7 ms·

Adobe modifies hosts file to detect whether Creative Cloud is installed

344 points by rglullis 7mo ago

cromka 7mo ago
> for a very stupid reason. I cannot stomach Thom's articles. So borderline judgmental, holier than thou, feels like he only writes whenever there's something to criticize. No, it's not a stupid reason. Reason is OK, the execution is controversial.
- gjsman-1000 7mo ago
  > Reason is OK, the execution is controversial. And even then, only controversial to nerds with opinions. Nothing else about it is controversial. If anything, knowing whether the app is installed or not is kinda important? If you open a file shared with you in the browser, the option to "Open in Desktop" versus "Install Desktop App" actually works correctly?
  - rglullis 7mo ago
    > In which case, how else would you propose doing it? - Registering an url handler? - Asking the user?
    - gjsman-1000 7mo ago
      You can't detect whether a URL handler worked correctly in a browser; otherwise Windows will appear with a "Select an app to open YOURPROTOCOLHERE://" which is completely nonsensical to the user. As for option 2; ask them every time, or edit their hosts file. Easiest decision in the world: Edit their hosts file, every time, no question. The 1% of nerds who care, and oddly enough don't buy Adobe software, are completely meaningless to the 99% of customers who experience the decision positively.
      - imiric 7mo ago
        What a ridiculous conclusion. Why does Adobe need to exfiltrate some information from my machine anyway? If I'm a customer, then they should know this when I sign into my account. They absolutely don't need this information if I'm visiting their website without logging in. Modifying a global system file is something their software shouldn't be doing in the first place, but relying on this abuse to track me on their website is on another level of insidious behavior.
        gjsman-1000 7mo ago
        If you're worried about device fingerprinting, Adobe has far more reliable ways to do it already. Canvas fingerprinting, IP tracking, cookies. A hosts entry tells them almost nothing they couldn't get elsewhere, provides them with almost no entropy, and attributing insidious intent to what is most plausibly a UX feature is conspiratorial.
        imiric 7mo ago
        I'm not worried about this, since I don't use Adobe products. I'm just calling out what's clearly user hostile behavior. Considering the amount of hostility Adobe has exhibited towards its users over the years, I'm inclined to believe this is yet another example. Nothing conspiratorial about that. If anything, calling this a "UX feature" without any evidence either way is suspiciously dismissive.
  - jacobgkau 7mo ago
    > If anything, knowing whether the app is installed or not is kinda important? If you open a file shared with you in the browser, the option to "Open in Desktop" versus "Install Desktop App" actually works correctly? This is not an approach any other app on any platform has historically used, and it doesn't seem sustainable if every app you install has to modify your hosts file to use a hack like this to detect whether it should handle files or not. If you want the browser to be able to give the OS a file handler and have the OS present an option to install the app if it's not installed, that should be handled at the platform level, not on the website using a hack like this. Why can a file not simply be downloaded with a page displayed showing a link to install the app and also instructions to open the file, trusting the user will know if they already have it installed? At best, you're talking about a very small UX optimization. Emphasis on the "kinda" in "kinda important."
    - gjsman-1000 7mo ago
      > This is not an approach any other app on any platform has historically used, and it doesn't seem sustainable if every app you install has to modify your hosts file to use a hack like this to detect whether it should handle files or not. Actually it's completely sustainable. DNS was invented a decade after hosts files. The idea of your host file being almost completely empty is a modern aberration from the days it used to be thousands of lines long. Do I wish there was a better mechanism? Sure. Would HN ever agree on a OS-level app-detection API for the browser? Never. > Why can a file not simply be downloaded with a page displayed showing a link to install the app and also instructions to open the file, trusting the user will know if they already have it installed? At best, you're talking about a very small UX optimization. Emphasis on the "kinda" in "kinda important." A small UX decision, adding up to tens of millions of times per day, affecting 99.9% of people who don't give a darn - versus a matter of slight software engineering principles of "we just don't do it that way." Easiest decision ever.
      - jacobgkau 7mo ago
        > Would HN ever agree on a OS-level app-detection API for the browser? Never. There already is one. It just asks the user whether it's okay before it tells the website, as you acknowledged: https://news.ycombinator.com/item?id=47664546 https://news.ycombinator.com/item?id=47664546 What you're arguing for is not good UX. It's lack of user privacy & control. You just think you're being hip or whatever for being blasé about it.
- Steeeve 7mo ago
  It's literally a 2 sentence article. Might as well have just tweeted "Adobe makes me mad"
- tombert 7mo ago
  I don't know anything about Thom, but I've kind of grown to prefer the pissy opinionated tones of blog posts. I think impartiality is difficult or impossible for a lot of tasks, and I'd rather people lay out their opinions plainly than trying to pretend that what they're saying is "objective". Also, I think writing only when you have things to criticize is a valid enough thing to do; what's the point of writing a glorified "I agree!" article? I only ever blog when I have something that I think is unique to say, and as such a lot of the time my posts end up being kind of negative. I don't think I'm that negative of a person, I just don't see the point of flooding the internet with more echo-chambers.
