Uninstall the NightOwl app
robins.one
robins.one
> We reserve our right to alter the terms in this Agreement and/or the pricing information and method detailed in NightOwl app's website at any time. In case the Agreement is amended as described, we will post an updated version of it in our website, at which time it becomes active and binding.
> In case NightOwl app alters the Agreement in a way which will be deemed material to the relations and/or obligations of the parties by NightOwl app's sole decision, we will inform you of these changes on our website or via our social media accounts and other established communication channels.
Great, a website update for a locally installed application. Definitely going to subscribe to your social feed to get an update.
> [Safeway] reserves the right to, from time to time, with or without notice to you, in [Safeway's] sole discretion, amend the Terms and Conditions for use and purchases regarding the online shopping services. Any amendment by [Safeway] will be effective only as to orders you place after [Safeway's] revisions of these Terms and Conditions as displayed on the Web site. [Safeway] will plan to notify you of any material amendments to these Terms and Conditions; however, it is your responsibility to review the Terms and Conditions before submitting each order. [Safeway] has no responsibility to notify you of any changes before any such changes are effective.
> Defendant argues that, at the time of their safeway.com registration, Class Members agreed to give Safeway the authority to change the terms of the contract without notice to them, by indicating that they agreed to the version of the Special Terms that are in effect at the time they make their subsequent orders. Defendant's version of the Special Terms states that customers agree to the terms "and the form in which they appear at the time your online transaction is processed." ECF No. 187 at 16-17 (emphases added). In order to complete their registration, Customers were required to manifest agreement to the Special Terms shown to them by clicking a link. Defendant contends that, as a result of users' agreement to this Special Term at the time of their registration, Safeway was not required to notify customers of future changes to the terms for those changes to become effective. Safeway contends that, because Class Members read the initial registration contract, every time they opted to go forward with an online purchase after registration, they were on notice that they were assenting to a new contractual agreement, governed by the Special Terms operative elsewhere on the website at the time of that purchase.
> The Court rejects this argument. The safeway.com agreement did not give Safeway the power to bind its customers to unknown future contract terms, because consumers cannot assent to terms that do not yet exist. A user confronting a contract in which she purports to agree to terms in whatever form they may appear in the future cannot know to what she is are agreeing. At most, this term in the safeway.com agreement could be read to indicate that a customer agrees to read the terms and conditions every time she makes a purchase on the website in the future. But the Court also concludes that, even in light of their agreement to the Special Terms at the time of registration, customers' assent to the revised Terms cannot be inferred from their continued use of safeway.com when they were never given notice that the Special Terms had been altered.
> Even if Douglas’s continued use of Talk America’s service could be considered assent, such assent can only be inferred after he received proper notice of the proposed changes. Douglas claims that no such notice was given. (Douglas v. Talk America)
> But the Court also concludes that, even in light of their agreement to the Special Terms at the time of registration, customers' assent to the revised Terms cannot be inferred from their continued use of safeway.com when they were never given notice that the Special Terms had been altered. (Rodman v. Safeway)
Both cases seem focused pretty narrowly on situations where notice was not given. Is continuing to use an app after an update notification enough? Glancing over a GDPR-like popup? An email? I'd prefer an explicit opt-in to changes once they've occurred.
What the “speculated worst” is from that depends on your paranoia about such information gathering. Most likely the information was to be fed into various marketing databases.
Obviously the same information could be used for even more nefarious purposes, particularly for users in countries with very monitor-y governments and people whose governments otherwise want human-rights abusing controls over them (women in a number of US states for instance – in fact even if their local legislature is not acting on tjhat sort of information, unpleasant groups active within the state might be).
I don’t know what is the state of this app now. Does anyone know? What is the profit scheme (I suspect it might be similar to this one described here) and to which app would you switch instead?
I've been using it and it is great.
Several years ago, a friend entered into a contract with Comcast for business internet and phone service that had similar wording and no actual URL for the site. My instinct was that would be unenforceable and unconscionable, but you’d think Comcast legal would have thought it through.
