1  |   Order by index

Jan 10, 2003, 10:14pm

I'm privileged to announce the final release of Demeter 1.18. This version
builds upon Demeter's first release a month ago by adding key features such
as:

-The ability to log in automatically
-A command to delete terrain within a certain area
-Improved eminent domain features for vandalism control
-Logging of all terrain-related activities within your world, including
privilege password and action for all events, to crack down on vandalism and
theft
-Updated statistics tracking
-Several features to optimize Demeter based on your available bandwidth
-Windows localization settings compliance
-Commands that send help to the user

A full list of what's new along with updated documentation is available at
http://www.shoemakervillage.org/help/dwhatsnew118.html, while detailed
technical information is available at
http://www.shoemakervillage.org/release.html.

Go check out and download Demeter today, and join worlds like AWTeen, A!!CT,
pata, Gulakon, Lugia, and others that allow builders to take their creations
to the next level!

Jan 11, 2003, 7:34am

[View Quote] <snip>

>
> A full list of what's new along with updated documentation is available at
> http://www.shoemakervillage.org/help/dwhatsnew118.html, while detailed
> technical information is available at
> http://www.shoemakervillage.org/release.html.
<snip>

After a long and heated debate with Brant, I have no other choice but warn the community about the behavior of Brant's programs.
His programs which are sharing the same splash screen "calls home" without the user's approval. Brant has a "Privacy policy" posted on his "General Info" page wich is not linked directly from the pages he mentioned above ( http://www.shoemakervillage.org/programs.html ). Read it and decide yourself if it makes you comfortable.

Here is my last post regarding to this issue. More can be read at news://news.andras.net/AW.VillageBeta newsgroup under the thread: [demeter] Security problem .

-------- Original Message --------
Subject: Re: [demeter] Security problem
Date: Tue, 07 Jan 2003 17:25:20 +0100
From: Andras Sarkozy <andras at andras.net>
Newsgroups: AW.VillageBeta
References: <3e15cef8$1 at ns.storage.co.hu>


Hey folks - maybe this issue requires a clarification:

Imagine what Brant can do with your priv password! That is a caretaker account, so it puts your world into his merci!
He is clearly doesn't want to cut this option from himself (claiming it would take forever to change the code and oh yes - posting some lame privacy statement on his website!) - maybe that is the real reason he is so eager NOT to remove the call home feature?
It is true - there are spywares and all of us aware of it (and the clever ones never let them run on their machine) but I don't see ANY reason a silly bot calling home!!!
Disagree? Read again the first paragraph! Are you willing to lose everything in your world? Are you prepared to some vandalism? What if you can't access your world any longer? Who can make you sure he won't do that? His words? Well,,,,, just think about it!
I'm not accusing Brant any of that but the opportunity is there and we saw black sheeps in the past, didn't we?
If I want to update my program, I either check manually the site it supports it or I give temporary access the program explicitly (this is the so called "Opt-In" feature), so it can check itself.
I'm very disappointed that a really talented programmer (Brant) can't see the difference.

On my side - I finished with my arguments. If the program is released as it is - I'll warn the community about that and I'm standing firm behind my policy. I'm sorry to blackmail Brant, but if the security issue is not solved I have no other choice.


--
Andras
"It's MY computer" (tm Steve Gibson)

Jan 11, 2003, 11:51am

Thanks Andras for this info, I noticed myself this even happening on each
boot up and was wondering why it was trying to contact a remote site. I
dislike any program that transmits any data or contacts any server or system
that I have not been prewarned about. I am deleting it as my right from my
machine till this is removed.

Cheers Anfras
[View Quote]

Jan 11, 2003, 11:58am

Ok Wizard delete your entire computer. That sends info to the net without
your info.

[View Quote]

Jan 11, 2003, 12:12pm

lol, only if I let it through the firewall, unless you know different?


[View Quote]

Jan 11, 2003, 12:13pm

All Microsoft products contact the internet

[View Quote]

Jan 11, 2003, 12:16pm

Unless Microsoft uses its super spyware WinSox control :P

- Mark
[View Quote]

Jan 11, 2003, 1:02pm

All I can say to that ridiculous statement is: prove it. In any case, just because it is a Microsoft product doesn't mean it is immune to firewalls. Its communications must pass through the same place as every other application.

