Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Privacy The Almighty Buck Your Rights Online

California Sets Fines for Spyware 199

Posted by CowboyNeal from the pay-to-play dept.
aj50 writes "The BBC has the story that California is introducing new laws to help eradicate spyware. The bill bans the installation of software that can be used to take over another computer and allows customers to seek $1000 in damages if they've fallen victim to this kind of malicious software. Can this really help cut down spyware or will it just be another fatally flawed piece of legislation?"
This discussion has been archived. No new comments can be posted.

California Sets Fines for Spyware More

California Sets Fines for Spyware

Comments Filter:

  • Yep, bad legistlation... or maybe it's the summary (Score:5, Funny)

    by Rahga ( 13479 ) on Saturday January 01, 2005 @12:28PM (#11233731) Journal
    "The bill bans the installation of software that can be used to take over another computer..."

    Goodbye, SSH. I'll miss you.

    • Re:Yep, bad legistlation... or maybe it's the summ (Score:5, Funny)

      by Anonymous Coward on Saturday January 01, 2005 @12:30PM (#11233739)
      Goodbye, SSH. I'll miss you.

      Goodbye, Windows.

    • Re:Yep, bad legistlation... or maybe it's the summ (Score:5, Informative)

      by Kjella ( 173770 ) on Saturday January 01, 2005 @12:46PM (#11233815) Homepage
      (d) Nothing in this section shall apply to any monitoring of, or interaction with, a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications
      carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for
      network or computer security purposes, diagnostics, technical support, repair, authorized updates of software or system firmware,
      authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in
      connection with a network, service, or computer software, including scanning for and removing software proscribed under this chapter.

      I skimmed through the bill text found here [ca.gov], and it seems fairly well worded. However, it doesn't solve the actual problem. An "authorized user" can still be suckered pretty much as before.

      Kjella

      • Re:Yep, bad legistlation... or maybe it's the summ (Score:2, Funny)

        by Anonymous Coward
        Man, the one chance to say "RTFB!" and you blew it. Good going.

      • Re:Yep, bad legistlation... or maybe it's the summ (Score:4, Interesting)

        by TheGavster ( 774657 ) on Saturday January 01, 2005 @02:10PM (#11234131) Homepage
        Nothing in this section shall apply to any monitoring of, or interaction with, a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications
        carrier, cable operator, computer hardware or software provider, or provider of information service ...

        So ... the software provider is allowed to monitor your private machine and you connection. This does absolutely nothing to stop spyware-riddled software from being sold to unwitting consumers.
        • If you read the whole sentence though, all those entities can only monitor your computer for the purposes described, such as repair or authorized updates.

          The scary thing about that is pointed out in the post just below yours: one of the purposes for which basically any program is allowed to monitor you is "prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software." Say hello to a wave of RIAA-sponsored MP3-eating worms that
          • Nothing in this section shall apply to any monitoring of, or interaction with, a subscriber's (emphisis mine) Internet ... prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software
            The way I read it is your ISP can monitor you for illegal activity, but a third party like the RIAA can't; of course if your file shareing with a P2P app, your announce your activity to the world in general, by using a program you installed with inf

    • software that can be used to take over another (Score:5, Interesting)

      by frovingslosh ( 582462 ) on Saturday January 01, 2005 @01:27PM (#11233963)
      Yea, I question the wisdom of this wording too. On the one hand my first bad experience with spyware was a piece of software that had Internet supplied advertising in it. I didn't mind the advertising at all and welcomed the chance for the author to earn a few bucks, even occasionally clicked on an ad. But after a lot of users of the software started reporting very strange problems with it I investigated and found that the advertising company was Aureaut, and that the software did a lot more than just display ads. Worse, it contained a "feature" that would let Aureaut download and run any program on your machine. This was supposedly in there so they could update their software, but the potential for abuse was obvious and complete.

      Unfortunately, I don't see how the ban on installation of software that can be used to take over another computer... can be enforced, without completely outlawing any software upgrade service. Maybe the law is better worded than the article, but from experience I have my doubts.

    • It may be a useless bill, but at least they are trying. I think it is a step in the right direction.

  • Watch out for the loophole! (Score:5, Insightful)

    by IO ERROR ( 128968 ) * <errorNO@SPAMioerror.us> on Saturday January 01, 2005 @12:31PM (#11233744) Homepage Journal
    Read the law [ca.gov] for yourself. It was signed September 28 and takes effect today (January 1).

