot for not letting me edit posts or add something to my old posts and making me wait to post!

Re:The major lesson of all this.

[Anonymous Coward]

This is not a windows issue (as much as I dislike windows).

Personally I think that this is, in fact a windows issue. If Windows had come with a proper installer from the start, with a nice tool to see what packages have been installed and which files came with which package, we wouldn't have the situation today that everything comes in .exe files, which more often than not are just self-extracting archives that extract setup programs that extract archives, over and over again, and every one of them installing their own (.exe) uninstaller with no proper way for the users to verify what either the installer of uninstaller really did.

Yes, there are .msi files, but when was the last time you downloaded something off the net that came in this form? Even windowsupdate.microsoft.com downloads most of its stuff in .exe files, and so do most other things like TweakUI etc available from Microsoft, and Firefox isn't any better in this regard.

Re:The major lesson of all this.

[bsims]

I don't know if users really find it easiest to use. It's just "what's installed on the computer". I would say that way under 5% of the user community has made any kind of comparison between alternative operating systems and decided, as a personal choice, which one they want to use.

My mom (age 62) had never used a computer before, I installed SuSE 8.1 on a older machine running KDE. I made a taskbar icon for solitare and mozilla (her homepage is set to her Yahoo email account).

Before her last power-outage her machine had 290 days uptime (logged into KDE, 24/7), no viruses, no spyware, no glitches.

Now, she is a happy Ubuntu Dapper user. (The admitedly old HD in her machine started to fail. (Current uptime of 15days, darn power outages)) The grandkids really like Potatoguy, and have no problems using it for Cartoon Network and stuff like that.

In short, It Just Works. She has no interest in adding new software, any hardware she asks me first anyway as she has no idea what to buy. (90+% of the hardware out there Just Works anyway)

So for anyone like her who uses their computer for email, web-browsing, and solitare, Linux already meets their needs, with less annoyance and lower cost than Windows.

Re:The major lesson of all this.

[TemporalBeing]

I think you missed the point. If a user is dumb enough to run a script or downloaded executable, then that user can still fsck himself. Perhaps the user runs an innocent looking script that claims to clean up dupes in his mailfile and in reality it emails out his private ssh key? Or yeah, it could delete anything he has perms to.

Ah...but you missed the point - it is one thing if the user enables the script to run (chmod +x somescript), but quite another for it to run directly out of the browser like is possible on Windows. It is much harder to execute a script directly out of the browser on Linux because of this. So, at the very least the user has to knowingly and take a few extra steps to run it. If they run it, then yes - they are a dumb user that deserves what happens - but even so, it will only affect that user in most cases. (Per your example, if the attacker gains access via their account and then finds an exploit that can elevate their priviledges then it could affect other users too.)

Re:The major lesson of all this.

[Hosiah]

all sorts of NEW software (screensavers, games, weather checkers, and download accelerators)

OK: read my lips. I will speak very slowly. We Linux users already have those things, without any ads at all. In the commercial software world, the motivation for running adware crap is that putting up with the advertizing garbage is the only way to get something for nothing. But there are some 300-odd complete Linux distributions out there, all of them loaded with more free software than you could ever run, and none of it has any sneaky adware in it. It's open-source: if you *did* include something intrusive in it, the next user could just remove it from the source and recompile it - and distribute it as their own! Oh, I'm sure you could *try* to do adware for Linux, it could work. But nobody's going to use it - they have nothing to gain by running a free program with adware that they don't gain by running a free program without.

Keep sprinting and you'll get here.

Re:The major lesson of all this.

[CTalkobt]

In the current PC you can't break anything by pressing buttons. You can mess up it's configuration but I can do the same thing with my VCR or Cable box by locking all the channels out.

Plain and simple this is a user issue.

A lot of people are afraid of new technologies. When VCR's first came out, sure a lot of elderly people were afraid of them. Now, it's not so much of a problem. BTW, don't go by sterotypes - I'm 117. :-)

Re:The major lesson of all this.

[MOGua]

We Linux users

there's your problem.

first of all, no one will even write malware for linux as of now. What's the point? User base of what? 0.5%? No one's saying you linux users will install malware; come on, you are a slashdotter; you know your stuff!

I am writing under the assumption that most of the world has switched to Linux (like the parent said.)

Then, all the malware will start popping up. Targeting not You Linux users, but them Linux users that were windows users.

Re:The major lesson of all this.

[jZnat]

Or you could just re-add the sources.list widget to Synaptic's .glade files. I guess that could be a good idea if this became a problem.

Re:The major lesson of all this.

[jZnat]

The US Constitution is like 2 fucking pages. You could read that while on the shitter and still have time left over. I think it's more of the idea that they just don't care.

Re:The major lesson of all this.

[sparkz]

Similarly, we shouldn't teach people to spell correctly :)

Re:The major lesson of all this.

[TimTheFoolMan]

Point taken. As someone who typically runs spell-check prior to submitting a post (and chose not to for expediency), the post-post spell-check has me fuming at myself. (I think 8 is a new "personal worst.")

Thanks for the humility reset. :-)

Tim

P.S. Even more annoying was using "effects" instead of "affects."

Re:The major lesson of all this.

[Snover]

Firefox 1.5's pop-up blocking blocks pop-ups from plug-ins such as Flash. What were you saying, now?

Re:The major lesson of all this.

[jonadab]

> some things such as installing certain drivers are tougher in Linux than in Windows

Umm, yeah.

Have you ever actually tried to install Windows? You can spend five minutes (or, occasionally, longer) just getting the network card to work so that you can attach the thing to the network and spend twenty minutes hunting down the manufacturer's video card drives so that you can get out of that infernal 256-color mode of which Windows is so enamored. Every Linux distribution I've tried in the last five years (RedHat, Mandrake, Gentoo, Debian, Ubuntu, Knoppix, ...) just automatically detects the graphics card and automatically installs the correct driver, without even asking the user a question. I have installed Windows hundreds of times on dozens of different systems with graphics cards by every manufacturer you can name, and I have never *ever* seen it automatically correctly detect a graphics card. When you get *lucky*, all you have to do is go into the Device Manager and select the graphics card and tell Windows which manufacturer made the thing and pick the model number off the list (and reboot of course), but frequently it's not listed, so then you have to hunt down the manufacturer's website... That should *NOT* be necessary with any reasonably common hardware. FreeBSD certainly didn't have any trouble figuring out what my graphics hardware was and automatically configuring it correctly. Incidentally, it also detected what resolution my monitor was capable of supporting and automatically picked the highest res for which monitor could do TrueColor and automatically just used that, without asking me so much as a single question. I'd just once like to see Windows come up in a decent color depth when it's first installed; I think I'd faint.

Bottom line: Installing drivers on Windows is easy? Big deal. Installing drivers shouldn't be something a user should even *need* to do. I didn't have to install a *single* driver on my FreeBSD system, not one, not for anything. All the drivers that were needed were automatically installed without user intervention. I did have to tell it to _load_ the (already installed) driver for my sound card, but I didn't have to tell it which one, I just chose the "try them all" option, and it chose the csa driver automatically; shortly thereafter I was playing music.

This is all only relevant, however, for powerusers and developers. End users do not generally install software when they can possibly avoid it, *especially* operating systems, and the only hardware most of them will "install" is external peripherals. If any heavy-duty installation needs done (beyond what was already done by the OEM), they get help from a poweruser (who, as often as not, screws it up, but that's another thread). Whether Windows, or hardware drivers for Windows, are easy to install has, for practical purposes, no bearing on how easy Windows is for end users to use.

My big problems with Windows are that it's not configurable enough for power users, and that when something goes wrong with it the science of getting it fixed is more like a black art. I'm tired of fighting with situations like the one I ran into this past week, wherein a system just decided one day that any attempt to reboot it will result in a blue screen, except when booting in safe mode; any attempt to use the System Restore facility to restore to an earlier (working) state will require a reboot, resulting in a blue screen, followed by booting in safe mode to a message indicating that System Restore was unable to restore to that checkpoint. Trying to diagnose what is actually wrong in cases like this is usually an exercise in futility, so you end up doing a from-scratch reinstall, which means that no applications are installed, making the system essentially a paperweight until you spend 50+ hours installing stuff to bring it back up to an actual useful state. Like as not a year later it'll happen again. Bah, I'm not doing Windows anymore unless I get *paid* for it. Solving proble

Re:The major lesson of all this.

[msormune]

Yes, now I remember... stupid people not using the mechanic write protection :) But it is the same thing anyway: People copied software and games far more on DOS than on Mac computers, so viruses would spear more efficiently. Granted, DOS probably was more insecure than whattsitcalledMacOS at the time.

Re:The major lesson of all this.

[Hosiah]

Targeting not You Linux users, but them Linux users that were windows users.

LOL. OK, I'll award each of us a half-point. You're right in what you say. But this leads to yet another of my favorite hobby-horses: probably one of the least popular opinions in all of computing that I'm about to utter, here, but true nevertheless: "People aren't nearly as stupid as we make them out to be."

Only six years ago, I was still one of "them Windows users". I was banging my skull in frustration at the built-in lameness of the platform. Then I got my hands on Linux. I dual-booted the family PC for awhile until the rest of the family caught up with me, and used Linux exclusively on my own box. And happy ending: we've all been running Windows-free for years, now.

Like any other ex-Windows user, I was a slow convert...we all were. We had to discover how to do things the Linux way. We had to adjust to the security constraints, which we first circumvented running as root, then grudgingly got user accounts, and now fully accept the sysadmin/group/user way as the sanest way to compute.

The number one thing I like most about Linux is: it lets me be as smart as I am! I was *always* computer-savvy, even when I was running a 286/DOS 6.22/Win_3.1 box and spending most of my time on it writing little gopher programs in QBasic (compiled to 'executables' with QB 4.5, of course!) from the DOS prompt. Linux was the first system that trusted me to have the brain I'd always had. The difference is, I can USE it now! Likewise, my family is discovering skills they didn't know they had as well. My spouse now is learning quite a bit of web design; she's discovered that there's more to it that a click 'n' build ISP-linked "home page". My kids are beginning to explore Python from the command line; we have to watch they don't use it to cheat on their math homework!

True, the AIM/AOL/MySpace crowd is almost entirely a loss. But to hypothesize what they'd do if they were to suddenly swoop on Linux would be the same as to ask what they would do if they suddenly got awarded physics degrees. But even if we discover (to our flabbergasted shock) that "Joe Sixpack" has a few tricks in him (hey, he learned Windows 15 years ago; even he was able to grok a copy of "Windows for Dummies" in order to do so.) and discovers Linux, even he's going to observe "I have xscreensaver and more plugins for it than I can possibly use that are risk-free, or I can download this spam-o-matic gizmo that takes over my machine..." Edge-cases, yes, some people will still use adware, no matter what. But adware will not thrive in the Linux world the same way it does in the Windows world, where there is no free xscreensaver option to start with.

Re:The major lesson of all this.

[MOGua]

major props to your entire family :)

My family is pretty much divided: the guys know their stuff and the girls have no clue. Even with Firefox + AdBlock + AV + Firewall, my sister still manages to come back from school with her firewall turned off, homepage hijacked, virus-infected...etc. (makes me wonder if it started with malware or malicious-dorm-neighbor)

Even though you might be right that people aren't as stupid as we make them out to be, I think they are still easily manipulated/exploited; particularly the AIM/AOL/MySpace crowd, which is one huge crowd.

Re:The major lesson of all this.

[Anonymous Coward]

It is also the operating system that users find the easiest to use

Compared to what? Their dishwasher?

Most users that "find Windows the easiest to use" never tried anything else, of if they did, it was DOS. They only *heard* that Windows is easy to use, and somehow believe it, even when reinstalling for the third time this month.

Re:The major lesson of all this.

[pipingguy]

It is also the operating system that users find the easiest to use, and it is also the operating system that (in my opinion) has the most flexibility for programmers and software corporations of all sizes.

Windows is the OS that most people were *forced* to use at work, so they naturally took that knowledge home with them.

Re:The major lesson of all this.

[Anonymous Coward]

"While the *nix varieties are definitely more secure (as they are now)" - by dada21 (163177) * on Saturday January 14, @08:59PM

http://www.us-cert.gov/cas/bulletins/SB2005.html

Take a read of that. As of 2005, it seems Unix & all its derivants (+ wares that ride on them) turned up more security holes than Windows & all its wares this year.

APK

And one of them is slashdot

[Anonymous Coward]

Mysteriously, some random links inside the popular site known as "slashdot" point to goatse. Some do not even require any user action. It's even worse than spyware!

Spyware is bad for your server

[Nanite]

All that spyware must be killing their server. Slashdotted :)

Re:Spyware is bad for your server

[Anonymous Coward]

You guys are network terrorists. How about installing Coralize firefox extension.

Here is a link that works

http://tinyurl.com/dcs5p

Re:Spyware is bad for your server

[Anonymous Coward]

Because I've personally never seen a coral cache that worked when the original server was down, and never seen a coral cache faster than a server that is up. And I do have the coralize bookmarklet. Although a coralize/tinyURLize button to get both done in one swoop would be convenient.

However, going through that whole process would just make it easier for people to slip in links to the goatse.cx guy.

Flame me. You know you want to

[jibjibjib]

Windows is easier to use for a lot of things, has more drivers, less configuration issues, and the reason it has so many security holes is because it has so much useful stuff in it for people to exploit. A Linux system with as many features, applications, as much usability etc as a Windows system will probably have nearly the same amount of security holes. Then you have to consider the fact that hackers target Windows because everyone uses it. If everyone used Linux, the situation would be just as bad.

Re:Flame me. You know you want to

[CyricZ]

Try a recent Kubuntu release. You may just find that it includes all the drivers you need, even for laptops and other picky systems. I know that for my HP and IBM laptops, I need acquire drivers separately when using Windows XP. It's far less of a hassle to use Kubuntu, knowing that it detects all of the hardware on those systems, and automatically uses drivers/modules that work perfectly fine.

Often times second-hand systems do not include the driver CDs from the system vendor. Again, that leads to a situation where you have to find out what type of hardware the system includes, and then find drivers for it. Why bother finding them when Kubuntu (or other modern Linux distributions) offers them for you right off the bat?

Ideally, everyone would use a system that best suits them. These days, Mac OS X and Linux are very suitable desktops for most users. The one ones who are really left out are those who wish to play games. But for people who run a business or use their computers mainly for non-gaming tasks, a non-Microsoft system will often be superb.

Not only that, but it will be more secure. You attribute it that security to such systems not being targetted as much, but the actual reason is most likely because they are of a higher quality to begin with. While not perfect, they do have a track record of being far more secure and stable, while being just as usable (if not moreso).

Re:Flame me. You know you want to

[kernelpanicked]

You know I could flame you to hell and back but I won't. I'd rather just point out something you're obviously missing.

It has been my experience that most Windows systems that end up with this crap installed end up having to be reloaded, wasting hours of time backing up data, reloading, reconfiguring the system. Now in the unlikely event that one of my systems got hold of one of these imaginary UNIX spyware apps, it would leave me having to run a total of 2 commands.

# userdel -r kernelpanicked
# useradd -m kernelpanicked

I'm really not seeing your point here.

How do they define the "top million" sites?

[CyricZ]

What is their criteria for deciding if a site is within the "top million" on the WWW? Are they using data from a service such as Alexa, or is it mere speculation on their part as to the traffic of the sites they have tested?

Re:How do they define the "top million" sites?

[NoMercy]

In my quick look though the blog, they quoted Alexa ranking figures. I'd say they're using those to determine how popular sites are.

Re:How do they define the "top million" sites?

[Dark_Archemedes]

RTFA. They TESTED a million websites. TESTED. TESTED.

Re:How do they define the "top million" sites?

[Anonymous Coward]

My site is in the top 95% of the web. Soon I hope to raise that to the top 98%!

End Users Beware

[queenb**ch]

I can tell you from the experience of working on a network where the end users have very unwisely been made local admins on their workstation that the *only* thing required for a full spyware infection is a nice little surf around the 'net. This is compounded by the problem that they all seem to have some touch of OCD that compels them to click "OK" on anything thing that wants to install itself despite all of our efforts to educate them.

I will say that it is nice to see someone put quantifable numbers to the things I have long known from practical experience, but this isn't exactly news.

2 cents,

Queen B

Re:End Users Beware

[jibjibjib]

Yes, despite all your attempts to educate them, they still click OK when it asks if they want to install Windows. No wonder your network has problems. Even though what I said before about Windows being better sometimes is true, *nix is still more secure in a network environment.

Re:End Users Beware

[EvilMonkeySlayer]

This can be reduced somewhat by making the internet zone very restricted and simply making a whitelist of sites and put them in the trusted sites list.
It doesn't solve everything like the recent WMF exploit but it does stop what I lovingly refer to as "dumbfuck user" syndrome, which exhibits such symptoms as the inability to read, lack of intelligence and an inherent lack of cognitive reasoning.

Unforunately the company I work at are currently locked into some bespoke software that REQUIRES lock admin rights. I'm currently trying my utmost to get all windows machines onto XP so I can atleast get IE and Outlook running in reduced priveleges mode using dropmyrights. (if anyone knows of a way to do the same under Win 2k please let me know)

Re:End Users Beware

[BushCheney08]

...what I lovingly refer to as "dumbfuck user" syndrome, which exhibits such symptoms as the inability to read, lack of intelligence and an inherent lack of cognitive reasoning.

It's a shame that DUS isn't only limited to computers...

Re:End Users Beware

[EvilMonkeySlayer]

I seem to be suffering a bit from DUS at the moment. Hangs head in shame at all the grammar and spelling mistakes...

In my defense, it is 2am here.

Site Mirror

[Anonymous Coward]

from Mirrordot

coral cache

[nabil]

http://blog.siteadvisor.com.nyud.net:8090/2006/01/ the_webs_download_disasters_in.html

The kind of plugin...

[themysteryman73]

That's the kind of plugin that I would be afraid to download for fear of spyware...

Re:The kind of plugin...

[shawb]

Forget sypware... I'd be afraid of people linking to the goatse.cx guy.

Re:The kind of plugin...

[Billly Gates]

Just to be evil I thought of writing something really cool and put spyware in their that puts windows to teh goatse guy and then puts out big letters saying "Spyware!".

I dont know why people put up with this crap? but negatively publicity would surely help not to mention I could piss people off.

Re:The kind of plugin...

[adyus]

It's true, I've heard you could catch some really nasty viruses from being in there...


The above was a joke, laugh, people...

Slashdotted

[the_flyswatter]

Here's a mirror: http://www.mirrordot.org/stories/01c106c874a385230 2ab3ebb3303acc6/index.html

Do what we say, not what we do?

[Jamesday]

"We've also made our data available under Creative Commons License 2.5". Data is ineligible for copyright cover in the United States, so no license is needed or can apply.

They wouldn't bundle an unnecessary license with useful data just after writing about bundling unnecessary software with desired applications, would they? :)

It is useful outside the US, though, so this is actually a but tongue in cheek. :)

Re:Do what we say, not what we do?

[Jerf]

The word "data" is confusing. It is true that the actual information described in those files can't be "copyrighted" (scare quotes as the concept does not actually apply). However, the database itself would be protected under a compilation copyright. That is unless you can demonstrate to the court that the compilation contains no creative effort whatsoever, something that the courts have historically interpreted as an extremely high standard that this collection would almost certainly not meet, leaving its copyright intact. (The only thing that I am aware of that has ever met this standard is the phone book as a set of names->phone numbers; if much else has, it's a small set.)

It is true that you don't need their permission to use the data from an entry or two as you choose, but by licensing the whole under CC, they are also allowing you use the whole database under the (loose) terms of that license. The CC license is not redundant, as it does add to your set of legally permissible actions (with direct negotiation).

Re:Do what we say, not what we do?

[teslatug]

The key phrase is "in the United States." There are countries that frown at public domain works (*cough*Frenchies*cough*) so the license might actually help.

Re:Do what we say, not what we do?

[CTalkobt]

>> "... is actually a but tongue in cheek. :)"

A butt toungue in cheek? Gah. *shudders*

Please don't use that type of imagery - it scares me. :-)

Re:Do what we say, not what we do?

[Jamesday]

Sorry about that. :)

Startup ... or shutdown

[lucm]

They should add a feature on the SiteAdvisor toolbar: "this site is often down".

No reason to be vulnerable to spyware.

[CyricZ]

Have you tried the recent Kubuntu releases? If not, give it a try. It is by far one of the most easiest systems to install these days. Even easier to keep up to date, as well.

I was recently asked to set up some computer systems at a seniors home. Now, many of these people have never used a PC. So we were able to acquire several used PCs for almost no cost, and I installed Kubuntu on their systems. We got them set up so that they could check their email, browse the WWW, use various instant messengers to chat with relatives, and even play games (bridge and backgammon were big favourites).

Now, why did I go with Kubuntu? Mainly because it is free, and it is quality software that is quite easy to use. But more importantly, I wanted these systems to always be available to these people. I know that they might visit malicious sites. I wouldn't want that resulting in their systems being compromised just because of that.

You may deny it, but the fact of the matter is that Linux systems won't get infected with spyware at this time. Sure, that may change in the future, but I'm doubtful about that. The basic (yet significant) differences in code quality and architecture are enough to leave Linux (and other non-Microsoft) systems far more secure and usable, even in the fact of malicious software.

Re:No reason to be vulnerable to spyware.

[GoofyBoy]

>I was recently asked to set up some computer systems at a seniors home.

Thats great. What happens when they go to Wal-Mart and want to buy some software?

Or when they want to hook up their brand-spanking new digital camera/mp3 player/PDA?

Lots of people are more bleed-edge than seniors.

>You may deny it, but the fact of the matter is that Linux systems won't get infected with spyware at this time. Sure, that may change in the future, but I'm doubtful about that.

You don't need a better code to prevent spyware, you need better users. Better system design/code will never beat out a user, unless the design is involves cutting the power to the computer.

Re:No reason to be vulnerable to spyware.

[masklinn]

You don't need a better code to prevent spyware, you need better users. Better system design/code will never beat out a user, unless the design is involves cutting the power to the computer.

So damn true. As Rich Cook once said:

Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.

Re:No reason to be vulnerable to spyware.

[CyricZ]

I advised them not to buy software from WalMart, or even to download it for themselves. I asked them to contact me, and I'd come over and find something that worked for them. I know I could find software that I know I could trust, or at least have access to the source code to inspect and build myself if I felt there could be security problems. Then again, Kubuntu includes all the software they seem to need.

I haven't heard anything from them regarding cameras and other devices which did not work. I did, however, hear of one grandson bringing over his camera and taking pictures of the seniors so they could email them to their relatives. One of the grandparents who had some PC experience as a secretary told me that she was really surprised how easy it was to get the camera to work. All they did was plug it in, and the storage device on the camera was automatically mounted. They could copy over the files without problem. The kid was reportedly stunned that the seniors could use the system so effectively.

Insult inexperienced users all you want. Frankly, I think that a well-designed system can easily avoid the problems caused by unwitting users. Indeed, any quality software system would be designed in such a way as to completely minimize the harm that an inexperienced user could do. Linux and much open source software appears to do this quite well, and as such spyware just isn't a problem when dealing with Linux systems.

Re:No reason to be vulnerable to spyware.

[GoofyBoy]

>I advised them not to buy software from WalMart, or even to download it for themselves. I asked them to contact me, and I'd come over and find something that worked for them.

Thats a wonderful solution. What about people who don't have 24/7 access to you? And did you really go through all the code in the Linux kernal/OpenOffice/Firefox/Thunderbird?

>I think that a well-designed system can easily avoid the problems caused by unwitting users.

A well-designed anything can do anything. (Can't do it? It just simply needs to be better designed!). I have yet to see this magical beast. Linux is not it (since linux rootkits exists or user logs into root then rm -fr / everthing since he needs more diskspace.).

Re:No reason to be vulnerable to spyware.

[Anonymous Coward]

Sorry man, but your talking out of your ass. Coming from nearly 11 months of SuSE 9.2-10.0 use, the Kubuntu 5.10 install I did this week was definitely a major stepbackwards in terms of ease and usability.

1) For starters, the install is ugly and while it won't push off new users what's the harm in making it look usable? It's uglier than the Windows 2000 installer, which was hideous in its own right. Contrast this with SuSE's down right gorgeous and painless setup. If I was a noob (which I sorta still am), I would definitely prefer SuSE's bloated, but beatiful and easier install than Ubuntu's anyday.
2) I tried five installs on the system. Every time the install would seem to go through, eject the CD, and then not boot. Why? Because as google told me much later, Ubuntu can't handle having a SATA drive and an IDE drive in the same machine. During setup it labled my SATA as HDA0, while in grub it saw it as HDA1. Which meant it didn't boot...
3) I physically unplugged my IDE drive, and then continued the install. Now during install it crapped out giving me some weird error message installing initramfs. It was working with the IDE drive plugged in a second ago!!! I don't know what I did to get around this, but eventually it installed. I booted the machine and was greated with no sound, no smp support, and no dma. Compare this with SuSE where all of my hardware (minus 3D on video card) was correctly identified, and initialized.
4) I tried really hard to get the smp kernel. For the life of me I couldn't get synaptic to see the kernel I needed. I finally gave up and downloaded the Ubuntu (not Kubuntu) dvd. I installed Ubuntu no problem, and it worked like a charm. This leads me to believe that Kubuntu is Shuttleworth's ugly stepson who no one likes and there is no where near the amount of bug checking and QA available as compared to Ubuntu.

So why'd I make the switch from SuSE? SuSE was a great beginner distro and all, but felt sluggish on my Dual Xeon machine. Kubuntu when finally installed was noticeably snappier.

Re:No reason to be vulnerable to spyware.

[Billly Gates]

Still its no windows.

I used to use FreeBSD and I tried Ubuntu (gnome version) and decided not to keep it. Its a hassle to upgrade to Openoffice 2.0 and Java5. Sure I could probably do it if I had time on my hands but its a pain to redo the apt.sources and download unstable software from god knows where. I am afraid it would make my system buggy with the nasty dependancies that are beta or RC level.

I got the Gentoo cd and I am going to try again with that but still its not for average Joes.

Windows is nice because it just works. With school and a shift from pc support to programming at work I dont care about some of the things linux has to offer from a server level. I just want to point and click and work.

During spring break I will put unix back on my system but for now I am sticking with windows. I am at least knoweldge to know better than to install most software that comes with malware.

Re:No reason to be vulnerable to spyware.

[netsharc]

Actually, digital cameras work "out of the box" in my Ubuntu installation, yeah it's bloat, but it seems to have all the drivers for different protocols that the cameras use to talk via USB. As for MP3 players or PDA's, they're seniors, I don't see it happening. :) MP3 players are usually just USB-disks anyway, and Ubuntu with its hotplug system can also detect and mount them automatically.

Re:No reason to be vulnerable to spyware.

[God_Retired]

You are just being an asshat. Linux works. So does everything else, really. My grandma uses Windows. I don't care. All she does is email, print some crap out and type up things.

I could easily set up her system with linux which could do what she wants. I may soon as it has recently started to slow down due to all the windows crap that get installed when she surfs around. But if she really just wants the same thing, I will try a little more to clean it out or just re-install. Not that big of a deal. She is 89 years old, for what that's worth.

