The Old Joel on Software Forum: Part 3 (of 5)

Stopping Spyware

I really hate spyware. There is nothing worse than a program that connects to the internet and exchanges information it doesn't show me and without asking for permission. I feel vialoted when this happens.

Well it turns out that spyware violates federal law. In the following article, information is given about contacting an organization that wants to do something about it and bring spyware authors to justice:

http://story.news.yahoo.com/news?tmpl=story&cid=1804&e=2&u=/washpost/a58655_2003nov18

They ask that everyone who finds spyware or knows anything about it report all details to them. They will create a database and then confront the feds who are supposed to be dealing with this stuff with their findings.

At last! This and the do-not-call list all in one year. Maybe things are really getting better.

Dennis Atkins
Wednesday, November 19, 2003

And in the meantime, what are people's favorite anti-spyware programs?

For Windows, I use Spybot Search and Destroy, which seems to do a good job.

For Mac OSX, I haven't found anything yet. I'd love to find a spyware removal tool for the Mac (and don't tell me that the Mac isn't vulnerable to spyware -- that's a myth). I've checked out Little Snitch but that's not really what I want; I want something that scans my computer for known spyware programs and offers to remove them for me.

Brad
Wednesday, November 19, 2003

I'm just as opposed to spyware, but it's a real stretch to say that it's prohibited by existing federal law. The actual report from the Center for Democracy and Technology is much more cautious -- it says that existing law might be applied to prohibit certain kinds of egregious spyware. (E.g., trojans, but not the typical adware.)

http://www.cdt.org/privacy/031100spyware.pdf
(Pages 10-11.)

Robert Jacobson
Wednesday, November 19, 2003

==>And in the meantime, what are people's favorite anti-spyware programs?

I use Ad-Aware by Lavasoft. No particular reason. It was the first one I tried and it worked well, so I've had no reason to switch to anything else.

Personally, I agree. Spyware should be illegal (and should be punishable by death! <grin>)

I've recently (last 2 months or so) spent time cleaning spyware from no less than a dozen computers at client sites. It's become a real problem for most of our clients. We have a few large clients, and they're usually AOK as they've got someone on site, and an IT department, that usually protects them from these things -- but the vast majority of our clients are small enough that they can't justify the costs of full-time IT staff (and hence they're dependence on us).

Most don't want to pay the costs associated with setting up their network/computers the "right" way to protect them from these things. Weird. They've got no problem calling us in when there's a problem though. Some of these machines had become completely unusable due to the proliferation of spyware and other nasties.

How come people can't afford to protect themselves, but when there's a problem, they can afford to pay twice as much to clean up the problems? I'll never understand this!

Sgt. Sausage
Wednesday, November 19, 2003

How about you don't install it in the first place? It seems like market forces should be sufficient to keep this problem in check. Why do we need federal laws?

Brian
Wednesday, November 19, 2003

[For Windows, I use Spybot Search and Destroy, which seems to do a good job.]

I concur.

Michael Bolton
Wednesday, November 19, 2003

Brian,

Well sure and let's allow cola companies to add heroin to their products without informing the public of its contents.

If programs clearly disclosed the nature of their spyware activities, it would be Ok. But as it is, people are shocked and surprised to find various apps they use and sometimes have paid for are watching them behind their backs, transmitting data to mysterious locations, and engaging in other unsavory activities.

Regarding federal law, it is a felony to hijack someones internet connection. Hijacking means to use without permission.

Dennis Atkins
Wednesday, November 19, 2003

What would be the permission set that I could allow/disallow for my kids on their shared computer, so that:

1. If one of them downloaded spyware, it would only affect that user.

2. Spyware would not have access to all files on the harddrive?

Thanks,

hoser
Wednesday, November 19, 2003

Spyware, by nature, attempts to cross permission boundaries. ("Permissions only keep honest programs honest").

Install (and keep updated) a Spyware program like Spybot Search & Destroy. Or, if you're extremely tech savvy and love to tinker with stuff, Tiny Personal Firewall (with the integrated Tiny Trojan Trap in the new versions) gives you very fine grained control over what programs can and cannot do - to the extent that you can stop Outlook from saving attachments outside of a predefined directory.

But installing SpybotS&D should keep you pretty well covered from the Spyware angle.

Ori Berger
Wednesday, November 19, 2003

> Well sure and let's allow cola companies to add heroin to their products without informing the public of its contents.

Nice straw man.

If you don't trust an installation not to put spyware on your machine, why are you installing the software at all?

