Slashdot Mirror
Download.com Bundling Adware With Free Software
Zocalo writes "In a post to the Nmap Hackers list Nmap author Fyodor accuses Download.com of wrapping a trojan installer (as detected by various AV applications when submitted to VirusTotal) around software including Nmap and VLC Media Player. The C|Net installer bundles a toolbar, changes browser settings, and, potentially, performs other shenanigans — all under the logo of the application the user thought they might have been downloading. Apparently, this isn't the first time they have done this, either."
Download.com have always done this... I thought this was how they funded the site.
Can we all agree that downloading free software is stealing from poor programmers who have to live in their mother's basement because they're so poor they cannot even afford their own place? And that as we can read in TFA downloading free software supports criminal activities, and is therefore terrorism? And that this probably means you're a communist child-abusing terrorist?
-- Yes, this was a joke, and no, I don't have a good sense of humor.
Download.com has been funded by bullshit third-party software addons for as long as I can remember. AFAIK, they only recently started this practice of causing the user to download a downloader which would first go through the third-party addons before downloading the actual installer... but it's not like it's any different than before. Yeah, lots of people will just click through and accept everything and that's their fault for not reading things before agreeing to them. Don't blame a free service operated by a for-profit corporation for wanting to make money. Host the Nmap installer yourself if you think it's so easy.
It's rather mindboggling that a decade into the 21st century, people are still going to third party download outfits like this.
Maybe someone wants to enlighten me as to why... I'm not coming up with much.
Sent from my PDP-11
1999 just called. It wants its flagship shareware download repository back.
Seriously, today there are so many better sources to get free stuff (legal or otherwise) than Download.com
Why even bother?
add &dlm=0 to the end of the 'your download is starting' page url..
1 go to a program's page
2. click download now
3. do not download the file that starts cnet_ or cnet2_ (if it doesn't start with cnet it's ok)
4. add the &dlm=0 to the url in the address bar after the spi=whatever junk
enjoy the direct download.. and go to the source next time..or try filehippo or softpedia (either one with your adblocker running)
It's a shame, cnet and download.com used to be moderately safe ways of downloading new trial and freeware software. In my opinion shareware is now an outdated practice, with it now possible to find an open source equivalent for just commercial piece of software.
Rapidshare, for that authentic 90s warez feel.
Not hosting your own files, or torrents for larger stuff, looks about as professional as a hotmail address on a business card.
Can I put the 90s on my 'do not call' list?
I just downloaded nmap and vlc. Both files were identical to what I got from the source.
...'. VLC was still from cnet.com.
Actually,it looks like cnet redirected me to the nmap.org download link (http://nmap.org/dist/nmap-5.51-setup.exe) using a 'META HTTP-EQUIV="Refresh"
I'm not logged in; I wonder if I have a cookie that prevents the wrapper -- or if download.com changed something.
Also, I'm using NoScript and cnet/download.com is not allowed. Perhaps this turns off the wrapper too.
I hold it, that a little rebellion, now and then, is a good thing. -- Thomas Jefferson
That's what I finally had to do, when some entity (might've been download.com, might've been someone else) offered an alternative download location for my software - which bundled some sort of malware installer onto my software. After one attempt to remove them as an alternate, I was told I could request my software be removed, and that's what I did. This occurred back in 2004.
This extremely common practice of bundling garbage with every download is the cancer that is killing Windows freeware, and no, it's not limited to Download.com.
A while ago, when I was in-between jobs and looking for some freelance work, I stumbled upon an entire "community" of scammers known as PPI : Pay-Pay-Install. This forum was all about participating in these shady bundling practices, discussing the advertisers that were most tolerant to things like silent installs, home page swaps, BHO's that redirect your Google searches through a proxy (to hijack ad revenue), Vista sidebar widgets, toolbars, bookmarks, and start-up items, along with uploading deceptively named and heavily trojaned stuff via P2P. This is why, with every goddamned Windows utility you get these days, you get prompted to installt he Ask.com toolbar, BonziBuddy, free trials for McAfee's swiss cheese, and a laundry list of other standards.
CNet should indeed be made an example of, and burned to the ground, but they didn't start this gangbang, the advertisers did. Follow the money... There is no reason why users should tolerate this aberrant behaviour.
-Billco, Fnarg.com
"If we warn the past about an event like 9/11, and they actually DO something about it, what happens then? Would the American government spin it even further out of proportion, claiming the attacks would have used nukes and biological weapons? There's no way of knowing for certain.
We know what we have: A world that is worse off than before, yes, but not on the brink of having the planet destroyed. With the possibility that we could make things a lot worse and start World War III, is is really sensible to send messages back in time?"
Family Guy did that exact plot.
Here is the Hulu Link. Your Country May Vary.
http://www.hulu.com/watch/299685/family-guy-back-to-the-pilot#s-p1-so-i0
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
While this has been normal practice for shady rippoff sites like the ones mentioned for almost a decade, I do wonder if appropriate extensions to FOSS licences such as the GPL could actually prevent this. Or at least make the culprits liable for damages, copyright infringement and/or fraud.
