Hacker News Reader

Comment by kybernetyk | Hacker News Reader

The crapware situation on Windows is horrible. I'm a Mac/Linux user but from time to time I have to power up my Windows VM.

A few days ago I wanted to install the Partition Magic trial on my Win XP VM. Having left Windows around 2005 I figured that typing "Partition Magic Win XP download" in Google would be helpful.

I got a handful of "reputable" download sources like CNet and the like. I went there and was bombarded by 20 (dramatization) different download buttons. I clicked the one that seemed most promising and somehow ended with a new Zip-Archiver installed ...

So I went back and found the Partition Magic installer. It was an installer with 'added value' that asked me three times to install some toolbar crap. I ended up with one of those toolbars installed because unchecking the box and clicking on 'next' obviously is not enough. You have to click the decline button instead of next.

Now I would consider myself computer literate and yet still I didn't manage to install a simple utility without littering my system with crapware. I can only imagine what hell the internet must be like to inexperienced (read: normal people) Windows users.

View on HN

Yeah, I share the same experience: I'm mostly a linux user who had to setup a windows machine not long ago.

Even when installing legit software from what appeared to be legit sources I had to be very careful at every step in order to avoid all the spyware/toolbars/dubious extensions bundled with the installers.

The worst offender was some crapware installer that wanted you to check the components you didn't wan't installed. I almost got tricked. Next thing I'm sure they'll ask you "Are you not sure you don't want those components not installed?" [Yes] [Ok].

I may be wrong but I believe even the official Oracle Java updater asks to install some toolbar (Ask or yahoo I think? Or maybe just set the homepage? I forgot). Good thing I don't think very highly of Oracle or I might have been disappointed.

Edit: I remembered correctly: https://forums.oracle.com/forums/thread.jspa?messageID=10723...

I recall that the java yahoo toolbar has been there since Sun.

When I was mainly just a Java developer I always found that kind of embarrassing.

Agreed, a lot of the reasons that non technical users dislike Windows seem to be the result of these. It really takes control out of the users hands.

We can see the origins of this becoming a problem on Ubuntu with Canonical adding stuff like the Amazon search and seemingly having no issue with bundleware as a means of monetisation.

On the other hand I'm surprised this isn't more of an issue on the Mac, since Mac (especially older versions) will allow installation of software from random sources which could include bundleware.

Is there something about OS X that makes bundleware more difficult to develop or is it just easier to monetise an OS X app without bundleware?

I can see the future of apt-get on Ubuntu now...

    $ sudo apt-get install emacs
    After this operation, 86.3 MB of additional disk
    space will be used and AVG Toolbar Pro! GOLD EDITION
    will be installed to Chromium
    Do you want to continue [Y/n]?

If that happens, all someone needs to do is repackage Debian's version of aptitude for Ubuntu.

Or an older version from Ubuntu.

Really, this is a non-issue on Linux, because either 1) someone will just "fix" it an release their alternative, or 2) everyone will just stop using the offender.

You could've said the same thing about e.g. download.com. Turns out there's such a thing as momentum.

Depends on what type of software you are talking about. For copyright protected proprietary software (which Canonical want people to develop for their OS) there may be legal protections which prevent it from being rebundled outside of torrent sites (which have their own risks).

#2 assumes a savvy enough userbase.

Legal protections against rebundling aptitude? Something released under the GPL? Which means everyone has all of the ability to easily change the sucker.

If you're packaging something as a deb, you can potentially bundle other things, but at the same time, because a deb is a glorified tar.gz, someone can just provide information on how to get rid of the offending thing.

Or, if you're using Arch, the AUR maintainer just adjusts the PKGBUILD to do it for you.

It's not particularly hard.

And sure, having people install a different package manager requires a savvy enough userbase, to an extent. If they can copy and paste a couple commands into the terminal, they can change it (wget [somefile] && dpkg -i [somefile]). How hard.

I don't mean aptitude itself.

I mean , if you are bundling your own software for Ubuntu you get to distribute it however you like. If somebody else decides to redistribute it minus the crapware then you can potentially sue them.

So you can say "the only legal way to get my software is to download this file which is bundled with InstallMonetizerForUbuntu".

Whether it is bundled as a .tar.gz or a .deb and whether it comes from a random website or the Ubuntu software store is largely irrelevant to this point.

