Slashdot Mirror
Digsby IM Client Quietly Installs Badware
An anonymous reader writes "IM company Digsby has quietly included malware in an update to their client software that utilizes users' computing power and bandwidth while idle for a quick buck. When questioned, developers at Digsby claim that they have done no wrong and that users should not complain because the client software is 'free.'" The money-making distributed computing software is in addition to six "crapware" apps that users must refuse during installation. The terms of service that no one ever reads does describe the CPU- and bandwidth-robbing moneymaker, and its off switch is located behind the "Support Digsby" menu item.
From the article:
Summary: Stick with Open Source
The only way you are definitely going to avoid greedy software developers exploiting you is to stick with open source, make sure to donate to your favorite open source projects, and stop installing software with bundled crapware.
Did we already forget that Ubuntu also installed such and without consent (and Linux Mint) - here you atleast have the change to disallow installing it.
There has been countless numbers of open source projects that also do this. Just because it's open source it doesn't mean you're safe from such tactics - it just means the source is open. You can check the source and remove those parts, but not many of us do so.
This is actually more the nuisance of free software. If you've paid for your software, you can usually except that they wont fuck you over with that crap. It's more like the price you pay for using free ad supported software, because if they develop it professionally they also have to get the money somewhere.
And also from the article Digsby's response:
Update: Disgsby responds, saying they're pushing out a new build today with more transparency about the research module.
It's not free if it's not open source.
Information about the badware is being removed from the Wikipedia entry..
The power of choice: change IM client. There are tons of free IM client, just change it to something else like Pidgin.
Free or not, hiding (or not mentioning it, or putting it in the .000001 point fine print, or burying it in a 100 page EULA - IOW: obscuring the truth) something that you know people will object to is deceptive, dishonest and wrong. You have to ask yourself, would people not install my "free" software if they knew what it was doing - if the answer is anywhere close to yes, you have a moral obligation to reveal the details.
This is part of the bargain - if you give away something for "free" and advertise it as "free", it needs to be "free" - as in not just that the costs are hidden. Otherwise, it really is a Trojan Horse.
Don't reap the goodwill of the public when you're secretly using them.
DISCLAIMER: This post was not checked for speling and grammar- if you complain- you're a whiner
Perhaps this is a good point in time to switch to Pidgin (multi-platform and my personal choice), Adium (Mac OS X), Empathy (Gnome), Kopete (KDE), or some other, more trustworthy client?
Does that mean that if I put a (small, unobtrusive) windmill connected to an accu on their cars and in the evening take that filled accu back to my house they won't complain ?
After all, I put it there for free !
Something tells me that is than suddenly my windmill will be everything bad, from occupying space on/in his car, ugly, dangerous maybe even decremental to their cars miles-per-gallon ratio.
Funny, as their un-allowed usage of a users computer (sneaking it in thru the backdoor and not upfront telling anyone about it is not the same as being allowed to do it), his storage, his computing-capacity and his internet connection (all which have to be payed for by their victims) seems to be "no problem" to those "developers at Digsby" ...
I think this is a great idea. Make it transparent and let all their users know whats going on (Didsby did a great job with this and their alert system is simple enough for anybody to notice). I don't expect a company to just GIVE me software, if they don't want. They have to pay their developers, so they need revenue. I would MUCH rather have my free apps supported by use of my unused processing power than by ads (which I imagine will be harder and harder to pull revenue from in the future).
As long as it's transparent this seems like a good idea.
Steal my band's record! Seriously,
I was about to try this out. Now I'm keeping Pidgin. TY Slashdot for the save!
Why not use one of the many free competing IM clients?
My favourite is Miranda (Windows only, free but not open source)) because it's incredibly lightweight, uses the default Windows UI, and has an incredibly active plugin community.
Then there's Pidgin (multiplatform, free open source) which is also an excellent and mature IM which is also very extensible.
No crapware whatsoever on these similar apps. Support the projects that contribute to the initiatives of free software with your downloads and your dollars. Snub the software that steals control of your computer for monetary gain.
