spyware on Apolyton?

[Nubclear]

The Apolyton cookies also seem to keep track of the threads you view

[Colonâ„¢]

I was thinking spyware are pieces of software.

[CerberusIV]

If you don't like the tracking cookies that you pick up from Apolyton (I usually get 3) just run Ad-Aware after a Poly session and it will get rid of them whilst leaving the cookie that remembers your log in.

[Toby Rowe]

Hi all,

I came onto the site earlier and about an hour later my computer seemed to go into overdrive.

I visit virtually no sites bar this, yet the free Swedish 'Adware' programme always picks up on about 29-35 cookies if checked once a week, this figure cannot possibly match sites visited as at most it will be about 3 sites.

Perhaps I've finally discovered the source via you lots' comments!

The site is also very badly laid out- It reminds me of mid-90's sites when the internet first took off properly, oh! just like Apolyon was then!

Perhaps it has hidden or forgotten bits that now contain unwelcome guests the current administrators aren't aware of?

Apoylon is well overdue for a re-vamp anyway, finding your way around the site is a maze and could be so much better, and might unearth unwelcome residents in the process.

Toby

[DanQ]

Hi Toby.

We are affiliated with a number of advertising agencies who in turn have a number of advertising clients -- this is most certainly where a majority of those numbers of cookies are coming from. As has been said before, not all cookies are spyware. I doubt they contributed anything to a level of requiring your or any computer to go into "overdrive", but certainly we must remain vigilant. If you have any specific concerns, please contact us by email with supporting documentation.

As for the layout issue, it is one we are well aware of; as a site run by volunteers now as throughout its existence, staffing numbers and hours are limited all around and as such "baby steps" are the most that can be accomplished on this front. Interested, knowledgeable, willing and able to assist in the effort perhaps?

--------
Dan; Apolyton CS

[Locutus]

I think a big problem here is Firefox 2. Usually FF is lauded for it's fantastic security but in FF2 a huge problem was introduced: you can no longer set in the UI settings whether or not you want to receive third-party cookies (e.g. cookies from Casalemedia while visiting Apolyton). By default FF2 is set to accept *all* cookies, whereas previous versions of FF only accepted first-party cookies (i.e. Apolyton cookies when visiting this site) by default. This is IMO a huge mistake by the Firefox developers and everyone I've spoken so far is absolutely baffled as to why this change was made, this makes FF users a lot more susceptible to being spied on. The good news is, you *can* still manually disable third-party cookies.

To do this, do the following:

1) Enter "about:config" as URL in the address bar (without the quotes)
2) You will get a very long list of options with a filter on top. Enter in the filter the text "network.cookie" (without quotes)
3) Most options will disappear as you type, when you're done the second option will say "network.cookie.cookieBehavior", which probably has the value 0. This means third-party cookies are enabled.
4) Right-click the text network.cookie.cookieBehavior and select Modify. Change the value to 1 and press OK. Now third-party cookies are disabled and you're back to the FF1 situation. Hopefully that will remove any warnings you may get from anti-spyware applications...

I hope the Mozilla guys will fix this in a future version of Firefox because this is not exactly an obvious thing to do and will cause trouble for a lot of FF users...

[DanQ]

Of this change I wasn't aware -- certainly not something Firefox's developers would want to... advertise.

Thanks for the info and work-around, Locutus. Not only is the revelation disturbing, but also what needs to be done now in order to work-around it.

--------
Dan; Apolyton CS

[Locutus]

It's not so much a 'work-around' as it is an 'advanced option'. There are loads and loads of useful settings in about:config but adding them all to the regular user settings in the UI (under Tools > Options) would overwhelm even the most experienced users. 99% of these advanced settings 99% of users wouldn't really want to change anyway, so they are rightfully kept a little out of the way. Power users know where to find them and how to change them, but they can't confuse less experienced users or overwhelm anyone.

But of course this particular setting is very important to any FF user so it really ought to be under Tools > Options as it was in previous versions, and have a more descriptive name as config setting as well. There's plenty of other stuff about which you could argue whether it belongs in the UI or not, but this one in my mind clearly stands out as very, very obvious one (and I've yet to find anyone to disagree on this -- other than the Mozilla team obviously).

Either way it's a very easy thing to remedy, but you do have to be aware of it.

[DanQ]

Originally posted by Locutus
It's not so much a 'work-around' as it is an 'advanced option'.

It's a 'work-around' in so much as it works around the fact that you cannot make the change needed through the "standard" FF (version 2.0) UI.

--------
Dan; Apolyton CS

[N35t0r]

I've both got a huge list of spyware sites redirected to localhost on my computer's hosts file (Spybot can do this for you) and personally manage my cookies with FF, so as to avoid this kind of problem.

[Gibsie]

One of the ads generated by this site just tried to install some crap on this computer; it was blocked fortunately.

One link to it from my history was http://www.amaena.com/securityworm81...=obrst&link=os
But I do not recommend clicking!!

[Caligastia]

Gibsie posts links to spyware! Ban him!

[DanQ]

Originally posted by Gibsie
One of the ads generated by this site just tried to install some crap on this computer; it was blocked fortunately.

What evidence do you have that this was delivered in an ad here from one of the advertising agencies we have contracted with?

---------
Dan; Apolyton CS

[Gibsie]

This was the only site I was browsing at the time. That doesn't cast-iron 100% definitely make it this site's fault, of course, but I thought you guys appreciated being told when your sponsors are slipping through some of the dodgier ones onto the site. If the ad didn't come from Apolyton, then great.

[DanQ]

Originally posted by Gibsie
but I thought you guys appreciated being told when your sponsors are slipping through some of the dodgier ones onto the site. If the ad didn't come from Apolyton, then great.

We do, but unfortunately the data you have provided does not give us enough information to investigate whether or not it came from one of our ad providers. My inclination is that it is not based on a) the content of the ad and b) its address does not reference any of our internal ads or contracted agencies.

Additionally items that could help us identify the source: a screenshot and the address of the image (e.g. domain.ext/image.ext).

--------
Dan; Apolyton CS