-Agent1

[View Quote]

Jan 11, 2003, 3:42pm

This post is one of the most ridiculous things I've read in a while, and
these newsgroups do have a lot of ridiculous posts. All of the programs
featured on that site have used the auto-update feature for over three
years, since Ultimate Paintball was first released in 2000. In all that
time, there have been no hackings, privilege password thefts, citizenship
disappearances, or any other illegal activity of ANY sort. I told Andras
that I would be looking into what can be done about this after this release,
and I'm sticking to my word. The simple reason for that is that I wanted to
get this release out before I go back to school and work on Monday, when I'm
worried about the kind of time I'll have.

There are a variety of factors that don't make this a quick fix. First, the
splash screen is used across many programs, so whatever changes were made
would need to be spread across four different applications as well as others
still in development. It would also take time to change the synchronous
behavior of the screen to asynchronous mode, so that the application
wouldn't freeze while "skipping" the update. Finally, I would have to talk
to Poseidon and Chanty to work out an amendment to the deal I made with them
to release Demeter to the public in exchange for it displaying a
200-character message for a few seconds at startup when AWTeen is organizing
a huge event. Had Andras bothered to wait until I explained all of these
factors more fully, then maybe this post wouldn't be necessary.

My policy states that no information is sent to the server, and that's what
happens. I would be much more worried about the programs that DON'T admit
to what's going on. Suppose someone wrote a ChatRelayBot like Tony M's that
console messaged people the Caretaker privilege password when they entered
the world? Suppose that phone bot written by that new programmer sends an
E-Mail with your social security number in it? There are NO programs you
can be absolutely sure about, no matter what they do, period.

Demeter is not spyware. It might be classified as adware, but I think
anyone would feel that using a program like Demeter or Ultimate Paintball or
the Activeworlds Utility in exchange for a five-second message advertising
AWTeen for Chanty once a month or so is a fair exchange. I might even
remove that requirement in the next release, as I promised Andras I would
investigate. People are going to post flames that it's not explicitly
stated that such messages are possible, and I apologize for that - anyone
who's used the Activeworlds Utility knew that it was possible, but in this
turmoil it slipped my mind.

Had I wanted to cause damage to Activeworlds, I could have written a bot at
any time to send an aw_delete_all_objects() call to AWTeen. Or maybe to
Gulakon, Antares, Georgia, WAR, NewYork... how many more worlds do I have to
list? Should I have deleted the terrain and world attributes in those
worlds too? Maybe I should have deleted AWTeen's object path and website
again, or kept the world password for the all the worlds we gave as prizes.
Who are you to question my integrity, Andras, after spending much of two
years of my life trying to recover from disaster after disaster from idiots
who are bent on nothing but destruction? After all the help you've given me
in testing and even before that with AWTeen, you turn around and make a post
like this.

If, after hearing all of this, you feel that Demeter is still spyware, then
it's your choice not to download the program - I can accept that. But I'm
NOT going to stand by while Andras makes posts like these that hint I would
think of destroying others' hard work, after all I've done to the contrary.

-Brant

[View Quote]

Jan 11, 2003, 4:27pm

I think the auto-update feature is useful in a variety of programs, but then
couldn't it be toggled on or off?

Ryan Jacob

[View Quote]

Jan 11, 2003, 4:38pm

Read the thread Andras mentions ... Brant states that the non-inclusion of
such an option was down purely to a desire to release the bot without any
further scope creep ... and is to be included in an impending version.

The words "teacup" and "tempest" spring to mind. I don't know why Andras saw
fit to brand the s/w "spyware" where as a simple "btw, please note this
application will 'call home' as part of the auto-upgrade facility ... view
any perceived security risks as you see fit" would surely have sufficed
inplace of the rant he did post.

Perhaps a new piece of text on your download page would be appropriate
Brant? .... something like "if you're prohibitively paranoid, don't download
this!!"

Grims

[View Quote]

Jan 11, 2003, 5:05pm

How about you release the source. Let people compile it on their own and make
modifications to it.

--Bowen--

Jan 11, 2003, 5:23pm

I agree that labelling the Demeter bot as SpyWare was a bit overboard.