My mistake! I'm happy to state that Miranda is both free and open source!
If a company did this "openly" with full, in-your-face disclosure, there wouldn't be such a bruhahaha.
Then again, as a for-profit, they would lose a lot of users. People don't mind giving up resources to non-profit find-alien-life or fine-a-cure-for-cancer projects nearly as much as they mind giving resources to corporate overlords.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
... if someone were to hack the malware. It would be very bad if they changed it so it downloaded copyrighted stuff, say whole CDs of recent music, to Digsby's machines, and then sent email to RIAA saying it's there. It would be a very, very bad thing indeed if this were then redistributed and thousands of unsuspecting people installed it and remained unsuspecting as the usually do, while it did its job then erased itself, because otherwise it would have been a Simply Awful very, very bad thing.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
Here's your problem:
In other words, they told you about it in documentation you agreed to and said your read but didn't. This sounds kind of familiar. I think it is because of all the people I have heard say "I didn't know that was in the contract. I signed it but didn't read it. You know, just like all those people with the "sub-prime" adjustable rate mortgages that ballooned after 2 years.
It is called due diligence and everyone should practice it, not just lawyers and businesses.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
I know in computing it's fashionable to make up words, but badware? That's just crap. Besides, there's already a suitable word: malware.
No colour or religion ever stopped the bullet from a gun
It's not free if it costs you electricity to run the CPU at full power 24/7. All modern processors have idle states in which they reduce energy consumption. These are not just "wasted cycles" that could be put to some use anyway.
A large amount of people also have metered bandwidth connections which might get impacted by this.
users should not complain because the client software is 'free.'
A malware spreader saying this is like a person who knowingly spreads HIV saying his victims shouldn't complain because they got sex for free. I was going to say "rapist" but digsby doesn't install via drive-by download.
Despite what people would like you to believe, willful ignorance is never an acceptable excuse.
if you set up your computer in such a way that, whenever a computer somewhere else on the internet contacts you and transmits "XYZ", your computer transmits "ABC", which by random chance happens to look very similar to some other data that would have been produced by a piece of hidden crapware on your computer, only different in a couple of small ways, nothing illegal has been done?
Yes, it does mean that if your program does something evil, someone else is free to modify the code so that it doesn't do that and redistribute it. However that requires that someone who cares notices, and then takes the time to do so. Not always the case. Also, when it comes to installers, you don't need the source. If an app is bundling crapware in the installer, you could very well grab it, and make a new install package that doesn't have the crapware. The only time you need source is if the app itself has crapware functionality in it.
As for an example of OSS bundling crapware, have a look at PDF creator. It's a great free alternative to the Adobe distiller. However, it does try to install the Yahoo toolbar, as so many things do these days. Now the Yahoo toolbar is tame on the crapware scale, but I'd say it still counts, especially since they try to sneak it in with every app they can.
Ok well nothing is stopping me from grabbing the source and making a new distro of PDF creator... But I haven't, and I'm not going to. I just don't care enough. Seems nobody else does either.
So really, OSS isn't going to save you. Ultimately, you just have to use companies that don't do shit like this, and out companies that do. Public pressure (and public knowledge) is the only real way to deal with it.
After an article in MaximumPC magazine that reviewed several IM clients. I downloaded Digsby and when I went to install it I noticed all that crap they wanted to install so I canceled the installation and deleted the installer. I wasn't about to follow through after all that crap they wanted to install. Now I'm glad I didn't try it.
The FTC gets around to doing something about it when a Senator falls victim to it.
Since the state and federal computers are fairly tightly controlled, and most of their "computing" is done by interns, don't expect much to happen for a while. Unless a lot of people make a lot of noise.
Cynical yes, but not exactly a rare circumstance.
Platform advocacy is like choosing a favorite severely developmentally disabled child.
It's is a shame that Digsby went down this route and will result in me installing one of the suggestions above.
Digsby had a lot of potential with their integration with Facebook, Twitter, and other social networking sites. I have noticed that many of my friends are no longer using IM clients as much as they used to because they simply post everything to Twitter or Facebook.
