Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?
Privacy Software Your Rights Online

Adobe Quietly Monitoring Software Use? 304

henrypijames writes "For months, users of Adobe Creative Suite 3 have been wondering why some of the applications regularly connect to what looks like a private IP address but is actually a public domain address belonging to the web analytics company Omniture. Now allegations of user spying are getting louder, prompting Adobe Photoshop product manager John Nack to respond, though many remain unsatisfied with his explanation."
This discussion has been archived. No new comments can be posted.

Adobe Quietly Monitoring Software Use?

Comments Filter:
  • Not about spying (Score:5, Interesting)

    by 75th Trombone ( 581309 ) * on Saturday December 29, 2007 @05:39PM (#21851418) Homepage Journal

    To clarify the summary, the biggest issue is not the spying on users; the biggest issue is the deceptive server name, It's at least meant to confuse unwary users, and possibly meant to confuse misconfigured firewalls.

    As someone said on a blog I can't find right now, this is not a story about privacy; it's a story about lies.

  • Re:Not about spying (Score:5, Interesting)

    by IdeaMan ( 216340 ) on Saturday December 29, 2007 @05:44PM (#21851438) Homepage Journal
    Adobe may indeed be the innocent party here, depending on how Omniture code is included into their build.
    What I found as a cause for concern is that it is tracking an embedded Opera browser.
  • by solios ( 53048 ) on Saturday December 29, 2007 @05:52PM (#21851480) Homepage
    Simply put, the only things on my machine that should phone out should be voluntarily invoked by me - the user. Namely the web browsers, software update, ssh, etceteras.

    Adobe's behavior of late (and it will only get worse) is why applications like Little Snitch [] exist.

    This kind of thing is why I wish The GIMP [] or similar would get useable* for those of us with hundreds of gigs of Photoshop documents.

    * Open, Save, full support for all blending modes, masking modes, layer groups, and fonts/text editing capability up to at least Photoshop CS. I don't need the thing to handle Exactly Like Photoshop, but if it's going to be the "photoshop competitor" every FOSS advocate claims it is (instead of, say, the Paintshop Pro competitor that it actually is), then it ought to at least be able to handle my existing documents as well as OpenOffice handles .doc files.
  • by prichardson ( 603676 ) on Saturday December 29, 2007 @06:23PM (#21851672) Journal
    GIF have their length defined at the start of the file, and bits after that length are ignored. Perhaps there's some hidden data at the end of the file? Try opening it in a hex editor.
  • Re:Phisher's Delight (Score:5, Interesting)

    by ScrewMaster ( 602015 ) on Saturday December 29, 2007 @06:32PM (#21851756)
    P.S. for those of you who have not set up a LAN, is typically an IP address for an internal LAN, not something out on the Web.

    More to the point, the 192.168.x.x address range is one of several that are specifically intended to be non-routable on the Internet. Many people know this, even those who aren't otherwise that network-savvy. This is a blatant attempt to make the address appear safe ("well, I dunno what it's doing, but at least it's only sending to address on my LAN!") Not what one should expect from a major software house, but unfortunately, it is what we are all coming to expect from everyone in the business. Doesn't much matter what they're actually sending to Omni-whatever ... the fact that they're sending anything at all is very bad. Nothing on my system is their business, unless I say it is. Period.

    You know, this reminds of something that Jack Valenti once said (about the only thing that sociopath ever said that I agree with): "Just because technology lets us do something, it doesn't mean we should." Now, he was referring to the copying and downloading of DVDs, but his point is still valid. We're seeing too many companies set up to serve larger organizations (Omniture, MediaSentry) using the Internet in unethical if not outright illegal ways. Presumably, this is so the corporation hiring them (in this case, Adobe) has some plausible deniability.
  • by owlnation ( 858981 ) on Saturday December 29, 2007 @06:53PM (#21851918)
    Competition. That's the only solution to this. Adobe has become a very arrogant and supply-side centric company over the past few years. Or rather, an even more arrogant company than it always was.

    It has almost no competition in most markets it trades in. Where it did have competition, it bought it out with the Macromedia purchase. That's a problem. It's not just this privacy/lying issue, it's price fixing, it's bloated features, it's the product delays (the universal binary versions), it's the (a la Microsoft) packaged versions that make it hard to get standalone versions.

