phorm, the isp-side adware/spyware technology being tested out in the UK, has been getting a lot of attention in the press for the past couple of weeks... on reading the description of it on the f-secure blog i got to thinking about why exactly this sort of advertising is so bad...
leaving aside the question of all the company's past bad acts (which i know is important but i'm focusing on the type of advertising, not this particular instance) and the isp-side implementation (and all the consequences that has for informed consent), i want to look at just the basic idea of targeting ads based on where a user has browsed in the past...
obviously this requires tracking the user's activities and adware companies will no doubt try to assuage our privacy fears by claiming they don't keep identifying information... for my purposes i'm going to assume they live up to their word, regardless of how unlikely that may seem... my contention is that simply displaying ads based on past browsing behaviour represents a privacy breach because we very often don't use our computers in a vacuum...
what do i mean by that? let's consider the scenario of the road warrior employee... he (or she) has a laptop they take with them on the road and most likely also take home with them... chances are good they will do some personal browsing at some point... chances are also good that at some point they're going to come back into the office and turn on their computer... what happens then is that their co-workers or perhaps even their boss may see ads linked to browsing they were doing while in the privacy of their own home... maybe the ads are of an adult nature (porn), maybe they're of an immature nature (cartoons), or maybe they reveal employment intentions the employee isn't prepared to share with their boss (why are there ads for monster.com on your computer?)...
of course there are those who would say that such an employee shouldn't be doing private browsing on the work computer anyways (ignoring the possibility that they're actually doing work on their own personal laptop - something that can happen in smaller companies) so how about a more reasonable scenario... lets say you're a single guy browsing the web the way single guys do... lets further say you get a new girlfriend and she comes over to spend time with you... at some point she may ask to use your computer to check her webmail because she's been staying over quite a bit and hasn't been home in a while... you concede because letting her use your computer is the least you can do for her considering all the time the two of you have been spending together... then she sees the ads linked to your past browsing behaviours and stops coming over and doesn't return your calls anymore... alternatively, perhaps you're over at her place fairly often and all of a sudden dating site ads start showing up on her computer...
accurately targeted ads are a wet dream for the advertising industry - their efforts would be so much better received and have so much more impact if only they could get the right ads in front of the right people at the right time... developing sophisticated profiles based on past usage makes a certain amount of sense in that context... unfortunately, when it comes to computer use it's pretty much impossible to accurately tell who's looking at the screen, so there's a very real risk of revealing things about people and what has meaning to them to the people around them if your ad targeting is based on anything other than what the user is doing right this instant... you cannot capitalize on knowledge of the user through ad targeting without revealing that knowledge to the user and possibly others as well...
when people can start inferring things about you based on ads targeted at you then then the ads themselves represent a privacy breach, regardless of what personal information the ad company may or may not be keeping... the more accurate the targeting the more likely you are to breach the user's privacy... the more you try to protect the user's privacy by throwing random ads into the mix, the less accurate the targeting becomes and the less impact the ads have because they get buried amongst garbage ads...
advertising is big (and arguably legitimate) business, but those considering the kind of optimization that phorm or really any kind of targeted ad serving represents should be aware of these kinds of less obvious privacy implications...
Showing posts with label adware. Show all posts
Showing posts with label adware. Show all posts
Sunday, April 20, 2008
Tuesday, July 17, 2007
microsoft's anti-malware ethical conflict
regular readers can probably recall me saying that anti-virus companies don't hire virus writers on occasion... i've called the notion that anti-virus companies are paying for the creation of viruses an urban myth because it would just be too hard to keep that sort of thing secret from their competitors and if their competitors found out about it they'd use it to hurt the company and free up some of it's market share for themselves... each company acts as a watchdog for the others, waiting to blow the whistle on ethical misconduct and in this way they actually help to keep each other honest...
now you'd think this same principle would work for other forms of malware besides viruses, but as i've shown in the past (here and here) that's not always the case... still, it should probably come as a surprise that microsoft, after sinking untold amounts of resources into entering the anti-malware market, has filed for patents on adware/spyware technology... no, not anti-adware/anti-spyware technology, literally technology to serve you ads (adware) based on the contents of your hard drive (spyware)...
so not only does microsoft have conflict where their anti-malware software may prove a disincentive to fixing vulnerabilities in their other software (not to mention that they're charging you money to protect against threats exploiting flaws in their other software) but now they have an ethical conflict where they're considering producing malware and anti-malware at the same time... apparently some of the PHBs at microsoft haven't gotten the memo yet about the new ethical constraints of the company now that it produces anti-malware software... let me put it as bluntly as possible: if you're going to be an anti-malware company you have to be anti-malware... that means no malware creation or malware-based revenue for you...
i, for one, would neither feel comfortable using nor endorsing the use of anti-malware software produced by an entity that ever seriously considered producing malware, never mind one that did so while producing the anti-malware in question at the same time...
now you'd think this same principle would work for other forms of malware besides viruses, but as i've shown in the past (here and here) that's not always the case... still, it should probably come as a surprise that microsoft, after sinking untold amounts of resources into entering the anti-malware market, has filed for patents on adware/spyware technology... no, not anti-adware/anti-spyware technology, literally technology to serve you ads (adware) based on the contents of your hard drive (spyware)...
so not only does microsoft have conflict where their anti-malware software may prove a disincentive to fixing vulnerabilities in their other software (not to mention that they're charging you money to protect against threats exploiting flaws in their other software) but now they have an ethical conflict where they're considering producing malware and anti-malware at the same time... apparently some of the PHBs at microsoft haven't gotten the memo yet about the new ethical constraints of the company now that it produces anti-malware software... let me put it as bluntly as possible: if you're going to be an anti-malware company you have to be anti-malware... that means no malware creation or malware-based revenue for you...
i, for one, would neither feel comfortable using nor endorsing the use of anti-malware software produced by an entity that ever seriously considered producing malware, never mind one that did so while producing the anti-malware in question at the same time...
