Pop-Under Deception and Private Property 103
RogerRamjet98 writes "I was browsing the web today and I got hit with a pop-under ad. Annoying but no big deal, right?
Wrong. This one managed to change my home page to (CT:Link removed. Why would we send these dicks traffic?)
Which pretends to be yahoo, and is convincing enough to fool the average computer user, but is really a platform for launching more pop-under ads.
Combine this with the AOL/WinXP news, and it makes me think that the settings on my computer ought to enjoy legal protection as private property: Changing them without my permission (such as adjusting my home page, or whatnot) should constitute assault or trespass." Or turn of JavaScript. Or don't run IE. But good luck on that trespass case. With a history of laws like the DMCA, Uncle Sam can only make it worse.
A possible solution? (Score:1)
Tech law, cyber law, or whatever one wants to call it is too early in its development to provide much help here. As CmdrTaco pointed out, the few times lawmakers get involved in this field, they really screw things up (eg, DMCA, patenting obivous things with lots of prior art, etc.). There aren't a lot of helpful precedents and/or laws on the books, so we are probably out of luck here.
There are some novel legal theories one could try from (NON-intellectual) property law concerning trespassing, personality, etc. But, again, things are too unsettled in this area for these types of legally novel theories to have a high probability of success as causes of action.
My thought is that the best possible solution to all of this is some combination of technological and legal solutions.
Technologically, there have been a lot of work done on blocking pop-up ads and maybe something like that can be used here.
Legally, it would be great if people could do something like what RMS has done with GNU GPL and give individuals A LOT of legal protections over their privacy and presence on the Internet and let them contract -- under their own informed free will -- with others on what terms individuals are willing to interact with businesses on the web.
Maybe if... (Score:1)
IE and virus access? (Score:1)
If you combine this behaviour with the recent IIS targeted virus, then you could easily have a virus that modifies web pages to include javascript to install itself into the machines of the vistors to the site.
I definetly ask myself why Javascript is not limited to a sandbox, in the same way Java is? Until then best use some other navigator to surf the web.
A similar incident (Score:2, Flamebait)
This should be illegal! (Score:4, Insightful)
Actually, this may constitute breaking the law. After all, if you hack into someone's computer and change any data on their computer, then you've broken the law. If you write a virus that goes in and changes data on someone's computer without their knowledge, again, you've broken the law. Seems to me that this qualifies. You don't have to do any damage, per se, but changing the data on their computer is enough.
IANAL, but I don't see a real distinction between a virus and what these ads are doing. Just MHO.
Re:This should be illegal! (Score:1)
Re:This should be illegal! (Score:2)
Let's see...
First, we copyright our web browser configuration. Then, we define our homepage as a copyright protection measure. Then, anyone who changes the ad is circumventing a copyright protection measure for profit! A pirate! Sic the federales on 'em! Yeah!
Hey, the DMCA could be a lot of FUN if we just abused it the right way.
Re:This should be illegal! (Score:2)
You do know what DMCA stands for, do you?
Defending Monopolies' Cashflow Act
c'mon taco, admit it (Score:2, Troll)
Don't run IE? you're funny... (Score:1)
As for disabling Javascript, say goodbye to quite a few websites that make extensive use of javascript.
Re:Don't run IE? you're funny... (Score:1)
"a few websites that make extensive use of javascript" are certainly no great loss. Any site excluding text-based clients (and blind users) don't deserve to be visited.
Re:Don't run IE? you're funny... (Score:1)
cough..troll..cough
Re:Don't run IE? you're funny... (Score:1)
I don't like the way the web has gone, with graphics all over and absurdly fancy layouts and irritating colors, but that's me hating complexity where it need not exist, I live with it, and just because a website uses javascript, doesn't mean it doesn't deserve to be visited.
Why should our settings be protected? (Score:1)
Sorry, but while these covert actions are annoying, and the people behind it definitely ought to be smacked hard, it's not cause for legislation - unless, perhaps, they are taking advantage of security holes to alter your settings in destructive ways.
Re:Why should our settings be protected? (Score:2)
unless, perhaps, they are taking advantage of security holes to alter your settings in destructive ways.
Exactly. We're talking about the potential for someone inspecting or modifying data stored on your computer without permission, explicit or implicit. Although the browser manufacturers are partially responsible, in my opinion it would be an easy sell to have lawmakers consider this in the same way as cracking. Especially if you embellish it a bit for your congressperson: "Just think -- one of these could pop up and change your homepage to pr0n! Or Ralph Nader's homepage! Think of the children!"