    I use Adobe Software every day (always firmly controlled by Little Snitch from install I may add). I don't like using it, it is not the best they can do, but it is the best available. I use it, but I will jump ship tomorrow.

    I really, really, really want to use products from a better company. Surely there MUST be developers out there who can make better products than Adobe.
  • EULA (Score:3, Interesting)

    by slashdotmos ( 819804 ) on Saturday December 29, 2007 @06:58PM (#21851952)
    I didnt see it posted and I dont read most EULAs, but as long as this has a line about the 'phoning home' process then all is ok. Now if they never post anything in the EULA then that is a big problem! You accept anything the software does when you click I agree. You dont have to agree and use the software. Anytime I think about EULAs, I think they are made to legal like that noone is going to read it and those that do will most likly just say 'yea whatever, i want to use the software'. Which reminds me of the one software that had a written reward in the EULA and after like 5 years (or longer, i dont remember) and a lot of users some guy saw a lil statement that said the the effect 'email us this code and we will send you $5000'
  • by azrider ( 918631 ) on Saturday December 29, 2007 @07:00PM (#21851976)
    Omniture's Opt-Out Policy:

    We offer visitors to certain of our customers' websites a means for controlling the use of session information with respect to the Omniture SiteCatalyst, Omniture DataWarehouse, Omniture Discover and Omniture SearchCenter products using cookies set from Omniture's domain (i.e. that use the cookie to facilitate data collection). If, at any time a customer's website visitor does not wish to allow his/her session visitation information to be aggregated and analyzed by Omniture on such customer sites, he/she may utilize the following opt out mechanism. For customers that use non-Omniture cookies to collect data on their websites, please review the privacy disclosures of such customers for specific details on any and all applicable opt outs on such sites.
    It was noted in one of the linked articles that the opt-out action sets a cookie on your machine. If you delete this cookie, you have just opted back in.

    So let me get this straight. In order to tell Omniture not to do anything on my machine, I have to give Omniture access to my machine. What sort of half-assed policy is this?

  • Firewall, anybody? (Score:2, Interesting)

    by garry_g ( 106621 ) on Saturday December 29, 2007 @07:31PM (#21852180)
    Even having nothing to hide (read: de-centralized backup copies) and using mostly Linux, running a personal firewall that not only controls incoming, but also outgoing software is a total must nowadays. For Windows, there are several, even freeware (e.g. Ashampoo does a pretty good job), or things like Apparmor under Linux ... So with any program suddenly requesting internet connection, just deny it once, or for good ...

    I guess that's the curse of the ever-growing number of always-on internet users ... guess one of these days, you won't be allowed to even launch your commercial apps without the software's main server confirming you're not running a pirated copy. Then, if the company dies, all the programs die with it ...
  • by fermion ( 181285 ) on Saturday December 29, 2007 @08:08PM (#21852376) Homepage Journal
    It is not a misleading server name, at least not anymore. Cognizant web users know, or whatever, is the cookie tracking site, and mostly blocks them. This company though liegitimate, does smell of sleaze. It was one of the first companies to use such social confusion, replacement of the '0' with 'o' so that in the days when one manually entered the domains to block, they would block the wrong domain. They are legitimate, and companies that work with them are legitimate, but the original sleaze factor is always there, and is obviously going to be transfered to clients.

    This then leads to the question of why Adobe is using them for applications, which leads to think what has been aquired in the past year or so. I know. Macromedia. You know, that company that produces complicated resources hogging web content that unlike other resource hogging content cannot be filtered by most web browsers. I had hoped that Adobe might soften the rules and ship a flash player that was less user hostile, but no such new player exists. So, can we presume that instead of the user friendly Adbobe culture positively affecting the old macromedia products, that the end user hostile macromedia culture is infecting the adobe products.

    OTOH, this product is a web design product, and most web designers get their money from ad revenue, so I would hardly think that the users of the product would have much problem with working with 2o7, kind of a necessary evil sort of thing. I can't imagine why adobe would use them at the design level, but overall I agree that it will be of no big deal to users of the product. To me, it is another step in the downfall of Adobe.