  - deleted 7mo ago
    [deleted]
  - trollbridge 7mo ago
    I like his tone too. It also is easier to identify that it isn’t LLM generated text. (I have nothing against LLMs but have little interest in reading text generated from them.)
    - tombert 7mo ago
      It's one thing when it's the Associated Press, where they are trying to be a somewhat impartial source of news and reporting raw facts to the best of their ability; stuff like that probably should not have an opinionated tone at all. But I think for things like blogs, without opinions being clear, posts can feel kind of soulless. Even before LLMs I felt that way, and now it has been amplified ten fold with people just cranking out low-effort posts with ChatGPT for reasons that I do not understand. When I write stuff for my blog, I like to think of it as a time capsule of the entirety of the thing I'm writing about. This doesn't just include the raw subject matter, but also my mood and opinions about the subject matter. I'm egotistical enough to occasionally read through my old posts and the ones that I like the best are the ones where I feel like I was expressing myself the most, and where I make no effort whatsoever to try and be impartial.
- pessimizer 7mo ago
  > No, it's not a stupid reason. Reason is OK, the execution is controversial. This is a muddled statement. It is a stupid reason to "execute" the act of silently modifying your host file. If I murder somebody to keep them from stepping on my foot, and the judge says that it's a stupid reason to murder somebody, it's silly to say that the reason is "OK" because it hurts to have one's foot stepped on.
lousken 7mo ago
How is defender not flagging this? Changing hosts file should raise alarms
- xattt 7mo ago
  Can this not be blocked with file permissions? Or a symlink to a file in a ro folder?
  - SoftTalker 7mo ago
    Most software installers demand to be run as root/Administrator. The fact that this is largely seen as acceptable or even sensible is rather silly in this day and age.
    - deepsun 7mo ago
      Yes, and when apps do request many permissios, I just estimate how reputable the company is. A name like Adobe must be ok, right?
      - gruez 7mo ago
        >Yes, and when apps do request many permissios Most windows apps aren't sandboxed so the concept of "permissions" doesn't make any sense. The most there is is "asks to run as admin", but most installers do.
    - cmovq 7mo ago
      Software wants to be installed in C:\Program Files so that other software can’t modify their installation without admin permissions. Of course to do that your installer needs to be run as administrator which makes the whole thing rather silly.
      - tredre3 7mo ago
        Software installed through the Windows Store seem immutable enough even though they live in the user's AppData. At least the system prevented me from seeing or modifying the files the last time I tried. I did not try very hard, admittedly, but by contrast modifying something in C:\Program Files is just one UAC confirmation away.
vondur 7mo ago
If you don't like Adobe modifying your hosts file then I'd not use them. The checking for the software this way is kinda interesting though.
- dlev_pika 7mo ago
  I wonder how many Adobe users are aware of this sketchy behavior tho
  - tonyedgecombe 7mo ago
    My guess is most Adobe users have no idea there is a hosts file nor what it does.
ChrisArchitect 7mo ago
[dupe] https://news.ycombinator.com/item?id=47617463 https://news.ycombinator.com/item?id=47617463 https://news.ycombinator.com/item?id=47624990 https://news.ycombinator.com/item?id=47624990
jameskraus 7mo ago
Honestly a pretty nifty way to detect if it's installed. I'm sure this can power a lot of nice features, like linking directly into adobe products if they're installed.
- turtlebits 7mo ago
  It can power even more security issues too. This is absolutely horrendous.
  - tonyedgecombe 7mo ago
    I’m wondering how this can be exploited.
    - delecti 7mo ago
      Agreed, at worst this is just vaguely icky feeling; realistically this is a nothing burger. To exploit this kind of thing you'd either need to have access to someone's computer to change the hosts file yourself, pointing to a different IP address, or somehow gain control of Adobe's IP address and point it to a different server. For the former, if you have local root permission, you already own the machine, why bother with this slow of an option. And the latter is already such a takeover that the involvement of this hosts file change is basically irrelevant.
    - the_mitsuhiko 7mo ago
      They implemented it in a way that it only responds with a valid image and a 200 status code, when the referrer is adobe.com. It's probably somewhat sane given the insanity that is the host files hack.
Terr_ 7mo ago
Recycling a comment from prior discussion (4 days, 68 points, 13 comments): https://news.ycombinator.com/item?id=47617463 https://news.ycombinator.com/item?id=47617463 _______ Oh helllll no. Let's imagine an analogy for Adobe leadership: 1. You hired a night janitor to clean and vacuum your executive offices. 2. That janitor secretly stops at every desk-phone to alter the settings of voicemail accounts. 3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!" What's your reaction when you discover it? Do you chuckle and say something like "boys will be boys"? No! You have a panic-call, Facilities revokes access, IT starts checking for other unauthorized surprises, HR looks into terminating contracts, and Legal advises whether you need to pursue data-breach notifications or lawsuits or criminal charges. * Is it acceptable because they had some permission to touch objects in the rooms? No. * Is it acceptable because the final effect is innocuous? No. * Is it acceptable because the employment contract had some vague sentence about "enhancing office communication experiences"? No. * Is it acceptable if they were just dumb instead of malicious? No. No person that would blithely cross those lines can be trusted near your stuff, full-stop.
- jacobgkau 7mo ago