Friday, May 26, 2006
does µTorrent contain adware / spyware?
i recently became aware some controversy over the possibility that the popular bittorrent client µTorrent contains adware and/or spyware...
there are a number of threads on the µTorrent forums about so i thought i'd use this an an object lesson in how to make these determinations for yourself - and as an added bonus, we're going to do it without even downloading the software...
we can do that by looking at what the software's author had to say about the issue here...
the interesting thing (at least to me) is that there is no 3rd party adware client software - the ad-serving functionality is built by the same person(s) who built the µTorrent client... it's an option i didn't cover in my post about software developers who go the adware route but it's an important one none-the-less... if a software developer finds s/he needs ad revenue, creating the ad serving engine in-house is an excellent way to avoid the pitfalls of potentially nefarious behaviour from 3rd party adware clients... a software developer has the potential to offer users a far more benign adware client if they go this route than if they just accept whatever some 3rd party hands them...
unfortunately that potential seems to be lost in this case... for one thing, the ad-supported nature is not disclosed on the front page of the site nor on the download page - probably because the author doesn't want to admit that it's adware (just because you make it yourself doesn't mean it's not adware)... potential users need to be informed about this sort of thing, they need to be able to make an informed decision about whether they want to install software that displays ads before they download and install it... not disclosing it (whether one is in denial or for some other reason) is a breach of good faith...
the other thing that negates it's potential to be benign is the spyware issue...
there are a number of threads on the µTorrent forums about so i thought i'd use this an an object lesson in how to make these determinations for yourself - and as an added bonus, we're going to do it without even downloading the software...
we can do that by looking at what the software's author had to say about the issue here...
“Nothing is placed on the user's machine [when the NanoTorrent browser opens,]” Ludvid explains. “It's an advertisement inside the web browser only, the ad comes from a webserver owned by me, and it's removed when the window is closed. No cookies at all are installed, not even my own…The ads are generated by the script on the webserver. The µTorrent client as such does not contain any ads. They are generated by the webserver and shown through a php script to the webbrowser when the user searches.”so it does in fact display ads - and not just by accident, the browser is directed to his own site to display ads hosted there... the fact that the ads are not contained in the bittorrent client is not really an issue - adware doesn't need to contain the ads it displays, it just needs to display ads... the fact that the client isn't actually displaying the ads in a window that's part of the client itself but instead uses a browser window is also not really an issue, plenty of adware uses browser windows to display their ads (it saves them from having to reinvent the wheel)...
the interesting thing (at least to me) is that there is no 3rd party adware client software - the ad-serving functionality is built by the same person(s) who built the µTorrent client... it's an option i didn't cover in my post about software developers who go the adware route but it's an important one none-the-less... if a software developer finds s/he needs ad revenue, creating the ad serving engine in-house is an excellent way to avoid the pitfalls of potentially nefarious behaviour from 3rd party adware clients... a software developer has the potential to offer users a far more benign adware client if they go this route than if they just accept whatever some 3rd party hands them...
unfortunately that potential seems to be lost in this case... for one thing, the ad-supported nature is not disclosed on the front page of the site nor on the download page - probably because the author doesn't want to admit that it's adware (just because you make it yourself doesn't mean it's not adware)... potential users need to be informed about this sort of thing, they need to be able to make an informed decision about whether they want to install software that displays ads before they download and install it... not disclosing it (whether one is in denial or for some other reason) is a breach of good faith...
the other thing that negates it's potential to be benign is the spyware issue...
The latest version of µTorrent, version 1.5, contains an integrated search feature. The end user can opt to search several of the major search engines, such as Mininova, ThePirateBay, TorrentSpy, and isoHunt. Once the search is conducted, an independent browser window is opened. Instead of going to the Mininova.org domain however, the browser is directed to NanoTorrent.com.that basically tells me that my search queries are being sent somewhere other than the search engine they were intended for... oh, they get to their intended destination eventually, but not before going through a middle-man first... we're assured that the information is not collected or used in any way, but that's not the point (nor is it something we can verify)... spyware isn't spyware because the information it gives a 3rd party is abused, it's spyware because it gives a 3rd party (in this case nanotorrent.com, owned and operated by the same guy) your information (in this case your search queries)... personally, i would rather my search queries not go through middle-men - not because i search for things that i'd be ashamed to let others know about but rather purely on the basis of principle - what i search for is between me and my search engine of choice...
Wednesday, April 12, 2006
what is a popup?
a popup is a (usually small) window that opens (pops up) overtop of other windows...
popups are generally associated with advertizing however windows that open up overtop of other windows are common place in other contexts such as error messages, notification messages, etc..
there are a number of different popup types:
windows messaging service popups are popups that come in through the windows messaging service (not to be confused with the msn messenger client)... these are simple looking, text-only dialogs... these can be completely disabled by disabling the windows messaging service or blocking (or simply not forwarding) ports 135-139, and 445 at the firewall (or not allowing the windows messaging service to act as a server if you're using a software firewall)...
web browser content popups are additional (and sometimes frameless) browser windows that are launched by your browser running scripts or other active content like flash or activex on web pages that you visit... modern browsers like firefox have built-in popup blocking capability meant to deal with these types of popups but depending on the sophistication the built-in measures may not work against all of them...
