Cnet Apologizes For Nmap Adware Mess

Trailrunner7 writes "Officials at Cnet's Download.com site have issued a statement apologizing for bundling the popular open source Nmap security audit application with adware that installed a toolbar and changed users' search engine to Microsoft properties. Fyodor, the author of Nmap, raised the issue earlier this week, saying that his app was being wrapped in malware on Download.com. It's not unusual for download sites to bundle free applications with some kind of adware or toolbar, but the creators of open-source applications take a dim view of this practice, given the nature and ethic of open source projects. Nmap is a venerable and widely used tool for mapping networks and performing security audits and Fyodor wrote in a message to an Nmap mailing list earlier this week that Download.com, which is part of Cnet, a subsidiary of CBS Interactive, was bundling the application with its installer, which, if a user agreed, would install a search toolbar and change the user's search engine to Bing."

Comments

Perfect american corporate business practice

[unity100]

Do some shady/shitty dealing and make big money. Then apologize for the mess you have caused. IF thats not enough and you get sued, pay some reparations which is ridiculously low compared to your profits.

This cycle is what is driving the society down under. What BP did, what Lockheed did, what intel did. im sure you know about what bp did last year - killed an entire ecosystem. you may also know about intel's bribery case with pc manufacturers. but you probably dont know what lockheed did - they have bribed nato country defense ministers to buy f104s over more capable aircraft. as a result numerous things happened, including, approx 600 nato pilots dying due to design deficiencies (it had a tendency to maul its tail on landing and take off - hence nicknamed flying coffin) over the years, british and other european aerospace industries died.

what happened ? lockheed was sued, then admitted to bribery, apologized, paid pathetic sums.

unless people running corporations AND their shareholders start being held responsible for their doings, these will continue.

Re:Perfect american corporate business practice

[InsightIn140Bytes]

Companies can't murder people. People can. And they're already prosecuted under current laws.

Re:Perfect american corporate business practice

[MightyMartian]

Still, I'm thinking that in cases of gross negligence, stripping away corporate personhood and limited liability and making shareholders pay directly would certainly increase shareholder vigilance over the going's on of companies they're investing in. Imagine if BP's shareholders were directly sent a bill in proportion to the size of the Gulf cleanup. I'm thinking BP shareholders would probably be a bit more proactive in assuring the company management behaved themselves.

Re:Perfect american corporate business practice

[Hatta]

They distributed nmap in a manner inconsistent with its licensing, running afoul of copyright law. They should be forced to pay applicable statutory damages.

Re:Perfect american corporate business practice

[EdIII]

You can't go after shareholders in a public company. Not all of them. It would kill day trading for one, not that I mind that one bit.

It would make investments nearly impossible. All that would end up happening is they would bypass it with strategic revenue sharing agreements and legal clauses preventing the company from funneling assets and revenue out to other companies.

Making a farmer or teacher responsible for their share in a company they invested partly in for retirement is going too far. They lack the sophistication and access to resources to truly assess risk. Most of that is just long term investment in a big well known company.

Going after mutual funds and pension managers probably won't work well either. How could you ever really know what is going on in a company if it is fraud?

I think it would be more reasonable to strip corporate person hood and limited liability for the executives and any shareholder that is an accredited investor. The accredited investor part is really really iffy for me.

Unless you can really define just how shareholder vigilance is supposed to work without an absolute *ton* of micromanaging and audits on a constant basis. Most companies don't want that. So unless the investor is actively involved on the board of directors I just don't see how it is reasonable for you to assume, "they should have known". All they know is what is in the offering and disclosed. They know their risk, not ongoing operations.

Nail the executives and leave it at that.

Re:Perfect american corporate business practice

[Requiem18th]

Where does this psychopathic idea that corporate efficiency must be maintained at all cost come from?

work without an absolute *ton* of micromanaging and audits on a constant basis. Most companies don't want that.

