Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CNET Injecting Malware into Downloads

insecure.org

Post reply on HN
Print view View original

61–70 of 80 posts

Re: CNET Injecting Malware into Downloads

#61

Post by Georgiy »

easy_rider wrote: post #7

CNET was the top choice for me back 10-12 years ago whenever i wanted to download a utility / piece of freeware/shareware. Of course when their market share went down... they had to change their business-model...This is just the next step after bloating their pages with ads. I'm guessing that not the same people are in charge as those who were in their glory days:_)

I'm surprised software catalogs are still alive :D Especially when you can get literally everything you need from torrents with keygens/cracks.

Re: CNET Injecting Malware into Downloads

#62

Post by colkassad »

nodata wrote: post #50
colkassad wrote: post #35

Earlier quoted context omitted.

I think the Java runtime installer asks to install a toolbar. There is something else that I can't recall (flash runtime?) that asks to install the Ask.com toolbar all the time as well. Some popular open source projects too (PDFCreator).

The difference is that Sun adds the toolbar installer itself (and earns the revenue from it).

My comment was in response to the fact that everyone is doing it, including software authors such as Sun.

Re: CNET Injecting Malware into Downloads

#63

Post by marshray »

Georgiy wrote: post #58
marshray wrote: post #46

Earlier quoted context omitted.

Welcome to HN Georgiy. Here's the deal: That still doesn't mean it's not crapware. You mention the difficulty of funding your download site (built almost exclusively on supplying other people's free content). I can't imagine what the bandwidth costs must be on a site like that. I'm sure there are plenty of other visitors on HN that are familiar with this issue and are daily encountering similar ethical decisions abou…

It's just my humble opinion as an internet marketer :) i'm not related to CNET atm, worked there as tech for some time. And i think it's really an ingenious idea with wrapper, maybe not so good with all that toolbars. Maybe it's crapware and they lose like all geeks, 20% publishers and 30-40% users maximum - they still will be like x10 profitable than before. Don't get me wrong but Google wasted like hundreds of mill…

But it's not an ingenious idea; malware has been doing that kind of thing forever.

Downloading and installing software is an activity that is fraught with peril. The authenticity of the app you're downloading is critical and almost all the security properties depend on it.

If you think that breaking app authenticity is a great marketing opportunity, well, your brand will do no business with me or those I advise.

Re: CNET Injecting Malware into Downloads

#65

Post by pvarangot »

Zirro wrote: post #31
dendory wrote: post #20

There's three things here. First, adding a toolbar and screwing with user settings is freaking lame, but everyone does it and it's something that's been an accepted way to monitize software development. However, injecting that into other people's software is low, especially if the developers aren't aware of it. CNET should be ashame. Lastly, the way they present it to users should be plainly criminal. There's a way t…

"but everyone does it and it's something that's been an accepted way to monitize software development" No piece of software that I have installed during the past two years has done so, and I sure wouldn't accept it as a way of funding development. I'd rather pay for a product in that case. Can you give a few examples from your list of "everyone"?

jDownloader.

Both of the free antivirus I know about for Windows (AVG and Avast).

Re: CNET Injecting Malware into Downloads

#66

Post by DanBC »

skitzzo wrote: post #12
DanBC wrote: post #5

Previous post was mentioned on HN ( http://news.ycombinator.com/item?id=3317121 )

Yeah, I guess I wasn't paying enough attention but this was the first I'd heard of it.

Sorry, I wasn't meaning to say "This is already on HN", but more "Here's some more reading for people who are interested".

I need to practice my tone and style a bit.

Re: CNET Injecting Malware into Downloads

#68

Post by DanBC »

kajecounterhack wrote: post #15
karolist wrote: post #8

Earlier quoted context omitted.

But this is ignorant and not true.

For laymen's purposes it pretty much is, though. When was the last time anyone on Linux/OSX got some adware / popups? I've also never heard of antivirus for Linux. Which doesn't mean there aren't viruses, it means it's not a concern on the most part.

Maybe you don't remember the root-kitted Redhat boxes in Korea which were, for some years, responsible for a surprising volume of spam.

Linux distributions then started shipping with un-needed services turned off, and increased broadband meant home machines were attractive targets for botnet malware.

In the past anti-virus on Linux tended to be used by people with a Linux mail server and MS Windows clients.

But, to bring it back to this particular discussion: It'd be fairly easy to wrap malware around a Mac OS X software. The user would need to click and give it permission to install. But how many Mac users run as admin and would just click the warning anyway?

Re: CNET Injecting Malware into Downloads

#69

Post by skitzzo »

DanBC wrote: post #66
skitzzo wrote: post #12

Earlier quoted context omitted.

Yeah, I guess I wasn't paying enough attention but this was the first I'd heard of it.

Sorry, I wasn't meaning to say "This is already on HN", but more "Here's some more reading for people who are interested". I need to practice my tone and style a bit.

No worries. Can't have thin skin on the interwebz :D

Re: CNET Injecting Malware into Downloads

#70

Post by monochromatic »

Deestan wrote: post #16
suprgeek wrote: post #11

What good alternatives would people suggest? What should be the "goto" site we could suggest to a novice for finding a clean copy of almost any software...any suggestions? (Assuming that an expert user would straight to the source website)

Any good "goto" site won't stay that way for long, because it will automatically have strong incentives to try tons of stupid crap like this. But you can use these sites for software lookup. Then you check the listed developer name, Bing your way onto their website, and look for a download link.

Bing? What happened, did some malware install a Bing toolbar on your computer or something? :)
Post reply on HN