3rd party software popups are popups generated by some software installed on your system (often some form of adware)... often the popups will be browser windows in order to show web-based ads with all the graphics and multimedia we've seen time and again on the web... these can be avoided by not installing the 3rd party software in the first place, but if you do install then to stop the popups you'll have to remove the 3rd party software and in the case of 3rd party advertising software that's not always an easy task and often requires specialized removal software...
notification message popups are small, often text-only windows that pop up from the lower right hand corner (just above the system tray)... these are often to notify the user of some event, like a new email arriving or a instant messaging contact coming online... they can also be used to notify the user that there's a new advertisement for him/her to look at... this is a second, somewhat less obtrusive form of 3rd party software popup and must be dealt with in the same way...
the problem with popups is that they take up part of the screen, covering part or all of the work area of other windows/applications (even the notification message popups cover part of the screen when they appear)... this has the potential to interfere with the work the user is doing by covering an area s/he was using... when the popup is about something important, some option the user has to choose to continue a process they're involved in, some error condition, some event the user is actually interested in, etc. then the fact that it's covering up part of the user's work area is accepted - however when it's for advertising, the covering up of (even a small amount of) work area is almost universally not accepted because advertisements are just not important enough to justify interrupting what the user would have otherwise been doing...
back to index
popups are generally associated with advertizing however windows that open up overtop of other windows are common place in other contexts such as error messages, notification messages, etc..
there are a number of different popup types:
windows messaging service popups are popups that come in through the windows messaging service (not to be confused with the msn messenger client)... these are simple looking, text-only dialogs... these can be completely disabled by disabling the windows messaging service or blocking (or simply not forwarding) ports 135-139, and 445 at the firewall (or not allowing the windows messaging service to act as a server if you're using a software firewall)...
web browser content popups are additional (and sometimes frameless) browser windows that are launched by your browser running scripts or other active content like flash or activex on web pages that you visit... modern browsers like firefox have built-in popup blocking capability meant to deal with these types of popups but depending on the sophistication the built-in measures may not work against all of them...
3rd party software popups are popups generated by some software installed on your system (often some form of adware)... often the popups will be browser windows in order to show web-based ads with all the graphics and multimedia we've seen time and again on the web... these can be avoided by not installing the 3rd party software in the first place, but if you do install then to stop the popups you'll have to remove the 3rd party software and in the case of 3rd party advertising software that's not always an easy task and often requires specialized removal software...
notification message popups are small, often text-only windows that pop up from the lower right hand corner (just above the system tray)... these are often to notify the user of some event, like a new email arriving or a instant messaging contact coming online... they can also be used to notify the user that there's a new advertisement for him/her to look at... this is a second, somewhat less obtrusive form of 3rd party software popup and must be dealt with in the same way...
the problem with popups is that they take up part of the screen, covering part or all of the work area of other windows/applications (even the notification message popups cover part of the screen when they appear)... this has the potential to interfere with the work the user is doing by covering an area s/he was using... when the popup is about something important, some option the user has to choose to continue a process they're involved in, some error condition, some event the user is actually interested in, etc. then the fact that it's covering up part of the user's work area is accepted - however when it's for advertising, the covering up of (even a small amount of) work area is almost universally not accepted because advertisements are just not important enough to justify interrupting what the user would have otherwise been doing...
back to index
Saturday, April 08, 2006
attention visitors from subeltblog - please read this
i'm getting an influx of traffic from sunbeltblog readers over the adware comment thread to end all adware comment threads that i wrote about earlier...
i would like to ask you all, before you send me hate-mail for being an 'adware apologist' (which i'm not), please take some courses in abstract reasoning and critical analysis - because once you actually have a handle on those skills you will probably understand what i was talking about in that comment thread...
the synopsis goes like so:
an anti-spyware website criticized an anti-spyware application (labelled it rogue, actually) in part because it was bundled with adware...
the question is, does installing program B make program A bad? the answer is yes if:
while many adware clients are also spyware of one form or another, the anti-spyware website in question never established that the adware in question was also spyware so number 1 above is out... that just leaves us with number 2, but again the anti-spyware website in question failed to show that program B was bad, opting instead to simply indicate who created it...
being created by bad people (in this case very bad people) doesn't make software bad (john mcafee became a pariah in the av industry for his practices, but his software was still good)... furthermore, just because most of the software made by those bad people is bad doesn't mean this one in particular is bad... you can't prove they've never made good software (because you can't prove a negative), but you can prove that this one was bad if it really was - either indicate how the program was bad or indicate that it matches a program that was previously analyzed and determined to be bad...
does just being adware make it bad? no it does not.. not all adware installs in secret (and in this case the adware's presence was fully disclosed), not all adware has pop-ups, not all adware is also spyware... none of those really bad things most people associate with adware are actually inherent to adware, they're simply present in the vast majority of cases...
was this particular instance of adware bad? probably... most (possibly all) instances of adware produced by it's creators were spyware and those creators are now paying the price for it...
was the anti-spyware app it was bundled with really rogue? definitely... aside from bundling probable spyware with an anti-spyware app, it used deceptive practices to get users to install it and there is serious question as to whether it actually detects and/or removes any spyware...
unfortunately for me, i use a functional definition for adware that is unencumbered by emotional baggage related to it's association with other types of malware and so i create contraversy and get hate-mail... but using an adware defintion that is abstracted from other forms of malware doesn't make me an adware apologist, it makes me a computer scientist and anyone who doesn't like it can stick it where the sun don't shine...
