2 ms·

I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't

by dimino 11y ago

I think maybe I've touched a nerve here, and I'm sorry for that (I'm trying to do that less often on HN in particular) -- all I'm trying to say is that I don't think Sourceforce wants to hurt its users, and that, to me, a guy who works in the computer security industry, is a standard for "malware". It just seems to me that the term "malware" is being used here intentionally to antagonize, rather than to accurately classify the software being installed by Sourceforge. Please understand that I am casting no judgement or assessment whatsoever of what Sourceforge is doing -- personally I think they're a dying website that's trying to do whatever they can to make money and stay relevant. It just intuitively feels wrong to classify China in the same category as Sourceforge.

oneeyedpigeon 11y ago
There are certainly different understandings of the term 'malware', even within the technical community, let alone the wider world. The fact that a large number of people use it to describe "software that ended up on my computer that I wasn't expecting", no matter what it's doing, means that companies need to be very careful how they go about using this practice. Even if you have the very best possible intentions in the world, you're probably going to damage your reputation by bundling unrelated software, so why not just offer it as a separate download in the first place?
- dimino 11y ago
  I get where you're coming from, and ultimately I agree that Sourceforge screwed up by doing this whole "bundling" thing, and probably because they're scrambling desperately to make money in a GitHub world. There is, however, a meaningful difference between the kinds of things my antivirus picks up and the software Sourceforge was bundling. Calling the Sourceforge bundles "malware" masks that difference, and I think that's harmful, and maybe a little childish.
  - JoshTriplett 11y ago
    I've seen multiple reports of people's antivirus software blocking downloads of the "installers" provided by SourceForge, or warning about the resulting downloaded executable. And rightfully so. Scrambling to stay in business, or being under new management, is not an excuse to suddenly become user-hostile or otherwise turn to shady activities. Similarly, many companies start throwing around litigation when they begin to fail, since that's the only way the purchasers of the various patents/etc owned by the company into money. Finally, the only "harm" it could do to classify all such software as "malware" is to make it more difficult for vendors of software who would prefer not to be classified in the same bucket as people who maliciously break into computer systems. And I have zero sympathy for any such companies; the sooner they go out of business, and the more they're viewed as universally unacceptable, the better off both users and the computing industry will be.
jackmaney 11y ago
You've been caught acting as a shill for SourceForge. The least you could do is admit it and slither away.
- dimino 11y ago
  Haha, come on man, let's assume positive intent on my part here, I just want to talk about how we classify bad behavior on the Internet.
  - deleted 11y ago
    [deleted]
  - jackmaney 11y ago
    > Haha, come on man, let's assume positive intent on my part here http://img2.wikia.nocookie.net/__cb20130620000603/walkingdead/images/d/d7/How-about-no-bear-meme.jpg http://img2.wikia.nocookie.net/__cb20130620000603/walkingdea...
- dang 11y ago
  Accusations of shilling without evidence are not allowed on Hacker News. An opposite opinion is not evidence. The vast majority of the time, people just sincerely disagree with each other. I've written about this frequently [1] if anyone wants more information. > admit it and slither away Totally not ok. Please comment civilly and substantively or not at all. [2] 1. https://hn.algolia.com/?sort=byDate&prefix=true&page=0&dateRange=all&type=comment&query=by:dang%20astroturfing https://hn.algolia.com/?sort=byDate&prefix=true&page=0&dateR... 2. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - jackmaney 11y ago
    He's accused people who disagree with him of being liars. That, along with his general behavior, is good enough for me. Oh, and don't bother trying to spam my email account. I set up a filter to automatically delete any email from hn@ycombinator.com long, long ago.
JoshTriplett 11y ago
Your response "Why are you lying?" elsewhere in this thread, now deleted, certainly doesn't help make your actions seem genuine. And attempting to trick users into installing software that you know they don't want is definitely ill intent and attempting to hurt users. Sure, some security professionals make distinctions between a variety of different subtypes of bad software, with varying definitions, including adware, malware, badware, ransomware, backdoors, viruses, trojans, and any number of other terms. But outside of the security industry, people trying to make fine-grained distinctions or introduce different terms are often malware vendors themselves, hence why you've "touched a nerve". For instance, when Lenovo started pre-installing the Superfish malware on their systems, they persistently called it "Potentially Unwanted Programs", to obfuscate what they were actually doing. On top of that, as the Superfish case indicates, even software that "just" serves ads tends to escalate, such as by MITMing and utterly breaking HTTPS. And any such software has the potential to introduce bugs. We have quite enough bugs in software that does what its users want it to do, without introducing more software that nobody wants and that can only further reduce user security and privacy.
- dimino 11y ago
  I'm trying to be a better actor on this site, I'm sorry for the "Why are you lying?" comment. I deleted it because it completely undermines my argument, you're right to call me out on it. I'm sorry. :( I think you and I are on the same page here. My only additional point I'd like to make is that there is value in differentiating between what Sourceforge did and what will happen if you download a bad torrent from TPB, or click the wrong ad on a porn website. Lumping them all together means my grandfather goes and buys identity protection services because the Ask toolbar on IE is "malware".
  - JoshTriplett 11y ago
    If you'd started out your comments in the way you're presenting them now, I think you'd have gotten a better response. It's still a hot-button topic, not least of which because as mentioned the main people that benefit from such distinctions are the companies writing software that users don't want (e.g. Lenovo's attempt to use the term "Potentially Unwanted Programs"). However, what is HN coming to if you can't argue about nitpicky distinctions? ;) Also, the Ask toolbar is not the only thing SF is installing; they're also installing much worse software. And sure, it's less harmful to change a user's search engine or waste a few dozen vertical pixels on a distracting toolbar than it is to turn a user's system into a botnet node, but "less harmful" is still harmful. For the record, I also think there are some bad actors in the "identity protection" and similar security spaces; not only is it ridiculous to need software or services to protect you from other software and services, but many such services are scamming novice computer users who know enough to be afraid. And the entire consumer antivirus industry is a bit ridiculous as well, not least of which in the sheer amount of resources such software tends to take up. I much prefer the portion of the security industry that's pushing for a sandboxed-by-default, principle-of-least-privilege world. But at the same time, adware, malware, or whatever you want to call it (including the vast majority of IE toolbars and such) are good examples of software that needs to go away and never come back. I'm not interested in shady ways to scam and "monetize" users; as has been said many times elsewhere, "your failing business model is not our problem". And the existence of even worse software doesn't excuse slightly-less-awful-but-still-awful software. The only question is how much damage such companies will do in their death throes before they finally die.

