potentially dangerous file in AutoGK instalation pack

[stephanV]

With me, the problem is not the adware/spyware, but the fact that len0x didnt seem to mention it anywhere.

[fewtch]

Really glad I found this thread, I had DAE installed on my Win2k partition. To think every URL I typed in my browser was being sent to some company for review, without my knowledge or permission... that's scary.

Whether it's really risky or not, it feels like a personal violation. One's private behaviors to be exposed without knowledge or permission, perhaps logged/archived forever somewhere. I'm really offended by this.

[ydobon]

And so it begins...
http://www.sowbug.org/

Thanks God I don't use URLs like server.com/?usr=username&pwd=password (specially not in IE). If you do, the guys at www.responsetarget.com have a backup copy of your login information, in case you lose it


Regards,

[fileman]

I was just updating AutoGK to 1.84beta when I got that alert from my virus scanner:


("C:\...\TEMP\TEMP.EXE is the trojan horse TR/Dldr.Agent.fy")


Is this related to the topic of this thread in any way, or is it the next step, or just false alarm?

[len0x]

Originally posted by fileman
("C:\...\TEMP\TEMP.EXE is the trojan horse TR/Dldr.Agent.fy")

It is a DAE installer, not a trojan...

[fileman]

Ok, thanks for the clarification len0x. Then it's a faulty classification in my virus scanner's database.

Well, this made it easy to not install the Adware at all, I chose "delete this file" and it was gone and couldn't be executed by AutoGK setup.

[len0x]

Originally posted by ydobon
And so it begins...
http://www.sowbug.org/

Yeah, the sad thing (as I expected) is that even before I actually go ahead with this system its already advertized as a fact. Now you understand why I sort of hide it in the first place.

[fileman]

Come on len0x, you should have known that everybody would rip AutoGK into pieces...
It's like that with every program that suddenly comes with adware, and if it's done by a trusted good programmer like you, it's even more a shock to everyone and the "wave of disgust" is even larger than with some company whom nobody trusted before.

[ydobon]

Hi, Len0x.

Originally posted by len0x
Yeah, the sad thing (as I expected) is that even before I actually go ahead with this system its already advertized as a fact. Now you understand why I sort of hide it in the first place.

Err... not to be picky about words, but you actually *went* ahead with it and *it's* a fact. Or did I dream about uninstalling DAE?

and... "sort of"?!? well, it's true you didn't rename the .dll but...


Regards,

[len0x]

The system is not live and I didn't get a cent from it, so theoretically if I don't get an agreement with responsetarget then DAE will be removed from AutoGK's installer.

[metropolis2004]

Although everything has been said before, I'd like express my opinion because I haven't read a single word of excuse from you.

LenOx: I appreciate your work. I use AutoGK since I always got oversized files when using GK and AutoGK made everything right.

But by bundling Spyware with your software WITHOUT stating that clearly destroys all your integrity. I think I will go back to GK and try to find the mistake I make. I am really disappointed.

You want to make money? OK? Do it, but be man enough to admit it in the installer instead of cheating all the people that trusted you.

[Taurus]

Originally posted by len0x
It is a DAE installer, not a trojan...

If you let the antivirus program do it's job, AutoGK 1.85 beta continues installing without interuption (and of course without DAE).
I will try to make an installation with Virus scanner turned off, just to see what's happening
Strange, the scanner did'nt recognized DAE in former 1.84 install.
So either the virus definition got updated or the DAE installer got twisted.

Cheers

Taurus

[shevegen]

There is an easy solution for you users - use Windows on machines not connected to the Internet, and everything is fine. And use another OS while being connected to the WWW.



Personally though, I think throwing in adware is a very very bad option to attempt solving a problem.

[fewtch]

It's clearly announced now, so personally I have no objections anymore. If it reaches a point where AutoGK won't function without the spyware, then maybe it's time to say something again (like e.g. you get Paypal donation from me when hell freezes over ).

[DeadMetal]

Originally posted by Taurus

Strange, the scanner did'nt recognized DAE in former 1.84 install.
So either the virus definition got updated or the DAE installer got twisted.