  To be fair, your analogy has one flaw: > 3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!" Theoretically, it's not "any external caller." Only the janitor's department calling in can dial that sequence and get "Yes, you serviced this office!" If anyone else tries to dial the extension, the desk-phone pretends it doesn't know what it means. (Because it seems Adobe's server serving the analytics image checks the request origin and only serves the image if the origin is Adobe's own website.) The origin "security" doesn't excuse the complexity and the potential for both exploits and human-error breakage in the future.
  - gray_-_wolf 7mo ago
    > Only the janitor's department calling in can dial that sequence Is this the case though? Cannot any website use the same trick Adobe does to check whether you have Creative Cloud installed? Like, the entries in /etc/hosts are not magically scoped to work just on Adobe's web, no?
ramon156 7mo ago
To be fair, to crack all adobe products requires a few reg keys. It's wild that they have just given up on pirates.
- snapcaster 7mo ago
  They don't want to be too hard on piracy, its their new/young user on ramp method
  - kenhwang 7mo ago
    Also a lot of recent features are AI related and rely on talking to Adobe servers, which would require a valid subscription. They're probably betting the AI features are valuable enough that local only pirated copies aren't a threat long term.
OptionOfT 7mo ago
Can't even reproduce it when setting location to Belgium, or CA or AZ. I must be missing something.
hypeatei 7mo ago
Looks like they got a wildcard certificate for *.creativecloud.adobe.com[0] so that the HTTPS connection works and so they don't have to publish DNS records for the "detect-ccd" subdomain to obtain a cert. Pretty neat setup, but also kinda hacky. 0: https://crt.sh/?q=creativecloud.adobe.com https://crt.sh/?q=creativecloud.adobe.com
j45 7mo ago
Make affinity sound like a smarter and smarter choice.
- deleted 7mo ago
  [deleted]
matsemann 7mo ago
Oh well, as a teenager, blocking adobe servers in hosts file was how you got to "phone activation" and could generate a code. So I guess we're even, heh.
- butlike 7mo ago
  That CS2 torrent was a GOAT.
  - 9dev 7mo ago
    FCKGW-RHQQ2-…
    - 3-cheese-sundae 7mo ago
      Those particular neurons of mine haven't seen action in quite some time, thank you.
    - hoherd 7mo ago
      I worked at Gateway during this era and always saw that in the light of me quitting when XP came out and drove me crazy. FCKGW indeed.
- huflungdung 7mo ago
  [dead]
- userbinator 7mo ago
  The title of this article recalled that exact memory for me too. Not only Adobe but cracks for a few other expensive softwares needed the same. ...and then Adobe (unintentionally) gave away free downloads of CS2, with valid serial numbers, once they shut down the activation servers. You can still find them on the Internet Archive.
- ProllyInfamous 7mo ago
  I also did this as a teenager. Doing this again, now (well into adulthood): recently gifted a "broken" 2013 MacPro[0], and have set it up as my retro CS4 workhorse (decades old software on a decade old machine). Hosts/PiHole ready, blocking "*adobe*" entirely. Only problem now is I cannot find four's `FCKGW-RHQQ2-`... my oldmanfish surfs onwards, Santiago remaining uncertain. For now I just don't quit and never shut down (fresh install allows limited launches). [0] RAM slot was jamming, not allowing proper seating
nashashmi 7mo ago
So can I fool the website that I have CC installed?
Dwedit 7mo ago
Browsers could still do something about mixed Internet and LAN/Localhost requests by IP address regardless of the domain name.
- SahAssar 7mo ago
  This does not request a local/LAN file, it's a remote server but without any DNS entry unless the hosts file entry is present.
- Dylan16807 7mo ago
  Did you misread the post? They're doing this because the localhost shenanigans got blocked. This is pure internet requests, but the IP changes (or fails to resolve) based on what's in your hosts file.
1bpp 7mo ago
I owe thousands of dollars to amtlib.dll.
psyclobe 7mo ago
The most difficult of tasks is trying to un-unstall this pos app on windows.
hatradiowigwam 7mo ago
Whether it's run as root/administrator or not - you can disable this behavior by setting the immutable flag on /etc/hosts. No user, including root, can write to a file with the immutable flag set(although root could _remove_ the attribute and then write).
throw_await 7mo ago
what happens if you happen to use a DNS server that resolves this domain to the correct IP?
- djfobbz 7mo ago
  "Correct IP" wins ;)
ryandrake 7mo ago
As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. Dumping crap all over C:\Windows or /usr or /boot or something? No way--the OS should make the developer obtain my consent (not just a blanket sudo-like escalation) to do these things. Sneakily modifying /etc/hosts to act against me? Get the hell outta here!
- mikkupikku 7mo ago
  I thought the days if needing to "sudo" to install applications on windows were long gone; doesn't basically everything happily do user installations now? I would view a demand to escalate as basically proof that the application is about to do something janky, if not outright malicious. On linux, if I can't build and run software with just my user account, that software has some explaining to do. Virtually every desktop application should be able to run without escalated privileges.
  - Ajedi32 7mo ago
    "C:/Program Files" is still the recommended place to install programs, and it requires admin privileges to write to. Some programs (ab)use C:\ProgramData for that purpose instead and therefore don't need admin privliges. But even with that hack, ultimately Windows still uses the https://xkcd.com/1200/ https://xkcd.com/1200/ permission model. (Everything runs with full access to all your data.)
    - TiredOfLife 7mo ago
      On Windows enabling access control is 4 clicks. The problem with enabling it by default is that every time MS tries to harden the defaults there is much weeping and wailing and gnashing of teeth
  - vpShane 7mo ago