Re:Why should our settings be protected? (Score:1)
It's no different than someone defacing a website, the latter is just more visible.
Re:Why should our settings be protected? (Score:1)
Re:Why should our settings be protected? (Score:1)
Yes a person should be responsible enough to keep up on security patches and set proper security settings in their browser, but that doesn't mean we shouldn't hold the people writing this malicious code responsible.
To use a common analogy, do we let a mugger go because the victim shouldn't have been in that part of town at night?
Re:Why should our settings be protected? (Score:1)
lynx immune :) (Score:1)
Bad Browser! Bad! (Score:2)
Re:Bad Browser! Bad! (Score:2, Informative)
Ouch, nasty (Score:1)
That's a nasty one, kinda like the old DOS programs that would put up a screen or message that looked like your network log-in prompt, and then record your password before logging you in as normal.
I don't see how you're ever going to legislate against something like that, though. You immediately raise unanswerable questions about what consistutes an e-trespass, and what constitutes giving permission to change something on your system.
Fortunately, there is always an easy answer. People forget in this world of scripting and viruses that no-one can ever force you to run something on your own PC -- not even MS, though they wish they could :-). If you don't like it, just run with a browser where you can switch off cookies, Javascript, and all the other rubbish. Such things are freely available; all you have to do is go get them. 'Course, it would be nicer if switching them off was the default, so the people who want them get them, but the people who aren't informed enough to know about them don't get screwed...
WTF? (Score:2)
This doesn't sound *too* bad, but it won't stop there. It won't be long until some script kiddie figures out a way to change all the URLs on people's favorites to theirs. And by the time that people find out, it's too late -- They don't even know where the popup was (or that it even was a popup! I had no idea until just now...)
what about IE? (Score:1)
Re:what about IE? (Score:1)
Re:what about IE? (Score:1)
Re:what about IE? (Score:1)
Re:what about IE? (Score:1)
Re:what about IE? (Score:1)
Re:what about IE? (Score:2, Informative)
Probably not. In fact iexplore has considerably finer-grained controls for javascript (or as it says, "scripting of java applets") than netscape (or at least current versions of netscape).
Options -> Internet Settings -> Security -> The Internet -> Custom -> Scripting
and set everything to either "Prompt" or "Disable" as whim requires.
Grounds for Security hole (Score:1)
Re:Grounds for Security hole (Score:1)
Technical Details (Score:3, Interesting)
Are there any people (who have enough knowledge of Internet Explorer or the Windows OS in general) how this could be achieved? I find it very disturbing that such settings (such as your browser's home page) could be altered remotely without your permission, which could constitute a breach of computer security. As far as I know, (depending on your jurisdiction) there isn't any specific legislation that marks your computer's settings as your private property. The only thing you can do is, like Taco said, disable JavaScript or don't run IE. Which makes sense anyway.
Re:Technical Details (Score:2, Informative)
Most recent browsers provide a function in their scripting that lets you set the home page for the browser. This is what sites use when they provide a button that says "Click to make this site your home page" or some such. If you've got sensible browser security settings in place, you'll get prompted before the browser will actually do it, but many people have security settings too low for that. For those people, all it takes is a web site that hooks up the script to set the home page to run when the page is finished loading, and bang, one reconfigured browser.
Re:Technical Details (Score:2, Informative)
I would look up the commands for you, but I thought it wouldn't be that great to post 'em all over.
p.s. not tested for accuracy
Re:Technical Details (Score:1)
And which dicks would those be? (Score:5, Interesting)
Granted, I agree that we shouldn't send "those dicks" any traffic. And I agree that companies who do this sort of thing are indeed dicks. And I also agree that it would be most amusing to see an entire
But it would also get old quickly. So, Taco, what's the name of the organization whose link-to you removed? Not a domain or anything, just a noun that we can use instead of "those dicks."
Why give them the attention? (Score:5, Insightful)
Slashdotters are curious. We'll click any link and search any subject to learn more. Look at my post. Posting to slashdot with my
No, I can't help but feel that CmdrTaco did the right thing; even speaking their name here helps them out.
But of course, it's only a matter of time before some friendly poster mentions who it is anyhow.
So I know to avoid them, that's why! (Score:4, Funny)
"Don't touch a hot stove, dear."
"But Mommy, what does a hot stove look like?"
"I can't tell you that, dear. You might touch one."
Re:And which dicks would those be? (Score:2, Funny)
And an IP address too! (Score:3, Funny)
But an IP address would also be nice, to give to the Code Red Worm...