    Among other things, this bans unauthorized installation of keyloggers, spam sending/relaying software, zombies, and disabling your anti-virus or anti-spyware software.

    However, and this is a big however, they grant a blanket exception to your ISP or network admins. "Nothing in this section shall apply to any monitoring of, or interaction with, a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security purposes, diagnostics, technical support, repair, authorized updates of software or system firmware, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software proscribed under this chapter."

    You could probably drive a truck through a loophole like that.

    • Re:Watch out for the loophole! (Score:5, Insightful)

      by krymsin01 ( 700838 ) on Saturday January 01, 2005 @12:35PM (#11233764) Homepage Journal
      Yeah, especialy the "provider of information service or interactive computer service for network or computer security purposes" under which all websites, or programs used for accessing p2p networks, fall under.

      Good work people!
    • "However, and this is a big however, they grant a blanket exception to your ISP or network admins."

      Can you say MPAA/RIAA?

    • Re:Watch out for the loophole! (Score:5, Interesting)

      by mtrisk ( 770081 ) on Saturday January 01, 2005 @12:41PM (#11233794) Journal
      or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software proscribed under this chapter

      I think they just made it explicitly legal for the MPAA, RIAA, or BSA to install spyware on your computer to counter copyright infringment. What a shame, a rotten egg in a perfectly good law.

    • You can drive a truck through that loophole.

      "Nothing in this section shall apply to any monitoring of, or interaction with, a subscriber's Internet or other network connection or service ... by a ... computer hardware or software provider, ... or detection or prevention of the unauthorized use or fradulent or other illegal activities in connection with a network, service, or computer software."

      The part in bold essentially makes any spyware that is bundled by a software provider (Kazaa, GAIN, etc.) or hard

    • However, and this is a big however, they grant a blanket exception to your ISP or network admins.

      Well, it looks like AOL is out of the red then. They can keep covertly installing WeatherBug and Viewpoint Media Player and adding bookmarks everywhere without users' consent.

    • DRM Truck? (Score:4, Informative)

      by twitter ( 104583 ) on Saturday January 01, 2005 @01:00PM (#11233873) Homepage Journal
      I'm disgusted by the contradictory language. The loophole you mention seems to undo lots of other careful language.

      "authorized updates of software or system firmware, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software proscribed under this chapter"

      This looks custom made for grievous EULAs for junk like Microsoft's Windows XP and Windows Media Player. Even the nasty Overpeer [slashdot.org] effort might be overlooked with an attitude like that. So the thing that is fundamentally wrong, doing things to other people's computers without asking them, is explicitly allowed if you are "authorized".

      Another section defines "authorized user" and expressly prohibits EULAs as a vehicle:

      22947.1.(b) "Authorized user," with respect to a computer, means a person who owns or is authorized by the owner or lessee to use the computer. An "authorized user" does not include a person or entity that has obtained authorization to use the computer solely through the use of an end user license agreement."

      The contradiction is clear, how it will play out is not. If I click through Microsoft's Windows updater, have I signed onto having my computer monitored for copyright infringing works? What are security purposes? Microsoft's EULAs clearly grant them power to do these things and exercising those powers is a violation. We will see if some companies are allowed to violate this law while others are punished.

    • The interesting thing is the line about the "detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software." It is more interesting to compare this new law in the light of yesterdays information about the MPAA/RIAA and their new http://it.slashdot.org/article.pl?sid=04/12/31/15 5 3231&tid=95&tid=97&tid=172&tid=17 [slashdot.org]WMA's. The WMA's exploit a loop-hole that allows the spyware/adware to be installed on the

  • Checklist (Score:3, Funny)

    by Rie Beam ( 632299 ) on Saturday January 01, 2005 @12:31PM (#11233745) Journal
    "The legislation, which was approved by Governor Arnold Schwarzenegger, is designed to safeguard people from hackers and help protect their personal information."

    "One form of spyware called adware has the ability to collect information on a computer user's web-surfing.

    It can result in people being bombarded with pop-up ads that are hard to close.    "

    Lesse. Arnold Schwarzenegger. Check. Hackers as evil villians. Check. Mixing javascript pop-up ads and Malware. Check.

