5 ms·

> Software whose functioning mistreats the user is called malware Hmm, well based on that super broad definition, sure, proprietary software is "often malware"

by umvi 6y ago

> Software whose functioning mistreats the user is called malware Hmm, well based on that super broad definition, sure, proprietary software is "often malware". But usually "malware" is understood to mean software that exploits vulnerabilities in a computer system, not merely software with DRM, paywalls, banners, ads, etc. I think GNU might need to pick a different term here than "malware" unless they are intentionally fear mongering to get the free software conversation going.

easton 6y ago
Based on that definition, GNU Emacs is malware as whenever I see it on my system (it used to be included with several Linux distros and macOS), I cringe at the thought of all of disk space I could be filling with fortune files.
- crazypython 6y ago
  I would modify the definition to this: > Software whose functioning intentionally mistreats the user is called malware There is nothing stopping you from removing GNU Emacs. There are features missing in Roam Research. But in Emacs org-roam, if you are missing a feature, you can ask any programmer– they don't have to be an org-roam maintainer– to add a feature as it is free software. Roam intentionally takes away the freedom to modify the software.
- hundchenkatze 6y ago
  I get your point, but I think in this case the distro would be the malware not emacs.
Osiris 6y ago
> unless they are intentionally fear mongering to get the free software conversation going. I think it's this. However, they aren't wrong, per se. Users should have control over their systems and their privacy. But hyperbole and fear mongering are not very effective at affecting change in the system. I would argue that they have a noble mission but take it to such an extreme as to not be very practical.
dpeck 6y ago
I don’t know about that. The way I remember it “malware” as a term was invented to be a bigger umbrella term to account for things like bonzi buddy when “virus” wasn’t quite as good of a description.
crazypython 6y ago
Wikipedia[0] says > Programs are also considered malware if they secretly act against the interests of the computer user It's fair to say proprietary software often creates an ability and incentive to act against the interests the user which results in it becoming malware. [0]: https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware
monkin 6y ago
Yes, they are intentionally fear mongering, just read most of their examples. It’s like reading tabloids.
- atoav 6y ago
  Fear mongering? Now you go to the other extreme. What is malware? Is that browser toolbar your aunt has on ther internet explorer Malware? Probably yes. Is a "Cleaner" Program that does effectively nothing except Phone home Malware? Probably Yes. Is a software that does similar things behind your back without your knowledge, but that has some useful parts to it Malware? Maybe Yes?
  - DougN7 6y ago
    But is ALL proprietary software malware merely because I don’t get the source? I could get the Linux source but it wouldn’t do me any good because I don’t know how to compile it. The whole thing is a silly argument. I pay for some software precisely because it does what I want!
    - atoav 6y ago
      Probably not, but unless you fire up wireshark or reverse engineer precisely which bits on your disk a software touches, you cannot always tell which one does and which doesn't.
bitwize 6y ago
Malware needn't exploit a vulnerability. There is much malware (e.g., Comet Cursor, Bonzi Buddy, etc.) that relies on being installed by the end user and may even present as a fun or useful program... but it's really doing something to your detriment behind the scenes. If Bonzi Buddy counts as malware, so does the Facebook app.
jnwatson 6y ago
I used to work for a company that used to classify software as malware. The original definition is much closer to what is broadly accepted (at least by antivirus vendors). Much of what is classified as malware doesn't exploit anything other than the user's expectations. The definition of malware is social construct, not a technical one, otherwise Powershell.exe would light up like a Christmas tree. The only reasonable way to talk about malware is with respect to users' wishes and desires. I'll note that AV vendors invented a "less bad" label, PUP, for less-destructive malware. That doesn't make it not malware though.
- umvi 6y ago
  Ok, fair point, then maybe we ought to be quibbling over the semantics of "mistreat" then. IMO making software not work if the user doesn't pay isn't mistreating the user. GNU disagrees and thinks anything short of 100% optional/unenforced payment is mistreating the user.
  - ethanwillis 6y ago
    This is not true. If you are never provided with the software then GNU wouldn't say you can access the source code. So if someone says "I won't give you X software unless you pay Y dollars" that is fine However if they do pay the expectation is they also get access to the source code if they're running the software on their own machine (depending on which license we're talking about of course)
    - umvi 6y ago
      > So if someone says "I won't give you X software unless you pay Y dollars" that is fine How can you say that though if someone can just get a copy from a peer without paying you? People just go around the paywall and grab a free copy without payment which is why DRM exists at all. So then I make it so the software has to connect to a server to check if you've paid for it, and now suddenly that's mistreating the user?
      - 6y ago
butt_hugger 6y ago
That is... the definition of malware. I notice that lately people have been moving the goalposts so they can justify things like hidden telemetry as not being spyware.
- umvi 6y ago
  Not moving goalposts, just saying we need to be more precise in our categorization of software. Calling all proprietary software "badware" doesn't really convey much information. We should create more meaningful categories that convey what the software is actually doing that is undesirable.
rmah 6y ago
This is going to sound like a rant, but I really don't mean it that way. I'm not trying to make a value judgement. GNU picked the term "malware" on purpose. I think the purpose was to (slightly) confuse, connect a known bad thing with commercial software, and spur further dissuasion. I doubt they intended to fearmonger though. That said, your intuition that they picked it to "get the free software conversation going" is, IMO, spot on. They did the same thing with "free" in "free software". When people misinterpreted what they meant, they used that as an opportunity to ... explain their point of view. Many here may not remember when conversations like "it's free software" ... "no, not just free in cost, but free as in freedom" ... "yes, I know it's cost free, but you can charge money if you want" ... "yes, I know no one charges anything, but it's really about freedom!" was a common conversation in tech circles. I suspect a similar goal for "malware" now. If clarity was a primary goal, they would have, IMO, picked different words.
bsanr2 6y ago
Would the abuse of system privileges and capabilities count as "exploiting vulnerabilities in a computer system?" In fact, one might expand this in order to include software that that exploits vulnerabilities in psychology. In this way, you have a term that encompasses all the ways software can be "bad" for end users.
FriedrichN 6y ago
You can call it telemetry, you can also call it spyware. You can call it DRM, you can also call it user restriction. You can call it serving ads, you can also call it remote code injection. You can call it subscription based, you can also call it user lock-in or remote killswitch. There is not a lot of modern proprietary software that wouldn't fall into these categories. I know a lot of people claim not to care about it, that is a separate issue, but the fact is that most proprietary software is in fact malware, even if people don't mind installing malware.
- throwaway314158 6y ago
  A dandelion can either be a weed or part of a salad. It's a matter of context. > You can call it subscription based, you can also call it user lock-in or remote killswitch. If you stop paying for your gym membership and your access card gets automatically revoked, do you consider that to be some kind of physical instantiation of malware?
  - reificator 6y ago
    If the muscles I built at that gym were incompatible with any other gym, yeah I probably would. Metaphors don't work as well as people think.
littlestymaar 6y ago
Being a malware has noting to do with exploiting security vulns. When you installed a cracked video game found on a warrez website back in the 2000s, that came bundled with pop-up ads spawning on your computer, it was called a malware. Today, Windows itself comes bundled not just with ads, but with a keylogger and monitor all you do on your computer. Mainstream software have turned themselves into malware in a desperate attempt for monetization in a world where nobody wants to pay for software (in parts because FLOSS alternatives exist, but not only).
Xelbair 6y ago
I would say that modern forms of telemetry(some game companies used literal rootkits!) would be considered malware/adware 15 years ago. Try to find me a modern closed source program, with big userbase without such telemtry.