Companies don't want that? OH NOES we can't have that!

Of course these same companies want to monitor all of our forms of communication and behaviour to (enhance their marketing and) make sure we don't touch their oh so precious IP.But we can't have companies watching what they are doing, that would be inefficient.

Re:Perfect american corporate business practice

[fv]

But they didn't do anything illegal. They're basically just using their own download application that comes with extra stuff.

Yes, but Download.com still assures users that they will never bundle that "extra stuff". Their Adware & Spyware Notice says:

In your letters, user reviews, and polls, you told us bundled adware was unacceptable--no matter how harmless it might be. We want you to know what you're getting when you download from CNET Download.com, and no other download site can promise that.

Also, they make it look like a download link for the real installer (which it used to be), and then the user gets this CNET crap. But they still used our name liberally in the trojan installer as if we were somehow responsible for or involved in this abomination. I've got screen shots on my Download.com fiasco page.

Also, this "apology" rings hollow because they aren't fixing the problem along with it. In particular:

1) He claims that bundling malware with Nmap was a “mistake on our part” and “we reviewed all open source files in our catalog to ensure none are being bundled.” Either that is a lie, or they are totally incompetent, because tons of open source software is still being bundled. You can read the comments below his post for many examples.

2) Even if they had removed the malware bundling from open source software, what about all of the other free (but not open source) Windows software out there? They shouldn't infect any 3rd party software with sketchy toolbars, search engine redirectors, etc.

3) At the same time that Sean sent the “apology” to users, he sent this very different note to developers. He says they are working on a new expanded version of the rogue installer and “initial feedback from developers on our new model has been very positive and we are excited to bring this to the broader community as soon as possible”. He tries to mollify developers by promising to give them a cut (“revenue share”) of the proceeds from infecting their users.

4) You no longer need to register and log in to get the small (non-trojan) “direct download” link, but the giant green download button still exposes users to malware.

5) The Download.Com Adware & Spyware Notice still says “every time you download software from Download.com, you can trust that we've tested it and found it to be adware-free.” How can they say that while they are still adding their own adware? At least they removed the statement from their trojan installer that it is “SAFE, TRUSTED, AND SPYWARE FREE”.

Re:Perfect american corporate business practice

[EdIII]

Where does this psychopathic idea that corporate efficiency must be maintained at all cost come from?

You're being shortsighted and practicing reductio ad absurdum.

I never promoted the idea that corporate efficiency must be maintained at all costs. Only that efficiency at some level must be maintained otherwise the cost of the products and services would have to rise commensurately. There has to be a balance, otherwise we are just hurting ourselves.

Companies don't want that? OH NOES we can't have that!

Now you are just adding hyperbole. Companies can't have every single investor visiting the offices, or their lawyers offices, and hiring their own counsel and experts to inspect the financials and conduct audits attempting to find fraud or illegal activity.

They must hire experts. Accredited investors would not be excluded either. Just because you are an MD with a net worth of a couple million dollars meeting the current requirements for exemption under the Securities Act of 1933, does not mean you can walk into a mining company and understand what is wrong and what is right, and what is illegal .

Your hyperbole and reductio ad absurdum aside, corporations are already being monitored under current laws. Obviously, that needs to beefed up a bit, but requiring all investors (think how many that would mean for Exxon) to watch the company is just plain ludicrous. It can't work in the real world without making business so inefficient, it can't operate.

What if you own part of a mutual fund? Is it sufficient to investigate the mutual fund managers? Or must you then perform investigations and audits on the possible hundreds or thousands of investments they have? What if a mutual fund owns part of a different financial instrument?

WHAT IF... WHAT IF... (I get to do hyperbole) somebody that owned part of a mortgage backed security? Would they be required to make sure no lending laws were broken on each loan origination? Would they need to physically inspect each security to verify the possession of the note?