i would like to ask you all, before you send me hate-mail for being an 'adware apologist' (which i'm not), please take some courses in abstract reasoning and critical analysis - because once you actually have a handle on those skills you will probably understand what i was talking about in that comment thread...
the synopsis goes like so:
an anti-spyware website criticized an anti-spyware application (labelled it rogue, actually) in part because it was bundled with adware...
the question is, does installing program B make program A bad? the answer is yes if:
1. program A (an anti-spyware app) was supposed to stop program B (an adware client)
or
2. program B can be shown to be bad itself
while many adware clients are also spyware of one form or another, the anti-spyware website in question never established that the adware in question was also spyware so number 1 above is out... that just leaves us with number 2, but again the anti-spyware website in question failed to show that program B was bad, opting instead to simply indicate who created it...
being created by bad people (in this case very bad people) doesn't make software bad (john mcafee became a pariah in the av industry for his practices, but his software was still good)... furthermore, just because most of the software made by those bad people is bad doesn't mean this one in particular is bad... you can't prove they've never made good software (because you can't prove a negative), but you can prove that this one was bad if it really was - either indicate how the program was bad or indicate that it matches a program that was previously analyzed and determined to be bad...
does just being adware make it bad? no it does not.. not all adware installs in secret (and in this case the adware's presence was fully disclosed), not all adware has pop-ups, not all adware is also spyware... none of those really bad things most people associate with adware are actually inherent to adware, they're simply present in the vast majority of cases...
was this particular instance of adware bad? probably... most (possibly all) instances of adware produced by it's creators were spyware and those creators are now paying the price for it...
was the anti-spyware app it was bundled with really rogue? definitely... aside from bundling probable spyware with an anti-spyware app, it used deceptive practices to get users to install it and there is serious question as to whether it actually detects and/or removes any spyware...
unfortunately for me, i use a functional definition for adware that is unencumbered by emotional baggage related to it's association with other types of malware and so i create contraversy and get hate-mail... but using an adware defintion that is abstracted from other forms of malware doesn't make me an adware apologist, it makes me a computer scientist and anyone who doesn't like it can stick it where the sun don't shine...
Saturday, March 25, 2006
magic at sunbeltblog.blogspot.com
so there appears to be some vanishing act going on at the sunbelt blog... in a recent article there talking about how pamela parker got it wrong i made a comment about how alex eck wasn't exactly on the money himself...
now the original url points nowhere and the original comments link has been replaced with a new one that was showing no comments...
i suspect this is nothing more than the consequences of editing the original article to remove a paragraph defending aim against being called adware (sorry, i could find no cache of the original article, you'll just have to take my word for it that said paragraph existed) combined with the vagaries of how blogspot handles edits and how haloscan (the comment service provider there) handles changes to the article's permalink... i haven't checked to see if blogspot really changes the url when you edit an already published article, but i do have some articles where the permalink has a number at the end like the new link for the sunbelt article in question...
just in case the original comment link goes on walkabout as well, here's a quote of what i posted to it:
as i said before, i don't think there was any funny business going on here, i think it was probably just an edit to correct an already published article which in turn had some interesting side effects...
and now you know why i don't provide for comments on this blog - if i should happen to edit something (and there are some things i can see myself modifying on occasion, like adding citations to my definition posts) i wouldn't want to have to deal with the consequences...
now the original url points nowhere and the original comments link has been replaced with a new one that was showing no comments...
i suspect this is nothing more than the consequences of editing the original article to remove a paragraph defending aim against being called adware (sorry, i could find no cache of the original article, you'll just have to take my word for it that said paragraph existed) combined with the vagaries of how blogspot handles edits and how haloscan (the comment service provider there) handles changes to the article's permalink... i haven't checked to see if blogspot really changes the url when you edit an already published article, but i do have some articles where the permalink has a number at the end like the new link for the sunbelt article in question...
just in case the original comment link goes on walkabout as well, here's a quote of what i posted to it:
i'm going to both agree and disagree...
i agree that pam's got it all wrong - adware is more than just ad-supported software... it's got to actually DISPLAY ads, not just be supported by them... there are plenty of ad supported programs out there that leave the ad serving up to a completely different program...
i disagree about aim (and others) not being adware, however... the qualifier you use to justify that distinction is that the 'primary purpose' of adware is to display ads, but i contend that trying to determine the 'primary purpose' of an application is a subjective property... it's a bad defining quality and ruins what could otherwise be a perfectly good *functional* definition...
for example, say someone comes along and makes an instant messaging service that's functionally identical to aim, but they do it not to provide the world with yet another instant messaging application but rather to deploy a platform which not only serves ads but baits users into looking at the ad serving window by putting useful functionality on it... this is still all functionally identical to aim, but it's purpose is to display ads and the instant messaging is just to keep people looking in the direction of those ads... something doesn't stop being adware just because you shoe-horn useful functionality into the ad serving client, and there's really no way to know if the functionality is there to help the ads or if the ads are there to pay for the functionality...
of course, it's not necessary to go through that convolution... aim, like most of the mainstream instant messaging clients, has at various times erected barriers to interroperability both with other im services and with 3rd party clients... the only purpose interroperability barriers serve is to guard a captive audience, which are themselves only good practicing various types of persuasion (like advertising)... so the idea that aim's primary purpose is not providing advertising is questionable at best...
moreover, if the anti-adware/anti-spyware industry persists in using such a definition (yes, i noticed that the anti-spyware coalition's definition shares the same 'feature') the adware industry could easily just port their technology into dlls and activex controls that are bundled by way of integrating them into the 3rd party's application... they'd still be capable of doing all the bad things that people hate about adware but they'd no longer be separate from the programs they're bundled with and the 'primary purpose' of the main app would then exclude such a hybrid from the adware set...
as i said before, i don't think there was any funny business going on here, i think it was probably just an edit to correct an already published article which in turn had some interesting side effects...
and now you know why i don't provide for comments on this blog - if i should happen to edit something (and there are some things i can see myself modifying on occasion, like adding citations to my definition posts) i wouldn't want to have to deal with the consequences...
