The risk of using proprietary software

Do you know what you’re feeding your computer?

Short URL: http://fsmsh.com/1146

Write a full post in response to this!

About one out of every 200 people is allergic to peanuts. Depending on the extremity of the allergy, a person suffering from peanut allergies who was accidentally exposed to peanuts might develop an itchy rash. Others might experience anaphylaxis, a severe reaction that can prove fatal. People who are allergic to peanuts have a tough time in America, where more and more foods are manufactured in factories that also process peanuts.

Thankfully, manufacturers and restaurants are coming under pressure to clearly label foods that either contain peanuts or were prepared with machinery that also processed peanuts. These measures have saved lives and helped Americans live healthier lives, because knowing what you’re eating ought to be important to everyone. Without access to this information, hundreds of men, women, and children would die each year. People with a deadly sensitivity to peanuts would literally be playing a game of Russian roulette every time they tried a new food.

What if we lived in a nation where manufacturers weren’t required to print the ingredients of their foods on their packages? What if food corporations had successfully lobbied Congress to allow them to keep their ingredients totally secret? We can easily imagine the arguments. “If we publish our ingredients, then our competitors will be able to duplicate our recipes”. “We use chemicals and ingredients that might turn off consumers”. “If people don’t trust us, they shouldn’t eat our food; we shouldn’t be forced to list the ingredients”. Nevertheless, in this case, common sense won out, and now we’re entitled to not only read the basic ingredients but also get fairly reliable nutritional information about the foods we eat. We don’t necessarily consider that the manufacturers are graciously offering us a service. Instead, we see this as our right, a demand that we reasonably make to manufacturers. If a manufacturer refused to tell us what is in its food, we would be stupid to eat it anyway. It’s just common sense to require that manufacturers tell us what they’re putting into our foods—because we put those foods into our bodies.

You have a _right_ to know what’s going into your food, you have a _right_ to know what a piece of software is doing inside your computer

Now, let’s consider another case that isn’t really much different than food, but is nevertheless treated as though it were : computer software. No, I’m not saying that you should try munching your copy of Half-Life 2. What I mean is that software is something that you put in another type of body; namely, your personal computer. For the same reason that you have a right to know what’s going into your food, you have a right to know what a piece of software is doing inside your computer. It ought to be common sense that software developers be required to publish this code for your review before you run their programs. When a software developer tells you, “No, just trust us,” your mental red-alert should start sounding loud and clear. This is a dead giveaway that you should steer clear of this software and not even consider installing it on your machine. Sure, perhaps it is safe and legitimate. But how do you know? Is it worth taking a risk with all of your precious programs and data? Why should you even be asked to take this risk?

The propriety of trust

Let’s explore this concept a bit. Let’s say you are browsing the games at your local software shop and find a great new role-playing game from a major developer. Even though it’s a bit pricey at $60, you’re impressed with the description on the box and take it home. Unfortunately, after playing the game for a few hours, you decide you don’t really like it. It’s boring and not nearly as good as you thought it was going to be. Of course you can’t take it back to the store since no one is going to trust you enough to believe you didn’t make an illegal copy of the game. So, disgusted, you decide to use the game’s uninstallation program to take this clunker off your hard drive.

This program deletes the entire contents of your hard drive. Gigabytes worth of papers, emails, family photos, and countless other valuable data is lost forever.

Yeah, right, you say. This would never happen. Yet it did.

Never has a game been so aptly named
Never has a game been so aptly named

The game is Stormfront Studio’s Pool of Radiance II: The Ruins of Myth Drannor, distributed by Ubisoft and released in 2001 (see this IGN review or this Game Over.net review). If you haven’t heard of it, there’s good reason. The game was one of the most pointless and sleep-inducing games since E.T. for the Atari 2600. In the world of big-budget commercial games, this isn’t really anything unusual. It’s also expected that there will be plenty of bugs, some of them show-stopping bugs, in early releases that will only be fixed later on by downloadable “patches” and “fixes.” However, the development team responsible for Pool of Radiance II represents an all new low for proprietary development: The un-installation script can actually damage vital system files and has reportedly wiped some users’ hard drives completely.

Of course, the developers soon released a patch to replace the dangerous uninstall program, but is that enough to help us sleep better at night after installing a new proprietary program on our computer?

I started this article by describing why we, as a society, demand that food manufacturers tell us what they put in our food. What would be the equivalent practice we should demand of software developers? The answer is that they should release all of their source code so that we get a chance to see what their programs will do to our machines before we install and run them.

“Wait a minute,” you say. “I don’t know anything about software code. I’m totally code illiterate. How is that supposed to help me? I wouldn’t be able to tell what the software was doing to my computer even if I had the source code!”

Well, you could learn to code. It’s not impossible, and, in fact, not really more difficult than learning how to read or learning to speak another language. I’m of the opinion that everyone should learn at least the basics of programming. The rewards are immediate and immense.

But, let’s say that you don’t care and will never care about knowing how to program. Why would having access to the source code matter to you?

The answer is that while you may not understand the source code, there are plenty of other people who do. These people would be very likely to spot malevolent, dangerous, or just outright sloppy code coming from the developer and publish their discoveries on the internet for all to see. If you read that a new game contained code that could delete random files on your hard drive, you’d know better than to install it. There are plenty of people out there who would happily perform this public service, and they would get something out of it, too. By having access to the code, they’d be able to learn quicker and faster how other programmers are working their magic.

Don't miss out on the other pages!
12next ›last »

Write a full post in response to this!

0

Do you like this post?
Vote for it!

Copyright information

This article is made available under the "Attribution" Creative Commons License 3.0 available from http://creativecommons.org/licenses/by/3.0/.

Biography

Matt Barton: Matt Barton is an English professor at St. Cloud State University in Minnesota. He is an advocate of free software, wikis, and the Creative Commons. He also studies and writes about videogames and computing history. Matt also has blogs at Armchair Arcade, Gameology, and Kairosnews.

admin's picture

TurboTax 2002 installation rewrote boot sector

Submitted by admin on Wed, 2006-03-29 06:35.

Vote!
0

From: Mike O'Donnell
Url: http://people.cs.uchicago.edu/~odonnell/
Date: 2005-06-22
Subject: TurboTax 2002 installation rewrote boot sector

Intuit's TurboTax 2002 deserves a mention near the top of the list of badly behaved proprietary software. Its license control mechanism wrote to the boot sector. I discovered this because I ran Windows NT under VMWare, with the boot sector unwritable. My TurboTax installation failed, but registered itself across the network as a successful install. The implementors apparently neglected the possibility that the attempt to write the boot sector would fail.

Allowing unvetted software to write the boot sector constitutes almost the broadest security hole imaginable. Intuit was immensely presumptuous to expose customers to such risk with no warning.

To Intuit's credit (or at least to diminish the discredit), they provided a refund without challenging my claim that I had no installation, in spite of a registration asserting that I did. They also responded to public outcry against their attempt at copy control by releasing a revised version without the copy control, and presumably without compromise of the boot sector.



Other sites

Free Software Magazine uses Apollo project management and CRM for its everyday activities!