We're not Spyware, dammit! We're going to sue!!!!

Ironic that a discussion started here does bring to light the question of what exactly is spyware. It's interesting to see how much effort iSearch is putting into this. I almost want to say "They doth protest too much, me thinks". Anyways, has anyone had experience with iSearch/iDownload?

Quote:

---

Source: CastleCops

Letter sent to CastleCops

On the 16th of February, 2005, we received Certified Mail from the office of Savrick Schumann Johnson McGarr Kaminski & Shirley, attorneys and counselors at law, Mark D. Hopkins, Partner - Austin Office representing iDownload.com. The letter, dated February 10, 2005 begins:

"Re: Incorrect Classification of iDownload's Product as Spyware & Related disparagement of iDownload"

Rest of the letter in full quotation:

Dear Sir or Madam:

This firm represents iDownload.com with respect to your inaccurate classification of iDownload's software product, iSearch toolbar, by referring to it as Spyware in its description. Specifically, a recent review of materials disseminated by your company, via the Internet, revealed that your company is falsely disparaging iDownload's product, iSearch, in that CastleCops f/k/a Computer Cops, L.L.C. classifies the product as Spyware and articulates that,

iSearch is certified spyware/foistware, or other malware.

Castle Cops f/k/a Computer Cops, L.L.C.'s characterization of iSearch as Spyware is damaging to the iDownload brand. As we all know, Spyware is a phrase within the public conscience that has a specific meaning. A classification of Spyware is usually reserved for those programs that not only have the ability to scan an end- user's computer, but also seek to remain unnoticed or hidden, and also seek to gather personal information such as passwords, account numbers, etc. of the end-user. iSearch does not fit this profile.

iSearch does not qualify as Spyware. iSearch is a toolbar that in no way attempts to remain hidden or evade detection. Continuing, unlike Spyware, iSearch does not gather any personally identifiable information about end users, does not collect data about the user's web usage, does not collect any information entered into web forms, does not share information with third parties, does not send or cause to be sent unsolicted e-mail, and does not install items such as dialers on the end user's computer.

We would request that you correct your disseminated materials immediately to remove any reference to iSearch as Spyware, Foistware, or Malware. To the extent you fail to remedy your improper disparagement of the iDownload brand on or before February 15, 2005, we will take all necessary action against your company to protect iDownload from your continuing tortuous conduct. Should you have any questions regarding the foregoing, please feel free to contact me.

Best Regards,

Mark D. Hopkins

---

*italics added by me.

This is not uncommon now. We saw a similar complaint from WeatherBug, who happens to do business in our community. They have been trying to separate themselves from the nasty spyware name and have also secured council to assist them. In fact, they have petitioned Websense, Spybot and other related products to remove their weatherbug app from their spyware signatures.

But the question remains: are they or are they not spyware? Or is the definition too wide? (perhaps a new class called "damn pain-in-the-ass to remove ware"?)

It's interesting, they go on to explain why they are "not" spyware then all of a sudden lump spyware in with malware and foistware. Call it, "things you may not want ... thymnw-ware" Apperently people installing anti"spyware" tools are hurting business?

I'm going to have to agree with you ms. mittens. There are 3 types of spyware
1-damn pain-in-the-ass to remove ware
2-
3-
You know what, there is only one type of spywere. SO...I guess the definition isn't wide at all.

The real issue is that the law hasn't caught up with technology. It will be difficult to define these things (and letigate with success) until some kind of standards and definitions are setup.

I've been calling junk like this 'sneakware' - since the company sneaks it onto your machine. I firmly believe that all 'sneakware' should fall into the same category as spyware/malware : I didn't ask for the bloody thing, don't want it, and want to be rid of it for all eternity. If spybot and the others are forced to remove it from their definitions, it might be time to write an 'anti sneakware' tool...

Along somewhat the same lines

Microsoft compensates blocked Dutch web firm

http://www.theregister.co.uk/2005/02..._spyware_ilse/

Quote:

---

Microsoft is to compensate Dutch web company Ilse Media because its AntiSpyware software blocked one of Ilse's portals, Startpagina ("Startpage").