To sit back and say that this would be anything other than a good thing is just ridiculous. Crawl back into whatever the fuck hole you crawled out of. Your obvious ignorance of the useability of a modern Gnu/Linux system is so glaring I can't really focus on anything else you are writing.

Re:No reason to be vulnerable to spyware.

[GoofyBoy]

>Linux works.

I use Linux and I know what works on it and what doesn't.

Look at the parent post; his solution is "Don't install anything unless I'm there and if you need something, I'll find a good alternative."

Does that sound like Linux works?

Re:No reason to be vulnerable to spyware.

[donkybottom]

I think that would be his solution no matter which OS was used. Letting inexperienced people install whatever they want is a reciepe for disaster. The whole reason for these spyware epidemic is due to exactly this reason. It also makes complete sense to have one person being the admin for a shared resource, you can't let people who have no idea what they are doing admin a shared system.

Re:No reason to be vulnerable to spyware.

[GoofyBoy]

>I think that would be his solution no matter which OS was used.

Pretty ironic, that is my point in my original post.

Re:No reason to be vulnerable to spyware.

[geminidomino]

Does that sound like Linux works?

In all fairness, I think that's more telling of him than of linux.

Re:No reason to be vulnerable to spyware.

[GeoffP]

As a matter of fact, it does. These people are senior citizens. They won't be able to tell a Linux program apart from a Windows one. The fact that he's confident he can find an alternative is proof that it does work. Sure, you may not be able to buy the latest crapware from Wal-mart, but an experienced user will be able to find an alternative (which may possibly be even better) on the Internet.

Re:No reason to be vulnerable to spyware.

[Jeff DeMaagd]

I wonder though, as long as the user is allowed to run code from their own home directory, there is always a risk they'll agree to something they shouldn't. Sure, it likely won't dig into the OS but could still send garbage out and even host a server.

Re:No reason to be vulnerable to spyware.

[Anonymous Coward]

You're complaining about instability and not tested code from god knows where, and you're going to use GENTOO?!

If you really cared about that, you'd use Debian Stable if you really wanted linux.

Re:No reason to be vulnerable to spyware.

[Anonymous Coward]

> As for MP3 players or PDA's, they're seniors, I don't see it happening. :)

My 80-year-old mother in law has an iPod. Fuck you, elitist moron.

Re:No reason to be vulnerable to spyware.

[jZnat]

Windows only "just works" when it comes pre-installed for you. Setting up a Windows install from scratch is just as annoying as setting up a *nix system for the first time, but people conveniently forget that. If you had a computer with a Linux-based distro pre-installed and configured for you, I'm sure you'd think otherwise to your previous statement.

Re:No reason to be vulnerable to spyware.

[ClioCJS]

I tried and it did not recognize my 1997 NIC. Greyed out in the GUI.

I try unix once every 3 yeras. This is its third failure. I'm not interested in investingating a problem when it just works in windows. There were other issues that caused this whole thing to take up about 10 hours of my time. In that time, I could have earned the money to buy a new copy of windows. I got things to do.

I don't agree.

[Zombie Ryushu]

THe security paradigm of Windows and the Unix World are Apples and Green peppers. There will still be spyware threats out there if Windows didn't exist. But they would be different threats, and they could eeven be worse in some cases, but they would be fewer in number and the Internet wouldn't be such a darkened Hell hole it is steadily becoming. The Data miners would get more resistance from the Unix world than they have a Windows world that can't fight back.

Re:I don't agree.

[generic-man]

The only software installation difference between the Windows world of today and the UNIX/MacOSX world of today: to install software in the latter case the user must provide a password. That provides a little extra security to guard against background processes, but all the cases mentioned in the article required the user to click a button to proceed. Malware authors could simply say "To install this cool Aaliyah screen saver, enter your password!" and most UNIX/MacOSX users would happily comply.

To get software installed in a diverse environment, malware authors would just provide source code that would be compiled, the binary installed, and the code purged.

Oddity...

[Ambiguous Coward]

How can they be testing the top 1000000 web sites, if they're only downloading 100000 programs? That would leave a lot of sites untouched. It seems that in order to test 1000000 web sites, they would have to download at *least* 1000000 programs. Unless, of course, they grabbed programs from *some* of the top 1000000 web sites, in which case they would have programs from, say, site #1, #10, #20, etc.

Re:Oddity...

[CyricZ]

That is still one site of every ten which offers software for download. Remember, there are many more sites offering just information or other services than there are offering software for download. If anything, I'd think that 10% of the top million sites is an awfully high percentage to be offering downloadable software.

Re:Oddity...

[Anonymous Coward]

Why does each site have to have a unique program? Isn't it likely that programs are going to get re-used across different sites.

Re:Oddity...

[Elminst]

Umm news flash...

Not every site has downloads! Hard to believe, but true!

Re:Oddity...

[nacturation]

Did they test Slashdot? I hope they release a full report as I've been having a hard time finding the downloads section.

Re:Oddity...

[SamSim]

Not all sites offer programs for download.

Re:Oddity...

[Ambiguous Coward]

In regards to the sister replies to my original statement:

Yes, I made an oversite. What amuses me is that *all but one of you* failed to see that *someone else had already corrected me*. To the first of you: yes, you are correct, I did not consider that. I was assuming they were testing the top *software* sites. Fair enough, point noted. To the rest of you: you're too late. You're no more brilliant than I, at this point, having failed to see the obvious. :)

Very interesting...

[skogs]

This is a very neat process that I would enjoy having the ability to root around in. Very nice tool, and looks like it has created some excellent data.

I would enjoy seeing some of the nastier data put forth in a simple list so that I can add them to my banned domain listing on my firewall.

Currently, I knock down ads(from the ~1800 most active servers), with the wonderful help of the following gentleman.

# last updated: 2005-12-18 15:17:02

# The latest version of this list and other ways of viewing it are at:

# //pgl.yoyo.org/adservers/

# - Peter Lowe // pgl@yoyo.org

#

For the Lazy...

Now, about that warez/malware/stupid screensaver and other utilities list....

wow

[CountZero117]

no complaints about the article linking to a blog? what's the world coming to? ;)

Re:wow

[the_flyswatter]

It's so common, everyone is getting used to it...

Re:Wow

[Mancow]

Reading is fundamental, and this case I don't mean TFA:

"...has downloaded over 100,000 programs from the top million Web sites and tested them for adware and spyware using an automated system they've built."

Unless, of course, you're a troll. If that's the case I wish for you a slow and painful death at the hands of Windows 3.1.

Re:Wow

[Zerathdune]

find me a website that actually has 100,000 programs available for download. right now. no?

I'm pretty sure it means 100,000 total, so it's 10^5. besides which, they automate much of the process.

I disagree

[smittyoneeach]

Mr. Softy targets the dumb mean of the user distribution, +/- a couple of standard deviants on either side.
The *nix philosophy requires a great deal more learning on the part of the user.
Education can't stop a quality cock-up, but it certainly filters a great deal of blatant boo-boos, like coughing up a root password to www.passwordstorage.com.

Re:I disagree

[gutnor]

"The *nix philosophy requires a great deal more learning on the part of the user."

Come on, how many person are really interesting into 'learning', to simply use a computer. The average user buys a computer for a limited subset of functionalities : read mail, access website, read company memo, 'get' some media or for more advanced users do some image-editing.

Since computer have become mainstream product, nobody is interested into learning its inner-working anymore. The cool factor is over. That happened before with TV set, radio, car. Damn, do you know anybody not directly in the business that buys TV Set schematics or that replace all the capasitors of his radio to get beter signal ? Back several years ago you would have found quite a lot.

And anyway, what's the point? Going to a 'harder' but 'safer' OS will change nothing. Basically whatever a user can do, that can be exploited. Simple example, how many person still leave their door open even after millenia of burglary ?
With a very complex a tool like a multipurpose computer, the most scary is the problem.

I fear that rather going into a Linux/Whatever beter OS, big companies, selling mainstream product will use the 'time of fear under windows factor' to promote an apparantly simpler solution, like say, sony PSP/PS3 filled-up with DRM, communicating on private encrypted/approved network or google like thin-client applications running on a lockup machine accessing a subset of 'safe' (i.e. profitable ) internet.

Re:I disagree

[Kjella]

I disagree (...) The *nix philosophy requires a great deal more learning on the part of the user.

Which is equivalent to saying *nix will never be used by the masses, so whether or not there would be spyware is a moot point. If we're discussing whether or not there would be spyware, we must presume someone has made it easy enough for the masses to use. OS X might be a good clue in that direction. And there's really only so much you can do about a clueless user who is also the system administrator able to install programs and the like.

top million Web sites

[Anonymous Coward]

They claim to have tested the top million Web sites, but goatse and tubgirl aren't in there, so they can't have.

Re:top million Web sites

[mogwai7]

I think we all learned by now not to click on those links. ;P

Wow

[Life700MB]

downloaded over 100,000 programs from the top million Web sites

You know you have too much free time when you download 10^11 programs just to test them for spyware.


--
Superb hosting 20GB Storage, 1_TB_ bandwidth, ssh, $7.95

Exokernel Guys

[putko]

The technical guys in the company are from MIT's exokernel project.

They worked on delivering high throughput for video with their superior OS technology. It interoperated with Windows, allowing them to make money.