Sure, people will create programs and instructions on how to get the crapware off your system but this is basically the same state as now exists for Windows with various "cleaner" programs, some of which install even more shit.

I've said nothing about distribution. Only packaging. And specifically giving people instructions on how to do it themselves. Which isn't illegal. Nor is it particularly endorsing something illegal.

> So you can say "the only legal way to get my software is to download this file which is bundled with InstallMonetizerForUbuntu".

But, once I have that downloaded, I don't have to go straight to installation. I can remove files and change the install script. Sure, you can give me a binary file, but the only binary files I've ever received are after I've paid for something, and I've never found paid software bundled with crapware, even on Windows.

I can still write a script that would get rid of the bundled things provided you already have the packaged file, and distribute that script to anyone who wants it.

And while yes, people will create decrapifyers, I'm talking about preventative measures (modifying the installer).

Well sure, expert users can certainly reverse engineer installer scripts and some intermediate users might be diligent enough to go doing research before they install each program.

Not a solution that scales very well though, if it did we wouldn't have the problem we do on Windows at the moment.

> Do you want to continue [Y/n]

"Yes" & "No, I do not not want to install this"?

Oh Zeus, no! One of the reasons I love Linux is the fact that I get to control what gets installed and how. Don't give people such ideas. Given how Ubuntu now is going to be full of ads and the like.

IMO, some of it is due to http://en.wikipedia.org/wiki/Broken_windows_theory. One developer starts with an advert, somebody else has two, a third developer gets paid to sneak in some toolbar, the first notices "hey, I can make money that way, too", and the ball gets rolling.

Now, the question is why this has not happened for Mac Software, at least not on that scale. Gruber (2004) claims it is due to zero tolerance (http://daringfireball.net/2004/06/broken_windows).

I think that is partly true, and it sort-of started with the original PC. Installing a DOS program such as Lotus123 was a nightmare, where people had to answer such question as "number of lines on a page" and "how does your printer do bold" to configure a printer. Installing hardware, similarly, was a nightmare (what IRQ should we use? Do you have extended or expanded memory? etc).

Interesting analogy, it's certainly true that there is some sense of "community" for both Linux and Mac users in that people will generally choose these platforms because they have certain beliefs about how things should work and won't tolerate things that fall outside of this.

Windows on the other hand has no community and is kind of an multi-cultural wasteland where everything goes thus will tolerate more BS.

Not sure I agree with Gruber's conclusion though, if Mac had a large uptake in market share then that community would become diluted.

As it stands the random Grandma that uses a Mac without understanding computers gets a sort of herd immunity because there is a larger percentage of more nerdy and vocal users who won't tolerate BS.

If grandmas become the overwhelming majority of Mac users they lose some of that because the crapware vendors know that grandma is very unlikely to read the blogposts condemning their software.

It's low market penetration which explains the difference between OSX and Linux on the one hand and Windows on the other.

The iOS and Android app stores are full of crapware. Yes, that crapware does not have all the features of it's counterpart in the Windows ecosystem. Yet, much of it provides little value or functionality and even functional applications collect vast amounts of data not necessary for that functionality.

There is now a modest obstacle -- Apple's walled-garden app store approach. The default settings of the very latest OS won't allow a novice user to run a crapware installer, and Apple's app store won't feature them (unless the harried reviewer glances away from his monitor to drink some water or something).

HOWEVER, Mac OS X has never had this problem, and before the app store there was nothing inherently harder about writing crapware that bundles whatever creepy garbage could be monetized.

So actually I really wonder why OS X and Linux never had this problem (to any major extent). Is it merely the awesomeness of single-digit market share? In that case, Ubuntu's safe but Apple better start worrying about it.

Personally I suspect it's more complicated than that, but my ideas are half-baked.

A lot of OS X apps are installed by dragging the app to /Applications, no installer involved, it may be one of the reasons.

Not familiar with the OSX installation procedure, but I assume that dragging the app into the folder runs some installer script? Are there perhaps restrictions on what can be done via these scripts that would require 2 distinct actions to install say a browser toolbar and application?

Most OS X applications are usually a folder that behaves like an executable (has a custom icon, will run the app when you double click on it). So no, it's not running an installer script, it's just copying a folder, and the app runs with just what's in the folder, no install process needed.