  • Re:Not about spying (Score:1, Interesting)

    by Anonymous Coward on Saturday December 29, 2007 @09:00PM (#21852722)
    I have been running Vista on a Toshiba laptop. Besides the installed crapware phoning home and Adobe's preinstalled reader, of course, I'm more concerned about those I can't catch. My tinfoil hat tells me that if MS controls your system, it is hiding a bypass API somewhere to elude your its own (and your own paid for) software firewall. How else did those hidden windows updates get installed on unwilling corporate and home machines months back?

    Even if that isn't the case, I was pissed off when random windows components had to be blocked.
    Media player LAN sharing/search service? OK, I have a single PC --blocked cause I don't want that used as a future net-access backdoor for DRM.
    Windows sound recorder? Probably is just testing my local network or some local proxy port for scratchwork --hope it's not Bill G. trying to sample my microphone, like google talk does.
    Windows magnifier? What the HELL? Why does THAT need to open a socket?

    I caught so many OS programs and utilities doing this that it made me mad, in a single month of owning Vista. XP was never so vociferous. Back in the nineties, nothing ever wanted to open your connection upon launch to check for updates. MS and dobe do it to check if the LAN has many PC's running Word / Adobe under the same serial #, particularly on macs. The problem is, once you click on "trust this app" you never know when they'll use that setting to dial beyond your LAN, unless your routers already know to block traffic --and this power comes for $$$$ unless you have precompiled a list of former, though SUCCESSFULL, outside accesses.
  • metered connections (Score:3, Interesting)

    by wikinerd ( 809585 ) on Saturday December 29, 2007 @09:04PM (#21852756) Journal
    Some Internet connections are metered, usually based on the data volume (per kb). If Adobe uses your network connection to transmit data, then this means that some bandwidth (however small) that you pay for is wasted, especially if one is using an Adobe program a lot. Yes, it may be only a few bytes, but the principle holds true: Adobe may be using some of your metered Internet connection. Is this explained in their agreement? There are a lot of reasons why one should dislike this, apart from privacy.
  • by DeadChobi ( 740395 ) <> on Saturday December 29, 2007 @10:52PM (#21853344)
    I think he said it in his post. Let me repeat what he said, because I'm a whore. Strict Consequentialism is an untenable moral stance because it is impossible to predict all the consequences arising from a single action. Thus, what you might think of as a "little white lie" may actually result in some catestrophic life changing event for someone else. The tragedy of your moral stance is that you would not care because to you nothing bad happened as a result of your lie.
  • Try gimpshop (Score:2, Interesting)

    by jpetts ( 208163 ) on Sunday December 30, 2007 @12:44AM (#21853842)
  • Re:Not about spying (Score:3, Interesting)

    by jo42 ( 227475 ) on Sunday December 30, 2007 @12:51AM (#21853874) Homepage
    Complain to re: that address range as hosting a spyware server...
  • by adminstring ( 608310 ) on Sunday December 30, 2007 @02:17AM (#21854214)
    It can go even further: an act which, as far as you can tell, is purely beneficial may end up having negative consequences. You could help an old lady across the street and she could therefore avoid getting run over, and two weeks later she might introduce two people who end up being the parents of the next EVILPERSON$. So unless you are willing to put a limit on the length of the chain of consequences you consider, you end up being unable to make any moral decisions, because any seemingly good decision could have severe negative consequences.

    This is easily remedied by only considering the reasonably foreseeable consequences of your actions, which is what GP was suggesting.
  • by EdIII ( 1114411 ) on Sunday December 30, 2007 @02:46AM (#21854352)
    This is why I only use cracked software. Even if I purchase the software, which all of mine actually is, i run it cracked with lot of firewall rules.

    I have never trusted any software company that attempts to make an outbound connection for ANY reason. Certain programs being an obvious exception like web browsers.

    The fact that behavior like this is now coming from Adobe provably, is no surprise to me at all. Adobe has been almost militant in it's defense against piracy. If they had their way, all computers would be hooked up to a central database and run only authorized code decided by a "high council" of software developers.

    I know some may say that the "jury is still out", but I don't believe that any of this was done without Adobe's knowledge or consent. After all, any software developer would be stupid and negligent if it subbed out development work or services to a 3rd party without verifying the functionality of the code or auditing the services.

    In any case, for a company with Adobe's reputation, this is very damaging.

"It takes all sorts of in & out-door schooling to get adapted to my kind of fooling" - R. Frost