This project looks surprisingly un-technical and uncomplicated in comparison, given how competent and accomplished they are.

Here's an exokernel link:
http://pdos.csail.mit.edu/exo.html

Slashdot Safe To Use

[znx]

http://www.siteadvisor.com/sites/slashdot.org/

I plan on contesting the results, they plainly haven't investigated hard enough.

Re:Slashdot Safe To Use

[Jeng]

        Annoyances

Sorry, we haven't tested this, yet.

Clearly

Re:Slashdot Safe To Use

[Zerathdune]

perhaps, but I think it's more critical that they seem to think that sourceforge has no downloads.

You get what you pay for...

[ian_mackereth]

If the word "Free!" is enough to get users to download the screensaver, game, utility, etc., then this sort of thing will continue.

Somebody has to pay for the server bandwidth and the time to write the programs, and one viable model is adware. I deplore the installation of software that's a)not in the EULA or installer screens and b)damn hard to get rid of, but the 'legit' adware is what's paying the bills of the guys giving you free stuff.

There's always a subset of users who can circumvent the installation of the unasked-for bundles, but the average user without updated anti-spyware, firewall or anti-virus software will make enough money for the vendors to keep us in freebies for quite some time to come...

Re:You get what you pay for...

[slysithesuperspy]

Well, at least its a good way to know what not to download. :)

Re:You get what you pay for...

[jimicus]

I'm sure I won't be the first to say: Rubbish.

There has always been freeware and shareware, even before RMS started preaching Open Source. The quality of it's varied hugely, though bundling a whole wodge of spyware which causes nothing but harm is a relatively new phenomenon.

Believe it or not, some people write computer programs because they want to. It's a hobby, like some people paint, some people take photographs. If they can make some money out of it, great, but that wasn't the original idea.

Granted, some of the less scrupulous authors have decided they can make some money by building an installer which installs spyware at the same time. This by no means represents the entire market, and to suggest it's endemic to free software is at best somewhat disingenuous.

Re:You get what you pay for...

[ian_mackereth]

Oh, absolutely! I've used some and I've even written some, back in the day. A lot of it sits on isp.com/~username sites, which doesn't require any payment model.

There's still the requirement for some sort of payment, though, to maintain large software aggregation sites. Ads on the site are one option, or a mixture of free and fee software (with the site taking a cut of the fees), or there's this spyware/adware route.

Sorry if I gave the impression that there's no other way to get free software from a programmer to a user!

I don't get it

[penguin-collective]

There are already numerous companies that are looking for malware (including spyware) on the web, developing signatures, and making that information available over the web. They even provide handy little desktop applications that will scan and evaluate software not just by site-of-origin but by actual content. An example of this is "Spybot" (www.safer-networking.org).

It seems like what this company is trying to add into the mix is automated testing, but it's doubtful that identifying spyware is the limiting factor right now in eliminating it. It also seems doubtful that automated testing is, ultimately, going to be effective or reliable.

Spyware is a very recent development.

[CyricZ]

There will still be spyware threats out there if Windows didn't exist.

Recall that spyware is a relatively recent development. While malicious software has existed for decades, spyware didn't come into the picture until less than a decade ago.

Many have pointed out that spyware wasn't a problem while Netscape Navigator was the dominant browser. It has only became a very significant and prevalent problem since many users started using Internet Explorer. Also recall that Navigator was hardly considered a high-quality piece of software, even when dominant. I know many in the field of security who were quite astounded that Internet Explorer could be of an even lower standard than Netscape.

Spyware today is solely a problem with Windows, made possible by the shoddy quality of Internet Explorer. That fact is verified by the fact that those who have switched to Firefox suffer far fewer, if any, browser-related spyware incidents.

Re:Spyware is a very recent development.

[assassinator42]

In general, people using Firefox know more about computers. I'd say it would be about as likely for someone to get infected by an XPI installation in firefox as an activex installation in XP SP2's IE. You need to click a toolbar in both. Firefox may need a few extra steps to install stuff, but that really won't matter. There's also the fact that there are many more activex spyware installers than XPI spyware installers.

chroot(8), maybe?

[PaulBu]

While the *nix varieties are definitely more secure (as they are now), a switch to *nix will not lead us to less spyware-ridden applications online. In fact, if Windows were to fail commercially tomorrow and everyone runs *nix, you'll see spyware applications be written for these OSes immediately.

Dada,

While I generally enjoy your rather radical libertarian posts over here (by the way, what happened to your karma, why this is only Score:1, Informative? is Score:0 default for you now that you were outed as THE head of /. libertarian consipancy??? ;-) ), on the technical side you might be wrong here.

Does MS Windows have chroot(8) system call? I doubt that (not that I really know, never really programmed for Windows)... *nix architects have thoight of it, like, 20 years ago...

Can you 'alias firefox "sudo -u paulbu-paranoid firefox"'?

Why is it relevant? IMHO, any consumer-oriented version of *nix would be much tighter secured by default than current Windows. Note that I am not saying that, say, Ubuntu (as it exists now) is suddenly given 95% market share would be secure -- but some simple mods can be almost transparent to the user, while protecting the system (including your actual $HOME!) from most of the instances of his own poor computer literacy (AKA stupidity)!

Paul B.

Re:chroot(8), maybe?

[supremebob]

"Why is it relevant? IMHO, any consumer-oriented version of *nix would be much tighter secured by default than current Windows."

Unfortunately, that hasn't been the case so far. The Linux systems that Walmart has been shipping come with the Linspire distribution, which allows users to run as root by default. That's not exactly secure, is it?

Re:chroot(8), maybe?

[PaulBu]

Note the disclaimer I've made about Ubuntu (as an example) -- it's only WHEN/IF *nix-based systems start getting a significant share of CONSUMER market they will evolve to deal with threats like spyware. Linspaire had absolutely no reason to go there (they did NOT have hopes to become the next Windows, only to shave some margin off Walmart's PCs) -- but Apple, SUSE, Mandrake, whoever else new and unknown who manages to grab a rapidly expanding marketshare and notice in time that it is actually expanding fast enough to warrant additional precautions right then WILL have the time-tested framework to add those precautions.

Paul B.

Where is the accountability?

[Presence2]

If I designed a product that allowed me to invade your home without your knowledge, spy on your behavior, and report it back to me - I would be arrested (or hired by NSA/homeland security).

Yet, all these thousands of products do this with absolutely zero accountability. As far as I am concerned, the programmers and companies who promote this behavior should be just as culpable as any petty crook who selfishly holds no regard for their victims.

Re:Where is the accountability?

[dbIII]

If I designed a product that allowed me to invade your home without your knowledge, spy on your behavior, and report it back to me - I would be arrested (or hired by NSA/homeland security).

Possibly. Forget the hacking skills - how good are you at judging Arabian horses?

You do have a point, computer crime has gone mainstream and is now only considered a dubious business practice.

Holly molly, that thing needs a designer

[masklinn]

While the extension itself may be useful, it's ugly as a sin, the icons are criminal and the one in the status bar is horribly distorded under a 1280*1024 resolution, making it butt-ugly and hard to read.

Seriously, I'm afraid that I can't keep something THAT ugly in my browser, it's just too much.

Similar

[Mistlefoot]

Education is certainly the key.

I've been using the HOST file supplied by <URL :http://www.mvps.org/winhelp2002/hosts.htm > the Microsoft MVPS site for the past few years and have not had ANY spyware or Malware or viruses on any of my machines.

I still run ad-aware and spybot monthly and never see anything but a few cookies.  Once every few weeks I update my HOSTS file and then set it to read-only again and  the 10,000 or so sites it blocks are just that - blocked.

Web sites load faster too without some of the tracked ad sites loading.  From time to time I get pages that aren't found.....but I can review these as the HOST file is of course text.

I really do not know why HOST files are not a more common theme on here when setting one up on your Dad's computer saves you from removing crap from it as a hobby.

Re:Similar

[freedom_india]

FYI, i tried downloading this file and putting it into my Mac OS X /etc directory. But, Mac OS X says i have no rights !
Even though am a member of the "admin" group !

Doh!

What does it mean? Mac OS X/UNIX is a faer better, easier and better OS than Windows.

Spyware will be the death of Windows, i can guarantee that.

Re:Similar

[l810c]

This is pretty cool and combined with Adblock+ really keeps the noise down.

ESPN.com, which I stopped visiting when possible before Adblock now sends all links through x.go.com which is filtered out by this HOST file. Had to edit that one out.

I wonder if this is intentional by ESPN.

As things like these become more prevelant, some sites might just start setting up a proxy for their ad content so that it appears to come from the main content domain. The only option to avoid ads then will be to stop using the site.

Re:Similar

[kabz]

I dropped into terminal and had to use 'sudo vi /etc/hosts', then it worked. What the hell is this, Debian?!?? ;-)

Re:Similar

[Pope]

You have to sudo cp it to /etc. Or are you just being deliberately obtuse?

Re:Similar

[freedom_india]

i was pointing out how difficult it is to update/modify a HOSTS file in Mac OS X.
In Windows it is relatively easy to modify the HOSTS file if you are logged in as admin.

In Mac / UNIX you need to have xplicit rights. sudo does it for you.