Digsby was a single application that allowed me to keep tabs on all of these streams, but now I will have to find alternative (probably open source) solutions.
Java has no friends.
Aren't there about for zillion great free IM applications out there already? Why would someone use this one? What is the specific draw?
The only reason to hide in the fine print the disclosures of dubious functions is because there's a sense of guilt associated with those functions to begin with. There needs to be a guilt index, whereby not only the dubious functions are tallied and evaluated, but also the lengths to which disclosure concerning them is hidden, or in the worst cases, not revealed at all.
users should not complain because the client software is 'free.'
Oh, I'd love to kick that guy in the nads and when he says "Dude! What up?" I'll say "Shut up! It was free!" and then he'd be all weepy like and I'd be all laughin' up in his face. Yeah, good times.
How many people do you know that actually ready the TOS before they purchase the product?
It will make your computer like used! Slightly shotgunned!
Seriously, this is old news. I've been using Digsby for a few versions now, and knew about this from the beginning. The option to turn it off via the "Support Digsby" dialog has always been there. The very fact of the presence of this "feature" scared me off at first, but the quality of the app won me over in the end.
So no, I'm not a fan of having this be part of Digsby, but at least they disclose it (I'm pretty sure there was a blog post on the Digsby Blog a while back about it, and how to disable it) and allow you to opt out.
From steve: digsby developer
@All: This issue will be addressed first thing in the morning. As for performance, the functionality has actually been off this entire time. It is in the TOS because it was planned for the future and Digsby has not been using your CPU/Bandwidth when idle so if you have had performance issues it is not Digsby related.
This started up back in December of last year according to the forum posts. To top it off, Steve the administrator, shut off the research module since then. Why the stir now? Plura is the one that needs to be hammered that provided the software for this.
First rule of holes; When in one, stop digging.
if you have digsby
As outlined in TFA - it's in the TOS and it's possible to entirely disable it with 2 clicks.
I'm pretty sure I'm not alone in being confused as to why people are pissed off about this... You're not forced to use it, you're told about it, and you can turn if off.
This summary's horrible.
First off, they've been talking about it since December of 2008. They responded pretty quickly to concerns.
Second, it's not like you don't see the following on the download page:
I agree that having the disable-sharing-my-cpu flag hidden under Help, Support Digsby is a pain in the ass, so I'd prefer they moved it to Preferences where it belongs, but come ON, folks. Nobody died.
Who the hell is Digsby and why should I care, when there's other perfectly free alternatives available that don't bundle crapware with them.
Am I behind times? Is this what the "in" crowd calls Windows now a days?
It's Digsby's right to install whatever they want, as long as they do reveal it on their agreement with the end user. Stop whining.
However, it's our right, as users, to forget about Digsby and use another IM client.
Catalin Braescu
Ofaly.com
Then there's Pidgin (multiplatform, free open source) which is also an excellent and mature IM which is also very extensible.
And crashes twice a week, thrice if the wind blows hard. What made me finally stop using it was the 4 crashes in one day.
Canada: The US's more awesome sibling.
A. It's FREE
B. They didn't HIDE anything... hell they ANNOUNCED it yesterday!!! Why all the furor?!!? You don't like it, simply shut it off. Takes TWO freakin' seconds, and it's done forever. Hell, they even told you HOW to shut it off!!! Nothing hidden, and quite frankly I'd take an OPTIONAL program that I can shut off over a ton of obnoxious flashing ads pushing garbage I could care less about any day. Quit whining you bunch of techie elitist twits.... get over yourselves.
Wow, this is considered "badware"? It seems like a feature to me! Can I install the "badware" without getting Digsby with it?
I think an important point was completely missed in this entire thread.
The issue may or may not be whether it's right or wrong to include malware in free software, but more importantly the issue is that "IT IS STILL MY COMPUTER! My property."
It isn't right to make money off of someone else's property without compensatation. What if I ran a hot dog stand right on your front lawn or in the lobby of your business? I'm sure you would want some kind compensation like rent, free hot dogs for staff, or something. I would like to see the folks at Digsby give me a portion of what that make from my computer resources such as cpu time and bandwidth.
