Slashdot Banner
Stories
Slash Boxes
Comments
typodupeerror delete not in

Comments: 267 +-   Apple Pushes Unwanted Software To PCs, Again on Monday September 28, @07:10PM

Posted by kdawson on Monday September 28, @07:10PM
from the just-updates-please dept.
security
upgrades
apple
itwbennett writes "Blogger Steven J. Vaughan-Nichols wags his finger at Apple for indiscriminately pushing the iPhone Configuration Utility 2.1 update out to Windows users, since it is a tool for business system administrators to set up and administer corporate iPhones — the blogger himself (and practically every other iPhone user) not being of the corporate iPhone user persuasion. But more than just unnecessary, the update actually puts him and millions of other iPhone owners/Windows PC users at increased risk by installing 'not just a configuration program, but the Apache Web server as well,' says Vaughan-Nichols. 'A Web server like the one Apple [is] adding to your PC... [is] a gateway just asking to be hammered on by an attacker. Managed properly Apache is as safe a Web server as you'll ever find, but ordinary PC users shouldn't try to manage it, and even an expert can't do anything with it if they don't know it's there.'" Reader CWMike notes that Apple pulled the iPhone Configuration Utility from the update list after a few hours.
story

Related Stories

: by
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Not really... (Score:3, Informative)

    by Darkness404 (1287218) on Monday September 28, @07:18PM (#29574429)

    the update actually puts him and millions of other iPhone owners/Windows PC users at increased risk by installing

    Millions? Lets see here, the update was only recommended for a few hours and was quickly pulled. How many people do you think update constantly? If Windows updates are any indication (and most just install in the background with almost no user interaction) chances are very few. We aren't talking about "millions" but a few thousand in the worst case.

    • Re:Not really... (Score:5, Informative)

      by Anonymous Coward on Monday September 28, @07:24PM (#29574497)
      I'm sorry, but this is NOT even close to true. It has been offered for at least a week, and came up again on my machine last night. I've had it "offered" several times now on both machines. I don't know who first said it was only a few hours but that is just dead wrong.
      • Re: (Score:3, Informative)

        Thank you. And in addition, it was listed in a check-box list of items. True, it was enabled by default, but the user still had to hit the button to install it.

        • Re:Not really... (Score:5, Insightful)

          by shutdown -p now (807394) <int19h@@@gmail...com> on Monday September 28, @09:08PM (#29575481)

          Thank you. And in addition, it was listed in a check-box list of items. True, it was enabled by default, but the user still had to hit the button to install it.

          About 95% of all adware/malware crap, like those browser toolbars, uses precisely this technique to get installed. It has long stopped being considered adequate. The default for any "extra software" should always be off (Google, I'm looking at you, too).

      • Re: (Score:3, Interesting)

        I have also seen this offered multiple times on more than one windows box at work. We use Filemaker which installs Bonjour as a component. I enabled the Apple software update to keep Bonjour updated not to install Safari, Quicktime, iTunes or the iPhone Configuration BS.

        I declined the install on the PCs I noticed them on, but I'm not sure about how many other users at work just clicked update without knowing any better. The Apple update should only offer updates relevant to the programs already installed
      • Re:Not really... (Score:4, Insightful)

        by religious freak (1005821) on Monday September 28, @11:32PM (#29576443)
        Same here. I know enough not to select it (I don't even have an iPhone), but the average user doesn't. This is par for the course for Apple.

        And NO I don't want Safari for the 10 Billionth time, Apple. Dunno why people prefer them over MS so much - on the scale of evil, I'd rate them roughly equal and on the scale of software features and implementation, I think MS is much better, hands down. IMHO, it's all marketing, which is supposedly something we geeks can't stand.
    • Re:Not really... (Score:5, Informative)

      by Colonel Korn (1258968) on Monday September 28, @07:25PM (#29574509)

      the update actually puts him and millions of other iPhone owners/Windows PC users at increased risk by installing

      Millions? Lets see here, the update was only recommended for a few hours and was quickly pulled. How many people do you think update constantly? If Windows updates are any indication (and most just install in the background with almost no user interaction) chances are very few. We aren't talking about "millions" but a few thousand in the worst case.

      Well iTunes has been installing the Apple Updater Thingy by default for a long time, so the question is how often that checks for updates. And according to Ars Technica (http://arstechnica.com/apple/news/2009/09/apple-pushes-unwanted-enterprise-tool-to-windows-users.ars) the update was actually pushed "earlier this month" and only came to the attention of the online media today. It sounds like it was pulled a few hours after it hit half the computer-related news sites, not a few hours after it was pushed out to users.

