Cnet Apologizes For Nmap Adware Mess

Trailrunner7 writes "Officials at Cnet's Download.com site have issued a statement apologizing for bundling the popular open source Nmap security audit application with adware that installed a toolbar and changed users' search engine to Microsoft properties. Fyodor, the author of Nmap, raised the issue earlier this week, saying that his app was being wrapped in malware on Download.com. It's not unusual for download sites to bundle free applications with some kind of adware or toolbar, but the creators of open-source applications take a dim view of this practice, given the nature and ethic of open source projects. Nmap is a venerable and widely used tool for mapping networks and performing security audits and Fyodor wrote in a message to an Nmap mailing list earlier this week that Download.com, which is part of Cnet, a subsidiary of CBS Interactive, was bundling the application with its installer, which, if a user agreed, would install a search toolbar and change the user's search engine to Bing."

Comments

Perfect american corporate business practice

[unity100]

Do some shady/shitty dealing and make big money. Then apologize for the mess you have caused. IF thats not enough and you get sued, pay some reparations which is ridiculously low compared to your profits.

This cycle is what is driving the society down under. What BP did, what Lockheed did, what intel did. im sure you know about what bp did last year - killed an entire ecosystem. you may also know about intel's bribery case with pc manufacturers. but you probably dont know what lockheed did - they have bribed nato country defense ministers to buy f104s over more capable aircraft. as a result numerous things happened, including, approx 600 nato pilots dying due to design deficiencies (it had a tendency to maul its tail on landing and take off - hence nicknamed flying coffin) over the years, british and other european aerospace industries died.

what happened ? lockheed was sued, then admitted to bribery, apologized, paid pathetic sums.

unless people running corporations AND their shareholders start being held responsible for their doings, these will continue.

Re:Perfect american corporate business practice

[InsightIn140Bytes]

Companies can't murder people. People can. And they're already prosecuted under current laws.

Re:Perfect american corporate business practice

[EdIII]

You can't go after shareholders in a public company. Not all of them. It would kill day trading for one, not that I mind that one bit.

It would make investments nearly impossible. All that would end up happening is they would bypass it with strategic revenue sharing agreements and legal clauses preventing the company from funneling assets and revenue out to other companies.

Making a farmer or teacher responsible for their share in a company they invested partly in for retirement is going too far. They lack the sophistication and access to resources to truly assess risk. Most of that is just long term investment in a big well known company.

Going after mutual funds and pension managers probably won't work well either. How could you ever really know what is going on in a company if it is fraud?

I think it would be more reasonable to strip corporate person hood and limited liability for the executives and any shareholder that is an accredited investor. The accredited investor part is really really iffy for me.

Unless you can really define just how shareholder vigilance is supposed to work without an absolute *ton* of micromanaging and audits on a constant basis. Most companies don't want that. So unless the investor is actively involved on the board of directors I just don't see how it is reasonable for you to assume, "they should have known". All they know is what is in the offering and disclosed. They know their risk, not ongoing operations.

Nail the executives and leave it at that.

Re:Perfect american corporate business practice

[EdIII]

Where does this psychopathic idea that corporate efficiency must be maintained at all cost come from?

You're being shortsighted and practicing reductio ad absurdum.

I never promoted the idea that corporate efficiency must be maintained at all costs. Only that efficiency at some level must be maintained otherwise the cost of the products and services would have to rise commensurately. There has to be a balance, otherwise we are just hurting ourselves.

Companies don't want that? OH NOES we can't have that!

Now you are just adding hyperbole. Companies can't have every single investor visiting the offices, or their lawyers offices, and hiring their own counsel and experts to inspect the financials and conduct audits attempting to find fraud or illegal activity.

They must hire experts. Accredited investors would not be excluded either. Just because you are an MD with a net worth of a couple million dollars meeting the current requirements for exemption under the Securities Act of 1933, does not mean you can walk into a mining company and understand what is wrong and what is right, and what is illegal .

Your hyperbole and reductio ad absurdum aside, corporations are already being monitored under current laws. Obviously, that needs to beefed up a bit, but requiring all investors (think how many that would mean for Exxon) to watch the company is just plain ludicrous. It can't work in the real world without making business so inefficient, it can't operate.

What if you own part of a mutual fund? Is it sufficient to investigate the mutual fund managers? Or must you then perform investigations and audits on the possible hundreds or thousands of investments they have? What if a mutual fund owns part of a different financial instrument?

WHAT IF... WHAT IF... (I get to do hyperbole) somebody that owned part of a mortgage backed security? Would they be required to make sure no lending laws were broken on each loan origination? Would they need to physically inspect each security to verify the possession of the note?

Of course these same companies want to monitor all of our forms of communication and behaviour to (enhance their marketing and) make sure we don't touch their oh so precious IP

More hyperbole. Of course things are not balanced. Not even close. However, this has nothing to do with the specific question at hand......

But we can't have companies watching what they are doing, that would be inefficient.

No. We can have increased regulations, penalties, and monitoring of corporate activities. What we can't have is thousands upon thousands of independent parties doing it at the same time. That would be grossly inefficient to the point that it is no longer possible to operate a viable business.

That's why you can't go after the small investor. What I did say was put the executives (and I implied the board of directors) in prison for long sentences. I have a hard time seeing how proposing that, and sparing the small investor makes me a corporate apologist, which is what your raving character assassination seems to be trying to accomplish.

Is this just for public companies or private?

I got some news for you... every company (with few exceptions) needed an IPO to go public. Before that, they had to raise capital. The proposal to make investors liable would raise the bar so high, that new businesses and small business would have a significant and oft insurmountable barrier to entry.

You have a +5 insightful. That means that your hyperbole has sentiments that many can get behind (including myself) but you need to take a couple of deep breaths and realize that you have to be smart, clear headed, and forward thinking when you come up with better ways to regulate corporations and curtail their sociopathic behaviors that we all hate so much.

Who? What?

[RichardJenkins]

Who would download a tool like nmap from download.com? What sort of person does this? How is this a thing that happens?

Re:Who? What?

[Anonymous Coward]

I work in security for my company, so we keep an eye on unauthorized software in our enterprise. We had a guy just today download PuTTY from a download site,

PuTTY is a very bad example, almost ANY URL sounds more authoritative than the real one.

Working in security, you should expect people to screw this one up and have your sysadmin team deploy/maintain it.

www.chiark.greenend.org.uk/~sgtatham/putty/
*blech*

trust

[Anonymous Coward]

It takes years to earn trust. It takes only one event like this to destroy said trust for good. Up to a year ago, I used download.com where they always proclaimed "Spyware free" etc... That trust has been erased and I will never go back to that site. But really, after they began doing the indirect download using their own downloader, that turned me off right then and there and I stopped about a year ago.

Since it is mentioned prior to installing it

[koan]

Should you be using Nmap if you can't pay enough attention to opt out of installing a toolbar?