topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Friday April 19, 2024, 2:01 pm
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Last post Author Topic: App vendors discover a new way to abuse Windows  (Read 19435 times)

Jibz

  • Developer
  • Joined in 2005
  • ***
  • Posts: 1,187
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #25 on: October 08, 2011, 04:44 PM »
As someone who has spent way too much time manually updating Firefox and flash player on all kinds of machines, I think Chromes automatic updates are great.

If you only have your own machine at home to take care of, then you can afford to be paranoid, but to people who are not computer experts, having security fixes applied automatically without them even noticing, is a blessing compared to how Firefox works.

And I seriously doubt they are going to push an update that changes the EULA silently. Do you have any evidence of this ever happening?

Now Firefox is adding a similar feature, but as with the rapid release schedule, I am afraid they are going to mess it up because they simply don't realize what other changes it requires.

Eóin

  • Charter Member
  • Joined in 2006
  • ***
  • Posts: 1,401
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #26 on: October 08, 2011, 05:06 PM »
Flash player updates drive me bonkers, mainly because of the time they choose to popup, i.e. just as you've logged in. An almost silent updater which only asks for a yes before applying the final step would be easy enough, and better for the user IMO.

Carol Haynes

  • Waffles for England (patent pending)
  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 8,066
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #27 on: October 08, 2011, 06:37 PM »
If you only have your own machine at home to take care of, then you can afford to be paranoid, but to people who are not computer experts, having security fixes applied automatically without them even noticing, is a blessing compared to how Firefox works.

Except when they update things and break them - eg. one update broke Chrome's printing facility on lots of websites and it remained broken over numerous later updates. Allowing people to update when they want to alleviates this problem because people can look for any unforeseen issues before they choose to update.

If you don't like FF updates turn them off and periodically do a manual check.

And I seriously doubt they are going to push an update that changes the EULA silently. Do you have any evidence of this ever happening?


I can't think of a specific example from Google (though I am sure some here will be able to) but there are lots of examples of other big companies tinkering with EULAs and the small print says they can. Even if Google hadn't modified EULAs (which I know they have) there is nothing to stop them changing them in the future and by accepting a passive update with an updated EULA I am sure you will be deemed to have consented to the new terms.

Hell MS have made an artform of making EULAs as impenetrable as possible and varying them with every software release!

I can't remember what it was but I remember a few years back there was a piece of well known software that changed the EULA to say they could use your computer for distributed processing and another title that put a condition into the EULA to say that you couldn't uninstall their software. I seem to remember Sony did the latter example with their rootkit scare.

Flash player updates drive me bonkers, mainly because of the time they choose to popup, i.e. just as you've logged in. An almost silent updater which only asks for a yes before applying the final step would be easy enough, and better for the user IMO.

Given all the hassles with Flash over the years do you really want silent updates? If you don't like the frequent updates popping up turn them off and check manually once a month. Or even better go to http://www.macromedi...tings_manager05.html and change the update check to something tolerable like 28 days.

JavaJones

  • Review 2.0 Designer
  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 2,739
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #28 on: October 09, 2011, 02:31 AM »
Silent updates and EULA changes are separate issues. A new EULA should always notify the user, regardless of whether the app it applies to updates silently. Keep in mind a EULA can be updated without the software being updated and - probably much more the norm anyway - software can be updated without the EULA changing.

- Oshyan

Renegade

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 13,288
  • Tell me something you don't know...
    • View Profile
    • Renegade Minds
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #29 on: October 09, 2011, 02:38 AM »
Flash player updates drive me bonkers, mainly because of the time they choose to popup, i.e. just as you've logged in. An almost silent updater which only asks for a yes before applying the final step would be easy enough, and better for the user IMO.

+1 I hate being pestered.

But the true source of my all encompassing demonic bloodlust is the popup... that steals focus... Stealing focus has to be the single most evil thing in computing.

POP~! ==> "Hey! I see you're in the middle of some difficult work and have spent lots of time on it! Would you like to start cursing? Just press any key to reboot!"

Makes me wonder if the "pop" is supposed to mean a blood vessel...

Back on track...

Flash needs everything to close, so silent is hard as it would then require a reboot. So, if you have any browsers or that open, it can't be silent.

It's not a huge step for them to take to smooth that out, but it is a step.
Slow Down Music - Where I commit thought crimes...

Freedom is the right to be wrong, not the right to do wrong. - John Diefenbaker

tranglos

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,081
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #30 on: October 09, 2011, 11:24 AM »
Flash needs everything to close, so silent is hard as it would then require a reboot. So, if you have any browsers or that open, it can't be silent.

It's not like anyone's waiting with baited breath for the exiting new features a flash update will bring. If it requires a reboot, so be it, no-one will notice. They already wait for a reboot (or new session login, anyway) to launch the updater. So let them run it in the background and install it at the next cycle.