Any lawyers out there familiar with this type of wording related to contract changes being posted on a website, particularly where no notice is given?
This is a common use for residential proxies. Ticket touts buy use of the infected users to make requests to try beat restrictions on access from data-centre hosts or high-volume access from and other hosts, to increase their charge of getting valuable tickets for later resale.
A number of backdoored (by the creator, by someone cracking into their source repositories, or in this case by buy-out) free browser extensions, VPN apps, and such, turn the user's machines into a proxy like this.
On the other hand, Verizon also owns a large block of IP addresses that they give out to their residential customers.
NordVPN takes advantage of the fact that people like Netflix and Amazon don’t want to block out Verizon’s ip ranges, and disguise network traffic as residential traffic.
Do they? Last time I looked into this drama, it seems like the botnet accusations were just scurrilous slander.
https://www.comparitech.com/blog/vpn-privacy/nord-vpn-botnet...
The founder of the guilty party is also the founder of the company behind NordVPN. From the article it also seems like the operational practices are similar. Additionally, it is stated by the CEO of the guilty party that operational activities will resume as normal since the suit is only for damages. Assuming that NordVPN operates in a similar way, then a residential proxy service is still on the menu.
This is a great app idea. Monitor the app owner. If the owner changes overnight, alerts to the moon.
... unless they conspire together. Ugh.
Wait…
All these free apps have value but unfortunately it doesn't translate to any income for the developer so they find other ways.
If I want to do some shady app shit I am buying install base. 100x an app that makes a few grand a year could still be worth it for my nefarious purposes.
A developer who didn't charge anything from the beginning has more likely other motives releasing his software than making money.
But if you already make a little money you may easily fall for a lot of money.
(And yes, I'm aware that's a lesson that really should have been learned by now, if it was going to be learned at all. Alas.)
After a while it becomes a chore... and still getting $0 out of it. And that's when he might want to find other ways to get something out of the efforts he put in. Unfortunately the only option is to turn it into malware since nobody wants to pay for it, or turn it into a decent profitable business.
https://www.polygon.com/2018/6/20/17485762/red-shell-spyware...
I don't have a link handy but I distinctly remember Take Two, a giant corporation with billions in revenue, saying when they removed it from Kerbal Space Program that they promised to wait a while and be more subtle next time they did that.
People/users will complain about all of these. I've especially seen people complain about ads; the only real issue I see is when there's no alternative to ads provided (ie subscription, pay a couple dollars to buy a copy of the app, etc). It's Google's mistake, tbh, as that's the common rhetoric with Youtube, people got it for free for too long to be happy with more ads. Blame the people who're uploading "120 hours of black screen" multiple times per day.
When the packages are built from source code by a trusted distributor like Debian or F-Droid [1], this kind of change is likely going to be noticed by the packager and not let through to users.
If the buyer alone was responsible, there would be no terms of service. It's only with community protections and regulations that you get the information required to attempt to make an informed choice. The same community should be empowered to drive normal ethics without it being overtaken by the 'drivers licenses are tyranny' crowd.
[1] https://chrome.google.com/webstore/detail/hover-zoom%20/pccc...
Huh? Setting a schedule/location for nightshift and setting the dark mode setting to auto will always change instantly. If you use a launcher or spotlight then a simple one line applescript can change the setting as well. (tell application "System Events" to tell appearance preferences to set dark mode to not dark mode).
Not in my case?! I’d say there’s a 25% chance that Dark Mode enables at sunset. It’s been this way for years — even up til Ventura.
Has it worked flawlessly for everyone else the whole time?
From the article: "It is an alternative to the built in macOS automatic mode which only switches when the user steps away from the computer."
If I set up night shift, it will switch to dark mode at the time I set, but it also tints my screen (even subtly, if I turn the slider all the way down), which I don't care for as someone who does art.