---

I wonder if MS would be as quick to act to a US company? The EU courts seem much more anti MS.

Too weird. This just happened.

A co-worker of mine was helping another auditor remove some spyware just a few minutes ago and the co-worker asked me if our corporation has spyware... with my mouth agape, I muttered "Man - I hope not, please don't let it be so." And then he said "Well it might be like WeatherBug - you know, it's kinda like spyware." Weird.

I was also wondering if the law will always be in catch-up mode with technology... I believe it will be. As it seems as soon as one issue is dealt with, 5-10 more develop - like should their be classifications of spyware?

Also - just because a organization accused of using spywarefirm hires a lawyer and the lawyer sends a letter stating their client should not be classified as using spyware, that the accused still isn't a proprietor of spyware. I think there will be more issues like this as companies refine their spyware approach to make it look, feel anything other than spyware, but when analyzed - it's still spyware. Back to the point, just because a lawyer says that their client does not do this or that, does not prove anything. The proof so to speak, is in the pudding. Ask Bill Cosby - he'll tell you.

The dictionary defines spyware as the following:

Quote:

---

any software that covertly gathers information about a user while he/she navigates the Internet and transmits the information to an individual or company that uses it for marketing or other purposes

---

Now, keeping this in mind as we have said this is pretty broad. Vauge even. Nevertheless there are certain key words in this definetion that should be focused on. Covertly. transmits. individual or company. marketing. Some spyware that we have been discussing does this, gator is an example. The weatherbug. I have always thought as these kind of spyware like T.V. commercials. They are for marketing purposes. However just like when you are watching the game, you do not wanna see these commercials. You just wanna watch the damn game. Does this mean we should sue McDonalds for interupting our viewing plesure? No, of course not. Instead let's make TiVo. Should these companies be sued becuase they are practicing there freedom to market there product. No. Let's instead make a anti-spyware. But, as with any other freedom this applies only to the point when it infringes on our peaceof mind. If I wanna crank up some Hatebreed while in my apartment I have the freedom to do that. However by law when that noise becomes a nucience to others then I have broken the boundries and should be punished.

Keeping this in mind now, if a company is infringing on my freedom to pursue pleasurable internet surfing shouldn't the samerules apply? Of course they should. No one has the right to just install something on my computer with out my autorization. That could be compared to someone entering my home and setting on my end table a plethora of ad's and coupons. No one has the right to do that. So where do thesecompaines find the reason to do this to my computer? No where. It should be treated the same as we as humans are treated. I we infringe on someone elses freedom to be left alone then that action should be countered with a just punishment. In otherwords, force them to take that stupid ass spyware off of there software. Make a commercial, make a website about it. There is no need to make hidden packages that infest my computer with crap.

KuiXing,

The sad reality of the world is that there are always going to be cat-and-mouse games. Someone will invent spyware, then anti-spyware. By the time the law catches up with it, there will be something else against from which we will have to defend ourselves. So, until we come up with a better law, we will have to group them as spyware (by "we" I don't mean the AO community, but humankind in general).

BlackIce,

I totally agree with you. I don't want anything-ware on my computer unless I downloaded (or purchased) it and am willingly installing it.

I'm wondering, with these toolbars and stuff for IE, shouldn't there be an installation screen, a EULA, a way of removal, option to not install? IMHO, a production software that answers no to any of these is classified as "sneak"-ware, as BlackIce puts it.

Hatebreed,

Quote:

---

No one has the right to just install something on my computer with out my autorization

---

I would go a little further. Yes, no-one has the right to install something without my knowledge, but also, and maybe more importantly, no-one has the right to retrieve information from my computer without my permission, even if I did allow them to install a toolbar.

Of course, they usually take care of the permission by making you agree to a 100-page end-user agreement, where the finest of fine print says "oh, by the way, we are going to collect all the info we want from your PC".

I would be in favour of a law that forces companies to make you say yes to a big agreement button that says "YES, I allow you to take information from my computer without telling me again". Or better, force them to ask for permission anytime they want to send. That would make them think twice.