    "Can this really help cut down spyware or will it just be another fatally flawed piece of legislation?"

    I dunno, what do you think?

  • spyware (Score:2, Insightful)

    by spac3manspiff ( 839454 )
    Spyware is considered by computer experts to be one of the biggest nuisance and security threats facing PC users in the coming year.

    Unfortunatly the average computer user doesnt know this
    • Probably because it's false.

      Microsoft Windows is the biggest nuisance and securuity thread facing PC users in the coming year.

      Thankyou I'll be here all week.

  • Money not worth the effort. (Score:5, Insightful)

    by mankey wanker ( 673345 ) on Saturday January 01, 2005 @12:31PM (#11233747)
    The fine is too weenie. They need to do for consumers what they do for the likes of the RIAA and MPAA - give consumers something with which they can beat spyware vendors into submission.

    But that won't happen because they don't really give a shit about "consumers" as long as they continue to consume. When we consume we fulfill our political function.
    • $28,000 per user * 90% of the internet population is quite a lot of money.
    • The fine is too weenie. They need to do for consumers what they do for the likes of the RIAA and MPAA - give consumers something with which they can beat spyware vendors into submission.

      Are you kidding me? Take a brand new computer, and go out there and install all kinds of software which has this junk in it which, naturally, is illegal as of today. Find all instances of said software which violates this law. Contact your lawyer on Monday and start collecting in small claims court. $1000 for each spyw
    • ... they don't really give a shit about "consumers" as long as they continue to consume.

      How Gen-X of you. Who is the "they" of which you speak? Some secret cabal of billionaires? If the "they" is the California legislature, why would they enact the law if they didn't give a shit? The CA spam law is actually pretty good, read it sometime (CA Business & Professions 17529 et seq.), the legislature did their homework pretty well. I am finding it quite useful :)

    • The RIAA ad campaign has put out another announcement:

      When your not consuming
      You're supporting COMMUNISM.

      Like its predecessor [terrorgruppe.com], it had a devilish looking man and a hammer and sickle.

  • Well by definitions is where it might fail? (Score:5, Insightful)

    by Saven Marek ( 739395 ) on Saturday January 01, 2005 @12:31PM (#11233748)
    If you define spyware as they say in the article as "the installation of software that takes control of another computer." then it sounds broken already to me

    Spyware does not have to take control of a computer.

    It can be as simple as sending back browsing habits so cookies can, even, be not so far away from some spyware then,

    Or it can just send credit card details or other browsing habits or snoop in places it shouldnt. All without "taking control" of another computer.

    The devil is in the details. I would like to see what kind of software it really is defining as spyware.

    Great Macintosh Support [tribbles.org]
    • Spyware does not have to take control of a computer.

      A good working definition for me of spy/malware is: any software which is installed without the user's knowledge and/or consent, and once installed, actively resists being uninstalled.

      This may not define all types of spyware, but anything meeting these criteria is most likely spyware. At least I can't think of anything that matches this description, but which is not spyware.

    • Mod parent down! He includes a gratuitous advertising link to his Macintosh support company.

      Plus he didn't even read the article. He wrote: "Spyware does not have to take control of a computer.
      It can be as simple as sending back browsing habits so cookies can, even, be not so far away from some spyware"

      But the law disallows such actions.

      (b) Collect, through intentionally deceptive means, personally
      identifiable information that meets any of the following criteria: ...
      (2) It includes all or substa

    • It can be as simple as sending back browsing habits so cookies can, even, be not so far away from some spyware then,

      Or it can just send credit card details or other browsing habits or snoop in places it shouldnt. All without "taking control" of another computer.

      Without taking control? Did the user send in their personal records and browsing habits voluntarily?

      Your scope is out of whack. Those things are called "taking control." You're talking about "taking complete control." A court would know the diffe

  • Seek damages... from whom? (Score:4, Interesting)

    by bc90021 ( 43730 ) * <bc90021 AT bc90021 DOT net> on Saturday January 01, 2005 @12:31PM (#11233751) Homepage
    Would they seek damages from the spyware manufacturers? Or from the OS designer who designed a less than secure OS?

    Regardless of how you feel the question should be answered, will that be a choice?

    • > Regardless of how you feel the question should be answered,
      > will that be a choice?