For things that require changing system components, other apps etc. there is a normal install wizard.

The cool thing about Mac applications is they are self contained. Very rarely do you see an actual installer. Uninstallation is usually just deleting the application from the Applications folder.

I wish other operating systems did it that way. It's very convenient.

The problem is it leads apps to include their own copies of libraries - which then get out of date and have bugs. I remember when a vulnerability was found in zlib and just to update all of apple's first-party programs with the fix required something like 2.6gb of updates. I wouldn't be at all surprised if there were still some more obscure third party mac programs shipping the old, vulnerable version.

Well the alternative (dynamic loaded libraries) have their issues as well. After "DLL hell" and various issues on Linux in the past, I'm not convinced one side is fundamentally better than the other. 3 gig is nothing these days.

It isn't. Since every library the application needs is inside the bundle, you load multiple versions of the same lib on memory. Also counting the installer, the bundle and Brew or MacPorts you have a tons of way to install an app.

Not every. The ones that are distributed with the OS X base install usually are dynamically linked against.

My current project I'm working on links against the standard Cocoa frameworks, zlib, Core Audio, Audio Unit framework and the Accelerate framework. Yet the Frameworks directory in the app bundle is empty.

Well, if I'm not mistaken, Windows linking usually involves re-calculating offsets in the library code, so several versions of libraries are kept in Windows too. The only thing that is theoretically saved is disk space.

How often do you really have multiple third-party apps using multiple copies of the same third-party framework? How many third-party frameworks maintain binary compatibility between versions so that apps linked against different versions could still share a single installation of it?

MS-DOS did it, but on those days things were a lot simpler.

No, no setup scripts are run, you are just copying a folder inside /Applications. All setup an application needs (typically creating configuration folders and associating mimetypes) should be done the first time the application is launched.

Dragging an app into /Applications does just that: it copies a directory (hidden with an .app extension) that contains resources and executable. No script.

Some apps however come with an installer, but that's for apps that do more (e.g. need to install drivers, etc.). However, it's Apple's own installer which I think is provided by Xcode. So, no way to mess with it and install crappy things.

You can run arbitrary scripts in the installer, so you can install anything you want.

You can even (if you are iTunes 2.0, or a hater) delete the user's entire home directory!

Nope, no installer script. If a program needs installer script (to install drivers etc.), you get a package installer (like on Windows), however, they are rather rare and I've never seen any crapware in those so far.

No, it's just copying the bundle.

> Is there something about OS X that makes bundleware more difficult to develop or is it just easier to monetise an OS X app without bundleware?

MacOS apps very rarely have an installer, so there's little opportunity to install this sort of thing.

Installers are (rightfully) rare on OS X, but that doesn't preclude installing any random crapware you want. Your app can do it on first launch (or hey, tenth launch to make it less visible). Lots of apps have a first-launch screen where they confirm some options and maybe even ask for an admin password for housekeeping.

Hmm, Monetizer.framework?

Users are trained to just accept whatever in installers, however, while popups on first launch demanding admin passwords will often be treated with a little more suspicion.

Yes, I changed my UAC settings under Windows to require the admin password before sudoing (or whatever MS calls it).

It was just too easy to me even as a relatively experienced user to knee-jerk click the "Allow" button.

OS X applications are usually distributed as disk images (.dmg) containing the app itself, a symlink to /Applications for easily copying the app there, and maybe supporting files. Installers are unusual, except for huge software packages like Office or odd things like preference panes, which are not as easy to get to the right place.

I presume that people using Macs tend to be 1) wary of downloading any programs from random websites and 2) wary of having to run something like an installer. The Mac App Store means that people will only do these things less going forward.

>I presume that people using Macs tend to be 1) wary of downloading any programs from random websites and 2) wary of having to run something like an installer.

If only. Last time I did a "check up" on my sister's macbook she had managed to install a toolbar and some other evil shitware that would hijack her google searches to collect her info and redirect her to bing.

Yes, I've run afoul of the "download button" adverts before. I'm not surprised to see them on torrent sites etc, but it amazes me that some supposedly reputable download sites would allow such things.

Seriously. Take a look at the official site for the excellent open-source Windows graphics editor Paint.NET, for instance:

http://www.getpaint.net/

Now tell me where you are supposed to click to download the actual application. It confuses me, and I'm an experienced user who knows to look out for these sorts of things. I have no idea how normal people ever find the damn thing.