Anyway ... that's just my two cents. I'm off to run a spy-sweep again :P

Cheers,

BrainStop

I think the biggest problem in this case is that they're not installing anything without your authorization.

Here are the terms of the agreement - if you're stupid enough to agree to those terms, that's your problem, not theirs.

If you apply for a VISA "with 0% APR", and you don't read the small letters that state that the 0% APR is only for the first 2 months (after that, it's going to be 20%), isn't that your problem?
Try taking that to court - they'll laugh you away.

Quote:

---

By clicking "yes" or downloading, installing or using the Software, you acknowledge that you have read and understand this Agreement and agree to be bound by its terms. If you do not agree to be bound by the terms of this Agreement, you may not download or use the Software, and shall close this window without downloading the Software or clicking yes to indicate your acceptance of this Agreement.

---

It goes on stating that you agree:

Quote:

---

- that iSearch and/or the Software may, without any further prior notice to you, remove, disable or render inoperative other adware programs resident on your computer, which, in turn, may disable or render inoperative, other software resident on your computer, including software bundled with such adware, or have other adverse impacts on your computer.
- to enable iSearch and/or it's partners to provide and operate its Software, iSearch and/or it's partners may collect certain types of non-personally identifiable information about individuals who install the Software. This information may include your Internet protocol (IP) address, your domain, your operating system, your browser version, type and language and your Internet Service Provider.
- Advertisements may be displayed of advertisers who pay a fee to iSearch and/or it's partners and you may be provided with and/or redirected to content of other parties and/or links to third party websites or content or offered the opportunity to download software from third party software vendors.
- iSearch and/or it's partners may use invisible tracking or counting devices known as "web bugs" to register that a particular web page has been viewed and/or "cookies" or alphanumeric identifiers that iSearch and/or it's partners transfer to your computer's hard drive through your web browser to enable iSearch and/or it's partners systems to recognize your web browser.

---

and the list goes on and on...

That's spyware as far as I'm concerned, but that's not the point. I can definitely see why iSearch wants to distantiate itself from "spyware that's installed without your authorization" - I personally make the distinction between "you're infected by spyware because you're a moron that doesn't read agreements" and "you're infected by spyware because you're not that computer-savvy, not because you're too lazy/stupid to read agreements".

If this ever goes to court, it will probably boil down to a discussion on what exactly spyware is. Is it still spyware if you know that it's spying on you (or should know from the agreement you didn't read)?

A new clasifacation on all spyware/malware scanners would help this i think. Maybe a "Questionable Software" tab would be good for programs that do have EULA's and such. That should not hurt the companies rep, and the user would be able to go through and say, "I didn't know/want this installed..." and have the option to select and remove said program. The main reason I use these programs is to see what kind of crap is there... I may have programs on there that I want, and thats ok, I can choose to keep them, but the point is to see everything that isn't easily removed or seen. If you start removing programs like weather bug (compatability problems for us) off the list, these programs become more and more useless to people like me.

Negative, while that is indeed what the EULA claims, it is not necesarily presented at the time of install. iSearch comes as part of the Bube.d aka Win32.Beavis infection that we're seeing more of these days. In fact, having iSearch is one of the main signs I look for to see what I'm dealing with in a HJT log.

I installed the installer for Bube.d on my test box. At no point was I presented with a EULA. Doesn't do much good for all this legalese to exist if the person infected never sees it does it?

Quote:

---

Doesn't do much good for all this legalese to exist if the person infected never sees it does it?

---

You don't have to with this clause:

Quote:

---

iSearch Internet - EULA

By clicking "yes" or downloading, installing or using the Software, you acknowledge that you have read and understand this Agreement and agree to be bound by its terms. If you do not agree to be bound by the terms of this Agreement, you may not download or use the Software, and shall close this window without downloading the Software or clicking yes to indicate your acceptance of this Agreement.

