Slashdot Mirror
Download.com Bundling Adware With Free Software
Zocalo writes "In a post to the Nmap Hackers list Nmap author Fyodor accuses Download.com of wrapping a trojan installer (as detected by various AV applications when submitted to VirusTotal) around software including Nmap and VLC Media Player. The C|Net installer bundles a toolbar, changes browser settings, and, potentially, performs other shenanigans — all under the logo of the application the user thought they might have been downloading. Apparently, this isn't the first time they have done this, either."
Download.com have always done this... I thought this was how they funded the site.
Can we all agree that downloading free software is stealing from poor programmers who have to live in their mother's basement because they're so poor they cannot even afford their own place? And that as we can read in TFA downloading free software supports criminal activities, and is therefore terrorism? And that this probably means you're a communist child-abusing terrorist?
-- Yes, this was a joke, and no, I don't have a good sense of humor.
Download.com has been funded by bullshit third-party software addons for as long as I can remember. AFAIK, they only recently started this practice of causing the user to download a downloader which would first go through the third-party addons before downloading the actual installer... but it's not like it's any different than before. Yeah, lots of people will just click through and accept everything and that's their fault for not reading things before agreeing to them. Don't blame a free service operated by a for-profit corporation for wanting to make money. Host the Nmap installer yourself if you think it's so easy.
It's rather mindboggling that a decade into the 21st century, people are still going to third party download outfits like this.
Maybe someone wants to enlighten me as to why... I'm not coming up with much.
Sent from my PDP-11
1999 just called. It wants its flagship shareware download repository back.
Seriously, today there are so many better sources to get free stuff (legal or otherwise) than Download.com
Why even bother?
add &dlm=0 to the end of the 'your download is starting' page url..
1 go to a program's page
2. click download now
3. do not download the file that starts cnet_ or cnet2_ (if it doesn't start with cnet it's ok)
4. add the &dlm=0 to the url in the address bar after the spi=whatever junk
enjoy the direct download.. and go to the source next time..or try filehippo or softpedia (either one with your adblocker running)
It's a shame, cnet and download.com used to be moderately safe ways of downloading new trial and freeware software. In my opinion shareware is now an outdated practice, with it now possible to find an open source equivalent for just commercial piece of software.
Is the Hippo safe?
It's rather mindboggling that a decade into the 21st century, people are still going to the software producer's site like this.
Maybe someone wants to enlighten me as to why... I'm not coming up with much.
Rapidshare, for that authentic 90s warez feel.
Not hosting your own files, or torrents for larger stuff, looks about as professional as a hotmail address on a business card.
Can I put the 90s on my 'do not call' list?
I just downloaded nmap and vlc. Both files were identical to what I got from the source.
...'. VLC was still from cnet.com.
Actually,it looks like cnet redirected me to the nmap.org download link (http://nmap.org/dist/nmap-5.51-setup.exe) using a 'META HTTP-EQUIV="Refresh"
I'm not logged in; I wonder if I have a cookie that prevents the wrapper -- or if download.com changed something.
Also, I'm using NoScript and cnet/download.com is not allowed. Perhaps this turns off the wrapper too.
I hold it, that a little rebellion, now and then, is a good thing. -- Thomas Jefferson
That's what I finally had to do, when some entity (might've been download.com, might've been someone else) offered an alternative download location for my software - which bundled some sort of malware installer onto my software. After one attempt to remove them as an alternate, I was told I could request my software be removed, and that's what I did. This occurred back in 2004.
Always wondered why in heaven sites like this even exist in the first place. If people is dumb/lazy enough to seek out original sources or google for themselves, and instead blindly accepts recommendations and even downloads sw from these cheap shopwindows, i guess they simply deserve all spyware in the world.
This extremely common practice of bundling garbage with every download is the cancer that is killing Windows freeware, and no, it's not limited to Download.com.
A while ago, when I was in-between jobs and looking for some freelance work, I stumbled upon an entire "community" of scammers known as PPI : Pay-Pay-Install. This forum was all about participating in these shady bundling practices, discussing the advertisers that were most tolerant to things like silent installs, home page swaps, BHO's that redirect your Google searches through a proxy (to hijack ad revenue), Vista sidebar widgets, toolbars, bookmarks, and start-up items, along with uploading deceptively named and heavily trojaned stuff via P2P. This is why, with every goddamned Windows utility you get these days, you get prompted to installt he Ask.com toolbar, BonziBuddy, free trials for McAfee's swiss cheese, and a laundry list of other standards.