    on windows and mac they just get a prompt and a lot of people don't read it, care, nor wonder what it's actually doing they just want it to work. I know you all know this but companies will do this knowing that exploiting all of us. I use Linux and agreed on all those points. when I used adobe before it wanted to charge me a fee to cancel my subscription and wouldn't let me just 'cancel' in their system so I just blocked the payments on my card and dipped out. good software, garbage company
dpedu 7mo ago
I installed Creative Cloud just last week. No such entry was created in the hosts file on my macOs system.
cyanydeez 7mo ago
Are we sure this is to detect Creative Cloud instead of, trying to detect whether you have/had a pirated version of Adobe installed? Some reference material I've seen often involved blackholing adobe hosts to prevent installation software from verifying or otherwise talking to adobe.
486sx33 7mo ago
[dead]
dblohm7 7mo ago
I don't know whether is still does this, but 8-9 years ago I discovered that Acrobat overwrites the COM registry entries for Microsoft Active Accessibility (oleacc.dll) such that any application attempting to instantiate MSAA gets the Adobe DLL instead of the system DLL. This actually broke the stuff I was working on and had to override it in my app manifest to forcibly use the system version. I inquired about it and got some BS about how they absolutely _had_ to do this to intercept MSAA instantiations across the system, when in reality they were using a global solution to solve a local problem.
reactordev 7mo ago
Adobe has been user hostile since Create Suite launched. Where were you? They have been hiding backdoors in windows machines and Mac machines since at least 2010.
crest 7mo ago
There are no suspicious entries in my /etc/hosts just what I put there.
lemoncookiechip 7mo ago
Adobe really relishes being a villain. I don't understand how one company can be so anti-consumer.
- Ylpertnodi 7mo ago
  Consumers keep buying adobe.
stego-tech 7mo ago
Honestly, I've been dealing with crap like this for so many decades that I'm a fervent supporter of every "installer" just showing and logging a Git PR-styled diff to the user of every file and system change, everywhere in the system, complete with the ability to rollback from it. I am tired of inconsistent logging, opaque system changes, and vendors generally being malicious with endpoint security in the name of protecting profit. Screw the "show me the log" option that scrolls by in a flash and you can't get back to, show me the damn diff first.
- ethanrutherford 7mo ago
  Maybe you will read it carefully every single time (and to be clear, I doubt even that) but for the majority of users this will only lead to increasing the already excessive amount of decision-fatigue they deal with when interacting with software day to day. People already blindly click through sequences of confirmation boxes when they think they already know what they're doing. Odds are a million to one you've done that very thing before yourself. Adding even more friction is only going to make the average user spam the "next" button even more fervently.
- hrvstr 7mo ago
  For *.pkg installers there is Suspicious Package at least. https://www.mothersruin.com/software/SuspiciousPackage/ https://www.mothersruin.com/software/SuspiciousPackage/
basilikum 7mo ago
I'd like to answer the closing question > At what point does a commercial software suite become malware? The vast majority of commercial software is malware.
drowntoge 7mo ago
As much as I dislike what AI slop is doing to visual design, I wouldn’t mind seeing Adobe get hurt for being the comically terrible company it is.
Duanemclemore 7mo ago
I have been an Adobe user since 1996. Starting with Photoshop 3. Then, using the rest of their programs since 1999. Between this and the fact that they've just 1. Changed all the old accounts to "Adobe Creative Cloud Pro" 2. DOUBLED the monthly fee, now charging you for the AI features whether you want them or not, and 3. Removed any tiers that have full program access but no AI, I am walking away forever when my current month expires. Not to mention, students now only get the old $19.99 membership for the first year. I teach visualization and representation tools to architecture students. I had always taught them Adobe products before. Now I can't in good faith sign them up to have their expertise tied to using this program stack forever. So tomorrow I am giving them a lecture on free to use and FOSS versions of the same tools. And I'm going to teach the class from them in perpetuity. Congratulations, Adobe that's 50+ students a year who won't be using your products when they graduate.
- mishkatronic 7mo ago
  Is that not potentially detrimental to your students if the use of Adobe products is a more common industry practice?
  - eqvinox 7mo ago
    Probably different at huge companies, but small employers I know don't care how you get your work done. If anything they're happy if they don't have to buy/rent licenses for you. …now that I think about it, don't architects predominantly work in smaller companies?
    - knigyfrrob 7mo ago
      Speaking as a lifelong graphic designer with over 20 years experience under my belt: it really doesn’t matter what kind of software you use, HOWEVER, not using the industry standard can bite you in the ass quite fast. PDF export can be finicky, colour management is hit or miss, collaboration is nearly impossible… I wish someone would come and take Adobe’s monopoly down for good, but as it stands, shunting Adobe for something else in a professional environment is more trouble than it’s worth.
knlam 7mo ago
Yearly reminder that Adobe CC is malware. Open your Activity Monitor on your Mac and see how much craps CC run on your computer
taspeotis 7mo ago
https://devblogs.microsoft.com/oldnewthing/20061101-03/?p=29153 https://devblogs.microsoft.com/oldnewthing/20061101-03/?p=29...
linzhangrun 7mo ago
[flagged]
throwawayqqq11 7mo ago
Would it be possible (practical) to uniquely identify large numbers of users and even bypass anonymization efforts like tor and VPNs with this?
rkagerer 7mo ago
I vote we all add that HOSTS entry to poison their despicably dark-pattern detection algorithm.