---

I've heard of these ones. Just by viewing a page, or in this case, downloading without even being asked to download, you agree to their terms. IIRC, there used to be software EULAs like this whereby if you broke the seal you agreed to the EULA but it was inside with the disks/cds. (Made it hard to read). Perhaps the precendent that set the reason to have the EULA on the outside of the package should be used against spyware (that is, it's not published visibly where I can review it before agree to it -- like when signing up at a forum).

I'm surprised that no one has challenged these guys on Computer Crimes and specifically USC 1030?

i think we should just lump it all together and call it 'evilware'

Hey, y'all!

From where I sit, iSearch and iDownload are spyware. I have no way of knowing what they define as "non-personally identifiable" information and cannot verify their statements in their license. So, allowing this software to remain on our state-owned systems is probably in violation of FIRPA (that's the Federal privacy act as applies to student information), HIPPA (y'all know what that is) and a number of state statutes.

My users are not authorized to speak for the state and make agreements for the state based on that license agreement. So, that license agreement is null and void. I'm sure our state attorney general (whenever we figure out who that's gonna be), will disabuse them of any high and mighty claims they might have with regard to that.

From my experience to date, iSearch and iDownload are nasty. I find these on some systems where the user would not have purposely downloaded them (they all claim they don't know where it came from -- right). The problem is that getting it off is a real chore. iSearch, especially, hides in some pretty clever places and re-infects the system on the next reboot.

The real test of whether it is malware/spyware/whateverware is that the user cannot simply uninstall the package and have it stay uninstalled. Once on, it takes a concerted, expert effort to remove.

Ms. Mittens:

Quote:

---

I've heard of these ones. Just by viewing a page, or in this case, downloading without even being asked to download, you agree to their terms. IIRC, there used to be software EULAs like this whereby if you broke the seal you agreed to the EULA but it was inside with the disks/cds. (Made it hard to read). Perhaps the precendent that set the reason to have the EULA on the outside of the package should be used against spyware (that is, it's not published visibly where I can review it before agree to it -- like when signing up at a forum).

---

I wonder if there has been a class action lawsuit about the generalized wording of EULAs such that it allows software providers, or anyone who issues EULAs that provides themselves with blanket protection and privileges. I also noticed when reading iSearch's EULA - that they call their software "adware" - which as I believe should be a sub-category of spyware.

Ms. Mittens:

Quote:

---

I'm surprised that no one has challenged these guys on Computer Crimes and specifically USC 1030?

---

Yes - interesting - I wonder what will come from that letter from iSearch's lawyer? Ms. Mittens - ever thought about going into law? I think you and Negative could actually make for some "good" lawyers - no really!

Quote:

---

By clicking "yes" or downloading, installing or using the Software, you acknowledge

---

Emphasis added. This kind of language isn't enforceable in court. There's no way anyone
can know the state of mind of the person clicking the link. What if it is a minor, who
"buys" an expensive item online. The sale is null and void. It's almost as bad as
a cop interrogating you and saying "by not answering the question, you are acknowledging
your guilt. An agreement takes two parties communicating, not one party
dictating terms. "By drinking that beer, you are granting me permission to drug and rape you"
:cool:

Quote:

---

What if it is a minor, who "buys" an expensive item online.

---

rcgreen, oh they have that "covered". CYA, baby, CYA.

Quote:

---

iSearch EULA

4. Children's Privacy Policy and Use - The Software is not directed to children. Because iSearch cannot determine with any degree of certainty whether a child is using a computer at a given time, this "Children's Privacy Policy and Use" explains iSearch's practices regarding the collection and use of personally identifiable and non-personally identifiable information from children under the age of thirteen and provides important information regarding your rights under federal law with respect to such information.

iSearch does not knowingly collect personally identifiable information from children under the age of thirteen. If iSearch becomes aware that it has inadvertently received personally identifiable information and/or data from a user under the age of thirteen, iSearch will delete such past data from its records and will cease to collect any new data from that computer, including any non-personally identifiable data.