Re:And which dicks would those be? (Score:1)
-John
Re:And which dicks would those be? (Score:3, Informative)
Unauthorized Use of Computer Resources? (Score:1)
Where's the script? (Score:1, Interesting)
I suspect the poster was tricked into approving it, but is too proud to admit it... its seems the usual reaction to being duped is to cryout, "there outta be a law..."
I wish there were a better solution (Score:2)
So besides disabling Javascript, what else can we do? Is legislation a viable option? Complaining to the webmaster of the site with the evil js?
What have you tried that has worked for you?
FP
Re:I wish there were a better solution (Score:1, Funny)
Re:I wish there were a better solution (Score:1)
Run Mozilla/Galeon/K-Meleon, and encourage others to do the same, explaining to them *why* they should consider changing over!
Re:I wish there were a better solution (Score:2)
You'll have to go through a few more steps if your want to change your settings afterwards, but I don't see how javascript will be able to change anything behind your back.
Re:I wish there were a better solution (Score:1)
Unfortunately, some of the sites I like to hit use javascript. Javascript is occasionally useful
This has probably been mentioned before, but... One workaround in Internet Explorer is to go to the security tab and disable (or force prompting for) cookies and javascript for "Internet", and then to "opt-in" the sites that you trust by placing them on your "Trusted Sites" list (and allow cookies/javascript for trusted sites). Ideally, you should have finer-grained control than to put all sites into just two categories, but if you're stuck using IE and you don't want to go with a web filter like Proxomitron [spywaresucks.org], it's better than nothing.
javascript reform (Score:1)
There should have been an overhaul of javascript a long time ago. PARTICULARLY since stylesheets require javascript [Who the hell got bought out to get that one in the spec??]
There should be a subset of javascript that is only related to validating forms, playing around with formatting on the same page, etc. but has all of the secret nasty stuff like changing preferences and cookies TAKEN OUT. That that version, and only that version, could be the required scripting component for CSS, etc.
javascript could be turned into an actual force for good, instead of the deep pit of evil it is currently.
Private Property, Violators will be DOSed (Score:1)
I don't know if DOS retaliation is the right tact to take, but it sure is a shame we can't have a real life doberman that will sick whoever makes a pop-under ad... Wonder where X-10 HQ is?
If you don't think too good, don't think too much
www.jdhodges.com [jdhodges.com]
Web business and desperation. (Score:2)
When web advertising was less invasive, this was not such a big deal to readers. In fact, it was the business-model-of-last-resort: "ads will pay for an essentially free internet." (Let's play find-the-fallacy.) Web publishers ("content providers") promised the moon to advertising customers - that they could instantly generate sales and site visits, measure the results with click-throughs, and do this all without alienating their own base. It didn't work that way.
If the expectations of web advertising had been more moderate to begin with - in line with those of print ads - this sort of thing wouldn't be happening now. But I don't expect it to get better. I don't believe in rational markets with good information finding optima, I believe that irrational expectations create bad situations, vicious cycles develop, and things fall apart. The nice bit about it is that we are, ultimately, getting the internet back from the suits that are failing to selling it to us.
la la la la la la la la la la (Score:5, Insightful)
There are any number of really good reasons to run both JavaScript and IE. As a web developer I love JavaScript. If I validate a form with JavaScript I save the user time since they don't have to wait for the server to validate and respond (the server its own validation, of course, so I don't save any CPU cycles). This is a win for both of us: the user gets a faster response and I get a happier user.
For people running Windows (nearly everyone, last I checked), IE is the fastest, most stable, and most feature-rich browser available. Yes, it's chock-full of security holes. That's by design. Microsoft is pretty explicit in trading usability for security, and it shows. [Some of] Their products are very user-friendly.
To avoid getting modded down as a troll, I'll say that Microsoft sucks and only lusers use IE. Lusers like my mom, of course, who has trouble enough on the web without me updating Mozilla to milestone "slightly faster than a melting glacier" every other week on her P200. I use Mozilla, and it kicks IE's ass for my use, and on my computer.
My point? The problems here are (a) lack of security focus by Microsoft. There should be no setting, anywhere, that allows changes to local software without explicit user consent. They have fucked this up royally, time and time again, and I don't think it's ever going to change. Plus, if they have their way, the concept of "local software" will go away entirely.
The other problem ((b), if you're keeping track) is human capacity for evil. Some PHB had a brilliant idea: "Ok, we need to change every directory name on the computer to 'Porn-R-Us.com'. You can do that, right?". Some low-life programmer said, "Sure, there's an ACtiveX control for it."
