Live data from Hacker News

CNet's Download.com now bundling Nmap with malware

seclists.org

21–30 of 71 posts

Re: CNet's Download.com now bundling Nmap with malware

#21
I remember the first time I found Sun bundling the Yahoo! toolbar along with the Java runtime.

I knew at that moment that Sun had lost its self respect and had no credible strategy for Java. I immediately went back to developing C++ for MS Windows and Perl for Linux.

Re: CNet's Download.com now bundling Nmap with malware

#22
I'm confused. Did Microsoft make a deal with Cnet to include this on every download, or did a third party do this? StartNow (startnow.com) is run by an independent company:

"The StartNow Start page is owned and operated by Zugo Ltd, a start page platform company. Our start pages are usually official operated on behalf of one of our clients or partners. Some pages may be "unofficial" and in support of/dedicated to improving the user experience for an existing product or extending a product's existing functionality."

This sounds like really bad PR for Microsoft. I wonder what they will do.

Re: CNet's Download.com now bundling Nmap with malware

#24

Shit. I just found that my application which was updated last week and is the 10th most popular system utility app on Download.com is also being similarly bundled [1]. This was not the case last week. I think Softpedia and FileHippo are the only big sites left not doing this ridiculous practice. I'm debating whether or not to pull the application listing. What do you guys think? [1]: http://download.cnet.com/EasyBCD/…

You can certainly put such demands into an open source license.

Perhaps the easiest way of doing it is to actually put the restriction on the trademarked name, forcing them to distribute it under a different, likely unrecognized, name if they want to change the officially distributed package.

Re: CNet's Download.com now bundling Nmap with malware

#25
post #4

Off the topic here, are there still many people download software programs from download sites, like download.com, brothersoft.com or softpedia?

Yes. Download.com is the 173rd highest traffic site in the world. They're probably pushing over 100-200k downloads a month at least. Nothing compared to the Apple or Android app stores, but still a significant number.

Assuming an average download time of 1 minute, that's merely 5 or so simultaneous downloads at any particular point in time. That is nothing.

Re: CNet's Download.com now bundling Nmap with malware

#26
post #20

This happened to software from my company (ActiveState), and we made a request to remove the extra wrapper bits (very much not the user experience we wanted), and CNet complied. Someone just has to ask. [edit: of course, we did also find out _after_ the fact, which we didn't appreciate. We would have pulled our various bits, had they not complied ... but they did]

Their reputation is already tainted. Especially since your company is finding out after the fact.

What stops them from doing it again a month later?

Re: CNet's Download.com now bundling Nmap with malware

#27
C|Net / download.com has been doing this a while. They're even doing it to companies that pay to have their product(s) promoted on download.com. From what I understand, a C&D isn't necessary. If you email cnet-installer@cbsinteractive.com, they will remove the wrapper from your application.

BTW, here's a discussion about this from ~three months ago:

http://news.ycombinator.com/item?id=2910554

Re: CNet's Download.com now bundling Nmap with malware

#28

Shit. I just found that my application which was updated last week and is the 10th most popular system utility app on Download.com is also being similarly bundled [1]. This was not the case last week. I think Softpedia and FileHippo are the only big sites left not doing this ridiculous practice. I'm debating whether or not to pull the application listing. What do you guys think? [1]: http://download.cnet.com/EasyBCD/…

[deleted]
Post reply on HN