by umvi 6y ago

easton 6y ago

Based on that definition, GNU Emacs is malware as whenever I see it on my system (it used to be included with several Linux distros and macOS), I cringe at the thought of all of disk space I could be filling with fortune files.

crazypython 6y ago
I would modify the definition to this: > Software whose functioning intentionally mistreats the user is called malware There is nothing stopping you from removing GNU Emacs. There are features missing in Roam Research. But in Emacs org-roam, if you are missing a feature, you can ask any programmer– they don't have to be an org-roam maintainer– to add a feature as it is free software. Roam intentionally takes away the freedom to modify the software.
hundchenkatze 6y ago
I get your point, but I think in this case the distro would be the malware not emacs.

Osiris 6y ago

> unless they are intentionally fear mongering to get the free software conversation going. I think it's this. However, they aren't wrong, per se. Users should have control over their systems and their privacy. But hyperbole and fear mongering are not very effective at affecting change in the system. I would argue that they have a noble mission but take it to such an extreme as to not be very practical.

dpeck 6y ago

I don’t know about that. The way I remember it “malware” as a term was invented to be a bigger umbrella term to account for things like bonzi buddy when “virus” wasn’t quite as good of a description.

crazypython 6y ago

Wikipedia[0] says > Programs are also considered malware if they secretly act against the interests of the computer user It's fair to say proprietary software often creates an ability and incentive to act against the interests the user which results in it becoming malware. [0]: https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware

monkin 6y ago

Yes, they are intentionally fear mongering, just read most of their examples. It’s like reading tabloids.

atoav 6y ago
Fear mongering? Now you go to the other extreme. What is malware? Is that browser toolbar your aunt has on ther internet explorer Malware? Probably yes. Is a "Cleaner" Program that does effectively nothing except Phone home Malware? Probably Yes. Is a software that does similar things behind your back without your knowledge, but that has some useful parts to it Malware? Maybe Yes?
- DougN7 6y ago
  But is ALL proprietary software malware merely because I don’t get the source? I could get the Linux source but it wouldn’t do me any good because I don’t know how to compile it. The whole thing is a silly argument. I pay for some software precisely because it does what I want!
  - atoav 6y ago
    Probably not, but unless you fire up wireshark or reverse engineer precisely which bits on your disk a software touches, you cannot always tell which one does and which doesn't.

