21–30 of 188 posts
>Every IM install screen has a decline as well as an accept button, and if the user declines, no software is installed. Which is the default? Decline or accept?
I'd be willing to bet a dollar that InstallMonetizer will tank if they relied on opt-in, but will make bank if they rely on opt-out.
By the way, here's an example of what we're talking about: http://imgur.com/8SGXUPP. Oracle bundles the ask toolbar with Java installs now. This is the default state, i.e., the box is default-checked. Why, users love the ask toolbar, they probably have a 95% install rate!
Good show!
Thanks for this explanation pg This raises a question though: does this company make something that users want? When a user installs a specific program is he/she looking to install other software as well? Is the argument that InstallMonetizer bundles useful software that it feels will enhance the user's life in some way? (going off the adage that the consumer does not really know what they want i.e. they'd just ask f…
>Every IM install screen has a decline as well as an accept button, and if the user declines, no software is installed. Which is the default? Decline or accept?
I dunno, 1. and 2. seem like a cop out to me. When crappy freeware Windows installers provide a checkbox (checked by default, of course) to opt out of Bonzai Buddy or a million Ask.com toolbars or some bullshit malware scanner, they are still shitty and sketchy, and it's disappointing to me to know that YC is now behind a company that makes such software. And saying this crapware is popular does little to assuage my…
Beware that IP addresses are only 32-bit and MAC addresses are only 48-bit. So hashing them individually won't do any good.
Concat them into a single 80 bit value and hash THAT however, and you should be more than fine. Even the 48 bit mac address alone is 281,474,976,710,656 possibilities, and thus likely rainbow-table proof, especially if salted.
IP addresses don't have 32 bits of entropy either for that matter.
I wrote here: http://www.withinwindows.com/2013/01/16/installmonetizer-qui...
Long zheng wrote here: http://www.istartedsomething.com/20130115/y-combinator-is-fu...
I'll respond to each of your items individually.
1. OK.
2. Maybe. Or more likely users are mistakenly installing these applications because the offer screen is made to look exactly like the EULA acceptance dialog seen in every other installer.
But we don't expect this to be fixed. Anti-malware vendors have stepped in and are improving their definitions to catch this garbage but it's very much a cat/mouse game. (IM has been detected a few times, btw.) IM is very aware of this "threat" and designed their system around random domain names to mitigate detection issues as they arise. (Think about it -- Does IM, a legitimate company, really need to use fcgoatcalear.us and fcvalcsoi.us domain names? Come on.)
3. No idea where you got this information, given InstallMonetizer bundled software shows no actual EULA. The only EULAs shown during install are ones provided by the package author and the offer advertisers. Can you clarify this point, please?
4. Wrong. Existing IM bundles out there still send PII in the clear. This isn't something they can just flip a switch on and fix. (I saw IM edited their privacy policy to note the new hashing procedures but sadly that doesn't cover the bundles on the Internet today. So it's wrong.)
5. Yeah, I saw the company slip in the "Open-source software is a community product and you may not use our co-bundles with it" line. What a slap in the face of those who use commercially-permissive OSS libraries in their software...