Wednesday, March 22, 2006
stopbadware.org should check their own sources
in the recently released report on kazaa, stopbadware.org states:
unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...
this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...
the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...
so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...
part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...
Sharman Networks claims that Kazaa has "NO SPYWARE", based on a highly restricted definition of spyware (namely, that no personally identifiable information is sent by the program). However, Kazaa's installation includes several bundled programs that are considered spyware under the common definition of spyware as software that subverts the computer's operation for the benefit of a third party (see Anti-Spyware Coalition and Wikipedia's article on "Spyware").
unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...
this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...
the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...
so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...
part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...
Tuesday, March 21, 2006
practical suggestions for bundling adware
i was reading a blog post over at stopbadware.org about adware bundling and it struck me that there doesn't really seem to be much in the way of constructive practical suggestions for those software developers who are in the unfortunate position of needing financial assistance from an adware company...
as the stopbadware post suggests, if the adware you bundle with is bad you are going to be held accountable for it's actions because you chose to bundle it so lets go through some steps that may help to avoid that...
i know that sounds like an aweful lot of work but guess what, there's no such thing as a free lunch and making the choice to bundle adware isn't a way to get free money...
i don't know how easy it will be to find an adware provider that meets these requirements, perhaps there aren't any yet but you know what? adware companies don't get any money unless people bundle their software so as much as you may need them they need you too so don't be afraid to put some pressure on them to get the terms you want, eventually an adware company will come along that's willing to do business on those terms if there's enough demand for it... they're businesses after all and they have to bend to market pressure or go out of business... it's just another form of voting with your wallet...
and what should you do if you still feel like you have no leverage over the adware company? do what many groups of 'little guys' have done before you - organize... find like-minded software developers who also need the help of an adware company but are uncomfortable with the typical adware's shenanigans and go after what you want as a united group... and i'm not just talking about folks who haven't signed up with an adware company yet; there are plenty of folks who came before who wish their current agreement with their adware partner was better than it is - these are people who are in the market for a new adware partner and so can be added to your collective voice...
as the stopbadware post suggests, if the adware you bundle with is bad you are going to be held accountable for it's actions because you chose to bundle it so lets go through some steps that may help to avoid that...
- be up front about the presence of the adware, say right on your front page or on your download page (and not in a small font) that the software is ad supported... you should even go so far as to specify the adware provider so that people downloading your product know what they're getting... i know this will probably drive away customers because of the bad name adware has (often deservedly so) but if you don't tell them then it will be much worse for the long term viability of your product... better to have slow adoption than a big backlash...
- take personal responsibility for the quality of the adware you're bundling - make sure it's not buggy, make sure it doesn't contain spyware or take any other actions that would send personal information back to anyone, make sure it doesn't install silently/secretly, make sure it uninstalls cleanly, make sure it doesn't install anything unexpected or provide a platform for advertisers to install things secretly/silently through the ad windows themselves, make sure it doesn't interfer with what the user is trying to do by popping up lots of windows or playing with window z order or any other tricks to put their ads overtop of what the user is working on...
- make sure your contract with the adware company clearly specifies what kind of behaviour is acceptable from their adware so they can't play any kind of bait and switch game using an innocuous test version and an offensive upgrade, and make sure they can't change the terms of that contract unilaterally...
- research the company's history in order to get some idea of how likely they are to keep their word/not violate that contract, also to get an idea of what kind of ethics they've displayed in the past and how good they've been about fixing bugs and addressing concerns...
- keep up to date on issues relating to the adware in your bundle... for example if there's a bug, post information about it on your site and direct affected users to where ever they need to go to correct the problem...
- inform your users of the exact measures you go through to make sure the adware you're bundling with is safe for them to install...
i know that sounds like an aweful lot of work but guess what, there's no such thing as a free lunch and making the choice to bundle adware isn't a way to get free money...
i don't know how easy it will be to find an adware provider that meets these requirements, perhaps there aren't any yet but you know what? adware companies don't get any money unless people bundle their software so as much as you may need them they need you too so don't be afraid to put some pressure on them to get the terms you want, eventually an adware company will come along that's willing to do business on those terms if there's enough demand for it... they're businesses after all and they have to bend to market pressure or go out of business... it's just another form of voting with your wallet...
and what should you do if you still feel like you have no leverage over the adware company? do what many groups of 'little guys' have done before you - organize... find like-minded software developers who also need the help of an adware company but are uncomfortable with the typical adware's shenanigans and go after what you want as a united group... and i'm not just talking about folks who haven't signed up with an adware company yet; there are plenty of folks who came before who wish their current agreement with their adware partner was better than it is - these are people who are in the market for a new adware partner and so can be added to your collective voice...