The app was blocked from loading, but I still saw the two dylibs running. I wondered if it was because the certificate was revoked after they had already started. However, logging out and back in still showed them running. Perhaps they're persisting through log outs?
As well, I got a prompt from the macOS firewall to allow the mentioned AutoUpdate binary to listen for connections. That makes me think all of this was deployed in the last few days.
Edit: A reboot gave me the `“NightOwl” will damage your computer. You should move it to the Trash.` dialog. Allowing that did not fully clean things up (leaving a non-functional `/Users/*/Library/LaunchAgents/NightOwlUpdater.plist` in place and the usual preference files). For me, Hazel cleans those up.
I think for non-technical users who may not be familiar with the terminal would be to direct them to reboot.
No, Developer ID doesn't use a Certificate Revocation List:
XProtect is separate from Developer ID certifcate revocation. In many cases, malware is not even code signed, so certificate revocation would do nothing.
> it does look like it was revoked in response to the original article, and not the other way around.
I'm not sure what you mean?
If Apple only revoked the dev certificate (and possibly XProtect) today, that would make sense. But if it was revoked a ways back, then it would be concerning that it would require a reboot (with no prompting) for a regular user to fully kill the running background processes.
Actually, thinking about this further, if Apple had revoked the certificates before today, others would probably have noticed it and investigated given the “Move to trash” dialog and the strong assertion of “this is malware” in it.
Replaced it with NightFall https://github.com/r-thomson/Nightfall
Settings > Control Center > Display > Always Show in Menu Bar
I'll concede it takes a second click to toggle dark mode, but you also have night shift as an option, and it's 100% native.
* open up Automator and create new application
* select “change system appearance” and select toggle light/dark mode.
* save the ‘app’
Now, whenever you want to toggle light/dark mode, just open up spotlight and open up whatever you named the app. There’s probably a way to do it with Shortcuts too.
I should start doing this with big websites. And of course my EULA is a 10MB file I’ll send with every request until they accept… :)
Can you imagine if that caught on? DDOS by EULA!
> THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO […] FITNESS FOR A PARTICULAR PURPOSE
…and the GPL has nearly the same text in section 15. [1]
I want the other side of the deal: a default license implicit in the existence of software that can't be traded away without an explicit contract that involves something like an exchange of money, which a federal agency will safeguard against violations of. If an extension changes its behavior nefariously people should go to jail. If Google safeguards an extension that changes it's behavior nefariously then Google should go to company jail. (or, like, be fined and forced to comply).
(admittedly, this is hopeless idealism. But still.)
See https://www.legislation.gov.uk/ukpga/2015/15/part/1/chapter/...
Most jurisdictions have something broadly similar (albeit often not quite up-to-date around software and digital products). Everywhere in the EU will have laws that implement the EU's Consumer Rights Directive.
Which is great and would apply if you'd paid money for it. NightOwl is free (as in beer). The expectations the law sets out regulating the sale of goods and services do not apply when no money has changed hands.
Which I'd argue is pretty much right: while it sucks that companies get taken over and have spyware crap put into products, the idea that, say, a teenager who is hacking around and building stuff to learn how to code, puts up a project they've made as open source or a freeware download, does something silly like the left-pad debacle, then gets sued—potentially by a big corporate behemoth with very deep pockets and very scary lawyers—for a series of acts which involved them writing some software for no money. Regulation of technology should rest far heavier on the shoulders of Google, Microsoft, Apple and so on than it does on a hobbyist or small indie dev creating freebie menubar utilities or Chrome extensions or whatever.
The difficulty of ensuring those little freebie and open source apps don't become a vector for supply chain attacks remains difficult. Much better sandboxing and OS app-level permissioning, good network monitoring and anomaly detection on a per-app level, and building trust into packaging/distribution processes - these are all slow, grinding, incomplete ways to improve this. Lawsuits probably aren't.
This should fail on any router as you should have UPnP disabled.
They are not wrong. E.g. It amazes me how much pain and suffering Microsoft expects users to endure just to use a printer. It is not lost on my stepmother that her Windows machine has endless problems setting up and printing to her Brother laser printer, but her iPhone just sees it without having to be told.