by dimino 11y ago

oneeyedpigeon 11y ago

There are certainly different understandings of the term 'malware', even within the technical community, let alone the wider world. The fact that a large number of people use it to describe "software that ended up on my computer that I wasn't expecting", no matter what it's doing, means that companies need to be very careful how they go about using this practice. Even if you have the very best possible intentions in the world, you're probably going to damage your reputation by bundling unrelated software, so why not just offer it as a separate download in the first place?

dimino 11y ago
I get where you're coming from, and ultimately I agree that Sourceforge screwed up by doing this whole "bundling" thing, and probably because they're scrambling desperately to make money in a GitHub world. There is, however, a meaningful difference between the kinds of things my antivirus picks up and the software Sourceforge was bundling. Calling the Sourceforge bundles "malware" masks that difference, and I think that's harmful, and maybe a little childish.
- JoshTriplett 11y ago
  I've seen multiple reports of people's antivirus software blocking downloads of the "installers" provided by SourceForge, or warning about the resulting downloaded executable. And rightfully so. Scrambling to stay in business, or being under new management, is not an excuse to suddenly become user-hostile or otherwise turn to shady activities. Similarly, many companies start throwing around litigation when they begin to fail, since that's the only way the purchasers of the various patents/etc owned by the company into money. Finally, the only "harm" it could do to classify all such software as "malware" is to make it more difficult for vendors of software who would prefer not to be classified in the same bucket as people who maliciously break into computer systems. And I have zero sympathy for any such companies; the sooner they go out of business, and the more they're viewed as universally unacceptable, the better off both users and the computing industry will be.

jackmaney 11y ago

You've been caught acting as a shill for SourceForge. The least you could do is admit it and slither away.