Of course these same companies want to monitor all of our forms of communication and behaviour to (enhance their marketing and) make sure we don't touch their oh so precious IP

More hyperbole. Of course things are not balanced. Not even close. However, this has nothing to do with the specific question at hand......

But we can't have companies watching what they are doing, that would be inefficient.

No. We can have increased regulations, penalties, and monitoring of corporate activities. What we can't have is thousands upon thousands of independent parties doing it at the same time. That would be grossly inefficient to the point that it is no longer possible to operate a viable business.

That's why you can't go after the small investor. What I did say was put the executives (and I implied the board of directors) in prison for long sentences. I have a hard time seeing how proposing that, and sparing the small investor makes me a corporate apologist, which is what your raving character assassination seems to be trying to accomplish.

Is this just for public companies or private?

I got some news for you... every company (with few exceptions) needed an IPO to go public. Before that, they had to raise capital. The proposal to make investors liable would raise the bar so high, that new businesses and small business would have a significant and oft insurmountable barrier to entry.

You have a +5 insightful. That means that your hyperbole has sentiments that many can get behind (including myself) but you need to take a couple of deep breaths and realize that you have to be smart, clear headed, and forward thinking when you come up with better ways to regulate corporations and curtail their sociopathic behaviors that we all hate so much.

Re:Perfect american corporate business practice

[WorBlux]

"I got some news for you... every company (with few exceptions) needed an IPO to go public. Before that, they had to raise capital. The proposal to make investors liable would raise the bar so high, that new businesses and small business would have a significant and oft insurmountable barrier to entry."

That's not the only way business can operate. Check out the Mondragon Corporation.

In addition liability would be managed the same way to manage it in the same way as a sole proprietorship. You buy liability insurance, the cost of which is roughly proportional to the perceived risks that current management policies are taking. Any company that represents more than a token amount of stockholders could analyze the records (any insurer below that would have to cooperate with other insurers to get info), which would reduce the inspections to a manageable level.

You've set up a false dichotomy between everyone regulating a corporation for themselves and government regulating corporations for everybody. There is a middle ground and room for market mechanisms to solve the problem. Of course you want a reasonable bottom level the government assures, but complex industry-specific regulation often fails due to regulatory capture, and the fact regulators lack the implicit knowledge necessary to manage the risk.

Externalizing the costs of failed corporations onto the public at large is destructive, unfair, rife with moral hazard, and favors the established players over everyone else. The original point of the corporation was to promote public works such as roads, schools, dams and canals, and not to protect the profiteering of a relative few.

Who? What?

[RichardJenkins]

Who would download a tool like nmap from download.com? What sort of person does this? How is this a thing that happens?

Re:Who? What?

[Anonymous Coward]

I work in security for my company, so we keep an eye on unauthorized software in our enterprise. We had a guy just today download PuTTY from a download site,

PuTTY is a very bad example, almost ANY URL sounds more authoritative than the real one.

Working in security, you should expect people to screw this one up and have your sysadmin team deploy/maintain it.

www.chiark.greenend.org.uk/~sgtatham/putty/
*blech*

trust

[Anonymous Coward]

It takes years to earn trust. It takes only one event like this to destroy said trust for good. Up to a year ago, I used download.com where they always proclaimed "Spyware free" etc... That trust has been erased and I will never go back to that site. But really, after they began doing the indirect download using their own downloader, that turned me off right then and there and I stopped about a year ago.

Too little.

[Capt.DrumkenBum]

Too late.
They should not have done it in the first place, and I will be looking elsewhere for my downloads.

Re:Too little.

[DarwinSurvivor]

So YOU are the one that actually used that site! Of all the times not to post as AC....

Since it is mentioned prior to installing it

[koan]

Should you be using Nmap if you can't pay enough attention to opt out of installing a toolbar?

Typical corporate mindset...

