identification data integrity issue, possibly due to miscommunication

[Joe Walp]

I write to inform developers of an apparent data
integrity issue affecting the spyware identification
listings. Most likely, this issue is do to a forgiveable
lapse in communication between implementation teams.

I recently saw a message [1] that accused the GIANT team
of failing to propagate a listing change from the GIANT-
branded AntiSpyware product to the Microsoft-branded
product. The relevant listing, StumbleUpon Toolbar [2],
used to be identified by the GIANT-branded product as
spyware. After the vendor disputed that listing, GIANT
removed the listing from the GIANT-branded product (with
apologies for falsely identifying it as spyware in the
first place). But it's still identified as spyware by
the Microsoft-branded product.

As a satisfied user and beta tester of the StumbleUpon
Toolbar (for more than 18 months), I can attest to
exemplary privacy treatment and
installation/uninstallation behavior by the product. And
I can attest to zero privacy complaints by users in the
active community associated with the service. In short,
it appears to avoid every pitfall of the listing critera
[3].

=== aside ==
Being a software developer myself, I've perused the
source code for the Mozilla/Firefox version of the
StumbleUpon Toolbar and can attest to its submitting only
the information that the user explicitly directs it to
submit and that those submissions are always user-
initiated transactions.
=====

I'm disheartened to see its vendor (a small startup) hurt
by an apparent oversight by the AntiSpyware
implementation teams. Realize that this product relies
strongly on word-of-mouth to spread its adoption and that
a false listing poisons its reputation among early-
adopters. I hope that this issue affects few
organizations and that the issue can be resolved as soon
as possible.

(If developers aren't active in these forums, please
direct me to the appropriate venue. Note that I'm not an
employee of an affected vendor, so I cannot employ the
formal dispute mechanism [4].)


With thanks for your time,
Joe Walp
joewalp[at]yahoo.com


[1]
See posts 3 and 7 on the following page:
http://stumbleupon.group.stumbleupon.com/forum/7997/
[2]
http://www.stumbleupon.com/
http://www.stumbleupon.com/get_ie.html
[3]
http://www.spynet.com/info_spywarecriteria.aspx
[4]
http://www.spynet.com/vendors.aspx

 

[Steve Dodson [MSFT]]

Joe,

The vendor needs to follow the steps at the following web site:
http://www.spynet.com/vendors.aspx

-steve



Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
--------------------

Content-Class: urn:content-classes:message
From: "Joe Walp" <[email protected]>
Sender: "Joe Walp" <[email protected]>
Subject: identification data integrity issue, possibly due to miscommunication
Date: Thu, 20 Jan 2005 02:43:57 -0800
Lines: 64
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcT+3PGqQv4DeEnTQqS9bKbAnU1MSQ==
Newsgroups: microsoft.private.security.spyware.general
Path: cpmsftngxa10.phx.gbl
Xref: cpmsftngxa10.phx.gbl microsoft.private.security.spyware.general:3423
NNTP-Posting-Host: tk2msftngxa14.phx.gbl 10.40.1.166
X-Tomcat-NG: microsoft.private.security.spyware.general

I write to inform developers of an apparent data
integrity issue affecting the spyware identification
listings. Most likely, this issue is do to a forgiveable
lapse in communication between implementation teams.

I recently saw a message [1] that accused the GIANT team
of failing to propagate a listing change from the GIANT-
branded AntiSpyware product to the Microsoft-branded
product. The relevant listing, StumbleUpon Toolbar [2],
used to be identified by the GIANT-branded product as
spyware. After the vendor disputed that listing, GIANT
removed the listing from the GIANT-branded product (with
apologies for falsely identifying it as spyware in the
first place). But it's still identified as spyware by
the Microsoft-branded product.

As a satisfied user and beta tester of the StumbleUpon
Toolbar (for more than 18 months), I can attest to
exemplary privacy treatment and
installation/uninstallation behavior by the product. And
I can attest to zero privacy complaints by users in the
active community associated with the service. In short,
it appears to avoid every pitfall of the listing critera
[3].

=== aside ==
Being a software developer myself, I've perused the
source code for the Mozilla/Firefox version of the
StumbleUpon Toolbar and can attest to its submitting only
the information that the user explicitly directs it to
submit and that those submissions are always user-
initiated transactions.
=====

I'm disheartened to see its vendor (a small startup) hurt
by an apparent oversight by the AntiSpyware
implementation teams. Realize that this product relies
strongly on word-of-mouth to spread its adoption and that
a false listing poisons its reputation among early-
adopters. I hope that this issue affects few
organizations and that the issue can be resolved as soon
as possible.

(If developers aren't active in these forums, please
direct me to the appropriate venue. Note that I'm not an
employee of an affected vendor, so I cannot employ the
formal dispute mechanism [4].)


With thanks for your time,
Joe Walp
joewalp[at]yahoo.com


[1]
See posts 3 and 7 on the following page:
http://stumbleupon.group.stumbleupon.com/forum/7997/
[2]
http://www.stumbleupon.com/
http://www.stumbleupon.com/get_ie.html
[3]
http://www.spynet.com/info_spywarecriteria.aspx
[4]
http://www.spynet.com/vendors.aspx