And for all the flash groupies in the whole world (all three of them, including one cat), put up a balloon notification over the task tray to let then know an update is waiting for a reboot.

tranglos

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,081
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #31 on: October 09, 2011, 11:33 AM »
How about this... Instead of:

> App vendors discover a new way to abuse Windows

How about:

> App vendors discover a way that illustrates how Windows program installations are basically overly complicated, fragmented, and difficult to work with

Is it a problem with abusing Windows, or is it a problem with how Windows sets things up?

Both, I'm sure. I do see your points, Renegade, but I don't know if Windows' shortcomings should be a carte blanche for developers to make it even more "complicated, fragmented, and difficult to work with".

In a way you already mentioned a better solution yourself: distribute a separate, portable installation. That will work for those who can't install software where MS wants them to.

I fully agree there should be a common location for "user executables". One day we'll probably get it. OTOH, Microsoft was continually and rightly bashed for their non-approach to security ever since Win95. So now that they've built in a lot of protection, it seems to me subverting it is not the right thing to do.


40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,858
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #32 on: October 09, 2011, 01:33 PM »
And I seriously doubt they are going to push an update that changes the EULA silently. Do you have any evidence of this ever happening?

Hmmm...

From the Chrome EULA:

11. Software updates

11.1 The Software that you use may download and install updates automatically, from time to time, from Google. These updates are designed to improve, enhance and further develop the Services and may take the form of bug fixes, enhanced functions, new software modules and completely new versions. You agree to receive such updates (and permit Google to deliver these to you) as part of your use of the Services.

Ok...so Google can issue changes and/or updates to the software at any time and you agree to let Google install them. (I like the little tap dance where they say "You agree to receive them..." and "permit Google to deliver to you" instead of coming right out and just saying "You agree to allow Google to install software updates on your machine, as and when it sees fit.")

Then there's the EULA itself:

18. Changes to the Terms

18.1 Google may make changes to the Universal Terms or Additional Terms from time to time. When these changes are made, Google will make a new copy of the Universal Terms available at http://www.google.co...en-GB/eula_text.html and any new Additional Terms will be made available to you from within or through the affected Services.

18.2 You understand and agree that if you use the Services after the date on which the Universal Terms or Additional Terms have changed, Google will treat your use as acceptance of the updated Universal Terms or Additional Terms.

Ok...so once you've installed Chrome and accepted whatever term and conditions existed at the time you installed it, you automatically agree to any changes and give them your implicit consent if you use the product after such changes were made. In short, no need to formally agree. If you use it - you have! Even if they change the terms and conditions after the fact.

Of course Google will post the text - and even provide you with the link for the current EULA - which it is your responsibility to monitor since they are under no legal obligation to bring subsequent changes to your attention beyond them telling you there WILL be changes - and if you're concerned about it please go to the weblink.

Now Google could (like Apple's AppStore) periodically flash up a new consent form if the terms and conditions changed. But they don't. Or at least they don't have to. See that weasel-word "may"? That puts you under obligation without creating a reciprocal responsibility on their end. They can send you a letter, an e-mail, have it popup in the app, or just post it somewhere on their website. See below:

19.3 You agree that Google may provide you with notices, including those regarding changes to the Terms, by email, letter post or postings on the Services.

But again - they only may. Nothing says they will. Otherwise they would have said "will" instead of "may," Cute! Even Apple isn't quite that sleazy.

Not that Apple is worried in that regard. Their iPhone EULA is over 60 pages long last I checked. So I'm sure they're banking on nobody actually reading it all that often - assuming many will read it at all.

Not that it matters...

Because if you do disagree with Apple on that point you'll also have to scrap your iPhone or iPad. And that's because their terms and conditions also cover your use of their hardware. Pretty sweet, huh? Nice to know all that cash you thought you laid out to buy your iPad really only bought you the right to use it. And furthermore, that right is subject to change without notice. Or negotiation.

Maybe it's time for a universal EULA that reads:

1.  XXX retains all rights and accepts no responsibilities or reciprocal obligations for the use of their product.

2.  Anyone who installs or uses any XXX product agrees to immediately and forever waive any and all legal and/or moral rights they may have as a condition of using same.

3. This agreement will remain in effect in perpetuity and may be modified at any time. XXX may, at its sole option and discretion, notify the users of such changes. But it specifically waives any formal requirement on its part to do so.

4. It is the sole obligation of the user of this product to remain informed of any changes to this agreement. User acknowledges and agrees that it is their sole obligation, and specifically waives any requirement of notification by XXX for any changes in the agreement.

5. User further acknowledges that any and all items found in the most current terms and conditions are binding upon them as a condition of their using this software product; and agree that they shall be bound to such terms and conditions even if not specifically aware of them (or such changes made to them) at the time of their using said product.