CNet should indeed be made an example of, and burned to the ground, but they didn't start this gangbang, the advertisers did. Follow the money... There is no reason why users should tolerate this aberrant behaviour.
-Billco, Fnarg.com
"If we warn the past about an event like 9/11, and they actually DO something about it, what happens then? Would the American government spin it even further out of proportion, claiming the attacks would have used nukes and biological weapons? There's no way of knowing for certain.
We know what we have: A world that is worse off than before, yes, but not on the brink of having the planet destroyed. With the possibility that we could make things a lot worse and start World War III, is is really sensible to send messages back in time?"
Family Guy did that exact plot.
Here is the Hulu Link. Your Country May Vary.
http://www.hulu.com/watch/299685/family-guy-back-to-the-pilot#s-p1-so-i0
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
While this has been normal practice for shady rippoff sites like the ones mentioned for almost a decade, I do wonder if appropriate extensions to FOSS licences such as the GPL could actually prevent this. Or at least make the culprits liable for damages, copyright infringement and/or fraud.
If I were to work on a large FOSS project I would like to know that the software im contributing to doesn't legally end up on one of these fraudulent DL sites.
My 2 cents.
We suffer more in our imagination than in reality. - Seneca
And do you have something not United States Only?
-=This sig has nothing to do with my comment. Move along now=-
I'm part of the ScummVM group, a cross platform software for playing various classic adventure games, and the question of Download.com came up when we released the next version of our software. There were some arguments for including it on such sites, such as giving greater visibility to the project. However, the issue of the bundled 'crapware' was considered too big a downside. We weren't that desperate for wider coverage of our software, and we certainly didn't want people to adversely associate our software with malware.
These days I wouldn't touch download.com even if you paid me.
I understand the sentiments, but I'm curious as to why some (most it seems) feel that the repository should not add the wrapper software (which they don't charge the end-user, the ultimate customer I believe)?
Software creator is getting market exposure....This is good.
End User gets the software they want for little to no charge...This is good too.
CNet gets to make some money for hosting / providing a repository of software...Also good.
So if everybody wins, where is the downside, lol?
Regards,
MBC1977,
"I used to swing by CNet all the time back in the day" - by hairyfeet (841228) on Tuesday December 06, @06:19AM (#38278056)
As did I, & per my subject-line above Hairyfeet!
In fact, I used to have 5/5 star rated wares I wrote there, in over 40 apps I did over time circa 1997-2002...
I quit using them partially because of "shenanigans" like this one (when I was "into" doing shareware/freeware early on in my career "for the resume" mostly + to "sharpen the saw" above & beyond what I have done MOSTLY in coding for work: MIS/IS/IT db programming style work), AND?
Because initially in the 'shareware/freeware world', which I am doubtless SURE you'll recall (& which evidences greed imo also)? Initially, ONLY "SMALLFRIES" WERE FEATURED up to around 1999 or thereabouts.
THEN?
Then, the "big software publication houses" (ala Norton, Microsoft, etc.) started showing up to 'compete' with us, ON "OUR TURF" (shareware/freeware sites)... I didn't like that, but, it's "how it is" (from around 1999 onwards).
Isn't it ENOUGH they have "P.R. firms" & the money to host full page ads in written publications in computing to "get their name around"? Apparently not.
It made me also realize that yes: Websites DO get news of programs around, & apparently, MORE than written publications in computing do!
* Besides - theres PLENTY of competition for them now in many other sites that host wares for youngsters (mostly)!
(Yes, it's usually the young in computing who are probably in that game, most likely for the reasons I was early on in my career in computing: To "get your name around" the field, to have something interviewers can try that you wrote to see the quality in your work, & to just "up their skills" in coding on more levels than they're likely to see usually on the job!)