My question is: whose fault is this? Is it Paint.NET's, for allowing the ads onto their site? Or is it the ad network's (Google, in this case), for accepting the ads into their network?

The blame belongs to both.

Google should not allow ANY ads that contain a Download button, when the page has a link containing the text "Download." These ads can have no other purpose but to confuse users who are looking to download software. The problem is that Google makes money from these ads, and these ads have fantastic clickthrough rates. If they banned these types of ads, they'd make less money.

The author of Paint.NET is making good money every time a user mistakenly clicks on such an ad. This money also reduces his incentive to get rid of the confusing ad.

I get around this problem by running an ad-blocker, so I only see the one legitimate download link. But most users do not.

The problem is that Google makes money from these ads, and these ads have fantastic clickthrough rates. If they banned these types of ads, they'd make less money.

This is how industries get regulated -- when they refuse to regulate themselves. I hope Google realizes that and takes action on their own initiative...

Pardon me, but Paint.NET is not open-source.

"You may not modify, adapt, rent, lease, loan, sell, or create derivative works based upon the Software or any part thereof."

I did find this, but I've never used it: http://code.google.com/p/openpdn/

CNet/Download.com is not reputable. It's malware distributor.

The best rule of thumb is: if it looks shady, don't go there ever again. Another: every good program has an author, and this author has a valid, non-malware-installing link on his/her website.

If this is true then I imagine there is space for a trustworthy curated library which can replace CNET.

On OS X, there is MacUpdate. Not curated, but user-unfettered. There used to be another very similar one, called VersionTracker, which was much more popular... and then it was acquired by CNET. And everybody gradually stopped using it. There's probably some kind of lesson hiding in there somewhere...

Filehippo.com and Oldapps.com give the real, original installers, not the crap-wrapped. Sadly, both sites usually are not in top 5 in Google, so you need to know of their existence. Actually I rarely use them, addiction to Google is too big (though I usually go to the author's page from the results list). But when I can't find a 'normal' installer it's awesome to have them.

I learned this the hard way just the other day - installed an app from them and ended up with half a dozen adware installs as a side effect of their installer. I used to think that cnet was above board, but apparently they're not anymore.

This is why I have no moral qualms about using AdBlock on most of the internet. I made the mistake of disabling it on one such download site once, and it took me a while to find the actual download link in the mess of DOWNLOAD! ads. Then I went back to having plenty of whitespace on that page...

For me blocking advertisements online is no longer about blacklisting bad sites, but whitelisting the few good ones I want to support.

Good rule of thumb is to look for the smallest "Download" link on the page.

Won't be long before this rule of thumb goes out of the window.

They'll probably make a one by one pixel link that links to the clean download file.

Maybe we could write a chrome/firefox plugin that highlights downloads that are from the same domain? Or perhaps hides non-domain ones? Would that clean up most of these issues?

You'd probably have to have a button to toggle this on and off.

Most of these freeware download sites tend to use mirror sites for the actual downloads.

The download link for the actual product will often really be a redirect to a page with a "your download will start in 5 seconds" and then some JS triggers the actual download.

Even the legit download will usually offer you toolbars and crap anyway.

We could add the most common mirror sites as exceptions, you could add your own, and of course you can always toggle it on and off?

I think that may make it useful enough...

You could certainly create such a plugin, however those who would have the most use for it may not be those savvy enough to find and install it.

@jiggy2011 - oh, the irony...

Adblock covers the use case.

So true, the real one is almost always an ordinary looking link rather than a button.

My experience recently was similar. A simple open source installer landed me a like of toolbars, preformance tools, and other assorted crapware. Incredibly obnoxious, and instantly removed any respect I had for the developer.

Are you sure it was the original developer that inserted the crapware?

It would seem so. At least, it wasn't one of those repackaged installers that some download sites offer.

Do you have Adblock Plus installed? It frequently removes the illegitimate download links since it (rightly) classifies many of them as ads.

I'll take this chance to recommend the following linux distributions to those non-sysadmins who are wondering which one they can try out:

- Fedora 17 with Gnome. Out of the box it offers all kinds of installation options, like the one I always wanted and only found in Fedora (in my words): "Use all this but only this free space, and also encrypt it". The only downside is that out of the box it lacks some things every desktop user will want, like media codecs, but can be installed very easily. There are also tons of addons for Gnome that you will want to improve the UI (eg: get back the minimize button -.-), you can get them at extensions.gnome.org.