Yeah, here also. Using Avast! Antivirus.

[Guest]

I understand that AutoGK uses GPL'ed software from other developers. If len0x is now making money off AutoGK, this may change the equation for those developers whose work is included.

len0x needs to write to all these people, explain the situation, and offer them the opportunity to withdraw their permission for use of their work.

If there is any of my work included, I would prefer that it not be included in a package that distributes adware/spyware, and from which the author derives income, thereby violating the spirit of the GPL licensing.

[Guest]

I've thought a bit more and investigated about this.

It is *not* a GPL issue unless it places undue obstacles to getting the source code of the bundled GPL components. Assuming that is not the case, the only justifable reaction is a polite disapproval of the concept of adware/spyware. So that's it as far as I am concerned.

I politely disapprove.

[Carraway]

A couple things:

First of all, I hadn't planned on mentioning this, but now that DG has (rightfully) brought up the GPL issue and packaging free programs with a commercial work, it's probably relavent. I was going through the BeSweet readme and noticed this:

Distribution

• The program is a freeware and not commercial in any mean.

Technically the software is still free but it's definitely commercial now (in the same sense that, for example, American television is referred to as "commercial television" despite the fact that it's costs nothing to watch it and is funded by advertising dollars). So, yeah, my question is this: is that gonna cause problems?

Second! I said this a few days ago:

Originally posted by Carraway (that's me!)
So after hours of web browsing, I can only assume that RESPONSETARGET has a whole history of U=97883's web browsing. I don't know what they do with this information -- whether they are honorable and genuinely only use it for targeted ads and then promptly purge it, or if they harvest the info and sell it, etc etc. But they're an adware company so they're not at the peak of business ethics to begin with, so I suspect it's something closer to the latter.

This should probably be of interest to everyone. The answer to my question -- whether they only use my web history to provide ads or if they harvest it and sell it to other companies -- the answer is sadly the latter.

From their privacy policy:

ResponseTarget may collect any or all of the following types of information: (a) traffic or clickstream data, (b) cookies, (c) Internet Protocol ("IP") addresses, or (d) contact information and other personally identifying information...

[...]

(a) Traffic or Clickstream Data.

ResponseTarget may share information it collects with certain selected third parties, but only in aggregated, anonymous form. For example, we may tell an advertiser that a certain number of people visited a certain area of a Web site, or searched Web sites for the term "mortgage loan."

[...]

(b) Cookies.

Cookies let us know about repeat visitors and if we are delivering quality products and services. ResponseTarget may also use cookies to identify which sites our repeat visitors are coming from, so that we can place more of our online advertising on these sites, and can, where necessary, pay our affiliates and other business partners.

[and so on]

They are giving the info to third parties and using cookies to follow the sites that we go to. And they also collect IP addresses, so I can only assume that if they wanted to, they could easily supply the entire web history of any particular IP address. So, yes, they're deliberately doing more than simply "advertising". I give them credit for being upfront about it (moreso than len0x was/is), but they nonetheless seem like a pretty typical adware/spyware company. I encourage everyone to read their privacy policy because it's very informative.

Oh, one last thing -- DAE started being bundled in version 1.82b, not 1.84b as was previously thought. I don't know if anyone cares, but I figured I'd mention it anyway. So to anyone who has either 1.82 (as I did) or 1.83, you unknowingly have DAE and will have to uninstall it.

(Also NOTE: If you do happen to have 1.82b, uninstalling DAE will not suffice because doing so -- I kid you not -- cripples AutoGK. You will need to upgrade and then uninstall DAE).

[thop]

I think it's not a very good move towards all users that did donate. I already had a slight idea where this might be going when i first saw the PAYPAL button in the main window a few months ago.

I'd rather have AGKnot going commercial, than install spyware. Not sure if that's possible with the GPL and so.

[buk]

As i noticed, BeeSweet is not longer in AutoGK pack (from 1.87 beta). Caused throught problems with BeeSweet licence?