They want you to use their shitty apps and shitty software, though. HP is the worst at this (they cover up the USB port, and will only allow you a limited amount of prints before you need the activate the printer through an app).
Windows has plenty of printer problems (like its print spooler that needs a serious security overhaul which would break loads of printers) but the worst of it only seems to show up if you follow the manual and install the crapware, including apps, that printer manufacturers want to shovel onto your devices.
Which is to say, you do not REQUIRE UPnP for webRTC. But yes, if you have a crap router given to you by your ISP (looking at you, SBC and Comcast) then UPnP may be your best bet. My point is you don't NEED UPnP if you have a real router.
I should be saying... thx for bringing me up to speed on this. UPnP is obviously not something I spend a lot of time on.
Now, you can of course open the ports yourself, but this is inaccessible to the vast majority of users due to undiscoverable, inconsistent and complicated UX. Most people don’t know what a port is.
> $ tailscale netcheck
> […] * PortMapping: UPnP
I don't think most routers have a setting for that, so if infected devices are part of your security model, it would be wise to assume NAT is entirely non-functional because of [NAT slipstream attacks](https://samy.pl/slipstream/). An infected device can modify the router's NAT table to effectively act like UPnP, except they don't provide a user interface for you to audit.
If you're NAT free (i.e. only use IPv6) disabling UPnP can be a decent security measure if you're willing to manually do all of your firewall exclusions, but honestly host firewalls are the only reliable protection method for most people these days.
Fuck that with a chainsaw. Burn it. Burn it with fire.
Look at the amount of Start Menu modifiers there are out there for Windows. All because Microsoft keeps on changing the start menu. Why? I don't know. I just want to get rid of the Recommended section, but I'm not allowed to.
For now “Suggested” is turned off and I disabled all notifications for good measure, but I don’t know how much longer Windows will allow that. I don’t intend to find out.
I'm thankful, but also genuinely curious, why they put this explicitly in their TOS.
It just kind of seems to be like the kind of person/org who would implement this shady stuff in the first place, would also actively hide that they're doing it.
Is there a legal reason that protects NightOwl by explicitly putting it in the TOS? E.g. does this prevent them from being sued for any of it, where they could have been successfully sued otherwise? Like it's technically do to all this shady stuff but only as long as it's in your TOS?
You really don't want the government interfering with the implementation details and business models of software products. That's a really bad road to go down.
The problem is really a lack of inspiration for both the dev and user. In this case someone made a trivial tool and didn't know how else to monetize it than being a scumbag and exploiting social norms and good will. The user also decided to use something that's dumb and not worth risking making any agreement with any entity at all.
Situations like this are where free software excels. Things that are inconsequential in premise should stay that way in practice.
If they didn't disclose "this shady stuff" then the user can try to resolve their dispute via remedies stipulated elsewhere.
Really there are several ways they could have gone about writing this agreement. This is probably the simplest for everyone. This is also how the bigger orgs write their agreements. They state their intent and you have to agree or fuck off.
The badly written agreements (what you were expecting) are less honest and try to explicitly have the user waive some rights entirely including any remedies in or out of court, but those can usually be deemed unenforceable because they violate established rights and precedent rulings.
Sadly this isn't the case anymore. The layperson is distrustful by default and can only rely on the more astute to blow a whistle. Even a judge would just say to not install apps that aren't critical to your everyday life and be done with it. Nobody has the time to swat at flies.
This sounds like it was written from an alternate reality. It doesn’t match my experience at all
The guy's in the US, not China or Cyprus, so there's actually a chance he could get in trouble.
"I bought the Superman Halloween costume and on the side of the box it said 'do not attempt to fly'.
I always wondered about the kid who was:
- dumb enough to think they could fly
BUT
- thought to themselves 'wait, let me check the box first. Oh! Good thing I checked!'
The TOS sounds a little bit like the "do not attempt to fly" warning.