- Ubuntu 12.04 server edition. I chose server edition because it has an option for disk encryption, but it will use the entire disk, which sucks unless you have two disks like I do. Then you install 'ubuntu-desktop' and you are done. There is also a problem with both server and desktop edition when installing into some HDD's, they fail to align correctly for different block sizes. Other than that, this is the perfect distro for me. It is LTS so it will be supported for 5 years, and I hope that by that time they have rolled back the crap that they added to 12.10.

- Fedora 18. It should be released today, let's see what they got.

> Ubuntu 12.04 server edition. I chose server edition because it has an option for disk encryption,

Ubuntu 12.10 has options for disk and home folder encryption in the regular, GUI, desktop installer.

I know thanks, but I'm avoiding Ubuntu > 12.04 until they remove the crapware they added.

Been using Fedora 17 for a while at work. Used to hate RPM-based distros, but I took another look about a year ago. It's actually pretty nice.

I also don't hate Gnome 3. It's a bit immature, but it's pretty and fairly easy to use and stable.

I personally found Fedora 17 with KDE really awesome. It was both easy to install and configure, and is a pleasure to use. I would definitely recommend it as an alternative to Gnome.

If you can get used to Unity in a week or two, I recommend Ubuntu. Fedora has always worked fine for me, but Ubuntu tends to have fewer rough edges.

I use Ubuntu and I can't stand unity. It's far too easy to do `sudo apt-get install gnome-shell` and do `sudo add-apt-repository ppa:gwendal-lebihan-dev/cinnamon-stable; sudo apt-get update; sudo apt-get install cinammon` and still enjoy the Ubuntu base (community, font patches, etc). I've bounced around between many DEs lately. Elementary is really great, especially when I was just coming from OS X, but I've been shocked at how nice Cinnamon is.

xfce improved my experience of ubuntu considerably as well and the install was trivial too (sudo apt-get install xubuntu-desktop). alt-tab works there!

I use Xubuntu, it's probably the best way to get the good parts of Ubuntu (the good package selection, proprietary software support, and OOTB hardware support) while also having a good UI.

I don't know why people hate it, I love it. It gives me so much more visual space.

For example, with Unity I was able to start using Virtualbox VM's maximized instead of full screen, which is so much more comfortable. The host has the sidebar hidden (shows on hover), and the guest has it always visible (as hover wouldn't work for a guest). It really makes a great use of the visual space.

The alt-tab behaviour is borderline unworkable for anyone who's used Windows or Linux windows managers before 2011 and is trying to work with a case like several terminal windows and a browser window.

My GNOME 2/XFCE/MATE setup has one bar on top of the screen and that's it, I'm finding it is pretty good for screen space even on widescreen laptops.

The alt-tab thing I think they copied directly from Apple (not necessarily a good thing).

The thing that really hurts about the new alt-tab is that it breaks my mental stack. On Windows, in KDE etc I can switch back and forth between two browser windows easily. On Mac and Unity you either have to decide of your last app change was an app change or a instance change.

I love the altered behavior.

I want to switch to a different app -> Alt+Tab

I want my other Chrome window -> Alt+`

When I'm on my desktop, I switch between far too many windows to have a mental stack in my head of MRU applications, let alone windows.

Not arguing one is better than the other, but I thought I'd offer my perspective as a user.

And if you want to switch from a different app into the other Chrome window?

"I want to switch apps" = "Alt+Tab" ?

Even better with the previews because I can hit "Alt+Tab", see that Chrome is selected, keep Alt held down and then "Alt+`" to the right window.

CNet hasn't been a reputable download source for some time.

"A few days ago I wanted to install the Partition Magic trial on my Win XP VM"

Windows XP is more than a decade old. The latest release, nearly five.

To generalize about the current state of Windows based upon recent experience with Windows XP is either ignorant, disingenuous, or blindly biased.

The results of a google search are somewhat independent of OS. I've found exactly the same problem myself, when searching for Windows downloads in Mac OS X, and get similar spammy results in Windows XP, Windows 7 and Windows 8.

