Download.com Bundling Adware With Free Software 228
Zocalo writes "In a post to the Nmap Hackers list Nmap author Fyodor accuses Download.com of wrapping a trojan installer (as detected by various AV applications when submitted to VirusTotal) around software including Nmap and VLC Media Player. The C|Net installer bundles a toolbar, changes browser settings, and, potentially, performs other shenanigans — all under the logo of the application the user thought they might have been downloading. Apparently, this isn't the first time they have done this, either."
This is news? (Score:5, Insightful)
Download.com have always done this... I thought this was how they funded the site.
Re:This is news? (Score:5, Interesting)
Download.com have always done this... I thought this was how they funded the site.
This may be true, but doesn't shadow the efforts of those irritated enough to stand up and say something. Hats off to Fyodor for bringing it to light in hopes that things change.
And as knowledgeable as the average user has (been forced to) become about spyware and malware, Download.com should listen, because it's obviously not just those uploading content that keeps them in business. Let's hope they don't react and generate that stench of arrogance around themselves, not unlike many large businesses today that think they're "too big to fail", and could care less what their customers think.
Re:This is news? (Score:5, Informative)
You can always choose not to offer your downloads through download.com.
Re:This is news? (Score:5, Insightful)
You can always choose not to offer your downloads through download.com.
Can you? Even if it's under a copyleft license, or in the public domain?
Re:This is news? (Score:5, Informative)
If your logo or name is a trademark, yes. That's why no distribution can redistribute a modified Firefox with the same name & logo.
Re: (Score:3)
Re:This is news? (Score:5, Informative)
The new installer is a "derivative work", and you can specify that derivative works must not use the original trademarks. Mozilla and RedHat are both very strict about this: the source is open and free and all but you keep their name out of your modified stuff.
Re: (Score:3)
Re:This is news? (Score:5, Insightful)
Honestly, the whole story is nonsense created an a very ignorant person. Free software was never intended to keep programmers from making a living
Sorry but no. The whole story is a very real warning to a user community that a large company is acting in an unethical and immoral manner by trading on the name and reputation of someone else.
Making money through advertising on the download site isn't causing any problem. Pretending to offer Fyodor's downloader while in fact seeking to install other software is a trojan attack and bad behaviour no matter how you look at it.
Calling this nonsense fails to understand the key issue and misrepresents both the complaint, and the complainant.
Re:This is news? (Score:5, Insightful)
the problem is folks now blaming the original software writer for
1 mucking about with browser settings
2 installing adware
3 installing who knows what else??
How would you like it if you wrote a program (lets say its a conversion calculator) and then hosted your downloads on download.com
and THEY WITHOUT TELLING YOU decided to bundle Diapered Dolls Slideshow 2012 (4-7 edition) and then made that the default screensaver (and locked the settings)???
Re: (Score:2)
Re:This is news? (Score:4, Informative)
remove download (Score:5, Interesting)
That's what I finally had to do, when some entity (might've been download.com, might've been someone else) offered an alternative download location for my software - which bundled some sort of malware installer onto my software. After one attempt to remove them as an alternate, I was told I could request my software be removed, and that's what I did. This occurred back in 2004. [degreez.net]
Comment removed (Score:5, Informative)
Re:This is news? (Score:5, Insightful)
Re:This is news? (Score:5, Informative)
Thank you for Ninite. It will unsuck my life considerably.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:This is news? (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Does ninite prevent developer included crapware? Specifically looking at uTorrent here which is notorius for giving you check boxes concerning crapware and then installing it anyway regardless of what you checked.
Re:This is news? (Score:5, Interesting)
Yes it is news for me.
I submitted something I wrote a while back and it used to offer the file the way I uploaded it. I just checked and sure enough my download is now wrapped in a Cnet installer. Now I need to dig out my account info and remove my software listing because this is fucking BULLSHIT!
Thanks Slashdot for pointing this out.
Re:This is news? (Score:5, Informative)
If anybody else wants to remove their software as well then you need to contact support to delist from Download.com/Upload.com
They will respond with something like:
Thank you for contacting CNET Upload.com. There are several ways to opt-out:
- Premium subscription
- PPD
But if you insist they will remove your listing. Fucking scammers!
Re:This is news? (Score:5, Interesting)
Just send them a DMCA takedown notice. If the system exists you might as well use it.
Re:This is news? (Score:4, Informative)
If you're on Brothersoft as well, you'd best contact them to "unwrap" your software too - unlike download.com they won't charge you to do that though, and will do it for you.
Re:This is news? (Score:5, Informative)
Re: (Score:2, Interesting)
Re:This is news? (Score:5, Informative)
Cnet is only bundling their adware with programs uploaded since they started bundling.
I've got a program listed there, its not bundled.
If I upload a new version they are going to bundle it with their crapware.
So I'm not uploading a new version, ever.
They told uploaders what they were going to do with their program, they don't agree to your terms and conditions, you agree to theirs.
Remove your program from their site and go elsewhere.
Re: (Score:3)
Incorrect. I had software there that was uploaded prior to their bundling, and eventually they wrapped it anyway. I'd watch them if I were you.
Re:This is news? (Score:5, Informative)
Re: (Score:2)
Of course, if they include the source code, and possibly rename the app, perfectly legal to do...
See points 1, 2 and 4 of the Open Source Definition http://www.opensource.org/osd.html [opensource.org]
Re: (Score:3)
Comment removed (Score:5, Informative)
Downloading free software is theft (Score:2, Funny)
Can we all agree that downloading free software is stealing from poor programmers who have to live in their mother's basement because they're so poor they cannot even afford their own place? And that as we can read in TFA downloading free software supports criminal activities, and is therefore terrorism? And that this probably means you're a communist child-abusing terrorist?
-- Yes, this was a joke, and no, I don't have a good sense of humor.
Re:Downloading free software is theft (Score:5, Funny)
but are they required now to gpl the virus and adware?
Re: (Score:2)
Nothing new. (Score:3, Interesting)
Download.com has been funded by bullshit third-party software addons for as long as I can remember. AFAIK, they only recently started this practice of causing the user to download a downloader which would first go through the third-party addons before downloading the actual installer... but it's not like it's any different than before. Yeah, lots of people will just click through and accept everything and that's their fault for not reading things before agreeing to them. Don't blame a free service operated by a for-profit corporation for wanting to make money. Host the Nmap installer yourself if you think it's so easy.
Re:Nothing new. (Score:5, Informative)
Re:Nothing new. (Score:4, Insightful)
How do you know he uploaded it, and not some anon schmuck?
Go to the software producer's site (Score:5, Insightful)
It's rather mindboggling that a decade into the 21st century, people are still going to third party download outfits like this.
Maybe someone wants to enlighten me as to why... I'm not coming up with much.
Comment removed (Score:5, Insightful)
Re: (Score:2)
People are creatures of habit, and once they learn how to use the download.com ( or some other site like freshmeat.net ) interface, they just return to it out of habit, and the fact that they already know how to search and navigate the site.
Thought here's a small but crucial difference between download.com and freshmeat/whatevertheheckit'snowadays: Download.com hosts stuff, while freshmeat just listed and categorised software, linking to developers. The details on where to get the software are posted by the developer on freshmeat. You get the software exactly where the developer wants you to get the software. A choosy user can then download the source or official binaries or just say "hey, it looks like it's already packaged in my distro".
In o
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re:Go to the software producer's site (Score:5, Interesting)
In my eyes they already screwed up when they allowed sw developers to promote the features of the full (paid) version in the description of the free version without any indication the free version didn't include the feature.
Re: (Score:3)
Re: (Score:3)
Not much of advantage anymore. You can just host on rapidshare/megaupload/similar site.
Rapidshare (Score:5, Interesting)
Rapidshare, for that authentic 90s warez feel.
Not hosting your own files, or torrents for larger stuff, looks about as professional as a hotmail address on a business card.
Re: (Score:2)
I'm pretty sure that we didn't have such nice download sites in the 90s. Which is why we had p2p for most of the copyright infringement back then.
Not to mention that pretty much no one "hosts their own files" anymore, except for really big companies. Outsourcing to professional hosting makes a whole lot more sense nowadays.
Re: (Score:2)
As someone who had to use it a few times, CRINGE.
Re: (Score:2)
But hosting on "rapidshare/megaupload/similar site" makes it a pain for the user to download the software ("wait 60 seconds before you can download at a low speed!"), so it's not a good alternative.
Re:Go to the software producer's site (Score:5, Informative)
Pick mediafire then. Zero wait, over 1MB/sec download speed.
Megaupload usually saturates my 2.2MB/sec download bandwidth, but it has wait time.
Re: (Score:3)
Not if you pay them. I'm not talking about Rapidshare Premium or anything, I mean you can actually legitimately pay them for distribution of your legitimate files. No wait screens, no slow downloads, it's like everyone who downloads your file is premium from their perspective. You just pay for hosting.
Re: (Score:2)
Not much of advantage anymore. You can just host on rapidshare/megaupload/similar site.
And that's why people (used to) go to Download.com.
If I'm looking for warez I might go to rapidshare/megaupload/similar site. And I'll assume anything I get from those sites has a trojan/virus/bot until I can prove otherwise.
If I know what app or utility I need, I'll go directly to that site. If I don't have a particular name in mind, I used to go to Download.com. For example, I recently needed to get some updated codecs, but didn't know the exact package or provider I needed.
I don't feel a Google searc
Re: (Score:3)
If you're "looking for warez", those are the last stop, not first one. They host whatever it is that you want them to host. They only offer downloads of material that other people chose to to upload to them. The main reason why anti-piracy outlets like to paint them as "omg warez" is because they are free to use, fast, and you can only get the download if you have the proper link - there is no directory.
You sound like your typical ignorant person who just swallows whatever media tells him at face value, and
Re: (Score:2)
And by "videos", I do mean "stuff I shot with my phone". I.e. stuff that I have copyright on.
Re: (Score:2)
avast anti-virus redirects you to download.com
Re: (Score:3)
avast hosts the download off their site too but you have to know where to look....
http://www.avast.com/en-us/free-antivirus-download#tab4 [avast.com]
avg is the same way.. their offline installer is here...
http://free.avg.com/ww-en/download.prd-afh [avg.com]
(these are links for en-us)
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Re:Go to the software producer's site (Score:5, Insightful)
1. Enter name of software into browser search box*
2. Go to first link
3. Click 'download.' Repeat until a download starts.
4. Click 'next' until installation complete.
They go to download.com because for some programs, it actually comes higher in the listings than the program's main site. Espicially if they add 'download' to the search query, as many do.
*They don't quite get the concept of a search engine yet, so they'll go with the default. Theres a one-in-two chance they'll just type it in the address bar.
Re: (Score:2)
Because people would rather trust a single central location (eg download.com) than a multitude of different websites, any of which could be pushing malware or owned.
This is of course primarily a windows problem, linux users can get the majority of the software they want through the built in repositories while mac users now have the app store...
Windows culture (Score:2)
You never see anything like this from Linux repositories simply because Linux users would never stand for it. Many (maybe most) of the Windows users I know accept malware and crapware as just the unavoidable cost of getting what they need or want in a convenient way.
So it's a cultural thing, and it will take a lot of user education to create a higher level of expectation. The trouble is that I don't see from where the incentive to provide that education is going to come, interests in the MS ecosystem being
Re: (Score:2)
Re: (Score:2)
Download.com?? Really?? (Score:4, Insightful)
1999 just called. It wants its flagship shareware download repository back.
Seriously, today there are so many better sources to get free stuff (legal or otherwise) than Download.com
Why even bother?
Re: (Score:2)
Do not call (Score:2)
Can I put the 90s on my 'do not call' list?
Re: (Score:3)
The interesting question becomes this:
If we warn the past about an event like 9/11, and they actually DO something about it, what happens then? Would the American government spin it even further out of proportion, claiming the attacks would have used nukes and biological weapons? There's no way of knowing for certain.
We know what we have: A world that is worse off than before, yes, but not on the brink of having the planet destroyed. With the possibility that we could make things a lot worse and start World
Re: (Score:2)
if someone had went back in time and removed the stupid wrapper from downloads downloads, would this article be here?
problem with trying to decide if you should send a message back in time is that if you did send the message, you already sent it.
time travel stories are for books and games like crono trigger and day of the tentacle.
honestly, the wrapper wouldn't be such a bad thing if download just checked that the sw they're offering at least worked.
Re:Download.com?? Really?? (Score:4, Informative)
1) if they actually do something, it means the many worlds hypothesis is true, and the divergent timeline occurs in a different quantum universe.
2) if the get the message, and do nothing, then you could have created a closed timelike curve, and doomed your own universe to experience the exact timeline you are reporting on. This closed timelike curve would be an indelible part of that universe's history, both present, past and future. (The time after the event creates the preceeding event, which causes the event to happen. Rinse, repeate until dizzy.) (It could also simply be another instance of the many worlds hypothesis being true though.)
3) attempts at bidirectional communication would be systematically prevented by quantum collapse. All attempts to talk to 1999 on the other end of the call would mysteriously fail 100% of the time, even if the theory behind such a transmission seems sound.
4) 1999 calls us using a one way temporal transmission device. (Like an ordinary metal time capsule.) Communication is received, but no reply can be sent.
Of these 4 options, 4 and 3 are the most likely scenarios for "1999 called, they want...." happening. #4 being the most likely.
Causality, it's a bitch.
Re:World War III (Score:3)
"If we warn the past about an event like 9/11, and they actually DO something about it, what happens then? Would the American government spin it even further out of proportion, claiming the attacks would have used nukes and biological weapons? There's no way of knowing for certain.
We know what we have: A world that is worse off than before, yes, but not on the brink of having the planet destroyed. With the possibility that we could make things a lot worse and start World War III, is is really sensible to se
Re: (Score:2)
And do you have something not United States Only?
Re: (Score:2)
Not in this case. The warning would simply be "these planes are going to be hijacked on this day". Don't include "and they're going to fly them into buildings". They would simply assume what everyone on the planes assumed, that the hijackers want to either be flown somewhere or want to use the plane and passengers as leverage in bargaining. The same thing plane hijackings had been used for for the prior couple of decades.
That is why they hijackers succeeded. Their real weapon was surprise and unpredictabili
Re: (Score:2)
easy way to bypass (Score:5, Informative)
add &dlm=0 to the end of the 'your download is starting' page url..
1 go to a program's page
2. click download now
3. do not download the file that starts cnet_ or cnet2_ (if it doesn't start with cnet it's ok)
4. add the &dlm=0 to the url in the address bar after the spi=whatever junk
enjoy the direct download.. and go to the source next time..or try filehippo or softpedia (either one with your adblocker running)
Re: (Score:2)
Re: (Score:2)
Shouldn't have to edit URLs to bypass their crap; either offer me both download methods or gtfo.
As for the ad blocker, I'm making a habit of turning it off for sites that prove useful and not annoying; denying them the revenue makes me more of a leech.
Re: (Score:2)
I can't quite believe I'm pasting a Dilbert strip here, but it's entirely appropriate:
http://dilbert.com/strips/comic/1994-02-01/ [dilbert.com]
It's a shame (Score:4, Insightful)
Re: (Score:3)
open source is the new shareware. buying expertise for configuring is the "registered" version.
huh? downloads not wrapped for me (Score:2)
Actually,it looks like cnet redirected me to the nmap.org download link (http://nmap.org/dist/nmap-5.51-setup.exe) using a 'META HTTP-EQUIV="Refresh"
I'm not logged in; I wonder if I have a cookie that prevents the wrapper -- or if download.com changed something.
Also, I'm using NoScript and cnet/download.com is not allowed. Perhaps this turns off the wrapper too.
Bundling / wrapping is old news (Score:5, Interesting)
This extremely common practice of bundling garbage with every download is the cancer that is killing Windows freeware, and no, it's not limited to Download.com.
A while ago, when I was in-between jobs and looking for some freelance work, I stumbled upon an entire "community" of scammers known as PPI : Pay-Pay-Install. This forum was all about participating in these shady bundling practices, discussing the advertisers that were most tolerant to things like silent installs, home page swaps, BHO's that redirect your Google searches through a proxy (to hijack ad revenue), Vista sidebar widgets, toolbars, bookmarks, and start-up items, along with uploading deceptively named and heavily trojaned stuff via P2P. This is why, with every goddamned Windows utility you get these days, you get prompted to installt he Ask.com toolbar, BonziBuddy, free trials for McAfee's swiss cheese, and a laundry list of other standards.
CNet should indeed be made an example of, and burned to the ground, but they didn't start this gangbang, the advertisers did. Follow the money... There is no reason why users should tolerate this aberrant behaviour.
Re: (Score:2)
Re:Bundling / wrapping is old news (Score:4, Informative)
It's full of errors. Especially the spiel about alignment. In 64-bit mode you don't have to align everything to 64-bits for best performance, only 64-bit-sized values (including memory pointers). The example 16-bit value actually only needs 16-bit alignment for best performance, which is no different to the 32-bit version of the program.
2: The increase in the memory use of pointers doesn't explain Windows x64's extra 300MB of memory use. My bet is on it loading both 64-bit and 32-bit versions of a bunch of libraries in order to support various components of Windows that are still 32-bit (as well as any 32-bit software you run).
3: Saying that a 64-bit version of a program won't be faster... Two things are actually in favour of it being faster: 64-bit mode exposes more and larger registers to use, and also guarantees certain instruction set enhancements exist (SSE2). The latter especially is a huge speedup if you take advantage of it.
Extend open source licenses to prevent this? (Score:2)
While this has been normal practice for shady rippoff sites like the ones mentioned for almost a decade, I do wonder if appropriate extensions to FOSS licences such as the GPL could actually prevent this. Or at least make the culprits liable for damages, copyright infringement and/or fraud.
If I were to work on a large FOSS project I would like to know that the software im contributing to doesn't legally end up on one of these fraudulent DL sites.
My 2 cents.
This came up in the ScummVM group recently (Score:5, Informative)
I'm part of the ScummVM group, a cross platform software for playing various classic adventure games, and the question of Download.com came up when we released the next version of our software. There were some arguments for including it on such sites, such as giving greater visibility to the project. However, the issue of the bundled 'crapware' was considered too big a downside. We weren't that desperate for wider coverage of our software, and we certainly didn't want people to adversely associate our software with malware.
These days I wouldn't touch download.com even if you paid me.
Re: (Score:2)
You chose well. Congratulations on 1.4 BTW!
Click to Download (Score:2)
Happened to me with 7-zip (Score:4, Informative)
Venn Diagram (Score:3)
I am shocked that the number of nmap users who are also download.com users would be significant.
Re: (Score:2)
Since your to lazy, here;
C|Net is adding trojans to the installer.
C|Net is in violation of the Nmap license.
So exactly who is winning here?
Re: (Score:2)
The downside is that CNet is deliberately preying on users' ignorance and installing software they don't want as well.
I fully believe users should take responsibility for what they install on their systems by at least looking at what they're installing but that doesn't preclude companies from leaving that crap out in the first place.
Re: (Score:2)
Software creator's good name is tarnished because people installed their software and got malware as a result. Not good.
People get malware, period. Also not good.
Re: (Score:3)
Re: (Score:3)