Live data from Hacker News

CNet's Download.com now bundling Nmap with malware

seclists.org

11–20 of 71 posts

Re: CNet's Download.com now bundling Nmap with malware

#12
This is one upside to using trusted repositories with signed applications in the Linux Distribution model. It's not perfect but at least this kind of sadness doesn't happen. There's no good reason this couldn't be done for Windows as well; it's just that users are conditioned to download from assorted random sites to collect the apps they want.

Would be a good community project which would likely attract the kinds of people who use nmap anyway.

Re: CNet's Download.com now bundling Nmap with malware

#13
Shit. I just found that my application which was updated last week and is the 10th most popular system utility app on Download.com is also being similarly bundled [1]. This was not the case last week.

I think Softpedia and FileHippo are the only big sites left not doing this ridiculous practice. I'm debating whether or not to pull the application listing. What do you guys think?

[1]: http://download.cnet.com/EasyBCD/3000-2094_4-10556865.html

EDIT

The benefit of our freeware not being open source is that we retain full control over distribution and packaging. Unlike nmap and others, we actually have a legal right to demand that CNet, et. al. either host the unaltered EXE or pull their listing.

I have just sent CNet a "cease and desist"-ish open letter, which we've also published on our blog. We will be forwarding this to any and all download sites we find bundling EasyBCD with their intrusive downloaders and installers, as that goes explicitly against the products' licensing agreements, which are there to prevent exactly this type of behavior.

Link: http://neosmart.net/blog/2011/open-letter-to-cnet/

tl;dr of link: C&D bundling of EasyBCD with installers and downloaders or pull the listing.

Re: CNet's Download.com now bundling Nmap with malware

#14

Shit. I just found that my application which was updated last week and is the 10th most popular system utility app on Download.com is also being similarly bundled [1]. This was not the case last week. I think Softpedia and FileHippo are the only big sites left not doing this ridiculous practice. I'm debating whether or not to pull the application listing. What do you guys think? [1]: http://download.cnet.com/EasyBCD/…

I'd personally pull it. People are going to download it and it will then look like YOU bundled it this way.

Re: CNet's Download.com now bundling Nmap with malware

#15

Shit. I just found that my application which was updated last week and is the 10th most popular system utility app on Download.com is also being similarly bundled [1]. This was not the case last week. I think Softpedia and FileHippo are the only big sites left not doing this ridiculous practice. I'm debating whether or not to pull the application listing. What do you guys think? [1]: http://download.cnet.com/EasyBCD/…

Most people would think it was you who bundled those extra "apps", not download.com. To protect your app's brand I would remove it from download.com

Re: CNet's Download.com now bundling Nmap with malware

#16
post #7

What an egregiousness abuse of user trust. I hope this destroys their brand forever.

Until this story hits mainstream, there's no hope of that happening. Even if it does hit mainstream, you need a bunch of talking heads that are able to explain to luddites what the implications are.

Re: CNet's Download.com now bundling Nmap with malware

#17
post #3

Earlier quoted context omitted.

And to think that Microsoft is paying them for it. O how the mighty have fallen.

Worth noting that CNet is under new owners (CBS Interactive).

Worth noting that if enough bad PR gets into the lamestream media about this it could be a death knell. CBSi doesn't exactly monetize well, and CNet has always bled money.

Re: CNet's Download.com now bundling Nmap with malware

#18

Way to destroy one of the remaining strong brands from the (relatively) early days of the web, CBS. (CBS owns CNET.) Hope it was worth it.

Not that I want to defend CBS, but CNet pretty much runs itself, and had run itself into the ground way before CBS "saved" it.

Re: CNet's Download.com now bundling Nmap with malware

#19
This, and preinstalled "crapware" on newly bought computers/phones happens because vendors have no incentive not to do it, except perhaps out of goodness their heart. Yes, it disgusts me too, but moral issues aside:

(a) Vendors are looking to make money (simply speaking) and bundling crapware is a low-hanging fruit to do so. They have a choice between making $X per customer and $X+30 cents. Which choice should they pick?

(b) Users are not savvy or discerning enough to notice that they are getting the said crapware. We, techies, care. Do mainstream users care? They buy a new computer (or download an app), and they get the computer or the app, as far as they are concerned. How can grandma know that the "monthly anti-virus subscription" popup is "unwanted"?

People will buy/download from $VENDOR with or without crapware. Companies want to make more money and they have no reason to be "good." They gain more than they can lose. Until these variables change (say, if users revolt, or class action suits arise, or $CONGRESS_PERSON complains, or advertising revenue somehow diminishes, etc.), this will sadly keep on happening.

Re: CNet's Download.com now bundling Nmap with malware

#20
This happened to software from my company (ActiveState), and we made a request to remove the extra wrapper bits (very much not the user experience we wanted), and CNet complied. Someone just has to ask. [edit: of course, we did also find out _after_ the fact, which we didn't appreciate. We would have pulled our various bits, had they not complied ... but they did]
Post reply on HN