Gadgets are, in my opinion, completely intended as a means of distributing
adware/spyware. Remember WeatherBug? It was a cute little "gadget" that
sat in the notification are of the TaskBar? It is one of the worst spyware
programs ever. There are several other such TaskBar gadgets for XP. The
problem is, there just wasn't enough room for them all. That's why Apple
created it's own form of gadgets and why Microsoft thought Apple's idea was
a great one and created the SideBar to do the same thing.
A lot of people will create useful gadgets for fun and share them freely.
But beyond that, gadgets cost money to create. The cooler the gadget and
more sophisticated its user interface (such as circles and gauges and such,
compared to plain text) then the more money it costs to develop that gadget.
And that development cost has to be paid somewhere. And the way that cost
is going to be paid is by installing adware and spyware.
The installation mechanism for a gadget is a full MSI installer. With that,
the gadget installation can put anything it wants onto your PC. Just as
demonstrated a week or so ago on another site - since all installations
require administrative permission to run - installing any program on Vista
would, if the creator of the installer chose to include it, also install a
rootkit on your PC. And, oddly enough, Microsoft recently bought out Mark
Russinovich, heart, mouth, and soul. Mark Russinovich is the guy who
discovered the Sony rootkit using the rootkit detector that he had written.
Interesting timing. Mark has already begun to defend the DRM practices of
his new masters.
Now, once you have that malware installed on your PC, including rootkits,
the next security problem with gadgets is that gadgets, while advertised as
HTML-based, really have complete access to your file system. They can call
any dll, they can access any file. They can transmit the contents of any
file to any server they wish.
If you, even logged in as administrator, create a web page of your own and
store that page on your own desktop and try to call a dll in the
Windows\System32 folder with that web page, you will be blocked and it will
not work. Yet gadgets, created by people you don't know and certainly
shouldn't trust, have full and complete access to your PC and your personal
data stored there. They can access any program, any dll, and any file.
So, you're thinking a firewall will help? How? If you install a weather
gadget and it has to access the Internet to get the weather, the first thing
you're going to do is allow that gadget access to the Internet.
If you want gadgets, either create your own or get them open source, review
the code, and compile them yourself.
But even with all of this, most of you are going to install gadgets anyway.
So imagine what percentage of the less-informed public are going to install
gadgets without thinking? How many of even us here do you think are even
going to read the license agreement before installing? How many of us here
are going to install anyway when the license agreement clearly states that
the gadget will install updates or other programs?
Gadgets pretty much spell the end of you owning your own PC and your own
private information.
Avoid them.
Dale