Since iSearch does not knowingly collect any personally identifiable information from children under the age of thirteen, iSearch also does not knowingly distribute such information to third parties. Further, because iSearch does not knowingly collect any personally identifiable information from children under the age of thirteen, it does not condition the participation in online activities of a child under thirteen on providing personally identifiable information.

For more information on children's privacy on-line, please visit the Kidz Privacy website, sponsored by the Federal Trade Commission at http://www.ftc.gov/bcp/conline/edcam...cy/index.html.

5. Age Limitation - You must be thirteen years of age or older to download or use the Software. By downloading the Software, you represent and warrant to iSearch and it's partners that you are thirteen years or older.

---

i'd call it "garbageware"- things that arent explicitly malicious or spyware but are installed sneakily(for example, if you dont do a custom install of aim you get stuck with weatherbug), that i dont really want installed on my system, and slow my system down because they insist on loading at startup and running in the background.

everybody start using garbageware now! :D

Well there has been an update to all this. From slashdot:

Quote:

---

Paul Laudanski writes "Slashdot ran an article earlier on 'iDownload Tries to Silence Spyware Critics'. Since then, the spyware critics have responded to iDownload: CastleCops, NetRN, and Sunbelt Software. InternetWeek and BroadbandReports have picked up this story as well. Brian Livingston interviewed iDownload's CEO Arlo Gilbert, who claims the letters were a success: "The majority of sites we've contacted have taken down or properly classified iSearch" and "When asked to name some of the sites that had complied, Gilbert answered, "I'm not going to share that information. It would be shooting a gift horse in the mouth."" General overview by Kye-U and Zhen-Xjell."

---

I decided to visit CastleCops and saw this:

Quote:

---

CastleCops recently received a letter from iDownload claiming that we have incorrectly classified iDownload as Spyware and demanding that we remove them. Interestingly enough we were given a 5 day window to comply with their demand, but we didn't actually receive it until the 6th day. Brian Livingston's published an article regarding the cease and desist letters being sent out by iDownload, indicating not only did CastleCops, Spywarewarrior, Spyware Guide and SunBelt Software all receive similar letters, but the CEO of iDownload is calling the campaign a "success"?

Quote:

---

When iDownload's CEO, Arlo Gilbert, called me, I asked which companies had received a cease-and-desist letter from iDownload's attorney. "It would not be in our best interest to share that list," Gilbert said.

He did assert that the letter was having the desired effect. "The majority of sites we've contacted have taken down or properly classified iSearch," Gilbert stated.

When asked to name some of the sites that had complied, Gilbert answered, "I'm not going to share that information. It would be shooting a gift horse in the mouth."

Gilbert added, "The people who are profiting off this information and have not reclassified the information will be sued." When asked for the names of some companies that iDownload has filed suits against, Gilbert said, "We're not going to reveal it," but added that the suits were a matter of public record that could be looked up.

---

CastleCops subsequently responded to iDownload but we were not the only ones. Suzi from Spywarewarrior also posted her reply publically in her blog and now Alex Eckelberry President of Sunbelt Software has also made their reply publically available.

I find myself asking the question what exactly does Mr. Gilbert consider success? Does it fall into a similar category of "acceptable loss" or "collateral damage"?

Since the threat tactics of iDownload were made public, their practice and products and choice of attorney have been under scrutiny, by the security community and public at large. There have been a number of questionable things uncovered by individual sources, like the unauthorized use of ICSA Certification published at Edbott.com

The company claims the product is certified by ICSA Labs. This is a prestigious honor and not lightly awarded. ICSA Labs is a division of CyberTrust, which was formed recently by a merger of TruSecure Corporation and BeTrusted. Its staff and management number some of the world’s foremost authorities on computer security and information technology. To earn ICSA Labs certification, a product must pass a series of stringent tests, and it can be removed if it fails the testing at any time.

When I reviewed the list of certified products at ICSA Labs’ Web site, I did not see any mention of Virus Hunter. So I fired off an e-mail to Larry Bridwell, Content Security Programs Manager for ICSA Labs. I received the following response within three minutes:

Quote:

---

VirusHunter is NOT certified by ICSA Labs nor has it ever been submitted for testing.