Sunday, March 12, 2006
the adware comment thread to end all adware comment threads
story time folks... currently i'm embroiled quite the debate in the comments section of a posting over at sunbeltblog and in true vitalsecurity.org fashion i thought i'd offer up my observations here...
first i'll confess to making an error, i started out by misinterpreting the source material, i thought an anti-spyware app had been labelled rogue simply because it had been bundled with adware... the interesting thing is that people actually defended this interpretation - that is, if my interpretation had been what actually happened they would defend that action apparently just because the adware in question was produced by a company with a shady past...
now, i hate adware as much as the next guy and i certainly wouldn't touch this thing with a 10 foot barge pole (at least not outside of a virtual environment), but i'm honest enough with myself to admit that that is purely on suspicion alone, whereas the overwhelming opinion of the other participants seems to be that if the software is made by bad people or even people who have done bad things in the past then the software itself is bad... it's been these kinds of peculiar ideas that have kept me going back...
now i've known for a long time that the malware problem has many dimensions, it's not just the software that we need to concern ourselves with, but when we are dealing with the software part of the problem should we let things like the creator's past cloud the issue? no, of course not, that's a different part of the malware problem and it's best dealt with in a different way... when we classify malware we're concerned with whether or not the software itself poses a risk, not whether it further's some corporation's nefarious agenda... internet explorer furthered a corporation's nefarious agenda (just ask the department of justice) but that doesn't make it malware...
another peculiar idea i encountered was that if you don't deal with the question of whether the people who made the software are bad when you're deciding whether the software itself is bad then somehow you're not addressing the badness of the people at all... come on, the malware problem is a complex one, and the secret to dealing with complex problems is to break them into their component parts and deal with those parts separately... just because you aren't dealing with the people when you're dealing with the software doesn't mean you aren't dealing with the people at all, just that you've compartmentalized your efforts... is that a bad thing? no, certainly not, in fact it means you're much less likely to try and use your software solution on a people problem... and lets face it, software doesn't solve people problems - it solves problems for people, but not problems with people...
first i'll confess to making an error, i started out by misinterpreting the source material, i thought an anti-spyware app had been labelled rogue simply because it had been bundled with adware... the interesting thing is that people actually defended this interpretation - that is, if my interpretation had been what actually happened they would defend that action apparently just because the adware in question was produced by a company with a shady past...
now, i hate adware as much as the next guy and i certainly wouldn't touch this thing with a 10 foot barge pole (at least not outside of a virtual environment), but i'm honest enough with myself to admit that that is purely on suspicion alone, whereas the overwhelming opinion of the other participants seems to be that if the software is made by bad people or even people who have done bad things in the past then the software itself is bad... it's been these kinds of peculiar ideas that have kept me going back...
now i've known for a long time that the malware problem has many dimensions, it's not just the software that we need to concern ourselves with, but when we are dealing with the software part of the problem should we let things like the creator's past cloud the issue? no, of course not, that's a different part of the malware problem and it's best dealt with in a different way... when we classify malware we're concerned with whether or not the software itself poses a risk, not whether it further's some corporation's nefarious agenda... internet explorer furthered a corporation's nefarious agenda (just ask the department of justice) but that doesn't make it malware...
another peculiar idea i encountered was that if you don't deal with the question of whether the people who made the software are bad when you're deciding whether the software itself is bad then somehow you're not addressing the badness of the people at all... come on, the malware problem is a complex one, and the secret to dealing with complex problems is to break them into their component parts and deal with those parts separately... just because you aren't dealing with the people when you're dealing with the software doesn't mean you aren't dealing with the people at all, just that you've compartmentalized your efforts... is that a bad thing? no, certainly not, in fact it means you're much less likely to try and use your software solution on a people problem... and lets face it, software doesn't solve people problems - it solves problems for people, but not problems with people...
Wednesday, March 01, 2006
what is adware?
adware is any program that displays advertisements for something other than itself...
sometimes the display of such advertisements is completely benign and serves as a means of subsidizing the development of software or the provision or services... for example, older versions of the opera web browser displayed ads to users who hadn't paid for the browser in order to help pay for the cost of development of the software... users had the option of using the free version and letting the advertisements take up a certain portion of the screen or paying for the ad-free version and getting more screen real-estate with which to browse with... another example is the internet service providers that used to (and perhaps still do in some locales) provide free internet service so long as you used their custom connection software which utilized part of your screen real-estate to display ads...
while all that sounds ok, that's just the well behaved adware... sometimes 3rd party adware is bundled with software the user downloads... ideally the presence of this adware is made obvious during installation and the user given an opportunity to opt out of the installation - also ideal would be that the adware is easy to find and uninstall once on the system... however, often the presence of the adware is hidden in an EULA (End User License Agreement) that no one reads and is installed in such a way as to make it difficult for the user to find it and/or remove it...
when adware is installed in secret and/or is made difficult to find and/or remove it qualifies as a trojan horse program and it is this combination of adware and trojan that most people are talking about when they speak of adware in a malware context...
back to index
sometimes the display of such advertisements is completely benign and serves as a means of subsidizing the development of software or the provision or services... for example, older versions of the opera web browser displayed ads to users who hadn't paid for the browser in order to help pay for the cost of development of the software... users had the option of using the free version and letting the advertisements take up a certain portion of the screen or paying for the ad-free version and getting more screen real-estate with which to browse with... another example is the internet service providers that used to (and perhaps still do in some locales) provide free internet service so long as you used their custom connection software which utilized part of your screen real-estate to display ads...