It all comes down to human decisions. Somewhere along the line a human being decided to fuck another human being to make a buck. The only way to stop this is to remove the buck. This is often done with a lawsuit, or other legal action. So I say yes, sue these bastards 'til they can't walk straight.
Suggestion..... (Score:1)
How 'bout this: We attempt to have the server slashdotted and possibly go offline. Everyone turn off JavaScript in your browsers and we'll allow Taco to post the link. Everyone cuth with that? Even if that doesn't work, just reprogram Code Red to set it's sights on that server as opposed to the whitehouse
Now this is interesting javascript (Score:1)
My page [geocities.com]
KernelPanic.com [kernelpanic.com]
And this demo only works on 95/98 machines:
My 95/98 demo [geocities.com]
Guide to changing user prefs in JS... (Score:3, Informative)
Hit his URL:o ns/javascript.html#7 [netscape.com] for Netscape's guide to how to use JS to change user prefs...
http://developer.netscape.com/support/faqs/champi
Re:Malicious JavaScript (Score:3, Interesting)
no warnings and no question - this can be done and according to my developers is really easy to do - and as these days to get all web pages to work you need to use IE- theres not a lot of choice - of course you can lock it down but that means many things wont work properly anyway - so whats the solution ?
someone come up with an answer for this ? PS popup killer doesnt work with My IE - i use cable and of course it doesnt work as its a customised version.
So any ideas ? (please dont advise me to change to Mosaic or Netscape or opera as i cannot do that with my cable provider (i love opera but it wont work properly with most of my plugins without playing and i dont see the point of having a broadband link and a crippled browser - i spend my days playing with servers and dont want to spend my nights configuring browsers - this is why i dont use linux at home)
ahhhh Linux (Score:2)
Now that I have a super fast computer I am beginning to like mozilla and some of its features of turning off things, like images from certain servers. Maybe someone will implement turning off JS from hostile sites (like mozilla's cookie rejecting) or prompting you for this.
NOTE I am NOT talking about turing off ALL javascript, just allowing users more control over it.
This user may want to try proximitron (sp) it is a proxy that allows you to set up some filters. Thus turing off pop ups and pop back....
Arghh... make up your mind... (Score:3, Interesting)
When somebody distributes a copy of an MP3 ripped from a licensed piece of music, it's OK because you would not have bought the album anyway
But somebody changes your homepage, and suddenly it's a job for the federal government.
BTW, the DCMA, as stupid and flawed as it is, probably gives you some legitimate avenues to address this sort of offensive behavior.
I know the DCMA is the only reason you won't be seeing those dreaded "smart links" in the next version of Internet Explorer.
It is your fault (Score:1)
It's your fault for letting the web sites change your home page and popping up windows. Since the default installation of IE set by Microsoft apparently lets this happen, you have to set your settings higher if you don't want these things from happening.
Re:It is your fault (Score:1)
1. Call up Microsoft and tell them that they want their default installs to be more restrictive.
2. Install one of tons of programs that will stop ads from popping up. It isn't that hard to install most of these little programs.
3. Use something else. It doesn't take that much to go install Netscape or others.
This isn't a "Microsoft bash" - if there are things popping up all over the place and your homepage keeps changing, don't write your congressperson trying to make certain use of javascript illegal - write Microsoft asking them why they allow these javascript "features" in default installations of their browsers.
Sure...if you set your Security to "Rape Me" (Score:4, Informative)
This is on IE's Medium security level. On High I'm sure it is even more protective. So can we please be clear about this? Is this new trick able to bypass these kinds of protections? Is this a problem only on Netscape or IE or any JavaScript enable browser?
Keeping in mind that MS wants everyone's homepage to be MSN.com (the first thing IE goes to after installing is a page with code to make MSN your homepage) I can't believe they would allow any website to so easily snatch this setting without user interaction of some kind.
- JoeShmoe
Re:Sure...if you set your Security to "Rape Me" (Score:2, Funny)
"Warning! If your homepage is changed from MSN.Com you will not receive valuable updates and integrated web functionality! Are you sure you want to proceed with this reckless course of action?"
:)
- JoeShmoe
Re:Sure...if you set your Security to "Rape Me" (Score:1)
Whoa there, Taco (Score:3, Insightful)
Re:Whoa there, Taco (Score:1, Funny)
Yeah, they make an ASS of U and .... HEY!!!
Another option (Score:1)
One solution is for browsers to have an option to disable javascript's ability to open new windows. I use OmniWeb [omnigroup.com] on Mac OS X and it has exactly this option. In fact your choices are to allow javascript to open windows always, only in response to a link being clicked, or never. A very useful feature and one reason I will ultimately hand money over for this software.