We have sent a letter by post requesting that the certification claim be removed.

---

I don't understand how what they are doing or have been doing can be called a success. Perhaps that is because we at CastleCops measure our success in relation to Our Vision. Maybe it is because we value above all things integrity, or because we believe in doing the things we do and helping the people we do because it is the right thing to do. Our success and that of the Anti-Spyware/Security community is measured in the number of people who are freed from the applications they don't wish to be on their systems. It is measured by the people we help to educate on how to protect themselves, their systems and their families

---

I'm glad to see that CastleCops isn't backing down. I think reality maybe for some is to hide their information or forums from the prying eyes of iSearch. At an Information Security and Privacy conference yesterday, it was mentioned by David Perry, Executive VP of TrendMicro, that there is a need to define what exactly and industry-wide what spyware is (amongst about 20 other vague terms).

And it's interesting to see this little gem. I dunno. I'd seriously consider that as spyware.

If I were a "removal" company and I'd get a letter like that.. I'd comply..

And call their stuff "CRAPWARE" instead of 'spyware' from then on :D

And send them a letter back (in full legalspeak) to tell them what they made you do :p

I agree that there is a problem with classification. My definitions are simple. If it causes pop-ups, or in some way targets advertising to your browsing habits, then it is adware. If it sends any information at all about your browsing habits to a third party, then it is spyware. I think in general, adware and spyware share the same bed, and in some cases, are interchangeable.

Whether or not iSearch is spyware is still something I am looking at. Interestingly enough, it seems that the popup advertising that I am getting are based on results from previous searches I have done.

iSearch represents an emerging third category, and my term for that is faciliation software. It may well be that their application in and of itself does not meet the criteria, but it installs other applications that do meet the criteria. I have been testing a variant of bubis, and as meeeeee stated in another thread, an iSearch bar that won't go away is the primary indicator of an infection. This particular strain I am testing downloads CWS and Abetterinternet (VX2). There is no question that they meet the criteria.

One of iSearch's methods of installation is a pop-up that appears to be, if one is not reading closely enough, a Real Media update. If one reads it carefully, then one can see that it is from iSearch, licensed by an outfit called....crap, I can't find the page I had it written on. At any rate, it is extremely deceptive.

If anybody is interested, I have an installer, but I guarantee you don't want it if you don't have a test box. It kills all of your security settings in the registry, and changes permissions so that it is incredibly difficult to change them back. It also attaches itself to explorer.exe, increasing the size roughly 400kb. This gets in deep.

Even more info about iDownload.com...

http://sunbeltblog.blogspot.com/2005...tter-more.html

That is an excellent response by SunBelt to the "threat" by iSearch. Very detailed. i suspect that iSearch is trying to use their EULA as protection against the claim of Spyware. Just because they say it isn't so, however, doesn't make it so.

I guess that's what happens when you have high paid attornies working for you...They actually make things clear for the everyday user to read.

Quote:

---

Originally posted here by MsMittens
Ironic that a discussion started here does bring to light the question of what exactly is spyware. It's interesting to see how much effort iSearch is putting into this. I almost want to say "They doth protest too much, me thinks". Anyways, has anyone had experience with iSearch/iDownload?




*italics added by me.

---

I would have to say, from experience in the industry, any application or applet that is installed indirectly as a result from visiting a site that requires said application or applet in combination with proof that the application or applet utilizes an internet connection to 'phone home' for any reason including reporting statistics back to the mothership or even to see if updates are available. Then I would treat this applicaiton as malware/adware and it would be taken care of like a mosquito on a urinal at a Texas Roadhouse.

All techs know that toolbars suck resources... (even if it is minimal, I still call it "sucks")

If interested, additional info can be found here > Silencing the Critics: ISearch/IDownload

Wow, talk about timely release of info.
I got this from US-CERT today...I get their Security Tips mailer for low-level info to share.

Quote:

---

Source
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Cyber Security Tip ST05-005 archive
Reviewing End-User License Agreements

Before accepting an end-user license agreement, make sure you
understand and are comfortable with the terms of the agreement.