        • Re:Not really... (Score:5, Informative)

          by MichaelSmith (789609) on Monday September 28, @07:36PM (#29574603) Homepage Journal

          My sister in law runs itunes on her windows laptop. When she bought it I installed firefox for her to use then she called me to report some strange behavior. She had somehow started running Safari. Firefox had disappeared. So either it happened automatically or she was tricked into installing it.

          • Re:Not really... (Score:5, Insightful)

            by Techman83 (949264) on Monday September 28, @08:39PM (#29575219)
            It would have been an "Opt-Out" option, which is nearly as bad as the common theme for windows apps and damn toolbars or other "partner" software. If a friend desperately needs/wants iTunes and I know for a fact they will install it against my advice anyway, I use this [msfn.org] method. iTunes, without full quicktime, no updater, no bonjour, updater etc. I stipulate that I won't fix their machine if they choose to update it themselves. It works, keeps them happy and saves me the effort of diagnosing a slow computer.

            Why an F'ing music syncing application needs something like 8 persistently running services is absolutely beyond me.
            • Re:Not really... (Score:5, Insightful)

              by MichaelSmith (789609) on Monday September 28, @08:17PM (#29575007) Homepage Journal

              My sister in law runs itunes on her windows laptop. When she bought it I installed firefox for her to use then she called me to report some strange behavior. She had somehow started running Safari. Firefox had disappeared. So either it happened automatically or she was tricked into installing it.

              Or she just went ahead and clicked OK. It's OK to admit that your sister in law might have done that.

              She is not sophisticated enough to understand the implications. iTunes should manage music. Not the operating system.

                • Re: (Score:3, Insightful)

                  by Anonymous Coward

                  I had that happen too

                  I was at my sister's house this weekend and Saturday at around 11 am CST I saw it pop up on her old Dell machine.

                  The big problem I had with it was what it was called which was "iPhone Configuration Utility" and the kicker is she owns an iPhone. Which confused me because she had nothing installed on there for her iPhone, only her iPod. So there I was debating on whether or not to install this for her because it sounded applicable and useful to her. I didn't install it but if I did, I wou

                • Re:Not really... (Score:5, Insightful)

                  by Brian Gordon (987471) on Monday September 28, @08:57PM (#29575391)

                  Yes, operating systems should periodically pop up cryptic dialogues asking you to solve an obscure computer science problem, and if you get it wrong then it changes your wallpaper and your file type associations.

                  There's no reason to make it harder than it has to be, which is what Apple's doing by presenting users with an option they didn't ask for and don't know how to answer.

                  • Re:Not really... (Score:5, Insightful)

                    by Culture20 (968837) on Monday September 28, @09:30PM (#29575669)

                    There's no reason to make it harder than it has to be, which is what Apple's doing by presenting users with an option they didn't ask for and don't know how to answer.

                    It's almost as if Apple is trying to make Windows look hard to use...

                • Like it or not, most people have to use computers now. Apple have a reputation as being good UI designers. It is a shame they have this abusive approach to users of a different vendors OS. My wifes sister previously used Ubuntu. I will try to steer her in that direction on her old windows laptop, now that she has bought an apple laptop. I am sure that the niggling updates from Apple contributed to that.

            • by Hognoxious (631665) on Monday September 28, @08:20PM (#29575025) Homepage Journal

              It just works!

              Even when you don't want it to, apparently.

        • Re:Not really... (Score:5, Insightful)

          by Plasmic (26063) on Monday September 28, @08:09PM (#29574937)

          Do you seriously not understand the difference between having something show up on a list of updates that are available and actually having it download and install behind your back?

          How much research do you think people do before checking a box in an iTunes dialog? The onus is on Apple to not offer stupid things that would coincidentally inflate the installed base of an enterprise utility.

          Do you seriously not understand the use case of a typical end-user, e.g. teenager, that thinks they want the 'iPhone Configuration Utility' since it's offered by Apple iTunes and they ... have an iPhone? "Hey, I might want to configure my iPhone. And I've always downloaded every other iTunes update with iPhone in the title." (Anyone that can read the description and decipher that it's for enterprise device management doesn't fit the definition of "typical end-user".)

          The results speak for themselves: millions of users installed this software because it looked like a standard iPhone update.

          • Indeed.. I installed it on my Win partition because I thought it was something that OSX had built in.

            If it installed apache behind my back I'm somewhat pissed.