while all that sounds ok, that's just the well behaved adware... sometimes 3rd party adware is bundled with software the user downloads... ideally the presence of this adware is made obvious during installation and the user given an opportunity to opt out of the installation - also ideal would be that the adware is easy to find and uninstall once on the system... however, often the presence of the adware is hidden in an EULA (End User License Agreement) that no one reads and is installed in such a way as to make it difficult for the user to find it and/or remove it...
when adware is installed in secret and/or is made difficult to find and/or remove it qualifies as a trojan horse program and it is this combination of adware and trojan that most people are talking about when they speak of adware in a malware context...
back to index
Tuesday, July 12, 2005
the importance of good definitions
Techdirt has an article on the recent attempts by a group of organizations to come up with an agreed upon set of definitions for spyware and adware... predictably, Techdirt gets it all horribly, horribly wrong...
the author feels that what the software does or doesn't do is immaterial - that any unwanted application that got on one's machine by unknown means should be classified as spyware... he's not the only one who feels that way but there's a BIG problem with this line of reasoning...
the problem is that classifying instances of software on the basis of how they make some nebulous real world group of users feel (which is essentially what the author's position boils down to) is ridiculously difficult on a number of levels... not only will countless millions be spent on navel-gazing exercises trying to divine whether a particular instance of software in a particular software bundle is going to be unwanted and unnoticed at install time by some fictional average computer user or one if his/her 3.2 kids, but countless millions more will be spent defending against a deluge of specious lawsuits on the grounds that each classification was arbitrary and prejudicial - ultimately leading to a system where the courts, rather than the industry decide which program is spyware and which isn't..
we're computer scientists, not mind readers - we don't deal with this eye of the beholder crap unless we absolutely have to - and in this case we don't have to... we already have an umbrella term for all bad software - it's "malware"... if we're going to classify software for anti-whatever purposes we need to do it based on functional definitions (definitions based on what functions the software performs rather than definitions based on guessing how users will react to it)... we already have one malware classification saddled with an eye of the beholder definition, it's known as the "trojan", and that non-functional catch-all definition has been the bane of anti-trojan detection for years and is probably the reason we've had to make so many other classifications because it's proven totally unworkable as a classification that people can agree upon... classification based on eye of the beholder type criteria excludes widespread agreement by definition...
functional definitions, on the other hand, are much more reasonable... no guessing is involved and legal defense is practically a non-issue - define something based on it's function and it becomes much more feasible to demonstrate that a particular thing belongs or doesn't belong in that class...
on reading the actual document that the group of organizations (the anti-spyware coalition) came up with i think that for the most part the definitions are reasonable but a little on the wordy side... adware, for example could be much more simply defined as any software that advertizes a product or service other than itself... likewise spyware can be defined as any software that surreptitiously collects information from the user's system and sends it back to a remote 3rd party...
they did miss the mark on rootkits again, but the most notable problem is their adoption of spyware as an umbrella term for just about all bad software... they justify this by saying that the public at large is calling it that but this is foolish; 2 years ago the public at large was calling all bad software viruses, 2 years in the future they'll be using yet another term... how will this system cope with that? better to ignore the foibles of the unwashed masses and simply strive for internal consistency... trying to accomodate terminology misuse by people who don't know what they're talking about will never work because the people who don't know what they're talking about will not be consistent over time - leaving those of us who do know what we're talking about having to guess what they're talking about regardless of how accomodating we try to be...
EDIT (07/19/2005): i retract what i said about their definition of rootkits - i don't know what i was looking at before but now it looks fine... turning spyware into an umbrella term is still bad though...
the author feels that what the software does or doesn't do is immaterial - that any unwanted application that got on one's machine by unknown means should be classified as spyware... he's not the only one who feels that way but there's a BIG problem with this line of reasoning...
the problem is that classifying instances of software on the basis of how they make some nebulous real world group of users feel (which is essentially what the author's position boils down to) is ridiculously difficult on a number of levels... not only will countless millions be spent on navel-gazing exercises trying to divine whether a particular instance of software in a particular software bundle is going to be unwanted and unnoticed at install time by some fictional average computer user or one if his/her 3.2 kids, but countless millions more will be spent defending against a deluge of specious lawsuits on the grounds that each classification was arbitrary and prejudicial - ultimately leading to a system where the courts, rather than the industry decide which program is spyware and which isn't..
we're computer scientists, not mind readers - we don't deal with this eye of the beholder crap unless we absolutely have to - and in this case we don't have to... we already have an umbrella term for all bad software - it's "malware"... if we're going to classify software for anti-whatever purposes we need to do it based on functional definitions (definitions based on what functions the software performs rather than definitions based on guessing how users will react to it)... we already have one malware classification saddled with an eye of the beholder definition, it's known as the "trojan", and that non-functional catch-all definition has been the bane of anti-trojan detection for years and is probably the reason we've had to make so many other classifications because it's proven totally unworkable as a classification that people can agree upon... classification based on eye of the beholder type criteria excludes widespread agreement by definition...
functional definitions, on the other hand, are much more reasonable... no guessing is involved and legal defense is practically a non-issue - define something based on it's function and it becomes much more feasible to demonstrate that a particular thing belongs or doesn't belong in that class...
on reading the actual document that the group of organizations (the anti-spyware coalition) came up with i think that for the most part the definitions are reasonable but a little on the wordy side... adware, for example could be much more simply defined as any software that advertizes a product or service other than itself... likewise spyware can be defined as any software that surreptitiously collects information from the user's system and sends it back to a remote 3rd party...
they did miss the mark on rootkits again, but the most notable problem is their adoption of spyware as an umbrella term for just about all bad software... they justify this by saying that the public at large is calling it that but this is foolish; 2 years ago the public at large was calling all bad software viruses, 2 years in the future they'll be using yet another term... how will this system cope with that? better to ignore the foibles of the unwashed masses and simply strive for internal consistency... trying to accomodate terminology misuse by people who don't know what they're talking about will never work because the people who don't know what they're talking about will not be consistent over time - leaving those of us who do know what we're talking about having to guess what they're talking about regardless of how accomodating we try to be...
