August 25th, 2008
New StopBadware guidelines take aim at software update bundling
If the StopBadware coalition has its way, software updaters from Sun Microsystems (see screenshot above) and Apple will carry the embarrassing “badware” label.
According to a draft of revamped guidelines (.pdf) from the Google-backed computer security consortium, the badware label will expand to include products that:
- Install a new application through unattended automatic updates.
- Introduce new potentially unwanted behaviors to an application through unattended automatic updates.
Under these new guidelines, Apple’s WASU (Windows Automatic Sofware Update) utility will be considered badware because it bundles new products like Safari, iTunes and QuickTime alongside security patches without the end user’s explicit consent.
[ SEE: How does Apple get away with this badware behavior ]
The StopBadware alliance is currently seeking feedback on the new guidelines.
The non-profit group said it would not use the badware label for installation of new applications alongside updates if there is separate disclosure and consent.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
