The voice of a user – why PUA is a misleading term

In quite severe cases, not only are additional programs installed but several settings on the computer are changed too, making it behave completely differently. In the worst case, this then means that the computer can no longer be used correctly and must be reconfigured.

The topic of PUA makes the issues with free software particularly clear. If, as a user, I purchase a piece of software, then I expect to get that exact software. No more. No less. Ultimately, I am paying for the effort put into developing the software.

If I download a free piece of software from the Internet, that’s where it gets complicated – because a lot of effort has also been put into developing this software and if the software is good and up-to-date, it is being maintained by someone and is constantly being optimized and improved. This “someone” may want to or only be able to afford to do this occasionally, and if the software is distributed for free, this “someone” needs to earn money in some other way. It doesn’t matter if the developer is an individual or a company. One possible way to pay for the effort put into development is as follows: Additional applications are installed alongside the actual application, and the manufacturers of these additional applications then pay for their software to also end up on the users’ PCs.

The topic of PUA makes the issues with free software particularly clear.

Who, then, is still interested in bundled software being installed along with other software? Download portals, i.e., the areas of the Internet where users download software, are opportune places for this. Although these portals offer a “free” service (presenting and providing software) for users, they still need to be financed somehow. It is also here where some software manufacturers are willing to pay for the distribution of their software, a possible source of revenue for the operators of the download portals. The user downloads program A from the Internet and installs it. At the same time, programs B and C are automatically installed alongside it. The manufacturers of programs B and C pay for this, meaning that their software is distributed further, whether the user had wanted it or not. From a financial perspective, this may be a good reason for software manufacturers and download portals to combine further applications with the application that was actually wanted, and install them at the same time. But what’s the picture like for those on the other side – the users?

Bernard has bought a new PC. He is quite familiar with computers, but he is by no means an expert. After a short amount of time, he has got his computer set up in the same way as his old one. Bernard loves filming and wants software he can use to edit small films. After a few searches he finds exactly what he is looking for in a download portal and it’s free! Bernard installs the software. He doesn’t understand why he has to click through lots of different windows once the software has been downloaded. Actually, he was expecting the software to install quickly and easily. But the manufacturer must think that this is the easiest way of installing the software, so Bernard clicks on “Next” several times so that he can test the software as quickly as possible. While the installation is still running, it slowly but surely fills the desktop with more and more icons. “Why does an application need so many icons?”, Bernard asks himself. Again and again, he is presented with further windows which require him to confirm something. It seems strange to him, but the supplier of the software must know why this needs to be done. After 20 minutes, the installation is finally completed. On the desktop, next to the icon for the film editing software, are seven other icons which must come from software that Bernard did not want. As Bernard opens his Internet browser, he hardly recognizes it. The usual search has disappeared, new toolbars are displayed, and everything looks different somehow. His Windows installation, which was still almost brand new just an hour ago, is no longer useable. He only has one solution: to call his son and ask for his help.
“You’ve really got yourself in a mess here”, he says dryly after a quick inspection of the computer. “All PUA”.
“PUA?”, asks Bernard. “What’s that then?”
“Potentially unwanted applications”, says his son. “Programs you don’t actually want”.
“What does it mean by ‘potentially’ unwanted applications?”, replies Bernard. “They are unwanted applications!”

As a user I would like to know what I am getting without having these things imposed on me using various tricks and ruses.

Many years ago, the principal of WYSIWYG (what you see is what you get) was “devised”. This implies that what I see as a user is what I get. Sure, the term was introduced in a different context, but it actually suits the current discussion on PUA quite well. As a user I would like to know what I am getting without having these things imposed on me using various tricks and ruses, things which I do not want at all and need even less so. The additional software is not potentially unwanted, it IS unwanted, as long as I as the user have not explicitly agreed that I want it.

The post The voice of a user – why PUA is a misleading term appeared first on Avira Blog.

CVE-2013-6501 (php)

The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.

CVE-2014-9652 (file, php)

The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.

CVE-2014-9653 (file, php)

readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.

CVE-2014-9705 (php)

Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709 (libgd, php)

The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

CVE-2015-0273 (php)

Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.

CVE-2015-1351 (php)

Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVE-2015-1352 (php)

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.

CVE-2015-1353 (php)

Multiple integer overflows in the calendar extension in PHP through 5.6.7 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted year value to (1) the GregorianToSdn function in gregor.c or (2) the JulianToSdn function in julian.c, as demonstrated by a crafted third argument to the gregoriantojd or juliantojd function.