Zone Labs *might* fix bug

Zone Labs, the creators of Zone Alarm and Zone Alarm Pro, (and other products I'm guessing) was notified of a bug in their free version of the firewall. This is nothing unusual, bugs are reported all the time. The problem is that millions of people (including me) use this software to protect themselves from the ether beyond their ethernet, and they were not going to fix it.

See the story at Security News Portal

I was just wondering what all you guys thought about this: Whether Zonelabs should offer support and bugfixes for their free product, or just say you're out of luck, cheapo, buy the full version.

I was watching TSS the other day, and they said that ZoneAlarm changed their mind when they found out that TSS was going to run the story,and that they would have it fixed in a few weeks(this is what they claim).

Yes, i think if you are going to offer a "security product", then you need to make it secure as possible (including bug fixes) reguardless of whether it's free or not.

Yep, that's what the story said,

Quote:

---

"Zone Labs will make a fix for its free ZoneAlarm product available in the next two weeks," the company said, in a statement that was also published to the BugTraq list late Wednesday night

---

But it is still worrysome that they might not have done so, if the media hadn't said anything.

That's really cheap. I think that if they're going to offer a free firewall that tons of people rely on then it's their responsibility to patch it. Apparently they got that same message from a lot of people because now they've agreed to release a patch for it in two weeks, so that's good. I like how they quoted Symantec with

Quote:

---

go to hell and buy the registered version because they don't support freebie users

---

Quote:

---

But it is still worrysome that they might not have done so, if the media hadn't said anything.

---

I agree, this is why i believe media types are needed whether you love them or hate them.

I love 'em most of the time.....until they use the word "hacker" to refer to a cracker....or when they freak out about some SK's threatening to hack 6,000 geocities or angelfire websites :p

I think zonelabs attitude should be taken as all the reason in the world to use a different product.If i heard the same from Outpost, it would be off my windows box in a minute.

hmm.. whilst I agree that

Quote:

---

i think if you are going to offer a "security product", then you need to make it secure as possible (including bug fixes)

---

I'm not sure I totally agree with the sentiment

Quote:

---

reguardless of whether it's free or not.

---

if the essential purpose i.e. a firewall, of the free product is as good as the paid product then theres no need to upgrade to the paid product - agreed?
Commercially speaking this is suicide for a company... I can understand where Zonelabs is coming from when they said in the article that

Quote:

---

the cost to upgrade a free product would be prohibitive

---

I mean thats partly the reason why you pay for a product - to receive the updates... few things are free in this world so what do you expect.... I mean if the exploit was a fairly major one yeah ok fix it ASAP... but it doesn't sound like it was that major....

but then the paranoid in me shouts 'f***ers fix the damn thing now'.... I think I'm turning into something of a corporate whore :( .... should probably have a chat with Korpdeath :D

<scratches head and wonders off>

Z

Quote:

---

I think that if they're going to offer a free firewall that tons of people rely on then it's their responsibility to patch it.

---

I disagree. They are in business to make money. They would prefer to actually sell their product and provide the free version more or less as a hook to reel in new customers. Hopefully you will like the protection of the free product but want the bells and whistles of the full package so you'll upgrade to a paying customer.

The fact that there are so many cheap people who only want to use free products doesn't obligate Zone Labs (or other free software providing companies) to cater to them. They have a base of registered, paying customers that they have to service.

They are still providing a service IMO. If they didn't offer a free version how many more machines would not have firewall protection? The people relying on the free one should be thankful for what they have and appreciative if Zone Labs provides maintenance updates or even continues to provide new versions and not try to make demands on the company as if they "owe" something to the community of users that don't make them any money.

Don't get me wrong- I use many freeware products and used the freeware version of ZoneAlarm for quite awhile (I now have the full-blown ZoneAlarm Pro 4). I am not saying companies shouldn't put the software out or that people shouldn't use it. I am just saying that those who use it should not suddenly get some feeling of entitlement that the company owes them more on top of providing free software.

Quote:

---

if the essential purpose i.e. a firewall, of the free product is as good as the paid product then theres no need to upgrade to the paid product - agreed?

---

Yes i agree, to an extent.

I mean if it's a security flaw, then i feel they should fix it, or at the very least make an effort to tell all those who are downloading the free one from their site of the hole.

If it is a special feature or something, then go out and get the paid version, there is no obligation on their part to offer anyone that.

I'm still pleased that they are willing to offer a free version although my choice is Outpost. So yes, i see your point.

Ouch....I'm not the type that usually has the entitlement mentality that we've all encountered....but it seems like it would be ethical of them to make their product secure. I wasn't thinking of "all the cheap people" but more along the lines of kids who's parent's won't give them any money for the computer but would like to secure it. Or college kids that barely make enough money for school and can't afford anything but like to have some basic stuff like firewall and antivirus. True that they don't *have* to offer the firewall for free but since they do, it only makes sense that it would be secure....

Hey, I just thought of a good product pitch line, you can download and use our free version of ZoneAlarm, but there are several security holes and bugs in it, however if you fork out 100$, we will gladly allow you to use our professional version, for one year of course.

There are always reasons and incentives to upgrade or buy a full or new version, I never thought of leaving bugs and security holes in products before, but I think that this may actually be a good idea, from the business point of view. Instead of having 30 days, or limited features in this firewall, it doesn't block port 6666 or netbios, and it freezes up the computer if issued the following command, "blah". What do think of something like that ?