Ryan Jacob

[View Quote]

Jan 11, 2003, 5:38pm

"andras" <andras at andras.net> wrote in
news:3e1fe536$1 at server1.Activeworlds.com:

> After a long and heated debate with Brant, I have no other choice but
> warn the community about the behavior of Brant's programs. His
> programs which are sharing the same splash screen "calls home" without
> the user's approval. Brant has a "Privacy policy" posted on his
> "General Info" page wich is not linked directly from the pages he
> mentioned above ( http://www.shoemakervillage.org/programs.html ).
> Read it and decide yourself if it makes you comfortable.
>
> Here is my last post regarding to this issue. More can be read at
> news://news.andras.net/AW.VillageBeta newsgroup under the thread:
> [demeter] Security problem .

I can confirm that this warning is nothing but a HOAX. I had my packet
sniffer check what it did, and it only sends a HTTP/1.0 GET request for
/current.txt to www.shoemakervillage.org.

This is the exact query:
GET /current.txt HTTP/1.0
User-Agent: tlsNet.HTTP
Accept: */*

this means that it sends a GET request to see the current.txt file in the
document root of the server. It sends two headers, one specifying what
client sent it (in this case I believe it's an ActiveX control from
Microsoft), and what kind of documents it accepts (in this case, any).

There is absolutely no information about you or your system in this
request (off course, the server will get your IP address, but so does any
other server or peer you connect to), except that one can deduce that
you've (probably) used one of Brant's bots (the current.txt file is an
INI-formatted file containing file locations for Brant's various bots).

Please do not take this HOAX seriously, and do not let it ruin a serious
programmer's reputation.

Andras, with respect, this is total bullshit. A documented update-finding
feature that doesn't transmit any information about the end-user or it's
system does not qualify as spyware. I would be carefull about making such
false accusations in the future, you never know when you might encounter
someone keen on sueing you...

KAH

Jan 11, 2003, 5:43pm

Forgot to include this in my post.
You can see the entire session with www.shoemakervillage.org I sniffed at:
http://home.no.net/awphp/demeter.sniff.txt

If you think I made that up, have a go with a packet sniffer yourself.

KAH

Jan 11, 2003, 6:32pm

I totaly Agree with you KAH, and to say this is Spyware is Bullshit as you
said.
I run it in pata with no problem, and will contune with that.

[View Quote]

Jan 11, 2003, 7:23pm

I wouldnt know what to do with Demeter because i cant build my way out of a
paperbag, but i agree in principle: autoupdating properly setup is 1 way
traffic, and can only be viewed as a feature not as spyware. The name it as
such is grossly overstated, only thing Brant should add is a simple switch
to autoupdate or not..

And anyway: anyone running MSomeones OS can be sure to be spied upon, even
if it's 'anonymous', we all remember fondly the good old time MSomeone
build in hidden code so SomeWindows would not run properly if not run from
MSomeones Dos, but from Dr Dos. I hope nobody is that naive as to think
MSomeone has seen the light since then.....


"tengel" <glenn at tipssenteret.no> wrote in
news:3e207f5e$1 at server1.Activeworlds.com:

> I totaly Agree with you KAH, and to say this is Spyware is Bullshit as
> you said.
> I run it in pata with no problem, and will contune with that.

Jan 11, 2003, 9:01pm

AW itself has an auto-update feature as well, that's why you get the 'A new
version has been released' message.
No one complains about it, so why complaining about Demeter which is doing
exactly the same and nothing more? What's the matter, andras?

[View Quote]

Jan 12, 2003, 12:40pm

PS: So does Preston but I dont see a riot. :o

- Mark

[View Quote]

Jan 14, 2003, 10:37am

This was all a total distraction and a waste of time because of one little
thing that brought up so much defense for Brant. Brant himself, is a great
guy, ya know? but seeing spyware in his bot isn't what you see threw him
doing to us. He's making bots to make our AW experience a little easyer, and
a bit fun. I mean, the spyware hoax thing, theres no evidence behind it,
geez.

-TheMask

Jan 14, 2003, 4:54pm

Why are you replying to me? Im in total agreement with Kah.

- Mark
[View Quote]

1  |   Order by index