Spyware in Mac apps

--On Thursday, August 12, 2004 2:09 PM -0700 tekelenb <tekelenbeuronet.nl>
wrote:
> This keeps on coming up, as well as being pushed aside as nonsense. Is
> there
> a definite source on whether or not Real's software (and which versions)
> did
> or does contain spyware? (I seem to remember that a couple of years ago
> there
> was a lot of noise about it and my conclusion was it definitely did
> contain
> spyware. But I don't recall the details and don't have enough tech
> knowledge
> to check how spy-ish the current Real player is.)
>
> [I know the guy who does RealPlayer for the Mac pretty well, and I would
> be shocked if there was any spyware in it. -Adam]

Depends on your definition of spyware. If you're super paranoid then
technically it does contain tracking options, all of which you can turn off.

[Lots of apps have tracking features; in my mind, if they can be turned off, (and preferably if the more extreme ones default to off), I can't see calling it "spyware" in any way. -Adam]

RealPlayer contains the following "features" which talk back to RealNetworks and/or the
broadcaster:

1) Update checks - fairly standard these days. You can set this manual
checks only to prevent auto contacts with real servers

2) Send connection quality date back to RealServers - Real says it sends
the following data to the content provider (not Real):
* Data sent during transmission that was lost, recovered, early, or late
* Codec (media format) used and the network protocol used for sending
information
* Bandwidth at which the clip was encoded, average bandwidth used during
playback
* The maximum amount of time (latency) before recovering a lost packet; the
minimum latency experienced before recovering a lost packet; the average
latency experienced before recovering a lost packet
* Percentage of data resent; resent packets that did not get to the player
in time to be used
* Percentage of clip that required rebuffering
* Time when the player received the first piece of clip data.

3) Send RealPlayer GUID to RealServers - Each real installation gets a
globally unique identifier, meaning even if you change IP addresses,
service providers, etc... your player can be identified as a particular
player. Real claims this GUID is never tied to who you actually are so
this GUID tracks software installations, not people. Obviously there is a
bit of trust involved in believing Real about this. This option is off by
default. I'm not sure what benefit Real/content providers see from having
the GUID except maybe in tracking how many different players access content
vs. how many repeat people they get.

4) Cookies - Just like web browsers Real supports cookies (I assume the
cookies are unique to the the Real player and can't be accessed via your
web browser, just the real player). Just as with web browsers, cookies may
be required for access content you've paid for. However unlike most mac
browsers this is an all or nothing option -- if you need to have cookies
for one site, you have to enable them for all sites. I don't see a way of
enabling/disabling cookies on a per site basis.

5) Allow RealMedia content to link automatically to web pages during
playback. Presumably to serve ads to you while listening/watching things.

If Real has tracking software/auto-connecting "features" other than those
I'm not aware of them. I don't use Real enough to bother tracing the
package to see if it obeys the disable options in preferences.

Kevin

On Sun, 15 Aug 2004 05:24:28 -0700, Kevin van Haaren
<kevinvanhaaren.net> wrote:

You forgot the main one, getting Real software requires an email
address registration and, at least in the past, that address would get
spammed almost instantly.

I created a new email address quite a few years back called, iirc,
"real-spams" and used it to register my real player. It got dozens of
spams a day within a couple of weeks and hundreds within a year. I
never gave the email to anyone else and I unchecked the "send me spam"
options.

I wouldn't trust Real as far as I could throw Microsoft's headquarters
campus. Been there, done that.

I now have a fake email address that I use for Real that does not
deliver anywhere.

[To be fair, and not to defend Real necessarily, there are lots of ways an email address can start receiving spam that don't indicate malfeasance on the part of the company. A dictionary attack could work, as would any lack of security settings (such as not turning off SMTP Verify), and of course there's always the possibility of a theft at the company or dishonest employee, neither of which may be in the company's control. -Adam]

Then there is the problem that Real will work very hard to redirect
you away from the free player. This "bait and switch" method, while
crude (and illegal in a brick and mortar store) is effective, and I
know lots of people who have paid for what they expected to be a free
player.

[Yeah, that's always bugged me too. -Adam]

--
 ::::== <http://www.kreme.com> ==::::