344 points by rglullis 7mo ago

> for a very stupid reason. I cannot stomach Thom's articles. So borderline judgmental, holier than thou, feels like he only writes whenever there's something to criticize. No, it's not a stupid reason. Reason is OK, the execution is controversial.

gjsman-1000 7mo ago
> Reason is OK, the execution is controversial. And even then, only controversial to nerds with opinions. Nothing else about it is controversial. If anything, knowing whether the app is installed or not is kinda important? If you open a file shared with you in the browser, the option to "Open in Desktop" versus "Install Desktop App" actually works correctly?
- rglullis 7mo ago
  > In which case, how else would you propose doing it? - Registering an url handler? - Asking the user?
  - gjsman-1000 7mo ago
    You can't detect whether a URL handler worked correctly in a browser; otherwise Windows will appear with a "Select an app to open YOURPROTOCOLHERE://" which is completely nonsensical to the user. As for option 2; ask them every time, or edit their hosts file. Easiest decision in the world: Edit their hosts file, every time, no question. The 1% of nerds who care, and oddly enough don't buy Adobe software, are completely meaningless to the 99% of customers who experience the decision positively.
    - imiric 7mo ago
      What a ridiculous conclusion. Why does Adobe need to exfiltrate some information from my machine anyway? If I'm a customer, then they should know this when I sign into my account. They absolutely don't need this information if I'm visiting their website without logging in. Modifying a global system file is something their software shouldn't be doing in the first place, but relying on this abuse to track me on their website is on another level of insidious behavior.
      - gjsman-1000 7mo ago
        If you're worried about device fingerprinting, Adobe has far more reliable ways to do it already. Canvas fingerprinting, IP tracking, cookies. A hosts entry tells them almost nothing they couldn't get elsewhere, provides them with almost no entropy, and attributing insidious intent to what is most plausibly a UX feature is conspiratorial.
        imiric 7mo ago
        I'm not worried about this, since I don't use Adobe products. I'm just calling out what's clearly user hostile behavior. Considering the amount of hostility Adobe has exhibited towards its users over the years, I'm inclined to believe this is yet another example. Nothing conspiratorial about that. If anything, calling this a "UX feature" without any evidence either way is suspiciously dismissive.
- jacobgkau 7mo ago
  > If anything, knowing whether the app is installed or not is kinda important? If you open a file shared with you in the browser, the option to "Open in Desktop" versus "Install Desktop App" actually works correctly? This is not an approach any other app on any platform has historically used, and it doesn't seem sustainable if every app you install has to modify your hosts file to use a hack like this to detect whether it should handle files or not. If you want the browser to be able to give the OS a file handler and have the OS present an option to install the app if it's not installed, that should be handled at the platform level, not on the website using a hack like this. Why can a file not simply be downloaded with a page displayed showing a link to install the app and also instructions to open the file, trusting the user will know if they already have it installed? At best, you're talking about a very small UX optimization. Emphasis on the "kinda" in "kinda important."
  - gjsman-1000 7mo ago
    > This is not an approach any other app on any platform has historically used, and it doesn't seem sustainable if every app you install has to modify your hosts file to use a hack like this to detect whether it should handle files or not. Actually it's completely sustainable. DNS was invented a decade after hosts files. The idea of your host file being almost completely empty is a modern aberration from the days it used to be thousands of lines long. Do I wish there was a better mechanism? Sure. Would HN ever agree on a OS-level app-detection API for the browser? Never. > Why can a file not simply be downloaded with a page displayed showing a link to install the app and also instructions to open the file, trusting the user will know if they already have it installed? At best, you're talking about a very small UX optimization. Emphasis on the "kinda" in "kinda important." A small UX decision, adding up to tens of millions of times per day, affecting 99.9% of people who don't give a darn - versus a matter of slight software engineering principles of "we just don't do it that way." Easiest decision ever.
    - jacobgkau 7mo ago
      > Would HN ever agree on a OS-level app-detection API for the browser? Never. There already is one. It just asks the user whether it's okay before it tells the website, as you acknowledged: https://news.ycombinator.com/item?id=47664546 https://news.ycombinator.com/item?id=47664546 What you're arguing for is not good UX. It's lack of user privacy & control. You just think you're being hip or whatever for being blasé about it.
Steeeve 7mo ago
It's literally a 2 sentence article. Might as well have just tweeted "Adobe makes me mad"
tombert 7mo ago
I don't know anything about Thom, but I've kind of grown to prefer the pissy opinionated tones of blog posts. I think impartiality is difficult or impossible for a lot of tasks, and I'd rather people lay out their opinions plainly than trying to pretend that what they're saying is "objective". Also, I think writing only when you have things to criticize is a valid enough thing to do; what's the point of writing a glorified "I agree!" article? I only ever blog when I have something that I think is unique to say, and as such a lot of the time my posts end up being kind of negative. I don't think I'm that negative of a person, I just don't see the point of flooding the internet with more echo-chambers.
- deleted 7mo ago
  [deleted]
- trollbridge 7mo ago
  I like his tone too. It also is easier to identify that it isn’t LLM generated text. (I have nothing against LLMs but have little interest in reading text generated from them.)
  - tombert 7mo ago
    It's one thing when it's the Associated Press, where they are trying to be a somewhat impartial source of news and reporting raw facts to the best of their ability; stuff like that probably should not have an opinionated tone at all. But I think for things like blogs, without opinions being clear, posts can feel kind of soulless. Even before LLMs I felt that way, and now it has been amplified ten fold with people just cranking out low-effort posts with ChatGPT for reasons that I do not understand. When I write stuff for my blog, I like to think of it as a time capsule of the entirety of the thing I'm writing about. This doesn't just include the raw subject matter, but also my mood and opinions about the subject matter. I'm egotistical enough to occasionally read through my old posts and the ones that I like the best are the ones where I feel like I was expressing myself the most, and where I make no effort whatsoever to try and be impartial.
pessimizer 7mo ago
> No, it's not a stupid reason. Reason is OK, the execution is controversial. This is a muddled statement. It is a stupid reason to "execute" the act of silently modifying your host file. If I murder somebody to keep them from stepping on my foot, and the judge says that it's a stupid reason to murder somebody, it's silly to say that the reason is "OK" because it hurts to have one's foot stepped on.