      Well obviously not as it doesnt matter how secure your operating system malware spyware will still get. It does that in all computers just depends on whether the user is tricked into installing it or not. And tricking users, is easy.

      Great Macintosh Support [tribbles.org]
      • Odd... I've been running Linux for five years, and I've never had any spyware! My friend has a Mac, and he's never had any spyware... but yet a colleague of mine has Windows, and he's had to get AntiVirus, and Spybot Search & Destroy. He was never "tricked". He got it just by using his operating system in the manner proscribed by its creator.

        He got "MidAddle", just by surfing the web. See:

        http://www.angelfire.com/un/midaddle/

    • I mean really now, I hate MS as much as anyone but you can set off a bomb with a Timex watch. Do you sue Timex for making an unsecure watch, or the people who rigged it to the explosives?

  • Obvious (Score:4, Informative)

    by krymsin01 ( 700838 ) on Saturday January 01, 2005 @12:32PM (#11233752) Homepage Journal
    And let's get this out of the way:

    The law, if it affects any spyware company, will only affect those who are incorporated and/or exist in the USA.
    • Are you sure about that? If I run a company out of the Bahamas and distribute software to you, is my company not exporting software to the United States and therefore must comply with its laws? You'd have to sue in the US, and you'd have a hell of a time collecting, but I don't see why these laws wouldn't apply.

      • Are you sure about that? If I run a company out of the Bahamas and distribute software to you, is my company not exporting software to the United States and therefore must comply with its laws? You'd have to sue in the US, and you'd have a hell of a time collecting, but I don't see why these laws wouldn't apply.

        It's an interesting thought, but I think you could get very far into extraterritoriality and the like.

        Think of the case with Yahoo and their auctions. France decreed it was everyone's job to make

  • Yes! (Score:5, Interesting)

    by kngthdn ( 820601 ) * on Saturday January 01, 2005 @12:32PM (#11233754)
    The RIAA should be fined millions for their infected WMA files.

    • Re:Yes! (Score:2, Insightful)

      by Nurseman ( 161297 )
      The RIAA should be fined millions for their infected WMA files.

      This cracks me up. If I steal a car, and the brakes don't work, so I get to sue the guy who made the car ?. Crime or no crime, you are D/L'ing a file "illegally", and you want to complain when it messes up your computer ?

      • Re:Yes! (Score:3, Insightful)

        by Richard_at_work ( 517087 )
        The RIAA are offering the infected WMA files, so no copyright law hs been broken. Now you may have had the intention of downloading copyrighted material illegally when you searched for the file, but intent does not mean a law has been broken. Even tho you may be under the impression the file is illegal, the copyright owner has given it to you, so its veyr much legal.
      • This cracks me up. If I steal a car, and the brakes don't work, so I get to sue the guy who made the car ?. Crime or no crime, you are D/L'ing a file "illegally", and you want to complain when it messes up your computer ?

        If you steal a loaf of bread and the grocery store manager shoots you in the back with a 12 gauge as you run away, the grocery store manager goes to jail.

  • **AA affected? (Score:3, Interesting)

    by aynrandfan ( 687181 ) on Saturday January 01, 2005 @12:32PM (#11233757)
    The question is will the **AA adhere to this law, or will they find a convenient loophole/exception?
    • The loopholes discussed in some other +5 posts were probably due to recording/movie industry lobbying. Why hunt for a loophole when you can just buy one?

  • Huh? (Score:5, Insightful)

    by FiReaNGeL ( 312636 ) <`moc.liamtoh' `ta' `l3gnaerif'> on Saturday January 01, 2005 @12:34PM (#11233761) Homepage
    What's stopping me of 'getting infected' with some adware / spyware / malware and claim the money? Is there some legal procedures to go throught? How are they gonna prove that I didn't install them?

  • Did they use the right language to be effective? (Score:5, Insightful)

    by WidescreenFreak ( 830043 ) on Saturday January 01, 2005 @12:35PM (#11233763) Homepage Journal
    The state's Consumer Protection Against Spyware Act bans the installation of software that takes control of another computer.

    I'm really concerned about this type of language. The effectiveness of this really comes down to "How do you define 'takes control'?" Snooping where you go in the Internet is not "taking control". I don't even know that pop-up advertisements can really be called "taking control" since I have ultimate control over the power button as well as the network plug in the back of the computer. Even if there is spyware installed, I have control over installing another browser or installing spyware removal software. VNC, PC Anywhere, and other such tools are meant to truly "take control" of a system, but they're obviously not spyware. I'm also concerned about spyware being used at the threat. I would think that viruses and spambots would me the obvious targets, but do they "take control" or do they just "steal CPU cycles"?

    The article didn't go into great detail on this particular matter. How can one really define "taking control" if something ever goes to court on this? Or is it possible that this was just a bad choice of words on BBC's part?
    • The law [ca.gov] defines "taking control" in 22947.3(a) as follows:
      (1) Transmitting or relaying commercial electronic mail or a computer virus from the consumer's computer, where the transmission or relaying is initiated by a person other than the authorized user and without the authorization of an authorized user.
      (2) Accessing or using the consumer's modem or Internet service for the purpose of causing damage to the consumer's computer or of causing an authorized user to incur financial charges for a service that is not authorized by an authorized user.
      (3) Using the consumer's computer as part of an activity performed by a group of computers for the purpose of causing damage to another computer, including, but not limited to, launching a denial of service attack.
      (4) Opening multiple, sequential, stand-alone advertisements in the consumer's Internet browser without the authorization of an authorized user and with knowledge that a reasonable computer user cannot close the advertisements without turning off the computer or closing the consumer's Internet browser.
      • Ah. See, that to me is not "taking control". But - damn! - those four conditions pretty much smack all of the points of adware, spyware, etc!

        I still see this as a problem, though. Even if the company is a U.S. company who is found guilty of this, if they're not based in California does California have the right to extradite? Well, now wait a minute! That then involves interstate network traffic which puts it under FEDERAL control, and the jackasses in Washington would never make a law similar to thi
      • What is interesting is that 1, 2, and 3 are already illegal by federal law, and are aimed toward viruses, worms, and scams rather than spyware.

        However, #4 is truly the interesting one. This is the supposed spyware one, but doesn't apply to any known spyware. This looks more like its against pagejacking, which doesn't require any software installed at all; simple JavaScript will suffice. At its best, it could be used against some really obnoxious adware, but not spyware.

        I don't see anything here that ha

  • Actually (Score:2, Insightful)

    by 10101001011 ( 744876 )
    Now that I think about it, there are several very difficult problems with such legislation. AMong the hardest to define, however, would be what constitutes "taking over".

    Let's face it, we all know some idiot users out there who do things that are just dumb (like clicking on that "Yes" button for GATOR's new and improved super-duper piece of $#!+). With that installation comes a whole host of things but the user did knowingly and willingly click on that "yes".

    Now normally I'd say that this doesn't const

  • Payback Time! (Score:3, Insightful)

    by Comatose51 ( 687974 ) on Saturday January 01, 2005 @12:39PM (#11233784) Homepage
    Class action coming right up!

    RIAA/MPAA contractors using spyware. [slashdot.org]

  • Slashdot moderators - cite the bill (Score:3, Insightful)

    by Animats ( 122034 ) on Saturday January 01, 2005 @12:43PM (#11233800) Homepage
    When you allow a story about some bill on Slashdot, cite the bill, or provide a link. Stories like this are useless.

  • Group Fights Back (Score:4, Informative)

    by hhawk ( 26580 ) on Saturday January 01, 2005 @12:43PM (#11233801) Homepage Journal
    One person can't fight back for a $1,000 since it would cost more than that...

    Recent Prop. In Cali has limited the rights of private laywers to act on the public behalf which also makes it hard for a single laywer to fight for a group of people.

    The only way to really fight this type of spyware, ASSUMING there is someone with some deep pockets would be a class action, which is difficult to put together. You need to certify the class, then go to court to fight the 'bad guys.'

    • One person can't fight back for a $1,000 since it would cost more than that...

      $1000 would allow action to be taken against the perpetrators in small claims court where only a subpoena needs to be served and criminal intent doesn't need to be proven.

      You need to certify the class, then go to court to fight the 'bad guys.'

      If and when a small number of individuals win in small claims court it may set the groundwork for a precedent to be set

    • Re:Group Fights Back (Score:5, Interesting)

      by njcoder ( 657816 ) on Saturday January 01, 2005 @01:42PM (#11234014)
      $1,000? That's small enough for a small claims court. Things are a bit easier in small claims court. Imagine the impact of a million small claims court cases vs one large class action lawsuit where the only one that wins are the attorneys.

  • Fines for the RIAA? (Score:2, Redundant)

    by aerojad ( 594561 )
    So does this mean they'll be fining the RIAA & MPAA [slashdot.org], or is that acceptable spyware?

  • The Bill (Score:2, Informative)

    by euphonaesthesia ( 780368 )
    A copy of the bill is available here [ca.gov]. It defines spyware in this way:

    22947.1. For purposes of this chapter, "spyware" means an executable program that automatically and without the control of a computer user gathers and transmits to the provider of the program or to a third party either of the following types of information: [...]

    The bill also outlines many cases in which damages may be recovered. The $1000 damages that may be recovered refer to violations of section 22947.2 which defines how spyware

  • A thought (Score:4, Interesting)

    by smartin ( 942 ) on Saturday January 01, 2005 @12:47PM (#11233824)
    I don't really know much about spyware as I don't use windows but my understanding is that much of the legit programs collect personal information for marketing purposes. These programs must call home to upload what they collect. Why hasn't anyone written spyware spoofing software that uploads lots of invalid or better yet, simply incorrect data.

  • Plan for world domination (Score:4, Funny)

    by didjit ( 34494 ) on Saturday January 01, 2005 @12:53PM (#11233848) Homepage
    1. Setup insecure windows box.
    2. Intentionally get infected with spyware.
    3. Profit!

  • Listen up Californians - how to get rich (Score:4, Funny)

    by skinfitz ( 564041 ) on Saturday January 01, 2005 @01:04PM (#11233890) Journal
    1. Get a copy of Spybot [safer-networking.org]

    2. Run it on all your PC's. Statistically each PC will have on average 28 pieces of spyware on it.

    3. DO NOT FIX THE PROBLEMS!!! They are now evidence!

    4. Carefully research each piece of spyware found by Spybot to see if you can sue the makers for $1000 each.

    5. If you find anything, call your lawyer.

    6. Profit!
  • Though the intent is a noble one, the law is basically a lawyer's approach to what should be a technological solution. I understand that spyware, et el, is a problem but the Internet is global, this is just "feel good" politics for California. What now? Is every state expected to have its own law? Every country? What a waste of time. Like the can-spam act, this will have little or no affect and more likely it will be used by some powerful business interest to prosecute some kid who's just having fun playing

  • No... Ok, maybe. (Score:4, Interesting)

    by St. Arbirix ( 218306 ) <matthew...townsend@@@gmail...com> on Saturday January 01, 2005 @01:20PM (#11233939) Homepage Journal
    For once this is a computer law that doesn't supplant technical solutions. Now, spyware that installs itself without you knowing it works only because a technical flaw in the computer and you can penalize it all you want but you won't be getting rid of the vulnerability.

    For other things which piggy-back on other programs this seems to be the only feasible way. Since it technically gets installed by hand there's really no hole to plug.

    As much as virii and spyware (malware in general) is a problem there should be a clear distinction between what can be penalized and what can't. Things that prey on the gullibility of users should definitely be outlawed like any other con artist's scam. Things that have technical solutions should really rely on technical solutions. Don't fall into the habit of thinking that a strong law will plug your security holes for you.

    If squirrels are getting into your birdfeeders don't advocate municipal squirrel destruction, buy a birdfeeder with a squirrel guard. (If you want to shoot the squirrels anyway that's your own prerogative.)

  • What it means (Score:2, Insightful)

    by Muttonhead ( 109583 )
    This shows that engineers have failed to do their jobs and the governance of software has fallen into the hands of politicians. This is not good.
  • real world code (laws) have little effect on executable code. what does have effect: better user control of their computer. Let the user decide what gets installed and what doesn't.

    That's why I love FOSS. Better control. That's why windows and IE have issues - little user control. The soloution to a lot of the mess out there is to give users better control of their system. It's firefox vs IE that best illustrates the concept. Firefox will be a runaway success in 2005.

    Giving the user better control als

    • You need to be able to control what rights a piece of software has -- and that has always been one of *nix's strong suits.

      *nix is getting there, but it hasn't always been there. Unix permissions are traditionally based on a per-user basis. What is really needed is a way to have per program permissions. Yes, I suppose you could setuid everything, but that's kind of kludgy. Most of the rest is available, you can set up a firewall to only give certain users access to certain ports, but even this isn't r

  • Since when does any law coming from California make sence?

    Must be a new year's day prank.
  • I can see their new laws now: "Do not install spyware, or Arnold will personally come and terminate you!"
  • "Adware provider Claria supports the California legislation, according to D. Reed Freeman, chief privacy officer, because the confusion between spyware and adware has eroded consumer confidence and stifled the adware industry."

    From the marketing scum themselves: clickz.com [clickz.com]

    They're trying to convince us that adware is ok, but spyware isn't. How much do y'all want to bet that we see more "adware" companies popping up now?

  • so i wonder if... (Score:2, Interesting)

    by m2bord ( 781676 )
    i've heard about this law. i just wonder if what the RIAA is doing, http://it.slashdot.org/article.pl?sid=04/12/31/155 3231&tid=95&tid=97&tid=172&tid=17 [slashdot.org] will be criminalized (as it should be).
  • Fatally flawed.

    However, most state legislatures have a few members on a clean up committee, usually called something like a "Legislative Review Committee," to recommend changes to existing law.

    I strongly recommend you find out who they are for CA and encourage Slashdotters to lobby them.
  • I have often thought that what is needed is a law that requires the installation of _any_ executable on a computer to be subject to the following restraints:

    Uninstall information must be provided at the point of installation. This can be on the packaging of boxed software, or there must be a pointer to an uninstall file, giving its name and location, at the point of install. The uninstall information must be retained on the computer after the installation process.

    No software whatever may install itself wi

  • I wonder if there's a service business in this. Most consumers on their own (hell, even knowledgable people) would have no idea what spyware they had, who made it, and where the company was behind it, let alone have the time/energy to go through the process to get $1000.

    But a business organization could amass that kind of knowledge and provide that as a service. You bring in your infected PC, they ID spyware, produce evidence, and you sign over 90% of your bennies to them. They then collect bulk judgeme
  • At the risk of being too vague (much like the article), I get the feeling this law will be used selectively in cases of "I know it when I see it."

    There's a big difference between services that COULD be exploited (SSH, AD, VNC), data-miners or adbots (Claria, MyWebSearch) and the real nasties.

    Think CoolWebSearch *spit!*, VX2/NicTech and SecondThought. Each of those is considered malicious software in addition to spyware/adware because they install via exploits and use backdoor access to generate revenue.

    S
  • Now Adaware and Spybot can finally get paid if states would let Adaware and Spybot represent affected computer users. Something like 20% to Adaware or Spybot and 80% of the 1000$ to the affected user or the user's charity of choice may be good enough incentive to "make it stop".

  • As has been explained by the posts above, any bill outlawing spyware suffers from at least one of two fundamental flaws:

    1. It outlaws things that shouldn't be outlawed: operating systems, remote management software, P2P, F2F, distributed computing software.
    2. It doesn't outlaw anything, as long as the user is presented with a really long click-through agreement authorizing the software to perform the tasks (which no one is going to read, and is going to be in such cryptic language that anyone who does bother t

  • Ho Hum (Score:2, Interesting)

    by Surfing Caddis ( 731607 )
    I don't even have to read more than the few sentences posted here. Considering the whole purpose of the legislature these days of capitalist enlightenment is to ensure businesses can rifle through our wallets with impunity and our whole job is to consume, I am sure every commercial entity will find the loop holes since I am sure 'they ' and their lobbyists crafted this self-contradicting nightmare bill. Its 'feel good' legislation at its finest. Kind of like invading Iraq: it didn't solve anything, but it m

  • Hmm, sounds like the Junk Fax Law (Score:3, Interesting)

    by antispam_ben ( 591349 ) on Saturday January 01, 2005 @09:37PM (#11235950) Journal
    which was a Good Thing for people who owned fax machines about a decade ago. Junk faxes were about to make faxes useless just as fax machines were becoming affordable and many small businesses were getting them, but they virtually disappeared from the face of the Earth when this became law. The only reason junk faxes still exist at all is not enough people are aware of the law.

    This may not work as well for malware, as many of the creators are not only NOT in California, they're not even in the USA.

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close