I was just making a "look dumb" attitude for the parent post when i was pointing it to the parent.
Thanks by the way for the clarification.

Re:Similar

[Anonymous Coward]

> i was pointing out how difficult it is to update/modify a HOSTS file in Mac OS X.

But it is not.

> In Windows it is relatively easy to modify the HOSTS file if you are logged in as admin.

You can do almost anything if you're Administrator or root.

> In Mac / UNIX you need to have xplicit rights. sudo does it for you.

Your confusion stems from the fact that a Mac Admin account is something different from a Windows Administrator account. In Mac, Admin is someone in the wheel group, not someone who is root.

Re:Similar

[jZnat]

And since it's so easy to modify the hosts file in Windows, that's a common method to fucking up an ownz0rd box.

Re:Similar

[Anonymous Coward]

Errr, that's not off-topic. Use 'sudo' to be root for a vi session that can write to the root owned /etc/hosts.

Re:Similar

[rtb61]

Of course it is dead easy to modify the host file on windows, simply connect to the internet with M$ internet explorer, browese around a bit and before you know it your host file will be modifyed for you, maybe not the way you would like but modified it will be ;-).

Re:Similar

[bensafrickingenius]

We run a squid proxy for 10 local schools. We recently added a spyware category for blocking. It's kinda weird now -- you'll see individual frames on web pages with the "access denied" message from the proxy, while the rest of the page appears normally.

Re:Similar

[Redwin]

I really do not know why HOST files are not a more common theme

Maybe because "From time to time I get pages that aren't found.....but I can review these as the HOST file is of course text."

For you, me and the technically inclined this is no biggy, can you see your Gran doing this? As far as they know the site they want to view doesn't work but it was fine before you set up this funny named file.

Maybe it could be possible to design a two tier security model that flagged up if a site was being blocked, and you could allow it to run under limited privilages, just so you could view the page and no more.

Re:Similar

[I'mJVC]

We did something similar at my office, but redirected the pages to a 1x1 pixel transparent image. That way the frames just appear blank and the user does not get the error pages.

C'mon, hands up...

[kale77in]

Odds are good that some Slashdot readers are involved in producing and propagating spyware. (Lots of us, lots of it. You do the math.)

How about you fake your IP, make a new account, post as Anonymous Coward -- whatever you need to do -- and give us an insight into your world, and the attitudes of the people you work for?

Re:C'mon, hands up...

[Council]

Odds are good that some Slashdot readers are involved in producing and propagating spyware. (Lots of us, lots of it. You do the math.)

How about you fake your IP, make a new account, post as Anonymous Coward -- whatever you need to do -- and give us an insight into your world, and the attitudes of the people you work for?

It just so happens I work for a large spyware/malware company, and I'd like to blow the whistle. My report on our industry is available here. (To access my tell-all, you should all click "yes" on whatever dialogues come up.)

Re:C'mon, hands up...

[kale77in]

< (To access my tell-all, you should all click "yes" on whatever dialogues come up.)

Oh no, it doesn't seem to work on my computer. Could you maybe help me install it? My IP is 127.0.0.1...

dummy work around

[Anonymous Coward]

it would be easy enough if the users browser had an extension that brought up a really large font in blood red letters WARNING! YOU ARE ABOUT TO INSTALL SOFTWARE THAT REQUIRES FULL ROOT PRIVELEGES! ARE YOU SURE YOU WANT TO DO THIS? IT IS A SECURITY RISK!

There's one program example I am aware of, x-chat, that automatically protects noobs, if you are logged in as root it gives you a quite stern lecture to "not do this". There's no reason generic browsers couldn't do this now.

Re:dummy work around

[generic-man]

XChat is an IRC client, though, and many IRC servers expressly forbid users logged in as root to connect.

Besides, every scummy application distributor will simply say "You may see a message 'WARNING! YOU ARE ABOUT TO INSTALL SOFTWARE THAT REQUIRES FULL ROOT PRIVELEGES! ARE YOU SURE YOU WANT TO DO THIS? IT IS A SECURITY RISK!' Please click 'Yes' to install this important software." They already provide explicit instructions for getting past any Internet Explorer dialog boxes. It's up to the user to make intelligent decisions.

camera, pda, mp3, better users?!?!

[SpectralDesign]

Or when they want to hook up their brand-spanking new digital camera/mp3 player/PDA?

I'm running Ubuntu (Well, Edubuntu, for my son's edification) and I have no problems connecting and utilizing my digital cameras, mp3 players, and PDAs.... It's time to crawl out from under that rock there, dude.

You don't need a better code to prevent spyware, you need better users. Better system design/code will never beat out a user, unless the design is involves cutting the power to the computer.

Actually, much of the security of linux comes with the fact that a) filesystem permission structure is more robust than any Windows FS, and b) that you don't generally log in as root (administrator to you Windows folks) to do the day-to-day operating of the system... as a matter of fact, I've never logged in as root on this system... At most, I'll use sudo for things like installing or configuring firewalls, and then resume my regular privileges.

Re:camera, pda, mp3, better users?!?!

[fluffy99]

A more robust filesystem permission structure ?!?!?!

One of the biggest downsides of *nix is the lack of granularity in file permissions. Unless you're want to deal with the nightmare of selinux, you're pretty much limited to user/group/world permissions. Windows on the other hand has very good granularity that lets you define exact permissions on a user basis. I know some filesystems are started to support extended permissions, but there is no consistency meaning software can't rely on having anything but user/group/world. Also note that windows uses unique SID strings between machines instead of non-unique numbers uid numbers (anyone say NFS hell?)

Yes, this is one of the rare times I will actually say Windows has a better security feature. Of course, users running as admin and not having those permissions locked down is another question entirely

Re:camera, pda, mp3, better users?!?!

[SpectralDesign]

And how many "Joe Six-Pack" users have a Windows FS that's configured with proper security, per capita? And how many of same primarily use an account sans Administrator rights?

A couple of extended file-system permissions don't mean squat if they're not used or they're worked around.

Re:camera, pda, mp3, better users?!?!

[fluffy99]

Point taken. Still the ability to even set extended file system permissions is definitely a point in Microsofts favor. It's also one reason I hate running Samba - the users can't easily manage file permission. To make permission or share changes, you have to restart Samba!

stop advertising for MIT

[moosesocks]

An open letter to slashdot:

Please stop it with the name-dropping. It's irritating and insulting. The article has plenty of merit on its own, and is indeed a fine bit of information to put on slashdot.

However, the fact that it was started by two MIT alum is completely irrelevant. If this was the direct result of research being done by a group of MIT students or professors, it might be appropriate to place a reference to MIT in the blurb (but probably not the title). We're not an MIT related publication, as hard as that may be to believe (Wired is also a terrible offender of this).

It reminds me of my psychology textbook, which would always drop the name of the institution responsible for a certain piece of research: "Harvard Professor Shelly cline worked with Yale Psychologist Howard Walken to refine Pavlov's theory....." and so on, provided that the institution was in the Ivy League. Flipping through the pages, I found a few references to only Ivy Leavue Universities and overseas institutions (specifically Cambridge and Harvard).

Now, I'm not going to deny that a great deal of mighty fine research comes out of MIT and the Ivy League, but I'm also going to remind everyone here that other institutions also churn out a great amount of significant research, and they are hardly ever credited for it. My tiny public liberal arts school even churns out a fair bit of good research.

So, slashdot. Please stop shamelessly plugging these name-brand schools. They've done nothing wrong, but by publicizing them in such a way, you're dragging down the other 99% of the educational system that the rest of us have to utilize.

(To be fair, I did RTFA, and sideadvisor seems genuinely cool)

Re:stop advertising for MIT

[Anonymous Coward]

I don't go to MIT or the Ivy League but MIT gets all the mention because they are the ones who are at the front of alot of research in terms of both quality and quantity of publication.

If you feel that other institutions are doing quality work of similar vein that belongs on Slashdot, then feel free to post it.

Otherwise, you reek of some sort of jealousy/envy.

Re:stop advertising for MIT

[Anonymous Coward]

Yeah, face it, ivy leaguers are just better people. And Cambridge students are like little gods, you should be thankful they sometimes walk amongst us. I've never met someone from any of those universities I didn't fall totally in love with, whilst feeling utterly unworthy to express that love.

Re:stop advertising for MIT

[nacturation]

Flipping through the pages, I found a few references to only Ivy Leavue Universities and overseas institutions (specifically Cambridge and Harvard).

Harvard moved overseas?

Re:stop advertising for MIT

[sparkz]

Depends on where you live.

I live in the UK. My question is - has Cambridge moved overseas?

Re:stop advertising for MIT

[moosesocks]

Haha. My bad.

Oxford is the one! not sure how I made that mistake..... come to think of it, maybe they are superior given my profound lack of any common sense ;-)

Neat

[rune.w]

This is a good project and it has the potential of eventually becoming the "Google of spyware". It's a pitty their methods are not explained at a greater detail in their FAQ, but then it prevents spyware companies from finding a quick workaround to fool their system.

They even have a Firefox extension already: http://www.siteadvisor.com/ffinstall.html

I'm looking forward to them adding cookie support to their database. Maybe I could finally stop blocking all cookies by default.

Have I tried Kubuntu? Why yes, I did.