If I were to work on a large FOSS project I would like to know that the software im contributing to doesn't legally end up on one of these fraudulent DL sites.
My 2 cents.
We suffer more in our imagination than in reality. - Seneca
And do you have something not United States Only?
-=This sig has nothing to do with my comment. Move along now=-
I'm part of the ScummVM group, a cross platform software for playing various classic adventure games, and the question of Download.com came up when we released the next version of our software. There were some arguments for including it on such sites, such as giving greater visibility to the project. However, the issue of the bundled 'crapware' was considered too big a downside. We weren't that desperate for wider coverage of our software, and we certainly didn't want people to adversely associate our software with malware.
These days I wouldn't touch download.com even if you paid me.
It's bad enough without the malware. If you're trying to download a 40kB file, they make you download a MB of ads, and you have to navigate through half a dozen links to "Download" which just go to more advertising. Good luck finding that tiny link that actually goes to the file you want... but now even that doesn't go to the file you want. Greedy bastards.
Needed to install 7-zip on a windows computer, and was in a hurry, so I went to the first Google result instead of sourceforge. I aborted the install when I saw the "install this great toolbar" button. Still, I almost messed up my friend's computer. Important safety tip #1: Google doesn't always produce the result you really want anymore. Important safety tip #2: when installing open source software, Sourceforge is probably where you want to look.
Since your to lazy, here;
C|Net is adding trojans to the installer.
C|Net is in violation of the Nmap license.
So exactly who is winning here?
My karma is not a Chameleon.
The downside is that CNet is deliberately preying on users' ignorance and installing software they don't want as well.
I fully believe users should take responsibility for what they install on their systems by at least looking at what they're installing but that doesn't preclude companies from leaving that crap out in the first place.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
Software creator's good name is tarnished because people installed their software and got malware as a result. Not good.
People get malware, period. Also not good.
Assuming you are seriously asking and don't have your toung in your cheek: the key downside is that people will associate the trojan with your product, if they don't like the changes it makes to their systems they might blame you not cnet.
You never see anything like this from Linux repositories simply because Linux users would never stand for it. Many (maybe most) of the Windows users I know accept malware and crapware as just the unavoidable cost of getting what they need or want in a convenient way.
So it's a cultural thing, and it will take a lot of user education to create a higher level of expectation. The trouble is that I don't see from where the incentive to provide that education is going to come, interests in the MS ecosystem being vested as they are.
I am shocked that the number of nmap users who are also download.com users would be significant.
I've downloaded a bunch of things in the last 5mo, I've yet to see an installer. Maybe it's region based? Because when I'm in Canada I've never seen it, and I'll bet the majority that have are in the US.
Om, nomnomnom...
Stuff like this is why people are scared to install native apps for Windows. On iOS, you install apps safely, and with about 2 or 3 taps. On Windows, you get apps via 30 clicks, and you get your browser configuration screwed up, unwanted toolbars, and bonus adware for good measure.
This is the sick, sad state of Windows apps.
The Windows 8 app store promises to address these concerns. We'll see how they deliver.
Tech, life, family, faith: Give me a visit
So if c/net download.com has infected your PC, how do you recover? Will normal anti-virus or anti-malware undo the damage?
Does it show up in the uninstaller?
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Didn't CBS recently buy CNet?
Coder's Stone: The programming language quick ref for iPad
This has been going on for over 10 years. It became nearly impossible to find crapware free utilities, and that's one of the reasons I stopped using windows as an OS.
They used to have a prominent banner when downloading which said something to the affect of "Guaranteed Spyware Free" I don't see that message anymore.
Fair enough, I did not read the analysis by NMap, I admit that. :) Not understanding the stupid part or the seething hate but that's a different story.
Having read the analysis and then went perusing though CNet, I found this interesting bit on the vendor upload side: CNET DOWNLOAD.COM INSTALLER FREQUENTLY ASKED QUESTIONS.
See Stumbles, rather than just assume that CNet had an altruistic reason for providing a software repository, I assumed there would be a catch (in life there ALWAYS is a catch). In this case they clearly provide to both end-user and vendor the reason for the installer and the foreknowledge that they will be adding a piece of pre-screened software along with the install.
So in this case, the vendor, NMap, perhaps should have read the terms and conditions a bit more carefully. I know I certainly do before I enter any transaction.
Regards,
MBC1977,
Those of us who are long-time Mac users have a grudge against CNET for destroying VersionTracker.com. It used to be the best source for Mac software, before CNET bought it out.
Within a very short time, CNET had castrated VersionTracker.com. Now the decent but not quite as good MacUpdate.com is just about the only trustworthy site for Mac software that doesn't make it into the App Store (IOW, all the good stuff).
Nope. Not legally that I know of. But that's the problem of content today, right?
Tell ya what - anyone else who posts a legal example non-US service I'll add it to my notes. Otherwise that was all I could do.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine