republican-creole
Search:  

 
 
   News
newer
P2P Apps: Spyware, EULAs Explored
Did you read all 22,000 words of your Kazaa EULA?
(old news - 06:37PM Monday Mar 07 2005)
tags: legal · Fileswapping
Spyware Researcher Ben Edelman dissects five major P2P apps, which spyware they install, and takes a scalpel to their EULAs in his most recent report. Particularly entertaining is the length of the EULAs; Kazaa's collective agreement (including that of the bundled adware) spans some 182 on-screen pages and is more than 22,000 words long.

Related:
  1. Pirate Bay Sale All But Dead
  2. Download The Pirate Bay Before It's Gone
  3. Pirate Bay Gets Yanked Offline
  4. Britain Returns To 'Three Strikes' Plan
  5. France 'Three Strikes' Rides Again
  6. Barry Manilow Highlights 'Three Strikes' Law Stupidity
  7. British Cops, Spies Oppose 'Three Strikes'
  8. Will 'Three Strikes' Come To The United States?
Forums » P2P Apps: Spyware, EULAs Explored
view: topics flat text 
Post a:

Fountainhead
Premium
join:2003-10-25
New York, NY
clubs:

So what's the answer?

Which P2P App does not load up your computer with spyware and malware?
--
It's all part of my rock and roll fantasy

dadkins
Can you do Blu?
Premium,MVM
join:2003-09-26
Hercules, CA
·Comcast

Re: So what's the answer?

said by Fountainhead See Profile:

Which P2P App does not load up your computer with spyware and malware?
»www.shareaza.com/
Thaler
Premium
join:2004-02-02
Encino, CA

Re: So what's the answer?

Limewire too, but then again, if you don't want to be caught, IRC channels can't be beat.

But, back in those days of the just-after-Napster, there weren't too many viable non-crapware P2P alternatives. Hell, they hadn't coined the term "adware", "spyware", or "crapware" in those days...we just saw a crapload more pop-ups than normal.
hottboiinnc
ME

join:2003-10-15
Cleveland, OH

Re: So what's the answer?

like wire puts a spyware bot on the computer. I scanned my computer with Yahoo Anti Spy and it detected the Limewire but nothing else would...i removed it then Limewire stopped working...

ill take a screen shot and load it up on here.
Thaler
Premium
join:2004-02-02
Encino, CA

Re: So what's the answer?

The newest versions of LimeWire? Wierd...I think I would've heard more static on that software if it was still in the spyware market.

Please do put up that SS, I'd like to see.
hottboiinnc
ME

join:2003-10-15
Cleveland, OH
·Time Warner Cable
·buckeye cable

Re: So what's the answer?

here is the Limewire scan...just did it tonight.
Thaler
Premium
join:2004-02-02
Encino, CA

Re: So what's the answer?

Okay, well...it's listed under Adware, but do they have an explanation as to the reason why it's "spyware"?

I haven't heard of any phone-home activities, aside from the file sharing that normally happens on it.
hottboiinnc
ME

join:2003-10-15
Cleveland, OH

1 edit

Re: So what's the answer?

i'll take another one of the "view details" and post that too.
hottboiinnc
ME

join:2003-10-15
Cleveland, OH
·Time Warner Cable
·buckeye cable

Re: So what's the answer?

here is the details on Yahoo Anti-Spy
Thaler
Premium
join:2004-02-02
Encino, CA

Re: So what's the answer?

Now that is bunk...I haven't recieved one pop-anything ad on my Limewire machine at all. Could this just be Yahoo using old definitions back in the days of Limewire's adware phase?
hottboiinnc
ME

join:2003-10-15
Cleveland, OH

Re: So what's the answer?

dunno...thats a new update that i used to scan with. Although if i remove it Limewire stops working and i have to redownload it.

but i have MS Anti-Spy and it doesnt show up in there.

fartness
Computersoc Dot Com
Premium
join:2003-03-25
Look Outside
clubs:
DC++ and i2Hub.

tim_k
Buttons, Bows, Beamer, Shadow, Kasey
Premium
join:2002-02-02
Stewartstown, PA
·Millenicom
·WildBlue

said by Fountainhead See Profile:

Which P2P App does not load up your computer with spyware and malware?
»www.spywareinfo.com/articles/p2p/ Personally, I use Winmx.
psiu_nws

join:2004-01-20
Plymouth, MI

Re: So what's the answer?

Same here.

EnzonE

join:2000-03-23
Indiana, PA
I'll second that! =)
Thaler
Premium
join:2004-02-02
Encino, CA

I Didn't Need to Read...

...to see that KaZaA was pure crap. After seeing the "fun" my friends PCs went through, and the blurb about the net on the software, I knew well enough to keep this sh*t off my PC.

I mean, how many Ford Pinto fireballs do you need to see in order to determine that it might not be the safest car in the world?

Pz_

join:2001-03-31
Brownsburg, IN
clubs:

Re: I Didn't Need to Read...

I've seen my share of Pontiac Fieros burn up as well.

Looking back, you'd think people would have known. I mean, its sort of in the name.
AEKDB

join:2004-03-07
Towson, MD

Good Work but....

Good work...but my heavens, how does he have time for this?

fegul
Premium
join:2004-08-23
united state

Re: Good Work but....

said by AEKDB See Profile:

Good work...but my heavens, how does he have time for this?
He's a professor, they always have time j/k
--
|Networking Help|My Blog|
ross

join:2000-08-16
·Digizip

Re: Good Work but....

said by fegul See Profile:

said by AEKDB See Profile:

Good work...but my heavens, how does he have time for this?
He's a professor, they always have time j/k
You mean their TAs always have time, don't you?

Rogue Wolf
Ate The Last Of The Pumpkin Pie

join:2003-08-12
Troy, NY
·RoadRunner Cable

And if the party of the first part....

Really, is anyone surprised? Companies pack these EULAs so full of legalese and double-speak that we could read all the way through one that consigns our first-born children to ten years of servitude and not actually realize what we're agreeing to. And now they're just making them so long that most sane human beings simply don't have the patience to read completely through them.

I still say there needs to be a law stating that every program included in a bundle must have it's own EULA (preferably 500 words or less) and agreement box. Of course, then companies would just call the spyware "components".
--
I do NOT trust the Internet. Spread tin cans and string!
Thaler
Premium
join:2004-02-02
Encino, CA

Re: And if the party of the first part....

said by Rogue Wolf See Profile:

Of course, then companies would just call the spyware "components".
I think they do that already.
dave
Premium,MVM
join:2000-05-04
not in ohio
·Verizon Online DSL
·Verizon FIOS

said by Rogue Wolf See Profile:

I still say there needs to be a law stating that every program included in a bundle must have it's own EULA (preferably 500 words or less) and agreement box.
Great, there are about 1500 programs in Windows XP, so that's 1500 EULAs to agree to, and 750,000 words to read.

Rogue Wolf
Ate The Last Of The Pumpkin Pie

join:2003-08-12
Troy, NY
·RoadRunner Cable

Re: And if the party of the first part....

said by dave See Profile:

said by Rogue Wolf See Profile:

I still say there needs to be a law stating that every program included in a bundle must have it's own EULA (preferably 500 words or less) and agreement box.
Great, there are about 1500 programs in Windows XP, so that's 1500 EULAs to agree to, and 750,000 words to read.
I really meant this as an entirely separate application (not written by the designers of the main program), but I see your point. Might have to hammer out a different definition.
--
I do NOT trust the Internet. Spread tin cans and string!

Nerdtalker
Working Hard, Or Hardly Working?
Premium,MVM
join:2003-02-18
Tucson, AZ
clubs:

said by Rogue Wolf See Profile:

Really, is anyone surprised?
No, it's been common knowledge for a while now that nearly all of the "popular" P2P programs bundle crapware.

This report, however, is a very nice run-down on exactly what is installed and how they can legally install it.
--
Touch a thistle timidly, and it pricks you; grasp it boldly, and its spines crumble. -William S. Halsey

iPod Shuffle=iPos


I'm testing Gmail's spam filters: Broadbandreports1@gmail.com
Spam: 2785
Thaler
Premium
join:2004-02-02
Encino, CA

Re: And if the party of the first part....

said by Nerdtalker See Profile:

This report, however, is a very nice run-down on exactly what is installed and how they can legally install it.
Blah, how useful is that knowledge? Let me know when someone finds a legal loophole that allows me to put my foot up spy/crapware vendor's asses w/o legal repercussions, then we'll talk.

Tsume

join:2004-02-23
Johnson City, TN

Only 182?

Wow, ONLY 182 pages?

Rama767

join:2002-08-02
White Plains, NY

Re: Only 182?

182 ON SCREEN pages. That's totally acceptable IMHO, and if you don't have the patience to read through it then don't click 'yes'.

OK, now to turn off the sarcasm. I just wanted to say that there must be plenty of intelligent minds at work on this website. However, it doesn't seem that we all really put our minds to work to carve out a solution. Fine, we may not have millions of dollars, or tons of political power to start strong right away, but I think if there was some way to synthesize our ideas to solve this problem of adware/spyware/crapware I think we could actually make a difference. I, personally, have never been affected by adware. But that's because I use due diligence. But I truly believe that the sleazy tactics these companies use, no matter how 'legally legitimate', are just down right pathetic. The interesting thing is that if they were to take two seconds to think about how google has integrated ads into a multi billion dollar revenue stream, you'd think they would have changed their practices by now.

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Erie, PA

Re: Only 182?

It's as simple as this:
If the company feels the need to have 182 pages of legal document to describe the license for a piece of software, then it's pretty safe to assume they are hiding something and as such you can't trust the software.

You can solve many of life's problems by just staying as far away from lawyers as you can.
--
Dear Hollywood:Shut up and dance monkey!
dave
Premium,MVM
join:2000-05-04
not in ohio

Re: Only 182?

Good point. If it looks that much like they're trying to screw you over, they are.
bedelman
Premium
join:2004-06-20
Cambridge, MA

Finding time, and finding problems

Howdy folks. Glad to see this is of interest.

AEKDB, for better or for worse (perhaps worse!) I choose to spend a fair amount of discretionary ("free") time testing this kind of software, and recording what I find. I think I'm not alone in considering these installation practices important, and I actually do enjoy technical research and writing.

Fegul, I'm not a professor, just a grad student.

And on substance: I agree that the extreme length of many EULAs is cause for concern. But there's more to talk about than just length. Here are six other problematic characteristics that I observed in writing the piece and flipping through the screenshots:

1) Defective EULA content (e.g. missing links, broken links) (problems seen with Kazaa's Altnet and Claria, Morpheus's DirectRevenue)

2) Defective EULA formatting (e.g. missing section headings, or paragraph otherwise run together) (Kazaa's Claria, iMesh)

3) Misleading EULA presentation (e.g. putting multiple EULAS in one long box, without warning) (eDonkey, Kazaa's Altnet / MySearch)

4) Failure to show EULA, merely linking to EULA (Kazaa's main EULA and Altnet EULA)

5) Exceptionally dubious EULA presentation (e.g. tall narrow box w/ 3 words per line) (eDonkey)

6) Objectionable substantive terms (e.g. restrictions on how users can remove software [Kazaa's Claria, Morpheus's DirectRevenue], failure to describe software's purposes in even the most general terms [eDonkey's New.net], etc.)

So there's lots to think about, even beyond the very serious problem of extreme length.

GemSnake
Premium
join:2000-10-19
3rd layer
clubs:

Re: Finding time, and finding problems

Kudos, buddy! We appreciate your discretionary time What are you majoring in?
--
"In a fight between you and the world, bet on the world." - Franz Kafka
Indymike

join:2004-12-06
Indianapolis, IN
·Covad Communications

Ben,

I for one would like to thank you for the time and effort that you have put into all of this. I'm amazed at what it takes to understand, let alone read, just ONE of these EULA's that some judge somewhere said "that's all that's needed".