lousken 7mo ago

How is defender not flagging this? Changing hosts file should raise alarms

xattt 7mo ago
Can this not be blocked with file permissions? Or a symlink to a file in a ro folder?
- SoftTalker 7mo ago
  Most software installers demand to be run as root/Administrator. The fact that this is largely seen as acceptable or even sensible is rather silly in this day and age.
  - deepsun 7mo ago
    Yes, and when apps do request many permissios, I just estimate how reputable the company is. A name like Adobe must be ok, right?
    - gruez 7mo ago
      >Yes, and when apps do request many permissios Most windows apps aren't sandboxed so the concept of "permissions" doesn't make any sense. The most there is is "asks to run as admin", but most installers do.
  - cmovq 7mo ago
    Software wants to be installed in C:\Program Files so that other software can’t modify their installation without admin permissions. Of course to do that your installer needs to be run as administrator which makes the whole thing rather silly.
    - tredre3 7mo ago
      Software installed through the Windows Store seem immutable enough even though they live in the user's AppData. At least the system prevented me from seeing or modifying the files the last time I tried. I did not try very hard, admittedly, but by contrast modifying something in C:\Program Files is just one UAC confirmation away.

vondur 7mo ago

If you don't like Adobe modifying your hosts file then I'd not use them. The checking for the software this way is kinda interesting though.

dlev_pika 7mo ago
I wonder how many Adobe users are aware of this sketchy behavior tho
- tonyedgecombe 7mo ago
  My guess is most Adobe users have no idea there is a hosts file nor what it does.

ChrisArchitect 7mo ago

[dupe] https://news.ycombinator.com/item?id=47617463 https://news.ycombinator.com/item?id=47617463 https://news.ycombinator.com/item?id=47624990 https://news.ycombinator.com/item?id=47624990

jameskraus 7mo ago

Honestly a pretty nifty way to detect if it's installed. I'm sure this can power a lot of nice features, like linking directly into adobe products if they're installed.

turtlebits 7mo ago
It can power even more security issues too. This is absolutely horrendous.
- tonyedgecombe 7mo ago
  I’m wondering how this can be exploited.
  - delecti 7mo ago
    Agreed, at worst this is just vaguely icky feeling; realistically this is a nothing burger. To exploit this kind of thing you'd either need to have access to someone's computer to change the hosts file yourself, pointing to a different IP address, or somehow gain control of Adobe's IP address and point it to a different server. For the former, if you have local root permission, you already own the machine, why bother with this slow of an option. And the latter is already such a takeover that the involvement of this hosts file change is basically irrelevant.
  - the_mitsuhiko 7mo ago
    They implemented it in a way that it only responds with a valid image and a 200 status code, when the referrer is adobe.com. It's probably somewhat sane given the insanity that is the host files hack.

Terr_ 7mo ago

Recycling a comment from prior discussion (4 days, 68 points, 13 comments): https://news.ycombinator.com/item?id=47617463 https://news.ycombinator.com/item?id=47617463 _______ Oh helllll no. Let's imagine an analogy for Adobe leadership: 1. You hired a night janitor to clean and vacuum your executive offices. 2. That janitor secretly stops at every desk-phone to alter the settings of voicemail accounts. 3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!" What's your reaction when you discover it? Do you chuckle and say something like "boys will be boys"? No! You have a panic-call, Facilities revokes access, IT starts checking for other unauthorized surprises, HR looks into terminating contracts, and Legal advises whether you need to pursue data-breach notifications or lawsuits or criminal charges. * Is it acceptable because they had some permission to touch objects in the rooms? No. * Is it acceptable because the final effect is innocuous? No. * Is it acceptable because the employment contract had some vague sentence about "enhancing office communication experiences"? No. * Is it acceptable if they were just dumb instead of malicious? No. No person that would blithely cross those lines can be trusted near your stuff, full-stop.