        • Re:Not really... (Score:5, Insightful)

          by timothyf (615594) on Monday September 28, @08:22PM (#29575047) Homepage

          Users don't read dialog boxes. It could've had red flashing lights around it, and it wouldn't have mattered. It would still have remained checked by default and users would click the "OK" button to make the thing go away.

          Also, think about the actual action they'd need to perform to not install the software. Sure, it's easy to say "just uncheck it," but think about what that means. Unchecking the dialog box means that you have to know what the iPhone Configuration Utility is and why you absolutely don't need it. Unchecking it means risking that something will go wrong, because you didn't install something that your computer told you you needed.

          *That* is why it's a problem.

    • Re:Not really... (Score:5, Insightful)

      by eldavojohn (898314) * <my/.username@@@gmail.com> on Monday September 28, @07:51PM (#29574771) Homepage Journal
      I was at my sister's house this weekend and Saturday at around 11 am CST I saw it pop up on her old Dell machine.

      The big problem I had with it was what it was called which was "iPhone Configuration Utility" and the kicker is she owns an iPhone. Which confused me because she had nothing installed on there for her iPhone, only her iPod. So there I was debating on whether or not to install this for her because it sounded applicable and useful to her. I didn't install it but if I did, I would pissed to know that her five year old piece of crap Windows machine is now running an Apache server. Additionally, I had to uncheck Safari. Then I have to go into msconfig and uncheck the damned Quicktime (try installing iTunes without that!) run on startup shit that is always reset when you install iTunes. Because everyone wants that running non stop in the background especially when you have only 512 MB of SDRAM. So I did the little dance and I've bitched about it before but no one seems to care. It's bloatware and it sucks. Her computer can't even run iTunes videos, she just uses it for music but no one seems to care about that. Apple's the king of usability, design and interface chic!

      Now we get this story where someone points it out. Do we see people roll in and viciously attack Apple like we all would attack Microsoft if IE8 had Bing's Javascript Attackable Toolbar checked by default on installation? Or Microsoft's indexing service that eats up all your cycles whenever it feels like it? No, no, what we get is "there were maybe a thousand people, relax" or "it's not pushing, you could have unchecked it" or "the Windows people don't know how to update anyway."

      Unbelievable. How many free passes does Apple get before you start to question their infallibility? Hey, everyone makes mistakes but you guys are dreaming up probables and likely scenarios that somehow excuse Apple. Why?
      • How many free passes does Apple get before you start to question their infallibility?

        Probably about as many as there are strawman constructions of people's conceptions of Apple as a company.

        • Re:Not really... (Score:4, Interesting)

          by Kalriath (849904) * on Monday September 28, @08:25PM (#29575061)

          I love how it changes the registry to force the browser to load QuickTime for every PNG file on a page. Fuck does that take forever to fix! (Or load a page, for that matter).

        • Re:Not really... (Score:4, Informative)

          by Achromatic1978 (916097) <robertNO@SPAMpennyonthesidewalk.com> on Tuesday September 29, @01:44AM (#29577155)

          And you want to compare this to Microsoft? The company that hands you Windows Media Player like it was a security patch, and hogties your system with so much DRM that you need a cabal of starving Russian crackers just to restore your fair use rights?

          Yes, I do. Because Apple installs Quicktime when you install iTunes. iTunes when you install Quicktime. Safari when it thought it could get away with it when you installed iTunes.

          And when you tell Quicktime to not be the default audio / video player, good luck. It'll still be there. As will iPodService.exe as a kernel-level service, even when you've never used an iPod.

        • Re:Not really... (Score:5, Informative)

          by Brian Gordon (987471) on Monday September 28, @08:53PM (#29575351)

          Defending Apple? In my slashdot?

          This was a stupid move and Apple's not as innocent as you claim. Defaulting the box to checked is almost equivalent to installing it without consent and Apple knows it. In both cases you end up with users loaded down with crap they don't need and distrusting updates, which has real dollar costs. The only difference is that in the former case the tech crowd squeals a little less, so that's the route they choose.

          Honestly, even if they were really stupid enough to not see any problem when they did it the first time, they have no excuse for doing it a second time. Why would they put it out and then withdraw it a few hours later? Did they forget the user backlash from the first time?

        • Re: (Score:3, Informative)

          I don't have an iPhone either, I do have a iPod Touch, but both the iPhone Config are checked when iTunes has an update. Safari is ALWAYS checked, even though I have never installed it.
          • Re: (Score:3, Informative)

            Hahaha. Patently false.