By the time i get home after cleaning up PC's infected with most of this software, the last thing i want to do is play with it somemore!

Good job! I hope you can continue to keep doing it. Somewhere, sometime, somehow, all of this work is going to pay off for all of us (internet users) and I just want to say thank you!

Andrew J
Premium
join:2001-11-09
Lancaster, PA
clubs:
·Comcast
·Vonage
·Verizon Online DSL

Thanks Ben. I wouldn't read them since I wouldn't believe what they say.
"My testing uncovered no bundled software installed without at least some disclosure......"
I'm really shocked by that finding.
--
Best Team.

Wills

join:2001-01-03
Port Charlotte, FL

Re: Finding time, and finding problems

said by Andrew J See Profile:

I'm really shocked by that finding.
Sometimes the best place to hide something is in plain view...

Maybe 1 person out of 100 actually reads or digests these things.
--
I have a shaved head, a goatee, and tatoos. Don't you realize the rules don't apply to me.

David
No,there is another.
Premium,VIP
join:2002-05-30
Granite City, IL
clubs:
Nice research..

burgerwars

join:2004-09-11
Northridge, CA
·voip.ms
·RoadRunner Cable

We're doomed.

It makes me think that the recording industry is wasting their time suing P2P companies, since these same companies are killing themselves putting this cr*p in their software.

If you're thinking of installing this junk, do it on some old PC that you no longer have much use for, since this junk will slow it down into a useless state anyway.

Also, learn about system restore, setting restore points, etc., so you can go back to a previous version of your registry. This should help you if your PC gets infected with spyware/adware that you just can't remove or clean.

But once the spyware/adware/virus people figure out how to destroy your restore points, we'll all be doomed.

boiler
Premium
join:2002-01-27
J9H 1xx

Who is Mr. Edelman, really?

This guy works for Limewire. Read the fine print at the very bottom.

"Disclosures

This article builds on paid consulting I conducted for LimeWire. I thank LimeWire for their willingness to let me share my findings with the public. ..... "

However scientific his procedures were they would most certainly be skewed if he is on Limewire's payroll.

As a law student he should know better. Or maybe that is just where the current state of law education stands these days.

MeNaCeDog

join:2001-04-04
Las Vegas, NV

Re: Who is Mr. Edelman, really?

oops i didnt' see this before i posted mine. yes i noticed and how many drone customers just look at what he says as gold......

HangTheBums




thumbs down from:
Andrew J See Profile

Criminals exploiting other crimnals - what a hoot

Ya gotta laugh at how dumb Pirates are to think the P2P facilitators of theft would be doing this out of kindness. It should be blatantly obvious why the Net has gone to Hell in recent years when the only interest is the love of money. With any luck these scumbag P2P facilitators will lose all assets obtained thru criminal activity and they'll get 10 years minimum in a hard labor federal prison.

And EULA's should be banned from law IMNHO. If ya wanna sell software or online services then state and federal laws are all that apply, not some trumped up sh*t like MICROSUCKS and others develop to compliment their violation of anti-trust laws.

MeNaCeDog

join:2001-04-04
Las Vegas, NV

anyone read why he did this?

He was paid by limewire at the bottom of the page it explains it all. he is just making limewire look better than it actully is.
alexeck

join:2004-12-20
Clearwater, FL

Re: anyone read why he did this?

I think in the past Limewire was rumoured to have some stuff (like DlDer), but AFAIK it's clean now. We don't currently have it listed in our database.

One note on Ben: He is a very reputable antispyware fighter. He does expert witness work and some consulting, but his primary gig is being a grad student at Harvard. He was one of the first to document the WMP 9 media exploit, the google blogger drive-bys, has done the only known research on how spyware companies get funded, etc. It's worth reading through his site at www.benedelman.org.

Alex
Sunbelt Software
Forums » P2P Apps: Spyware, EULAs Explored


Sunday, 08-Nov 17:18:55 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.