What is an end-user license agreement?

An end-user license agreement (EULA) is a contract between you and the
software's vendor or developer. Some software packages state that by
simply removing the shrink-wrap on the package, you agree to the
contract. However, you may be more familiar with the type of EULA that
is presented as a dialog box that appears the first time you open the
software. It usually requires you to accept the conditions of the
contract before you can proceed. Some EULAs only apply to certain
features of the software, so you may only encounter them when you
attempt to use those features.

Unfortunately, many users don't read EULAs before accepting them. The
terms of each contract differ, and you may be agreeing to conditions
that you later consider unfair or that expose you to security risks
you didn't expect.

What terms may be included?

EULAs are legal contracts, and the vendor or developer may include
almost any conditions. These conditions are often designed to protect
the developer or vendor against liability, but they may also include
additional terms that give the vendor some control over your computer.
The following topics are often covered in EULAs:
* Distribution - There are often limitations placed on the number of
times you are allowed to install the software and restrictions
about reproducing the software for distribution (see Avoiding
Copyright Infringement for more information about copyright
issues).
* Warranty - Developers or vendors often include disclaimers that
they are not liable for any problem that results from the software
being used incorrectly. They may also protect themselves from
liability for software flaws, software failure, or incompatibility
with other programs on your computer.

The following topics, while not standard, are examples of other
conditions that have been included in EULAs. They present security
implications that you should consider before accepting the agreement.
* Monitoring - Agreeing to the EULA may give the vendor permission
to monitor your computer activity and communicate the information
back to the vendor or to another third party. Depending on what
information is being collected, this type of monitoring could have
both security and privacy implications.
* Software installation - Some agreements allow the vendor to
install additional software on your computer. This may include
updated versions of the software program you installed (the
determination of which version you are running may be a result of
the monitoring described above). Vendors may also incorporate
statements that allow them or other third parties to install
additional software programs on your computer. This software may
be unnecessary, may affect the functionality of other programs on
your computer, and may introduce security risks.
_________________________________________________________________

Author: Mindi McDowell
_________________________________________________________________

This document can also be found at

<http://www.us-cert.gov/cas/tips/ST05-005.html>

Copyright 2005 Carnegie Mellon University

Terms of use

<http://www.us-cert.gov/legal.html>



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQiYk4BhoSezw4YfQAQJRSAf/YwwTiDH7BQGooVDw8PhlzzP64nMIvSAB
rwFJaBzCUzj1e1+m8TGYh3aT1uP5tT1tH9FlNFAD2RKCBlxht0xrtYPPu6AcXBRv
xJgebw2hRNdjqqe8zlGIGadSyHNpt6U0EiUuKQYMLNi2hTgv5A0gA6wvsKOfSu7L
66kdRyFKv4ljj0aAzAd/jgQXJtkykqynlQ4jm/HbJSVDPz0XUIO4z/k4yEB935xt
fpoU49TpQd1Aj+DpITK3AwrhNP63cJHGR8v68+1jAsEamkGmOyuQFXh8KPy2ozVR
O0U9089yQBfQnsU6jjnwOdzVqq8gwIfScFdHOvh3LgMNiRu8Yhj8xw==
=t3K9
-----END PGP SIGNATURE-----

---

http://news.bbc.co.uk/2/hi/technology/4347325.stm

Quote:

---

If cars were sold under the same terms as software, the chances are we would all be walking to work.

This is because almost every computer program is installed on condition that you accept onerous terms that you would reject if they were applied to anything else.

For instance, if your car was sold to you under similar terms you would not be able to talk about its poor mileage down the pub with your mates, and would have to get the permission of the car maker every time you changed radio station or another member of your family drove it.

And don't even think about putting car seats in the back for your kids or adding a roof rack - if you don't want to void the warranty that is.

---

Quote:

---

But, he said, many software firms use the Eula to shield themselves from any responsibility for their creations; try to limit well-established consumer rights or try to impose onerous conditions on the use of the program.

---