bitwize 6y ago

Malware needn't exploit a vulnerability. There is much malware (e.g., Comet Cursor, Bonzi Buddy, etc.) that relies on being installed by the end user and may even present as a fun or useful program... but it's really doing something to your detriment behind the scenes. If Bonzi Buddy counts as malware, so does the Facebook app.

jnwatson 6y ago

I used to work for a company that used to classify software as malware. The original definition is much closer to what is broadly accepted (at least by antivirus vendors). Much of what is classified as malware doesn't exploit anything other than the user's expectations. The definition of malware is social construct, not a technical one, otherwise Powershell.exe would light up like a Christmas tree. The only reasonable way to talk about malware is with respect to users' wishes and desires. I'll note that AV vendors invented a "less bad" label, PUP, for less-destructive malware. That doesn't make it not malware though.

umvi 6y ago
Ok, fair point, then maybe we ought to be quibbling over the semantics of "mistreat" then. IMO making software not work if the user doesn't pay isn't mistreating the user. GNU disagrees and thinks anything short of 100% optional/unenforced payment is mistreating the user.
- ethanwillis 6y ago
  This is not true. If you are never provided with the software then GNU wouldn't say you can access the source code. So if someone says "I won't give you X software unless you pay Y dollars" that is fine However if they do pay the expectation is they also get access to the source code if they're running the software on their own machine (depending on which license we're talking about of course)
  - umvi 6y ago
    > So if someone says "I won't give you X software unless you pay Y dollars" that is fine How can you say that though if someone can just get a copy from a peer without paying you? People just go around the paywall and grab a free copy without payment which is why DRM exists at all. So then I make it so the software has to connect to a server to check if you've paid for it, and now suddenly that's mistreating the user?
    - 6y ago

butt_hugger 6y ago

That is... the definition of malware. I notice that lately people have been moving the goalposts so they can justify things like hidden telemetry as not being spyware.

umvi 6y ago
Not moving goalposts, just saying we need to be more precise in our categorization of software. Calling all proprietary software "badware" doesn't really convey much information. We should create more meaningful categories that convey what the software is actually doing that is undesirable.

rmah 6y ago

This is going to sound like a rant, but I really don't mean it that way. I'm not trying to make a value judgement. GNU picked the term "malware" on purpose. I think the purpose was to (slightly) confuse, connect a known bad thing with commercial software, and spur further dissuasion. I doubt they intended to fearmonger though. That said, your intuition that they picked it to "get the free software conversation going" is, IMO, spot on. They did the same thing with "free" in "free software". When people misinterpreted what they meant, they used that as an opportunity to ... explain their point of view. Many here may not remember when conversations like "it's free software" ... "no, not just free in cost, but free as in freedom" ... "yes, I know it's cost free, but you can charge money if you want" ... "yes, I know no one charges anything, but it's really about freedom!" was a common conversation in tech circles. I suspect a similar goal for "malware" now. If clarity was a primary goal, they would have, IMO, picked different words.

bsanr2 6y ago

Would the abuse of system privileges and capabilities count as "exploiting vulnerabilities in a computer system?" In fact, one might expand this in order to include software that that exploits vulnerabilities in psychology. In this way, you have a term that encompasses all the ways software can be "bad" for end users.

FriedrichN 6y ago

You can call it telemetry, you can also call it spyware. You can call it DRM, you can also call it user restriction. You can call it serving ads, you can also call it remote code injection. You can call it subscription based, you can also call it user lock-in or remote killswitch. There is not a lot of modern proprietary software that wouldn't fall into these categories. I know a lot of people claim not to care about it, that is a separate issue, but the fact is that most proprietary software is in fact malware, even if people don't mind installing malware.

throwaway314158 6y ago
A dandelion can either be a weed or part of a salad. It's a matter of context. > You can call it subscription based, you can also call it user lock-in or remote killswitch. If you stop paying for your gym membership and your access card gets automatically revoked, do you consider that to be some kind of physical instantiation of malware?
- reificator 6y ago
  If the muscles I built at that gym were incompatible with any other gym, yeah I probably would. Metaphors don't work as well as people think.

littlestymaar 6y ago

Being a malware has noting to do with exploiting security vulns. When you installed a cracked video game found on a warrez website back in the 2000s, that came bundled with pop-up ads spawning on your computer, it was called a malware. Today, Windows itself comes bundled not just with ads, but with a keylogger and monitor all you do on your computer. Mainstream software have turned themselves into malware in a desperate attempt for monetization in a world where nobody wants to pay for software (in parts because FLOSS alternatives exist, but not only).

Xelbair 6y ago

I would say that modern forms of telemetry(some game companies used literal rootkits!) would be considered malware/adware 15 years ago. Try to find me a modern closed source program, with big userbase without such telemtry.