The quality of search results provided by Google are valid as basis for judging Google. A paranoid individual might even see an alignment between Google's web services business model and search results which facilitate the installation crapware upon the most popular desktop operating system particularly when that crapware generally provides tracking information useful for targeted advertising.

Of course, another stripe of deluded individual might blame Microsoft for the abundance of crapware on the internet.

I doubt the installer/websites would have behaved much different if I have had used Windows 7 or 8.

Your doubt is unfounded.

http://www.symantec.com/connect/forums/partition-magic-windo...

Your research, poor.

http://en.wikipedia.org/wiki/PartitionMagic

And your characterization of the Windows ecosystem based upon your experience either ignorant, disingenuous, or blindly biased.

http://windows.microsoft.com/en-US/windows-8/apps

I suspect Partition Magic is intended merely as an example of the crapware-and-misleading-download-buttons trend. You can spot similar scamminess on (for example) http://getpaint.net/ and http://tortoisesvn.net/.

The commenter purports to have a degree of technical expertise - they're running a VM and have some need for Partition Magic. Those features place the scenario many standard deviations from typical Windows user activities.

More importantly, any person looking for Partition Magic in 2013 is likely to be an ideal candidate for crapware. They are performing system administrative tasks. They don't perform such tasks on Windows systems frequently. And they are ignorant of Partition Magic's demise as a product. To boot, they probably have an outdated skill set in regard to Windows.

Download aggregators started installing crapware five years ago. Any person concerned with crapware and who has recent experience avoids them if at all possible. In short, a person looking for Partition Magic in 2013 is likely to suffer from Dunning-Kruger syndrome.

The original claims depend upon a degree of sophistication which its author lacks.

> In short, a person looking for Partition Magic in 2013 is likely to suffer from Dunning-Kruger syndrome.

I'm asking myself where I could have insulted you to provoke such a reaction.

It's an assessment of your Windows expertise based upon the specifics the experience you relayed, not ad hominem. By your own admission your familiarity with the Windows landscape is based largely on experience gained more than seven years ago and with an obsolescent version of the OS.

Dunning-Kruger effects are the result of one believing that they have more expertise than the do. With regards to the Windows ecosystem, this seems to be the case.

One of the salient features of my experience with the Dunning-Kruger effect is that I don't recognize situations in which I am exemplifying it - and logic would dictate that I exemplify it more often than I am aware.

As a crapware vector, partition magic is akin to Nigerian spam. Those who seek it are the ideal targets just as those who respond to the Nigerian banker's uncle are ideal candidates. Both pursue something too good to be true.

I am not claiming that your experience isn't real. I am saying that its conclusion is not that of a Windows expert.

http://sivers.org/below-average

> Dunning-Kruger effects are the result of one believing that they have more expertise than the do.

I never said I'm a Windows expert.

Maybe I just hit the worst case scenario or maybe you need street smarts when surfing the web from a Windows system. Maybe being an OS X user made me soft and easy prey. But still - alone that a reputable download source (one of those that pop up on the first google page) tricks me into downloading a custom archiver utility and wraps installers with crapware doesn't really speak for the Windows eco system.

Now it could be an isolated case but then again if crapware spreading wouldn't be successful people wouldn't be doing it. And I doubt that all crapware infections come from Partition Magic downloads on Windows XP.

> I am saying that its conclusion is not that of a Windows expert.

But the thing is that Windows experts are the minority of all Windows users.

I'm not convinced the conclusion is incorrect. The crapware situation on Windows IS horrible, whether you download any of it or not. Even if you manage to reliably avoid it, that still takes a non-zero amount of effort.

Life requires a non-zero amount of effort. Avoiding crapware just requires sound practice and by definition less effort than dealing with crapware.

As a point of comparison, the iTunes store contains loads of crap. This is not a reasonable basis for condemning iOS.

>And they are ignorant of Partition Magic's demise as a product. To boot, they probably have an outdated skill set in regard to Windows.

the great irony being that the solution would be to use a gparted live disc.

Than I present my own research (sometimes referred to as usage): it's the same thing in Windows 7.

Sure, that wikipedia article doesn't include installers that aren't the official one. But finding the official one can sometimes be a ridiculously daunting task.

And sure, Windows 8 has an app store now. So what? I can still install applications outside of it.

Reply on news.ycombinator.com