            "Patently false" and "here's a minor detail you left out" are *not* synonymous.

            What's more, your "minor detail" is, itself (ironically) patently false. It wasn't in the "update" section, because there wasn't an update section at that time. The "Updates" and "New Software" sections were put in in response to people complaining (rightly so, but a bit hyperbolically in tone) about it.

            • Re:Not really... (Score:4, Insightful)

              by Achromatic1978 (916097) <robertNO@SPAMpennyonthesidewalk.com> on Tuesday September 29, @01:31AM (#29577079)

              Ignorance of what these services represent is easily remedied by disabling them via Services.

              I'll wager you that roughly the same percentage of Windows users have ever gone into Services with the intention of disabling unneeded services as OS X users do the same via /etc/rc.d. i.e. NOT F*CKING MANY.

              Only a few percent at top would probably be aware of the existence thereof.

              Security by obscurity doesn't work, and neither does, nor should "functionality by obscurity". "Oh, that's easily remedied, all you needed to do was disable it in Control Panel & Administrative Tools & Services, didn't you know?" is not what anyone would call acceptable.

              • This makes owning and supporting a computer more difficult for users. I don't have time to answer questions from my friends every time a software publisher pushes out a new update. I've taken to telling them, "If it's a Microsoft auto update, install it. If it's an Apple auto update, install it. If it's an Adobe auto update, install it." When Apple starts pushing out software that is not necessary as part of their update process, it adds unnecessary confusion and software bloat. Like another poster above said, he only has Quicktime installed but the Apple updater is pushing iPhone utilities and Safari onto his desktop. Doing that is just bad form, no matter how descriptive the accompanying text is.

                  • by bloodhawk (813939) on Monday September 28, @09:59PM (#29575889)
                    For the average user it has been just "snuck" onto their PC. The average user knows very little about there machine or the updates, my sister would not have the faintest idea what safari or boujour are or whether she needed to update them, they have learnt over time that the right thing to do is keep your machine UPDATED and the result is that a heap of garbage gets installed as users stick with the default selected options. apple is abusing the trust people play in updates.
                    • Additionally, in my experience, these Apple updates happen mostly when launching iTunes.

                      Picture it, if you will: A user wants to play some music, download a sitcom, or just sync their iPhone. So they launch iTunes, just like they have before. And instead of getting to do those things, they get an annoying thing that won't fucking ever go away until they press OK. Sure, they can cancel it (but then it just comes back), or they can read it and deselect things, but why should they be forced to do these things?

                      They just want to instruct the computer to provide some manner of entertainment. Instead, the computer ends up instructing them.

                      This, I think, the paradigm which bothers me most: That the computer switches from being told by the user what it should be doing, to telling (or at least suggesting to) the user what to do.

              • By the same token you can click on Microsoft's updates and, you know, actually read what they are for and what they do. They even have a link to tell you.

                Err... Most of the time.

                Fairness in our bashing would go a long ways.

          • by Rockoon (1252108) on Tuesday September 29, @02:18AM (#29577329)

            So ninjas are visible and easily disabled in your world, eh?

            In my world, if a program is called 'iPhone Configuration Utility' yet it does not perform configurations relevant to the average owner of an iPhone, then its big-time ninja.

            And for the record, it has only been a single year since the iTunes update (version 8) installed...

            Apple Mobile Device Support
            Bonjour
            MobileMe

            ...without any method of preventing it, or any notification that that was happening.

            You claim that I am filled with nerd rage, eh? I claim that you are fucking ignorant.

  • by diamondsw (685967) on Monday September 28, @07:21PM (#29574471)

    No one else reporting on this "issue" (it was a mistake folks - chill out) has mentioned installing Apache, which would definitely be a huge issue.

    Has anyone here independently seen this supposed Apache installation?

    • by zn0k (1082797) on Monday September 28, @07:33PM (#29574567)

      I have the iPhone Configuration Utility installed on a work machine as we support a few dozen iPhones at work. Just checked, and there's no Apache process (just an iPCU.exe) when running the app. One of the links in the summary also mentioned using a browser against localhost:3000 for configuration, netstat shows no process listening on that port.

    • Re: (Score:3, Informative)

      No I can't find the Apache server other than the one I installed on purpose.
      • Re: (Score:3, Informative)

        Except that we are not talking about OS X. We are talking about MS Windows, which does not come with Apache, so that is why it might be installed.I see not documentation on it being installed. I see a number of items that must be installed to support the utility.
          • by Kalriath (849904) * on Monday September 28, @10:52PM (#29576197)

            Since when has "virtually no" meant "no"? IIS6.x has had eight vulnerabilities in its seven years of existence (only seven if you search CERT). Less than one a year. IIS7.x has had two in two years (three if you search CERT, plus one "unreliable"). One a year. Apache 2.0.x has had TWENTY-FIVE, and Apache 2.2.x has had TWENTY SEVEN.