APK
P.S.=> Oh, & by the way, Hairyfeet? This will give you another laugh today I strongly wager & you may wish to give him your usual "piece of mind" as only YOU can, lol (from our "buddy", the ac off topic illogical adhominem attack using troll who thinks you & I are the "same guy" as usual):
http://news.slashdot.org/comments.pl?sid=2559120&cid=38269230
Enjoy, I did, & see the post parent to that one there...
... apk
It's bad enough without the malware. If you're trying to download a 40kB file, they make you download a MB of ads, and you have to navigate through half a dozen links to "Download" which just go to more advertising. Good luck finding that tiny link that actually goes to the file you want... but now even that doesn't go to the file you want. Greedy bastards.
Needed to install 7-zip on a windows computer, and was in a hurry, so I went to the first Google result instead of sourceforge. I aborted the install when I saw the "install this great toolbar" button. Still, I almost messed up my friend's computer. Important safety tip #1: Google doesn't always produce the result you really want anymore. Important safety tip #2: when installing open source software, Sourceforge is probably where you want to look.
Haven't they been doing this since like 2005? I remember this site was around forever and always seemed to try to bundle their own stuff with the actual program which is why I never have used them since when they first started.
You never see anything like this from Linux repositories simply because Linux users would never stand for it. Many (maybe most) of the Windows users I know accept malware and crapware as just the unavoidable cost of getting what they need or want in a convenient way.
So it's a cultural thing, and it will take a lot of user education to create a higher level of expectation. The trouble is that I don't see from where the incentive to provide that education is going to come, interests in the MS ecosystem being vested as they are.
The problem with the newer wrapper is that it is detected by a lot of AVs now causing the downloads to fail completely as long as the AV is working properly. And yes, there are still some times when download.com is the main or only download site for a program.
If you do manage to get it downloaded, read what options you are selecting, these are all opt OUT options, just like every other company that decided bundling shit is the best way to make money.
I am shocked that the number of nmap users who are also download.com users would be significant.
I've downloaded a bunch of things in the last 5mo, I've yet to see an installer. Maybe it's region based? Because when I'm in Canada I've never seen it, and I'll bet the majority that have are in the US.
Om, nomnomnom...
If enough people did it, users would get slapped with an "unsafe malware site" warning for any visit via google. Firefox and chrome would show a big red page of death before bringing the user there.
Is this different from the links you see on some of these sites with links in big fonts "Download Here!" that are for an unrelated piece of crap while the link for the software you actually want is hidden in smaller font lower in the page?
I used to work for VersionTracker, and it was such a disappointment when our small company was bought up by CNet. That place is a travesty.
Stuff like this is why people are scared to install native apps for Windows. On iOS, you install apps safely, and with about 2 or 3 taps. On Windows, you get apps via 30 clicks, and you get your browser configuration screwed up, unwanted toolbars, and bonus adware for good measure.
This is the sick, sad state of Windows apps.
The Windows 8 app store promises to address these concerns. We'll see how they deliver.
Tech, life, family, faith: Give me a visit
So if c/net download.com has infected your PC, how do you recover? Will normal anti-virus or anti-malware undo the damage?
Does it show up in the uninstaller?
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Didn't CBS recently buy CNet?
Coder's Stone: The programming language quick ref for iPad
This has been going on for over 10 years. It became nearly impossible to find crapware free utilities, and that's one of the reasons I stopped using windows as an OS.
So I'd missed this in CNet's little news and updates for our products. I'm removing our products from download.com. They only make up a small proportion of our downloads, and as far as I can see an even smaller proportion of conversions. I'd prefer to have our customers coming directly to us, where they get a clean installer with no bundled crap.
They used to have a prominent banner when downloading which said something to the affect of "Guaranteed Spyware Free" I don't see that message anymore.
Those of us who are long-time Mac users have a grudge against CNET for destroying VersionTracker.com. It used to be the best source for Mac software, before CNET bought it out.
Within a very short time, CNET had castrated VersionTracker.com. Now the decent but not quite as good MacUpdate.com is just about the only trustworthy site for Mac software that doesn't make it into the App Store (IOW, all the good stuff).
Nope. Not legally that I know of. But that's the problem of content today, right?
Tell ya what - anyone else who posts a legal example non-US service I'll add it to my notes. Otherwise that was all I could do.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Don't the software licenses forbid this?