Brian
Wednesday, November 19, 2003

Well Brian it's pretty clear what sort of software you develop so let's just move one. This thread is for folks who don't want their files or privacy to be compromised, or to at least be notified when that happens.

Any software that connects to the internet without being told to or at least asking permission first and offering the option to show exactly what is being transmitted is a serious security risk.

Anyone who has run software to check outgoing connections has been extremely shocked to find what sorts of apps engage in this material -- just as people would be shocked to find if there was heroin being added to their cola.

Someone who opposes truth in labelling laws, or laws to at least make software that steals information without asking, or hijacks a net connection like Brian is someone that should not be trusted.

Brian, please post the names of your privacy violating applications so we may delete them. After all, you said let the market decide. I want the oopportunity for the truth to be known so I can make a choice as an informed consumer.

Dennis Atkins
Wednesday, November 19, 2003

If you use antispyware softwares you have to think about what going on in the mind of the antispyware vendor's mind. There are spyware you can remove from your system (some stupid IE toolbar that hooks into everything written by a hacker and distributed over mal-webpages) and there's spyware you can't do anything about (any media player or cd ripper that hooks to CDDB or a web application like hotmail). I think there are very few choices right now but to ensure that from top to bottom you have some perimeter control (Zone Alarm's Application Firewall), practical every day control (Any-spyware, RegEdit/Uninstall), and fine tune control (open source software that you can verify or give you the features Microsoft or Real Network refuses to give you).

Li-fan Chen
Wednesday, November 19, 2003

Another vote for spybot.

Another app you might want to look at is autoruns.exe found at http://www.sysinternals.com/

It tells all apps that are set to run on startup through reg keys, ini file and startup etc.

Jack of all
Wednesday, November 19, 2003

Actually they used to have loads of cocaine in the original coca-cola recipe but it was taken out some time ago.

Years ago I worked as a loader in the local furit wholesale market, and one of the older admin staff used to send us out to get his non-prescription cough medicine every couple of days. We looked on the label and found out why: forty-five percent opium.

There also used to be an asthma pill you could buy over-the-counter by the name of "dodo"; pure amphetamine and it was only at the end of the seventies that they caught on.

As presumably they'd catch on some time or other in this neck of the woods, that there is a really neat Ayurvedic medicine that is basically liquid cannabis sativa. Suppose I'd better stock up soon for possible health problems in the future :)

Stephen Jones
Thursday, November 20, 2003

"Actually they used to have loads of cocaine in the original coca-cola recipe but it was taken out some time ago."

You know, I've seen conflicting information on that. I read somewhere that this was just an urban legend or something based on a misreported news story, and that Coca-Cola never actualy contained cocaine, or at least no more than a trace. Has anyone seen a definitive source that confirms it? I've always believed it but now I'm not so sure.

Brad
Thursday, November 20, 2003

Continuing the off-topic slant: as with any potential urban legend, I first try to find a reference at http://www.snopes.com/

They have an excellent writeup of 'Coca-Cola used to contain cocaine' at http://www.snopes.com/cokelore/cocaine.asp

Basically, the original Coca-Cola did have some (unknown the actual amount) - but then so did most other patent medicines of the day. The amount declined as Cocaine gained a bad name.

Quote: "...but we do know that by 1902 it was as little as 1/400 of a grain of cocaine per ounce of syrup. Coca-Cola didn't become completely cocaine-free until 1929, but there scarcely any of the drug left in the drink by then"

RocketJeff
Thursday, November 20, 2003

Ah Dennis, you got me. Did you also know I eat babies and was a member of the Hitler Youth Squad?
Seriously, your debating tactics are strictly 3rd grade. And on top of that, you don't seem to have understood a thing I've said.

I use AdAware, and I do block apps at the firewall. My point is not that spyware is good. My point is that if you are installing software that you don't trust, you're LUCKY if the worst thing they do is call home to a central server. What are these apps that are installing spyware on your machine, and why are you installing them in the first place? If it were widely known that they install/were spyware, do you think that people would still install them?

Brian
Thursday, November 20, 2003

I think Dennis just enjoys insulting people. No point to engage him in debate.

Robert Jacobson
Thursday, November 20, 2003

---"but there scarcely any of the drug left in the drink by then" ----

Yea, you can hardly expect an American drinks multinational to give you anything but overpriced sugar and water.

Stephen Jones
Friday, November 21, 2003

Incidentally when they debated making cocaine illegal it was said in favour that if they didn't there would soon have been as many as fifty thousand cokeheads in the US.

Good thing they passed the legislation wasn't it?

Stephen Jones
Friday, November 21, 2003