As I understand it, anyone can sue anyone for anything. What matters is convincing a judge/jury that you have been wrongfully harmed by the defendant. So if someone can make a good enough case for damages stemming from this data collection, then they can successfully sue.
This doesn't prevent them from suing, but it makes their case significantly weaker if the defendant can argue that the user agreed to have their data collected.
it's not a violation of your freedoms and privacy, it's an opportunity!
/s
Related, this just brought back the memory of the Southpark episode ‘Human centipad’ where people accept the iTunes T&C without reading them :)
--edit--
I do not know how to format code here.
--edit--
Another attempt to format code here.
# Step 1 Save script below to your local drive. For example, `/Users/xxxx/Documents/Scripts/DarkMode/darkModeWatcher.sh`
#!/bin/zsh
# ref: https://unix.stackexchange.com/a/526097
# start time is 18:33 -> 18 * 60 * 60 + 33 * 60 = 66780
# end time is 07:33 -> 07 * 60 * 60 + 33 * 60 = 27180
# install gdate via `brew install gdate`
if [[ $(uname -m) == 'arm64' ]]; then
secsSinceMidnight=$(( $(/opt/homebrew/bin/gdate +%s) - $(/opt/homebrew/bin/gdate -d '00:00:00' +%s) ))
else
secsSinceMidnight=$(( $(/usr/local/bin/gdate +%s) - $(/usr/local/bin/gdate -d '00:00:00' +%s) ))
fi
if [[ $secsSinceMidnight -lt 27180 || $secsSinceMidnight -gt 66780 ]]; then
# turn on dark mode
osascript -e 'tell app "System Events" to tell appearance preferences to set dark mode to true'
else
# turn off dark mode
osascript -e 'tell app "System Events" to tell appearance preferences to set dark mode to false'
fi
# cron job for enabling macOS dark mode periodically
# darkModeWatcher script is executed 60s after reboot. After that, it is executed at 35 mins of each hour if the display is not asleep.
# replace xxxx with your username
@reboot sleep 60 && /bin/zsh /Users/xxxx/Documents/Scripts/DarkMode/darkModeWatcher.sh >> /Users/xxxx/Library/Logs/systemDarkModeWatcher.log 2>&1
35 */1 * * * if [[ -n "$(/usr/sbin/system_profiler SPDisplaysDataType | /usr/bin/grep 'Asleep')" ]]; then newDisplayStatus=0; else newDisplayStatus=1; fi && if [[ $newDisplayStatus == 1 ]]; then /bin/zsh /Users/xxxx/Documents/Scripts/DarkMode/darkModeWatcher.sh >> /Users/xxxx/Library/Logs/systemDarkModeWatcher.log 2>&1 ; fi #include <stdio.h>
int main() {
printf( "Bonjour, totes le monde!\n" );
return( 0 );
}
Why do you need to call out to zsh for this command instead of just running it in the current shell?
It's a minor point overall. I was just checking if MacOS had something else going on with its file permissions.
I assume this is being used by those services that sell scrapers "real domestic IP addresses", where in fact they are selling a botnet.
We can't just have nice things can we.
The author alleges as much in TFA.
osascript -e 'tell app "System Events" to tell appearance preferences to set dark mode to not dark mode'When it gets down to brass tacks, I.e. the technical details section, it could really do with a once-over. One too many run-on sentences.
I'd not be surprised to find that that app has some sketchiness baked into it as well.
Stubbs BBQ?
I'm all for dark mode, but give me an option to switch back if it's a wall of pure white text please!
It sounds like you’re trying to schedule Dark Mode to stay on all the time, which can be accomplished by choosing “Dark” in System Settings-> Appearance in Ventura or later, or in System Preferences-> General in Monterey or earlier.
https://support.apple.com/en-ca/guide/mac-help/mchlp1109/mac
Should update that to “I love to throw the people who love my digital products under the bus”
Developer knew exactly what was going to happen.
Great piece.