6. XXX will make a best effort to publish any changes to the terms and conditions on a timely basis and make them available at this link: <wblink here> but is under no formal obligation to do so.
-----------

There ya go. Six items of gobbledygook that cover just about everything a 20 page EULA does. And with 90% of what most of them boil down to covered by Item #1 alone. How's that for data compression?  :Thmbsup:

« Last Edit: October 09, 2011, 02:15 PM by 40hz »

Stoic Joker

  • Honorary Member
  • Joined in 2008
  • **
  • Posts: 6,646
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #33 on: October 09, 2011, 02:25 PM »
There ya go. Six items of gobbledygook that cover just about everything a 20 page EULA does. And with 90% of what most of them boil down to covered by Item #1 alone. How's that for data compression?

Excellent. ...And also the very basis of my 25 word rule. That being: Anything that cannot be explained in 25 (plain English) words or less, is an obvious attempt at subterfuge ... And therefore exempts me bothering with it, or abiding by it.

85% of the people have a given perception of what fair and reasonable usage is, and that is what I follow. Anything beyond that is just silly...And therefore ignored.

Anything installed on my computer is considered a guest on my digital "home". Hence it is required to play nice or suffer the consequences of getting disemboweled with variate of utilities I keep handy for resolving software behavior problems.

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,858
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #34 on: October 09, 2011, 02:33 PM »
^+1!

I'm a Revo-lutionary myself. Be respectful or begone! And all the way down to your registry keys too! ;D

Renegade

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 13,288
  • Tell me something you don't know...
    • View Profile
    • Renegade Minds
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #35 on: October 09, 2011, 08:01 PM »
+1 for 40Hz

Regarding:

Ok...so once you've installed Chrome and accepted whatever term and conditions existed at the time you installed it, you automatically agree to any changes and give them your implicit consent if you use the product after such changes were made. In short, no need to formally agree. If you use it - you have! Even if they change the terms and conditions after the fact.

I really think that those kinds of things should be illegal. I honestly don't understand in the least how they could ever be enforced in court. Not with a judge that has half a brain at least.

I'm all for protecting "rights holders", but don't humans have rights? And shouldn't people come before "things"? Yeah -- those rights. And those "human" holders.
Slow Down Music - Where I commit thought crimes...

Freedom is the right to be wrong, not the right to do wrong. - John Diefenbaker

Carol Haynes

  • Waffles for England (patent pending)
  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 8,066
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #36 on: October 10, 2011, 07:50 AM »
I'm all for protecting "rights holders", but don't humans have rights?

Not if corporations have their way.

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,858
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #37 on: October 10, 2011, 07:55 AM »
Not if widespread public indifference can be counted on.

fenixproductions

  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 1,186
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #38 on: October 11, 2011, 11:54 AM »
I can't think of a specific example from Google (though I am sure some here will be able to) but there are lots of examples of other big companies tinkering with EULAs and the small print says they can. Even if Google hadn't modified EULAs (which I know they have) there is nothing to stop them changing them in the future and by accepting a passive update with an updated EULA I am sure you will be deemed to have consented to the new terms.

My memory isn't perfect (and web searches give nothing about*) but... wasn't there some issue with Google Desktop Search and its silent licence change few years ago (8-10)?

*) Same situation as for Crash IE project I could swear was real...

40hz

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 11,858
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #39 on: October 11, 2011, 01:10 PM »
@fenix -There was an issue with Google Desktop Search and the security issues it introduced. And some hassles with the wording of the GoogleDocs EULA which Google subsequently changed. ANd then there was the fracas over Omnibox retaining the IP addresses of searchers along with some information in their queries. (Turning off the autosuggest feature supposedly stopped it.)

But the only additional incident of outrage I'm aware of came up over some of the terms in the original EULA for Chrome back in 2008. Ars Technica did a writeup on it - read here.

Google on Chrome EULA controversy: our bad, we'll change it
By Nate Anderson | Published September 3, 2008 3:56 PM

Google's new web browser Chrome is fast, shiny, and requires users to sign their very lives over to Google before they can use it. Today's Internet outrage du jour has been Chrome's EULA, which appears to give Google a nonexclusive right to display and distribute every bit of content transmitted through the browser. Now, Google tells Ars that it's a mistake, the EULA will be corrected, and the correction will be retroactive.

As noted by an attorney at Tap the Hive and various and sundry other sites, the Chrome EULA reads like a lot of Google's other EULAs. It requires users to "give Google a perpetual, irrevocable, worldwide, royalty-free, and nonexclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services."

"Services" seems like an odd way to describe a web browser, but the EULA makes clear that "Services" refers to "Google’s products, software, services and web sites." The EULA's indication that Google could republish anything even "displayed" in the browser sounded a tiny bit evil, even if Google might just be looking to stave off lawsuits.

Was that what you were thinking about?


fenixproductions

  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 1,186
    • View Profile
    • Donate to Member
Re: App vendors discover a new way to abuse Windows
« Reply #40 on: October 11, 2011, 01:29 PM »
Was that what you were thinking about?
Nope: that one is too young (2008). The stuff I am referring to is at least 5 years old.