Also there is a big difference between open source software and just free software. Open source is more community driven where as regular free software is just free. Both worlds have both great software and less then good software. The difference is that I, myself or anyone can aid in improving open source software and the just free stuff in maintained by a sole individual or team.
This article made it seem a lot worse than it really is. I have been using Digsby for about a year now, think its great and was almost about to uninstall it after reading this article until I saw Digsby's post on the options added. It can be read here http://blog.digsby.com/archives/693 #2 article even tells you that you can disable the software from from allowing this option from happening. As long as they are honest about it and I can actually turn this function off I am fine with what they have done. I just wish they would have told you more about it upon installing it instead of finding out about it this way.
I'm not sure what the issue is. When I opened Digsby today, it updated and with in a few mins it displayed a message directing me to a FAQ. It clearly tells you how to disable the feature if you don't want it.
They were caught doing this before, so much that users made a big stink on their forums and they had to respond with a public statement. Apparently they havent learned their lesson.
Then again its probably the only way they can stay in business so they'll do whatever it takes to make some money.
Either way... I dont care. I dont use the software. I did install it recently while looking for an alternative to pidgin.... I now regret that greatly.
How do you Digby employees find the time to put crapware into your product when you're busy here?
Good lord, does Digby have an entire astroturfing department? Genius!
Anyone who loves or hates any language, platform, or manufacturer, doesn't know what they're talking about.
As a digsby user for almost 2 years now... I am disgusted by the way they have pulled this fast one on the digsby user community. I have lost some of the trust I have in them as a company, and will quit them if I see crap like this again. They should have also known better than to just hide it in a EULA- especially when users that have been using the software for years will miss the warning.
BUT- there is a way to disable this badware- it is in the "help" menu of Digsby, which can be used after you install it.
A cover-ass/ apology post has appeared on their Facebook page, explaining how to do this, and how they are going to make this "feature" more prominent so people are given a choice whether or not to use it:
http://www.facebook.com/note.php?note_id=119774451551&ref=nf
so I will continue to use it, as this can now be disabled, and it really is superior in features to any other IM app out there. but one more strike, and Digsby's out, as far as I'm concerned.
WTF is 'Digsby' ?
It's easy to turn it off, look in the options menu, it's right there. They even tell you on the Digsby site how to turn it off. Digsby did NOT say "Deal with it, because it's free" they explained what it does to their uses, and gave them an option to turn it off. All of the "Badware" presented itself ONCE at install, where all you had to do was uncheck the box, or hit "Decline" and it would not download/install anything extra ever.
It doesn't turn on while your laptop is on battery, it only runs idle in background, and runs as low priority so it doesn't clog your system. This article is obviously by someone looking for something to point their finger at. Perhaps this article should have been titled "Digsby helps cure cancer in the background". [Sarcastic fascism] Anyone who bashes Digsby for this Wants everyone to die of cancer. [/Sarcastic Fascism]
I always say "Free just means somebody else paid for it". I love Digsby, and I don't think they have done anything sneaky or underhanded here, nor do I think they have betrayed me as a user.
In my case, I switched from Pidgin to Digsby (and I used Trillian and Miranda as well, and Kopete while working on linux machine) because it had many convenient features, supported the most protocols (incl. facebook), checked email etc. I know that pidgin has plugins, and I tried them, but Digsby was just better.
I hope this publicity would lead them to
a) be more obvious what they include with their software
b) make those unwanted 'features' easy to switch off
I'd hate to se my new favorite IM client losing pace and users over such a dumb choice to include this crapware.
In the FOSS community, this 'malware' may by itself have interesting features worthy of a fork. Although the purposes to which it has been put are unsavory, it may have useful features.
Help stamp out iliturcy.
Eh, folding does this all the time. Never seen where the results of all that data is going, either.
I keed, I keed. I think.
Pidgin and Miranda IM both destroy Digsby in functionality and features. Oh yeah, and they're both truly free.