[Hamsterdan]

They're not sorry about the bundled *extras*, they're sorry they *got caught*...

precisely that

[unity100]

Making a farmer or teacher responsible for their share in a company they invested partly in for retirement is going too far. They lack the sophistication and access to resources to truly assess risk.

we are allowing people to reap benefits from things they cannot understand, fathom or use. and naturally, we are not holding them responsible from what they can not comprehend.

waiver of responsibility. no different from having to slap warnings against putting your cat in the oven on appliances. people dumber than the minimum requirement of systems and technologies we have in our modern day are using them.

long story short - whomever invests in something should be responsible with their investment. this may kill capitalism ? oh well.

Re:precisely that

[EdIII]

Your position is not reasonable.

It's like holding the landlord responsible if the tenant murders somebody on the property. Is it reasonable to assume that the landlord would have known about the murder to take place, assuming it is premeditated? Is it reasonable to assume responsibility for crimes of passion?

No small unaccredited investor purchases stock in a company expecting it to perform fraud, and you cannot reasonably hold them accountable for actions that are essentially unknowable.

Your solution raises the barrier to entry for stock ownership so high that only accredited investors and investment gateways (Wall Street investment firms) could meet them.

It will kill capitalism, which is your intent.

Either provide a reasonable solution, like holding the executives and board members personally and criminally liable for fraud, or just admit you want to replace capitalism and the stock market entirely.

Sorry, your position is just not reasonable in any way, shape, or form. Your analogies are false. There is a difference between personal responsibility with a hot coffee cup and indirect fraudulent actions that you have no way of knowing. If the average person did, then so would the authorities, and it would be stopped.

   

Re:precisely that

[Whibla]

The purpose of the markets is to match people who have surplus capital with those (allowing for the dubious state of companies as people) who have need of it. The lower the barrier to market entry the more readily available capital becomes, allowing companies to access it and use it, hopefully productively. Now, the majority of investors are already likely to carry out some form of oversight before directly investing in a company, through the purchase of shares or what have you, and while most of this oversight is likely to be financially directed - is this a good investment, am I likely to financially profit from this exchange - many people also already include an ethical element to their investment decisions - are the company's business practices reputed to harm the environment, do they manufacture 'bad' (tm) things. Holding individual investors to a higher level of oversight and responsibilty than this is not only not practical it would directly damage the main advantage of a free market, namely the free flows of capital.

As a side note, there is a huge difference between the idea of the (free) market and capitalism per se. Conflating the two does not help in clarifying specific objections to one or the other.

One 'direct' example of the market in action is your bank. You put your savings in the bank, (originally) on the assumption that you will see a small return on that capital, in the form of interest, and the bank, acting as a middle man / broker, lends that money to someone that needs it. This is both a purer form of matching lender to borrower and a more remote one in the fact that you as the lender have no direct say as to the destination of your 'loan'. You are of course free to chose your bank, but, in this day and age the only sure way of ensuring your bank is ethical would be, amongst many other things, if they do not engage in any counter party trades, do not sell stocks and shares isa's, and own no share portfolio of their own. I'm not sure if that would make for a financially viable business as a bank, or merely make them a credit union with a severely restricted remit. Anyway, I get away from the point I was trying to make...

long story short - whomever invests in something should be responsible with their investment.

I'm going to assume you have a bank account. Are you claiming (partial) responsibility for the millions of people who lost their homes / livelihoods / sanity in the recent debacle with the selling, mis-selling, and reselling of sub-prime mortgages? After all, it was your money that was lent to these people that allowed them to buy their homes in the first place, even if they were mis-sold. If so, what penalty should be exacted on you for this crime (and as far as 'evil' acts go this was as large a crime against humanity as any other I can think of in western so called democracies in recent times)? And if not, why not...why are you not being held resposible and accountable for the evils done with your money?

Re:DMCA Takedown anyone?

[alexo]

Or if PIPA or SPA were law, he could have tried to seize the domain "download.com"

The notion that the same laws apply to both the lords and the serfs is quaint but misguided.