EDIT (07/19/2005): i retract what i said about their definition of rootkits - i don't know what i was looking at before but now it looks fine... turning spyware into an umbrella term is still bad though...
Monday, July 04, 2005
the end of anti-adware/spyware software
it seems like only yesterday that microsoft stepped into the anti-adware/spyware business and now it's probably going to collapse...
why? well, the thing about adware and spyware in the past was, despite being a pain in the ass to remove they were relatively easy to detect... stand-alone programs or dlls that are discrete and easily removed, that use various registry or other startup tricks to make sure the the adware/spyware runs also gives away their location...
unfortunately, just as our cyber-innocence was lost 20 some odd years ago by the advent of computer viruses, some of it's final vestiges that managed to stick around are again under siege by file infecting adware...
you're probably wondering why i would take such an alarmist stance on this, since i rarely do so... the reason is simple - existing anti-adware/spyware technologies simply can't cope with file infection, it is in no way comparable to what those products were doing before, the only thing that can deal with file infection right now is anti-virus technology... so we're back in the position of needing the anti-virus industry to provide all-in-one 'solutions' again and the anti-whatever-else industries will be left in the dust because AV technology is neither cheap nor easy to develop and the AV industry has an incredible headstart...
this is actually really sad for the people involved... we had all these new types of threats and whole new industries spring up to try and deal with them, and then someone goes and adds file infection to them and it all falls down... the only 2 ways this won't happen is if file infection doesn't catch on as a big trend in adware/spyware, or if the anti-virus industry sits on their hands and (intentionally or otherwise) gives the anti-adware/spyware guys a chance to catch up...
of course, you could (quite correctly) argue that they should have seen file infecting adware/spyware coming and developed their products with that in mind, but that doesn't make things any less sad for the employees (who generally don't have a huge say in the architecture of the product) of those companies...
[edited to fix totally borked link - thanks for pointing that out nick]
why? well, the thing about adware and spyware in the past was, despite being a pain in the ass to remove they were relatively easy to detect... stand-alone programs or dlls that are discrete and easily removed, that use various registry or other startup tricks to make sure the the adware/spyware runs also gives away their location...
unfortunately, just as our cyber-innocence was lost 20 some odd years ago by the advent of computer viruses, some of it's final vestiges that managed to stick around are again under siege by file infecting adware...
you're probably wondering why i would take such an alarmist stance on this, since i rarely do so... the reason is simple - existing anti-adware/spyware technologies simply can't cope with file infection, it is in no way comparable to what those products were doing before, the only thing that can deal with file infection right now is anti-virus technology... so we're back in the position of needing the anti-virus industry to provide all-in-one 'solutions' again and the anti-whatever-else industries will be left in the dust because AV technology is neither cheap nor easy to develop and the AV industry has an incredible headstart...
this is actually really sad for the people involved... we had all these new types of threats and whole new industries spring up to try and deal with them, and then someone goes and adds file infection to them and it all falls down... the only 2 ways this won't happen is if file infection doesn't catch on as a big trend in adware/spyware, or if the anti-virus industry sits on their hands and (intentionally or otherwise) gives the anti-adware/spyware guys a chance to catch up...
of course, you could (quite correctly) argue that they should have seen file infecting adware/spyware coming and developed their products with that in mind, but that doesn't make things any less sad for the employees (who generally don't have a huge say in the architecture of the product) of those companies...
[edited to fix totally borked link - thanks for pointing that out nick]
Friday, June 25, 2004
terminology proposal
i hear a lot about people's machines becoming infected with spyware or infected with trojans or infected with adware or ...
i'm sorry, since when are these things considered infectious? if i connect to a network that has a spyware infected machine on it, is my computer going to become infected? how about if i share disks/programs/word documents/etc with such a machine? no, of course not...
VIRUSES infect, not spyware or adware or whatever... i realize people need a way to indicate that very bad software has been installed on their system but lets not confuse the issue by using terms that already have a different meaning in this field, lets try a new word shall we?
we could use "contaminate"... 'my machine became contaminated with spyware'...
but maybe "contaminate" is too fancy (thus "afflict" is also out of the question) or maybe just not pejorative enough... then the answer is simple - the word we want is "poison"... 'my machine has been poisoned with spyware'... that conveys that something noxious has gotten onto the system and it is quite pejorative...
i'm sorry, since when are these things considered infectious? if i connect to a network that has a spyware infected machine on it, is my computer going to become infected? how about if i share disks/programs/word documents/etc with such a machine? no, of course not...
VIRUSES infect, not spyware or adware or whatever... i realize people need a way to indicate that very bad software has been installed on their system but lets not confuse the issue by using terms that already have a different meaning in this field, lets try a new word shall we?
we could use "contaminate"... 'my machine became contaminated with spyware'...
but maybe "contaminate" is too fancy (thus "afflict" is also out of the question) or maybe just not pejorative enough... then the answer is simple - the word we want is "poison"... 'my machine has been poisoned with spyware'... that conveys that something noxious has gotten onto the system and it is quite pejorative...
Subscribe to:
Posts (Atom)