  • pushes? (Score:3, Informative)

    by Anonymous Coward on Monday September 28, @07:22PM (#29574473)
    I'm not so sure if asking me if I'd like to update/install something is the same as having it "pushed" to me. I had the Apple Software Update thing pop up on me the other day, I unchecked the items I didn't want (the iPhone Config Util being one of them), and I went ahead and updated the software that I did want. So how exactly are they "forcing" this one me?
    • Re:pushes? (Score:4, Insightful)

      by recoiledsnake (879048) on Monday September 28, @07:40PM (#29574661)

      Not everyone is a slashdotter. In fact, you'd be less vulnerable even if you install it just because you're a techie and post on a site that bills itself as 'News for Nerds'. So, the name (iPhone Config Util) itself sounds like something an iPhone user would want.

    • Re: (Score:3, Insightful)

      They should give us the option of not being offered it. I have tried several times to deselect it from the offer list, but that's not an option. Instead, you have to notice it in the update list. I'm not worried about what I am going to do, but about what my wife and kids are going to do. They aren't as tech savvy as me.
    • I had the Apple Software Update thing pop up on me the other day, I unchecked the items I didn't want (the iPhone Config Util being one of them), and I went ahead and updated the software that I did want. So how exactly are they "forcing" this one me?

      Wait until the Apple Software Update pops up again and you discover that all the items that have even a minor version number change are back — even though you selected "ignore this software" — and not only back, but checked by default again, because, even though you refused to install an enormous new program when it was on version 4.3.2, surely you'll want to install it now that it's 4.3.2.1.

      I have several business clients that feel a need for QuickTime. A couple of them even paid for QuickTime

  • by danaris (525051) <danaris@@@mac...com> on Monday September 28, @07:35PM (#29574583) Homepage

    The previous ones were probably Apple deliberately (and stupidly) trying to push its software to Windows machines that didn't have it already.

    Given that almost no one needs the iPhone Configuration Utility among regular consumer-type users, I can see no benefit to Apple in deliberately pushing it out, and thus conclude that it was just a mistake.

    Dan Aris

  • by NivenHuH (579871) on Monday September 28, @07:43PM (#29574701) Homepage
    Software updates are pulled from the client, not pushed to the client. There's an important difference between the two and the phrases shouldn't be used interchangeably. For software pushes, see: Amazon Kindle + 1984 book deletion
  • by spywhere (824072) on Monday September 28, @08:07PM (#29574911)
    When I build a Windows box, I turn off QuickTime's default automatic updates and delete the shortcut from the Start menu.
    (I also install Flash and Java in front of the customer, so I can show them the "already checked box" scam).
  • by Derwood5555 (828126) <derwood@naebunn y . n et> on Monday September 28, @08:36PM (#29575185)
    Quicktime Alternative, FTW.. No iTunes, no iPhone, no iToilet...
  • by SEE (7681) on Monday September 28, @10:09PM (#29575959) Homepage

    It looks like the only way to get Apple to start behaving responsibly would be for Microsoft to put Apple Software Update on the list of targets for the Windows Malicious Software Removal Tool, until Apple eliminates the default checkboxing of "updates" to software the user hasn't installed.

      • by Plasmic (26063) on Monday September 28, @07:52PM (#29574773)

        Incorrect. Apple Updater has been popping up every time my wife opens iTunes (and sometimes even when she doesn't) asking her to install Bonjour, Safari, MobileMe, QuickTime and the iPhone Configuration Utility.

        Can't argue with that!

        And aren't we aware of Apple's iPhone in the enterprise push with IT buyers? Apple would love to say, "With over 10 million installs, the iPhone Configuration Utility is widely adopted by corporate IT departments". Nevermind that 99% of those are due to the "accidental" installation.

        You also have to ask yourself, have they ever done anything to indicate their shyness with regard to software installation? QuickTime takes over every single audio/video playback association, both in Explorer and with browser-embedded media, and even gets its own system tray and desktop icons. Same goes for iTunes with its "uncheck if you don't want it" policy for the apps mentioned above.

        I just don't see why we'd give Apple the benefit of the doubt on this one.

The best prophet of the future is the past.