Hacker News Reader

Hacker News

Comment by ntakasaki | Hacker News Reader

Parent Full thread

ntakasaki

>This makes me even more angry at SourceForge and not less.

YCombinator also invested in a company that did this.

http://www.istartedsomething.com/20130115/y-combinator-is-fu...

Here's pg's response:

>2. The apps that get installed are "crapware."

>This one seems a matter of opinion. A lot of the world's most popular apps and sites seem like junk to us. But the users are choosing to install these things.

https://news.ycombinator.com/item?id=5092711

View on HN

It's also worth mentioning that one reason for Chrome's market share is this exact practice. When you let Java automatically update itself and download the new version on Windows, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you want to download Flash plugin for Opera or Mozilla and go to Adobe's site, if you don't uncheck a box, surprise... you get Google Chrome installed asking to be default browser. When you let the free version of Avast update itself on Windows, if you don't uncheck two boxes, surprise... you get Google Chrome installed asking to be default browser AND Google toolbar installed into IE.

Are they choosing? I've accidentally installed this crap on a number of occasions, and I'm typically very vigilant about it. But it's impossible to be perfect. That is where the adware market has gone: banking on the small-but-not-0 probability of someone forgetting to read installer wizards very closely, 100% of the time.

What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.

I guess it could happen if one use PPAs or similar, but i don't see it ever getting off the ground within the main repos.

I wonder if we will see more of it as distros move to Snappy or similar schemes. I guess it will come down to how "frameworks" gets handled etc.

> What systems are in place to prevent this from happening with package manager systems like apt-get, yum, or even npm? How often do we just blindly "sudo apt-get install blah-blah blah"? I know I don't read the dependencies.

Distributions don't typically package and distribute malware. And everything packaged in a distribution should be removable via the same package manager that installed it. So, while you might get a package you don't want, that package won't start showing you ads or harming your system, and you can always trivially remove it.

So the answer is "trust"? We're supposed to just trust Canonical, the company that put Amazon ads in our desktop search, to not figure out they could put adware in their package repository?

I wouldn't. But I'd trust Debian.

And, I would trust Fedora (which has similarly stringent Open Source guidelines for inclusion).

> What systems are in place to prevent this from happening with package manager systems ... ?

There aren't any technical measures in place to prevent this. Imagine the backlash, however, if any Linux distribution decided to do this.

I didn't know about that. Too bad, and the way PG was defending a crapware installing product was really unconvincing. Any application which installs other ones by relying on accidental clicks by users is without a doubt doing wrong.

Microsoft is now correctly marking "adware" as the malware it is:

https://threatpost.com/microsoft-to-detect-search-protection...

Only when the ads aren't coming from Microsoft themselves. Like how they pushed KB3035583, the advertisement to upgrade to Windows 10, as a "recommended" update that would be installed without user interaction if you had WU configured to download automatically.

Win10 don't harm your computer the way these "adware" does.

The next OS update isn't really "adware", or an ad, especially when it's a free update that will most likely be updateable to the RTM build (based on how smooth build-to-build upgrades have gotten). If you're going to apply this standard, OSX does the same thing now, it'll prompt you to update to the latest 10.X. Ubuntu does it too, it lists it at the top of the software upgrade.

Its funny how stupid smart people get when they're chasing big IPO dreams.

YC funding should not be taken as any kind of ethical seal of approval. It's not their job, and they are demonstrably bad at it. pg described AirBnB as "among the nicest of all the people we've funded" and their CTO was already a huge spammer and now a repeat offender.

But Quora's login wall has affected HN themselves, and pg spoke up against it.

He's defending it because he's been kind of douchey the last few years.

Reply on news.ycombinator.com