[bitflip]

I've been an Ubuntu user for about a year, and I've used FreeBSD for many more. I like Ubuntu, but I used KDE on my FreeBSD machines, and ended up installing the KDE packages on the Ubuntu machine.

So, when my hard drive failed I thought I'd just cut to the chase, and install Kubuntu.

I certainly didn't expect problems, as it is essentially Ubuntu, right?

I'm not going to iterate the various problems I had - the main one was getting wireless to work (which I did after manually hacking the config) - but I will say that Kubuntu ain't no Ubuntu. They need really need to work on polishing the system integration/config aspects of the tools. Ubuntu has just done a better job of it.

I wasn't happy until I blew away Kubuntu, and installed Ubuntu and the KDE packages. Everything is working just fine, and life is good.

(I'm not trying to start a Kubuntu/Ubuntu flamewar. You asked, and I'm just sayin')

Wow

[TechnoGuyRob]

They really mean it when they say ALL sites: http://www.siteadvisor.com/sites/siteadvisor.com

Can I get a list of those 1 million sites?

[British]

I'd like to turn them into a hosts.txt file, resolve ALL of them to 127.0.0.1 and then put that file on my dad's computer.

Then he won't call me so often to fix it when it's bogged down with all that junk.

Re:Can I get a list of those 1 million sites?

[nacturation]

I'd like to turn them into a hosts.txt file, resolve ALL of them to 127.0.0.1 and then put that file on my dad's computer.

I don't have a list of the top million sites, but I do know a few in the top 10. You can start by banning yahoo.com, google.com, and msn.com. Soon, your dad will be surfing only the bottom of the barrel on the internet.

Re:Can I get a list of those 1 million sites?

[Fnord666]

http://www.mvps.org/winhelp2002/hosts.htm

THE REAL QUESTION HERE: SO READ IT

[MrSoundAndVision]

Why isn't this considered "hacking"? In a word, money, or better yet, capitalism. Like so many of the other crimes that occur in our society, exploitation (and this is exploitation) for money is in many cases acceptable. Indeed, making money is exactly equal to exploitation, wouldn't you agree?

No, CyricZ is right, we need to educate users.

[tokengeekgrrl]

I have a brother who is marred and has 2 kids between the ages of 12-15. Those kids killed his last computer, unwittingly installing all sorts of nonsense when they downloaded games and graphics. That was on a Win98 SP2 machine which, as hard as I tried, I simply could not secure or revive from all of the trojans and malware that had infected it.

My brother supports a family of 4 on his one salary. They live very well considering the cost of living in their small, midwestern town, but computers still cost the same and he hasn't been able to afford to buy a new one. He's quite proficient with computers when it comes to using and configuring them for what he and his family needs it to do. He just doesn't have time to keep up on all the security issues and patches since he's too busy working to support his family and trying to be a good father to his kids.

After he got laid off from his job not too long ago, I bought him and his family a new PC with WinXP Home, (I know XP Professional is much better when it comes to security but it would have overwhelmed my brother and the best PC package I could find at the price I could afford only offered XP Home). I walked him through how to secure the new PC by setting up an account for the kids with guest access so they can't install anything, configuring automatic updates, installing spybot and automatic scans, tuning the XP firewall, and having him switch to Firefox. I sent him urls for websites that explained how to secure a PC and maintain it.

I've just emailed him about installing the SiteAdvisor plug-in for Firefox which is absolutely brilliant for users like my brother. Hell, I've installed it just for the novelty of it.

The point is, my brother is taking care of his machine now and he loves Firefox. He has told everyone he knows in his little town about how great it is and to dump IE. All it took was someone taking the time to inform him.

So chill and if you have the time and inclination, take 10-15 minutes to explain to a user how to protect their PC. If that's not the kind of thing you feel like doing, fine, then as far as I'm concerned, you don't have a right to complain about it.

If you're not part of the solution, then you're part of the problem, in my opinion.

Respectfully yours,
tokengeekgrrl

Re:No, CyricZ is right, we need to educate users.

[maxpublic]

I have no idea why you couldn't revive his computer. At worst you'd have to reformat the disks and reinstall; no virus, trojan, or piece of spyware is going to survive that. No matter how bad the software it isn't going to be able to rewire his hardware.

Max

Re:No, CyricZ is right, we need to educate users.

[tokengeekgrrl]

If I had had physical access to my brother's computer, then of course I would have reformatted the disk and reinstalled the OS. The problem is, he's in the midwest and I'm on the west coast with a 3 hour time difference. I tried to help him over the phone, (he couldn't access email since his computer wouldn't boot), on how to remove the trojans so he could backup his data and then reformat. I spent hours on the phone with him. At one point, I tried to talk him through pulling the disk out and just dropping it into the mail to me so I could take care of it but he didn't feel comfortable doing that fearing he would damage the disk.

With his new computer, I've given him specific instructions on how to turn on remote support access for me which works out better for both of us. :)

- tokengeekgrrl

Re:No, CyricZ is right, we need to educate users.

[sparkz]

Because he only had a license for Windows 98. It would be illegal to "fix" his computer by installing WinXP Pro + SP2.

Reinstalling Win98 would only be inviting further disaster. Installing a similarly aged Linux distro (SuSE8 would be my best bet for the scenario described, but lots of alternatives of course) would be one option; sounds like the GP chose the better option - he could afford to buy his brother a WinXP machine to replace the old one.

No matter how bad the software it isn't going to be able to rewire his hardware. - No, but reinstalling a bad OS is not going to provide a long-term solution.

Re:No, CyricZ is right, we need to educate users.

[waferhead]

He didn't spec the machine, but Mandriva 2006.0 installed on a new harddrive, sent in the mail would have done the trick as well, assuming >350MHz and 128M RAM.

BTW: You're a good brother, dude.

Chattin in IRC (ps love this program)

[t0qer]

http://www.siteadvisor.com/preview
<pickanick> testing
<toqer|7boo> ya that thing is pretty friggen cool
<toqer|7boo> its like knowin which ho has ghonorhea before you bang her
<toqer|7boo> very sexy
<pickanick> cool analogy
<Drumstix> hah

Imagine....

[Dark_Archemedes]

what a Beowulf Cluster of those site downloaders could do. Would they run on Linux???

Think of it this way

[PuppiesOnAcid]

Microsoft, since they are the controllers of the most used OS in the world right now, are basically the ones who say what level of technical competence a user must possess to use a computer. I think *nix is a lot more easier and logical than Windows, but that is because I hold a basic understanding of many of the underlying concepts to a computer and OS (partitions, good design i.e. separating the kernel from the GUI, what the difference is between booting from your hard drive and your CD-ROM drive, etc.) Until users are forced to know what a root user is (and other basics to the *nix environment) to surf the net, or until the *nix people (the open source community and whoever pushes for it) figures out a way to design their system so my grandma could understand EVERY part of it, I personally don't see people moving from Windows very rapidly. After all, if people are fed up with their Windows boxen running slowly because of spyware and suggest an alternative OS, what if they picked an OS that was just as evil as Windows and just happened to have a better security model? Not that one necessarily exists, but the point should be to encourage users to "try and learn GNU/Linux" and not "get away from Windows."

It is late, I am tired and may be wrong about a few things, but I hope my point was made.

At what point

[ScottCooperDotNet]

At what point do you move from educating the users to disciplining ones that need their system re-imaged more than once? Your company wouldn't put up with the staff showing up late, why do they tolerate end users installing crap?

I'm suprized garbage sites aren't being blocked by WebSense. If Maddox's site is blocked (as tasteless humor), why aren't known adware/spyware sites being blocked?

Firefox needs an MSI installer and some Group Policy mods to take off in a corp. enviroment.

I disagree as well.

[Anonymous Coward]

Most Linux software isn't installed in the same way as on windows - you don't go browsing through a dozen websites full of ads for software, you browse through your distro's software repository. If you want the latest and greatest, you either wait a few months for your distro to update the package, or if you're advanced, compile it yourself, or beter yet, find some trustworthy member of the community who will compile the package and create an extra repository.
  There will be spyware for *nix, but it will be a minor problem, since who needs to click on "FREE! FREE! FREE! WEATHER REPORT ON YOUR TASKBAR FREE DOWNLOAD CLICK HERE!" when you have distro-supplied (safe) software for the same thing?
  The problem lies with shareware software whose authors have decided that shareware registration fees aren't giving them the profit they were lead to believe would be theirs (by the windows culture) and who decide to sell a little ad-space inside their software's installer.
  *nix programmer and user culture places respect and reputation higher than cash, so you're not likely to see a massive problem like this ever without some fundamental changes. Commercial companies that want to make a living with *nixes must realize that here they will thrive or starve on their reputation (hello SCO!), and bundling spyware is the kiss of death.

Re:I disagree as well.

[Crayon Kid]

Not necessarily all Linux software comes from trusted package repositories. There are plenty of commercial apps which produce their own packages. I can name a few right now, off the top of my head: Win4Lin, MActor. They issue their own .rpm's.

I'm NOT saying they do, they are wonderful applications. BUT, if they were to bundle "spyware" ie. stuff that phones home or does other ugly things, how would you react? Would you even know? We'd find out, eventually, but would you stop using it if you really need it? Would the distro's refuse to carry them? On what grounds? Hell, if SuSE or other commercial distro's offered their free versions with spyware, what would you do?