jacobgkau 7mo ago
To be fair, your analogy has one flaw: > 3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!" Theoretically, it's not "any external caller." Only the janitor's department calling in can dial that sequence and get "Yes, you serviced this office!" If anyone else tries to dial the extension, the desk-phone pretends it doesn't know what it means. (Because it seems Adobe's server serving the analytics image checks the request origin and only serves the image if the origin is Adobe's own website.) The origin "security" doesn't excuse the complexity and the potential for both exploits and human-error breakage in the future.
- gray_-_wolf 7mo ago
  > Only the janitor's department calling in can dial that sequence Is this the case though? Cannot any website use the same trick Adobe does to check whether you have Creative Cloud installed? Like, the entries in /etc/hosts are not magically scoped to work just on Adobe's web, no?

ramon156 7mo ago

To be fair, to crack all adobe products requires a few reg keys. It's wild that they have just given up on pirates.

snapcaster 7mo ago
They don't want to be too hard on piracy, its their new/young user on ramp method
- kenhwang 7mo ago
  Also a lot of recent features are AI related and rely on talking to Adobe servers, which would require a valid subscription. They're probably betting the AI features are valuable enough that local only pirated copies aren't a threat long term.

OptionOfT 7mo ago

Can't even reproduce it when setting location to Belgium, or CA or AZ. I must be missing something.

hypeatei 7mo ago

Looks like they got a wildcard certificate for *.creativecloud.adobe.com[0] so that the HTTPS connection works and so they don't have to publish DNS records for the "detect-ccd" subdomain to obtain a cert. Pretty neat setup, but also kinda hacky. 0: https://crt.sh/?q=creativecloud.adobe.com https://crt.sh/?q=creativecloud.adobe.com

j45 7mo ago

Make affinity sound like a smarter and smarter choice.

deleted 7mo ago
[deleted]

matsemann 7mo ago

Oh well, as a teenager, blocking adobe servers in hosts file was how you got to "phone activation" and could generate a code. So I guess we're even, heh.

butlike 7mo ago
That CS2 torrent was a GOAT.
- 9dev 7mo ago
  FCKGW-RHQQ2-…
  - 3-cheese-sundae 7mo ago
    Those particular neurons of mine haven't seen action in quite some time, thank you.
  - hoherd 7mo ago
    I worked at Gateway during this era and always saw that in the light of me quitting when XP came out and drove me crazy. FCKGW indeed.
huflungdung 7mo ago
[dead]
userbinator 7mo ago
The title of this article recalled that exact memory for me too. Not only Adobe but cracks for a few other expensive softwares needed the same. ...and then Adobe (unintentionally) gave away free downloads of CS2, with valid serial numbers, once they shut down the activation servers. You can still find them on the Internet Archive.
ProllyInfamous 7mo ago
I also did this as a teenager. Doing this again, now (well into adulthood): recently gifted a "broken" 2013 MacPro[0], and have set it up as my retro CS4 workhorse (decades old software on a decade old machine). Hosts/PiHole ready, blocking "*adobe*" entirely. Only problem now is I cannot find four's `FCKGW-RHQQ2-`... my oldmanfish surfs onwards, Santiago remaining uncertain. For now I just don't quit and never shut down (fresh install allows limited launches). [0] RAM slot was jamming, not allowing proper seating

nashashmi 7mo ago

So can I fool the website that I have CC installed?

Dwedit 7mo ago

Browsers could still do something about mixed Internet and LAN/Localhost requests by IP address regardless of the domain name.

SahAssar 7mo ago
This does not request a local/LAN file, it's a remote server but without any DNS entry unless the hosts file entry is present.
Dylan16807 7mo ago
Did you misread the post? They're doing this because the localhost shenanigans got blocked. This is pure internet requests, but the IP changes (or fails to resolve) based on what's in your hosts file.

1bpp 7mo ago

I owe thousands of dollars to amtlib.dll.

psyclobe 7mo ago

The most difficult of tasks is trying to un-unstall this pos app on windows.

hatradiowigwam 7mo ago

Whether it's run as root/administrator or not - you can disable this behavior by setting the immutable flag on /etc/hosts. No user, including root, can write to a file with the immutable flag set(although root could _remove_ the attribute and then write).

throw_await 7mo ago

what happens if you happen to use a DNS server that resolves this domain to the correct IP?

djfobbz 7mo ago
"Correct IP" wins ;)

ryandrake 7mo ago

As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. Dumping crap all over C:\Windows or /usr or /boot or something? No way--the OS should make the developer obtain my consent (not just a blanket sudo-like escalation) to do these things. Sneakily modifying /etc/hosts to act against me? Get the hell outta here!

mikkupikku 7mo ago
I thought the days if needing to "sudo" to install applications on windows were long gone; doesn't basically everything happily do user installations now? I would view a demand to escalate as basically proof that the application is about to do something janky, if not outright malicious. On linux, if I can't build and run software with just my user account, that software has some explaining to do. Virtually every desktop application should be able to run without escalated privileges.
- Ajedi32 7mo ago
  "C:/Program Files" is still the recommended place to install programs, and it requires admin privileges to write to. Some programs (ab)use C:\ProgramData for that purpose instead and therefore don't need admin privliges. But even with that hack, ultimately Windows still uses the https://xkcd.com/1200/ https://xkcd.com/1200/ permission model. (Everything runs with full access to all your data.)
  - TiredOfLife 7mo ago
    On Windows enabling access control is 4 clicks. The problem with enabling it by default is that every time MS tries to harden the defaults there is much weeping and wailing and gnashing of teeth
- vpShane 7mo ago
  on windows and mac they just get a prompt and a lot of people don't read it, care, nor wonder what it's actually doing they just want it to work. I know you all know this but companies will do this knowing that exploiting all of us. I use Linux and agreed on all those points. when I used adobe before it wanted to charge me a fee to cancel my subscription and wouldn't let me just 'cancel' in their system so I just blocked the payments on my card and dipped out. good software, garbage company

dpedu 7mo ago

I installed Creative Cloud just last week. No such entry was created in the hosts file on my macOs system.

cyanydeez 7mo ago

Are we sure this is to detect Creative Cloud instead of, trying to detect whether you have/had a pirated version of Adobe installed? Some reference material I've seen often involved blackholing adobe hosts to prevent installation software from verifying or otherwise talking to adobe.