LOL @ The3ntropy... well it's a novel idea I'll grant you that.

Keezel... I can see you're point but like Tony says

Quote:

---

They are in business to make money

---

. Also at the end of the day the paid version of ZA is only something like $40 for a year which really isn't that much. Are you really telling me that a college student can't afford just over $3/month??? I spend more than that (the equivalent in £ anyway) on a single pint of beer.

I agree that it would be ethical for Zonelabs to make the free product secure... but... well put it this way how many companies do you know that put ethics over cash??? We gotta be realistic about this.

Z

lol, very good point Zonewalker. I understand that they're in it for money, and I guess I understand how ethics isn't exactly a top priority for business these days. I could probably spare 3 bucks a month, but it would actually cut in on my meal money.... I am seriously "cash deprived" for the moment. I can hear the word "free" from almost a half mile away now ;) . I guess I could deal with a buggy (free) firewall. However, if it was disabled just because someone gave the command "blah" I would be seriously pissed :p .

One factor to remember here is that Zone Labs makes the free version available to advertise their Pro version. This has been successful in my case, since I have bought several copies of ZA Pro after using the free version and satisfying myself that it was a pretty good product. With this in mind, it seems that it would be their best marketing strategy to fix a know bug in the free version. Now, it may be that sometimes the cost of a fix would be prohibitive. In than case, they should notify users that the bug exists and give some time frame for a fix, tomorrow, next week, when hell freezes over, etc.

Since I found that it was free I went on a downloading spree for stuff that I'd like all on one CD. (yes, hacking tools included bc they don't exactly take up much space and can come in handy every once in awhile... :)). I found another free firewall that apparently has higher ratings than ZA: Tiny Personal Firewall (don't let the name fool you). You can download it at http://www.tinysoftware.com/home/tin...=tpf5-download . I also found a free antivirus that I like because they don't require anything for you to download it. It's called Avast! and I have friends that have used it before and really like it. I suggest checking this out also. You can get it at http://www.alwil.com/en/default.asp . Note that the site seems to be moving slowly today....possibly from the hacker (cracker) games that have been going on. If anyone else has had some experience with either of these two tools, please feel free give a review.

I'm using avast right now, I've had it on my box for about a year now. The only problem was that I couldn't figure out how to update the definitions, so although it was free, it was of no use to me until about 2 months ago when I found out how. (I realize that a comatose simian infant could have found the menu option to do it, but I am that stupid at times)

Anyway, I dont know what I'd do without a free virus scanner, and if I had to pay for it, I'd look for another. If I couldn't find a free one, I would definitely pay for one, but so many people out there wouldn't. It's too bad they aren't better informed.

Everyone so far has a pretty good view of things. From my perspective giving a free Firewall is completly "cool". Even it it had bugs in it , I would still consider it cool. Coughing up $100.00 dollars is not alwayz that easy. Especially when u don't have a job.

Im not using ZoneAlarm but I hear it's pretty darn good. If i did have a job I would buy the Pro version because $100.00 compared to the price it might cost to repare my box is no contest.

I think you should USE A DIFFERENT PRODUCT. (Sorry for the shouting) I've always thought ZA is a pile of crap and there are various free products that do a much better job. *cough* Outpost *cough*

Now as far as finding a bug in your free software and you not wanting to fix it..... well I think that sets a precedent that all of your products will follow. The free product doesn't have to be "as good" as the paid for product but it shouldn't be released if it gives you a false sense of security. MIsleading end LUSERS is a bad idea for everyone.

Some further digging seems to suggest that maybe Security News Portal has an axe to grind with Zone Labs or it was just a boring week in the press and they felt they needed to sensationalize this for good headlines.

The flaw is not in ZoneAlarm, it is in Windows. Zone Labs did not say "screw you- go buy the Pro version". What they said was that their customers who use the Pro version did not need to worry because it has additional functionality which protects them from this Microsoft flaw.

That got turned around and spin doctored in the press and on these message boards to Zone Labs essentially telling everyone to go buy the Pro version and that they refused to update or maintain the free version.

In the end it became enough of a public relations nightmare that they agreed to "patch" the freeware ZoneAlarm. The "patch" will actually just be an update adding the functionality from the Pro version to the free version to also protect the freeware users from Microsoft's programming flaw.

Here is a link to a more detailed story on the subject: ZoneAlarm "Flaw" is a Bunch of Hooey

Thanks for that update on the issue Tony. The article shows just how quickly some media outlets will grab a headline and run with it. They don't spend the time to find out all the information needed about it before they start a 'panic' scenario.

As stated in the article

Quote:

---

This all started when someone posted a hypothetical password theft exploit to Bugtraq. In his hypothetical exploit, the person speaks of a rogue application stealing the user's passwords or credit card information. This application sends a command to Windows to start the user's web browser and load an internet address. In the poster's example, the rogue application sends the information that it had stolen as part of the request to the server. The person claimed that this constituted a bug in the core design of ZoneAlarm that allows software to bypass it and access the internet.

In fact, all the person had found was a feature of Windows that is commonly known and well documented. If a program gives the Windows shell a command, and the command starts with http://, Windows determines correctly that the program wants the user's web browser to load a web page. Windows checks the registry to see which web browser the user has configured to handle web surfing, then loads the web page in that browser. If the user has set their firewall to allow their web browser to access the internet, then obviously there will be no alert.

---

It doesn't really have anything to do with ZoneAlarm's product; it's more of a Windows problem (...agian).