The whole "do no evil" policy is VERY relative and fragile when you come to think of it. MS Windows is living proof of a platform which has undergone a decade or more of moral decadence. Give Linux enough time and assholes and commercial interests will start having their way there too.

not just ignorant, but also...

[ecalkin]

*unbelieving*!!

    i can't tell you how many times i've expressed the dangers to people. if you don't have anti-spyware, anti-virus, firewalls, and etc these are the risks. and they don't beleive. if you look at the large campaigns (at least in certain areas of the U.S.) to get people to wash their hands on a regular basis, it appears that people are disbelieving of germs also.

    how do you fix this?

    there is amazing evidence that the use of seat belts in autos reduces your probability of dying in a colision. but we still have to make laws to make people wear seat belts.

    so far there has been no real cost to a computer user for being stupid. with the exception of lost data, nothing bad is going to happen. if laws get passed that state your are responsible for your computers actions in dos attacks or if your computer is hijacked and made into a child porn depot, things might change.

eric

Re:not just ignorant, but also...

[maxpublic]

if laws get passed that state your are responsible for your computers actions in dos attacks or if your computer is hijacked and made into a child porn depot, things might change.

And these laws would be both stupid and unconstitutional. If a drug dealer grows a small field of pot on a wooded area of the back forty you never use, the law can't hold you responsible for not patrolling the land on the off-chance that drug dealers might hijack a piece of it for their own use when you aren't looking. If we lived in such a state we might as well use the Constitution to wipe our asses with, since it'd be nothing more than a worthless piece of paper.

Thanks, I think I'll pass.

Max

Re:This is too much: SiteAdvisor has adware!

[Blackice912]

No, I think it was you who installed it. I just installed SiteAdvisor and no nasty Yahoo toolbar appeared to me.

SiteAdvisor does not install Yahoo Toolbar

[bedelman]

Bombadier,

I'm on SiteAdvisor's advisory board, and I've tested their products at length. I've never seen anything like SiteAdvisor installing the Yahoo Toolbar, and I'm confident that there's some other explanation for what happened to your computer. Can you send me an email so we can troubleshoot what happened? I want to get to the bottom of this and clear SiteAdvisor's good name.

Ben Edelman

See Assessment Technologies v. WIREdata

[Jamesday]

You may well already know this, but it might be of interest to others: I recommend reading the full Assessment Technologies v. WIREdata (slow to load) decision because it's a very well written summary of this area of law. In this case the use of proprietary components to prevent the use of underlying public domain data was found to be invalid.

As you note, creativity can still prevent a compilation from being in the public domain, if there's some significant original creativity involved. One of the interesting bits of Assessment Technologies v. WIREdata was the requirement to hand over even the bits which might be copyrightable - the database structure - so that the data would be available.

There's more discussion of the general principle at Feist Publications v. Rural Telephone Service, which contains a fair overview of this aspect of US copyright law.

perhaps

[nwmann]

dude can't count two of the dialogue screens were browser induced

Install this:

[warrax_666]

http://flashblock.mozdev.org/

Unrelated to Windows

[Per Abrahamsen]

The bad effects could happen under any operating system, as long as users can and will install and run software from unreliable sites.

Of course, if you are admin for some too trusting people, installing some comparable obscure system would be a good idea, but only because there aren't many of these traps targeted towards users of such systems.

amazingly invasive stuff?

[schlumff]

Sounds like they found some p0rn too.

Can't agree

[guet]

Agreed. Especially when you consider that all of the programs in TFA were installed after the user clicked the "I Agree" button five, six, seven times. The OS could be totally secure and only allow the installed apps to affect the logged-in user. They'll still be there annoying that one user, though, since the user is the one who said it was okay to put them there. This is where informing the user comes in. And the user has already shown many times over that they don't care to be informed. This sort of crap is gonna be around for a long long time...

Yes and No. The user has to agree, but on XP the user has been trained to agree -

A big difference I notice between Windows XP and OS X (one of those nix) is the number of times I have to click 'Next' or 'Previous' in dialogs in Windows, just to get anything done at all. In my opinion the main reason for the growth of spyware on Windows (before ubiquity) is the way the OS trains you to click,click, click to do anything at all. You end up not reading any of the dialogs because you read the first few words and guess the rest. The user is inured to warning dialogs of any sort, and starts to click through the forest of 'Next' buttons to get to where they want to go (or thought they wanted to go :). There's also the problem with users running as admin all the time, meaning the only line of defence is the security policy of the web browser, not the users' permissions.

In contrast on OS X you very rarely have to say 'ok, do this, then that, next, next, finish', you are asked one simple question (usually) with an 'OK' the first time you open a document type with an application. And you very, very rarely have to enter your admin password, practically only when you are installing big applications like Photoshop which need to install libraries. So if a website pops up an authentication dialog (which they can't anyway BTW), you know something is wrong; you stop and think about it.

That said user ignorance of what constitutes safe computing is a problem too.

Re:Can't agree

[noidentity]

"And you very, very rarely have to enter your admin password [on Mac OS X], practically only when you are installing big applications like Photoshop which need to install libraries."

And only because they're a big company that people have to put up with. A small company wouldn't get away with requiring administrator privileges just to install a freaking application program.

Re:Can't agree

[Starxxon]

It's not about being a big or small company.

Mac developers avoid asking for the admin password as much as they can. Bigger apps tend to ask it more because they need to modify the System folder for some reason.

On OS X, programs rarely need to do that, most applications (even big ones) are contained in a single icon you can drag to your application folder without needing an installer.

Re:Can't agree

[noidentity]

"Bigger apps tend to ask it more because they need to modify the System folder for some reason."

I doubt it's because they need to in order to provide functionality; it's because they want to and because big companies will get away with requiring it. What the hell is a graphics application installer doing modifying the system?

Yes, I hate programs which insist on having admin privileges, because this just makes things less-secure in the long-run by training users to think it's normal to require that.

Be done with it already!

[chivo243]

If you are in charge of network security in any capacity, you understand that it is "your job" to stop this kind of traffic at the peremiter, if your systems are so complex that you can't configure what you have to do it, get a Barracuda Spyware Firewall, I have said it before in numorous posts about Spyware and Adware and Malware ad nauseaum, why is this concept so hard for Sys admins, engineers etc to embrace? Treat the internet like a singles bar, would you screw anybody you met there with out a condom??? I didn't think so, so treat your computer/network like a dick. Use a third party protection device if necessary.

Do your best to educate home users, but talking about computer security is like discussing Politics, Religion or Sports at the dinner table, everyone has their own beliefs.

Their database quality is in question

[Anonymous Coward]

I wish they better analyze their website.
FreeBSD.ORG = Marked as yellow - "Use caution." ( http://www.siteadvisor.com/sites/freebsd.org )
In the same time all fraud websites in Google search for "Green card" are green ( http://www.siteadvisor.com/sites/us-green-card-lot tery.org )

oddly enough...

[ecalkin]

it doesn't relate to criminal activities, but a large number of states have self generated easement laws. depending of state, if you are tresspassing (travelling/building/etc) for x number of years in a non-hidden fashion, you gain some legal usage righst. if i remember from the course where i learned this, it was 7 years in some states to 20 in others. it seemed to be in response to absentee landlords. so there is some history of reasonable management of your property.

    however, a better example might be attractive nuisance laws that require special protection/security of 'dangerous' stuff like backyard pools. many cases where 'one fence' was deemed not being secure enough to prevent the neighboorhood kids from getting in and drowning. again, this is civil and not criminal.

    so if gramma gets sued by abc-corp because her ip address is noted in a dos attack. show us what precautions you took to prevent this????

    this is where i think this all ends up.

eric

Nah, problem of their definition of 'score'

[Anonymous Coward]

aka: automated testing vs. human brain

They registered to some bsd ml and counted the mails... not sure where they got the link for the one app from (maybe a non-moderated list).

Unless the site does something bad, it doesn't register; and the fake page probably doesn't, as their intent is to rip money directly, no sense in scaring people of with malware-payload.

Captcha for mailware installations ?

[Anonymous Coward]

Now Mailware writers will have to use http://en.wikipedia.org/wiki/Captcha to protect themself from bots like thouse.

perfect example

[deadlocked]

This is taken a little out of context, but something that actually happened in an IRC chat channel.

user: how can I fix my PC to be able to play these songs?
me: listen, you need to clean your PC from that virus first
user: how do I do that?
me: go there and bla, then blabla and bla you're done
user: what? I just want to listen to my music
- user has quit

Re:This is too much: SiteAdvisor has adware!

[WoodieR]

and why is your homepage tektonics completely blank ? java only ? or some such nonsense? and why ?what would you like me to install or run on MY system?

Re:This is too much: SiteAdvisor has adware!

[Blackice912]

Because the space between and is empty? It's possible you see nothing because I put nothing there...consider that?

All I said is that I installed SiteAdvisor and got no pesky adware. Your Yahoo toolbar didn't come from it, so it must be from another source.

Re:Six degrees: A cool new website game

[Anonymous Coward]

yup. What is the link between the Whitehouse.gov and utexas.edu all about?

Anyway, this project has a long way to go, some green sites are 100% spam.