6 ms·

>This makes me even more angry at SourceForge and not less. YCombinator also invested in a company that did this. http://www.istartedsomething.com/20130115/y-

>This makes me even more angry at SourceForge and not less. YCombinator also invested in a company that did this. http://www.istartedsomething.com/20130115/y-combinator-is-funding-the-future-of-spam-in-windows-drive-by-crapware-installers/ http://www.istartedsomething.com/20130115/y-combinator-is-fu... Here's pg's response: >2. The apps that get installed are "crapware." >This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things. https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711

moron4hire 11y ago
Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but-not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time. What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.
- digi_owl 11y ago
  I guess it could happen if one use PPAs or similar, but i don't see it ever getting off the ground within the main repos. I wonder if we will see more of it as distros move to Snappy or similar schemes. I guess it will come down to how "frameworks" gets handled etc.
- JoshTriplett 11y ago
  > What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies. Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.
  - moron4hire 11y ago
    So the answer is "trust"? We're supposed to just trust Canonical, the company that put Amazon ads in our desktop search, to not figure out they could put adware in their package repository?
    - JoshTriplett 11y ago
      I wouldn't. But I'd trust Debian.
      - SwellJoe 11y ago
        And, I would trust Fedora (which has similarly stringent Open Source guidelines for inclusion).
    - deleted 11y ago
      [deleted]
- jlgaddis 11y ago
  > What systems are in place to prevent this from happening with package manager systems ... ? There aren't any technical measures in place to prevent this. Imagine the backlash, however, if any Linux distribution decided to do this.
piyush_soni 11y ago
I didn't know about that. Too bad, and the way PG was defending a crapware installing product was really unconvincing. Any application which installs other ones by relying on accidental clicks by users is without a doubt doing wrong.
- drzaiusapelord 11y ago
  Its funny how stupid smart people get when they're chasing big IPO dreams.
- davidgerard 11y ago
  Microsoft is now correctly marking "adware" as the malware it is: https://threatpost.com/microsoft-to-detect-search-protection-code-as-malware/113027 https://threatpost.com/microsoft-to-detect-search-protection...
  - whoopdedo 11y ago
    Only when the ads aren't coming from Microsoft themselves. Like how they pushed KB3035583, the advertisement to upgrade to Windows 10, as a "recommended" update that would be installed without user interaction if you had WU configured to download automatically.
    - yuhong 11y ago
      Win10 don't harm your computer the way these "adware" does.
    - mynameisvlad 11y ago
      The next OS update isn't really "adware", or an ad, especially when it's a free update that will most likely be updateable to the RTM build (based on how smooth build-to-build upgrades have gotten). If you're going to apply this standard, OSX does the same thing now, it'll prompt you to update to the latest 10.X. Ubuntu does it too, it lists it at the top of the software upgrade.
JohnTHaller 11y ago
It's also worth mentioning that one reason for Chrome's market share is this exact practice. When you let Java automatically update itself and download the new version on Windows, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you want to download Flash plugin for Opera or Mozilla and go to Adobe's site, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you let the free version of Avast update itself on Windows, if you don't uncheck two boxes, surprise... you get Google Chrome installed asking to be default browser AND Google toolbar installed into IE.
fapjacks 11y ago
He's defending it because he's been kind of douchey the last few years.
prodigal_erik 11y ago
YC funding should not be taken as any kind of ethical seal of approval. It's not their job, and they are demonstrably bad at it. pg described AirBnB as "among the nicest of all the people we've funded" and their CTO was already a huge spammer and now a repeat offender.
- yuhong 11y ago
  But Quora's login wall has affected HN themselves, and pg spoke up against it.

moron4hire 11y ago

Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but-not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time. What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.

digi_owl 11y ago
I guess it could happen if one use PPAs or similar, but i don't see it ever getting off the ground within the main repos. I wonder if we will see more of it as distros move to Snappy or similar schemes. I guess it will come down to how "frameworks" gets handled etc.
JoshTriplett 11y ago
> What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies. Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.
- moron4hire 11y ago
  So the answer is "trust"? We're supposed to just trust Canonical, the company that put Amazon ads in our desktop search, to not figure out they could put adware in their package repository?
  - JoshTriplett 11y ago
    I wouldn't. But I'd trust Debian.
    - SwellJoe 11y ago
      And, I would trust Fedora (which has similarly stringent Open Source guidelines for inclusion).
  - deleted 11y ago
    [deleted]
jlgaddis 11y ago
> What systems are in place to prevent this from happening with package manager systems ... ? There aren't any technical measures in place to prevent this. Imagine the backlash, however, if any Linux distribution decided to do this.

piyush_soni 11y ago

I didn't know about that. Too bad, and the way PG was defending a crapware installing product was really unconvincing. Any application which installs other ones by relying on accidental clicks by users is without a doubt doing wrong.

drzaiusapelord 11y ago
Its funny how stupid smart people get when they're chasing big IPO dreams.
davidgerard 11y ago
Microsoft is now correctly marking "adware" as the malware it is: https://threatpost.com/microsoft-to-detect-search-protection-code-as-malware/113027 https://threatpost.com/microsoft-to-detect-search-protection...
- whoopdedo 11y ago
  Only when the ads aren't coming from Microsoft themselves. Like how they pushed KB3035583, the advertisement to upgrade to Windows 10, as a "recommended" update that would be installed without user interaction if you had WU configured to download automatically.
  - yuhong 11y ago
    Win10 don't harm your computer the way these "adware" does.
  - mynameisvlad 11y ago
    The next OS update isn't really "adware", or an ad, especially when it's a free update that will most likely be updateable to the RTM build (based on how smooth build-to-build upgrades have gotten). If you're going to apply this standard, OSX does the same thing now, it'll prompt you to update to the latest 10.X. Ubuntu does it too, it lists it at the top of the software upgrade.

JohnTHaller 11y ago

It's also worth mentioning that one reason for Chrome's market share is this exact practice. When you let Java automatically update itself and download the new version on Windows, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you want to download Flash plugin for Opera or Mozilla and go to Adobe's site, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you let the free version of Avast update itself on Windows, if you don't uncheck two boxes, surprise... you get Google Chrome installed asking to be default browser AND Google toolbar installed into IE.

fapjacks 11y ago

He's defending it because he's been kind of douchey the last few years.

prodigal_erik 11y ago

YC funding should not be taken as any kind of ethical seal of approval. It's not their job, and they are demonstrably bad at it. pg described AirBnB as "among the nicest of all the people we've funded" and their CTO was already a huge spammer and now a repeat offender.

yuhong 11y ago
But Quora's login wall has affected HN themselves, and pg spoke up against it.