486sx33 7mo ago

[dead]

dblohm7 7mo ago

I don't know whether is still does this, but 8-9 years ago I discovered that Acrobat overwrites the COM registry entries for Microsoft Active Accessibility (oleacc.dll) such that any application attempting to instantiate MSAA gets the Adobe DLL instead of the system DLL. This actually broke the stuff I was working on and had to override it in my app manifest to forcibly use the system version. I inquired about it and got some BS about how they absolutely _had_ to do this to intercept MSAA instantiations across the system, when in reality they were using a global solution to solve a local problem.

reactordev 7mo ago

Adobe has been user hostile since Create Suite launched. Where were you? They have been hiding backdoors in windows machines and Mac machines since at least 2010.

crest 7mo ago

There are no suspicious entries in my /etc/hosts just what I put there.

lemoncookiechip 7mo ago

Adobe really relishes being a villain. I don't understand how one company can be so anti-consumer.

Ylpertnodi 7mo ago
Consumers keep buying adobe.

stego-tech 7mo ago

Honestly, I've been dealing with crap like this for so many decades that I'm a fervent supporter of every "installer" just showing and logging a Git PR-styled diff to the user of every file and system change, everywhere in the system, complete with the ability to rollback from it. I am tired of inconsistent logging, opaque system changes, and vendors generally being malicious with endpoint security in the name of protecting profit. Screw the "show me the log" option that scrolls by in a flash and you can't get back to, show me the damn diff first.

ethanrutherford 7mo ago
Maybe you will read it carefully every single time (and to be clear, I doubt even that) but for the majority of users this will only lead to increasing the already excessive amount of decision-fatigue they deal with when interacting with software day to day. People already blindly click through sequences of confirmation boxes when they think they already know what they're doing. Odds are a million to one you've done that very thing before yourself. Adding even more friction is only going to make the average user spam the "next" button even more fervently.
hrvstr 7mo ago
For *.pkg installers there is Suspicious Package at least. https://www.mothersruin.com/software/SuspiciousPackage/ https://www.mothersruin.com/software/SuspiciousPackage/

basilikum 7mo ago

I'd like to answer the closing question > At what point does a commercial software suite become malware? The vast majority of commercial software is malware.

drowntoge 7mo ago

As much as I dislike what AI slop is doing to visual design, I wouldn’t mind seeing Adobe get hurt for being the comically terrible company it is.

Duanemclemore 7mo ago

I have been an Adobe user since 1996. Starting with Photoshop 3. Then, using the rest of their programs since 1999. Between this and the fact that they've just 1. Changed all the old accounts to "Adobe Creative Cloud Pro" 2. DOUBLED the monthly fee, now charging you for the AI features whether you want them or not, and 3. Removed any tiers that have full program access but no AI, I am walking away forever when my current month expires. Not to mention, students now only get the old $19.99 membership for the first year. I teach visualization and representation tools to architecture students. I had always taught them Adobe products before. Now I can't in good faith sign them up to have their expertise tied to using this program stack forever. So tomorrow I am giving them a lecture on free to use and FOSS versions of the same tools. And I'm going to teach the class from them in perpetuity. Congratulations, Adobe that's 50+ students a year who won't be using your products when they graduate.

mishkatronic 7mo ago
Is that not potentially detrimental to your students if the use of Adobe products is a more common industry practice?
- eqvinox 7mo ago
  Probably different at huge companies, but small employers I know don't care how you get your work done. If anything they're happy if they don't have to buy/rent licenses for you. …now that I think about it, don't architects predominantly work in smaller companies?
  - knigyfrrob 7mo ago
    Speaking as a lifelong graphic designer with over 20 years experience under my belt: it really doesn’t matter what kind of software you use, HOWEVER, not using the industry standard can bite you in the ass quite fast. PDF export can be finicky, colour management is hit or miss, collaboration is nearly impossible… I wish someone would come and take Adobe’s monopoly down for good, but as it stands, shunting Adobe for something else in a professional environment is more trouble than it’s worth.

knlam 7mo ago

Yearly reminder that Adobe CC is malware. Open your Activity Monitor on your Mac and see how much craps CC run on your computer

taspeotis 7mo ago

https://devblogs.microsoft.com/oldnewthing/20061101-03/?p=29153 https://devblogs.microsoft.com/oldnewthing/20061101-03/?p=29...

linzhangrun 7mo ago

[flagged]

throwawayqqq11 7mo ago

Would it be possible (practical) to uniquely identify large numbers of users and even bypass anonymization efforts like tor and VPNs with this?

rkagerer 7mo ago

I vote we all add that HOSTS entry to poison their despicably dark-pattern detection algorithm.