dimino 11y ago
Haha, come on man, let's assume positive intent on my part here, I just want to talk about how we classify bad behavior on the Internet.
- deleted 11y ago
  [deleted]
- jackmaney 11y ago
  > Haha, come on man, let's assume positive intent on my part here http://img2.wikia.nocookie.net/__cb20130620000603/walkingdead/images/d/d7/How-about-no-bear-meme.jpg http://img2.wikia.nocookie.net/__cb20130620000603/walkingdea...
dang 11y ago
Accusations of shilling without evidence are not allowed on Hacker News. An opposite opinion is not evidence. The vast majority of the time, people just sincerely disagree with each other. I've written about this frequently [1] if anyone wants more information. > admit it and slither away Totally not ok. Please comment civilly and substantively or not at all. [2] 1. https://hn.algolia.com/?sort=byDate&prefix=true&page=0&dateRange=all&type=comment&query=by:dang%20astroturfing https://hn.algolia.com/?sort=byDate&prefix=true&page=0&dateR... 2. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- jackmaney 11y ago
  He's accused people who disagree with him of being liars. That, along with his general behavior, is good enough for me. Oh, and don't bother trying to spam my email account. I set up a filter to automatically delete any email from hn@ycombinator.com long, long ago.

JoshTriplett 11y ago

Your response "Why are you lying?" elsewhere in this thread, now deleted, certainly doesn't help make your actions seem genuine. And attempting to trick users into installing software that you know they don't want is definitely ill intent and attempting to hurt users. Sure, some security professionals make distinctions between a variety of different subtypes of bad software, with varying definitions, including adware, malware, badware, ransomware, backdoors, viruses, trojans, and any number of other terms. But outside of the security industry, people trying to make fine-grained distinctions or introduce different terms are often malware vendors themselves, hence why you've "touched a nerve". For instance, when Lenovo started pre-installing the Superfish malware on their systems, they persistently called it "Potentially Unwanted Programs", to obfuscate what they were actually doing. On top of that, as the Superfish case indicates, even software that "just" serves ads tends to escalate, such as by MITMing and utterly breaking HTTPS. And any such software has the potential to introduce bugs. We have quite enough bugs in software that does what its users want it to do, without introducing more software that nobody wants and that can only further reduce user security and privacy.

dimino 11y ago
I'm trying to be a better actor on this site, I'm sorry for the "Why are you lying?" comment. I deleted it because it completely undermines my argument, you're right to call me out on it. I'm sorry. :( I think you and I are on the same page here. My only additional point I'd like to make is that there is value in differentiating between what Sourceforge did and what will happen if you download a bad torrent from TPB, or click the wrong ad on a porn website. Lumping them all together means my grandfather goes and buys identity protection services because the Ask toolbar on IE is "malware".
- JoshTriplett 11y ago
  If you'd started out your comments in the way you're presenting them now, I think you'd have gotten a better response. It's still a hot-button topic, not least of which because as mentioned the main people that benefit from such distinctions are the companies writing software that users don't want (e.g. Lenovo's attempt to use the term "Potentially Unwanted Programs"). However, what is HN coming to if you can't argue about nitpicky distinctions? ;) Also, the Ask toolbar is not the only thing SF is installing; they're also installing much worse software. And sure, it's less harmful to change a user's search engine or waste a few dozen vertical pixels on a distracting toolbar than it is to turn a user's system into a botnet node, but "less harmful" is still harmful. For the record, I also think there are some bad actors in the "identity protection" and similar security spaces; not only is it ridiculous to need software or services to protect you from other software and services, but many such services are scamming novice computer users who know enough to be afraid. And the entire consumer antivirus industry is a bit ridiculous as well, not least of which in the sheer amount of resources such software tends to take up. I much prefer the portion of the security industry that's pushing for a sandboxed-by-default, principle-of-least-privilege world. But at the same time, adware, malware, or whatever you want to call it (including the vast majority of IE toolbars and such) are good examples of software that needs to go away and never come back. I'm not interested in shady ways to scam and "monetize" users; as has been said many times elsewhere, "your failing business model is not our problem". And the existence of even worse software doesn't excuse slightly-less-awful-but-still-awful software. The only question is how much damage such companies will do in their death throes before they finally die.