An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#36977 - 11/04/15 08:28 AM Caution: MacUpdate started using Adware installers
alternaut Offline

Moderator

Registered: 08/04/09
In the past couple of years we have had a few threads dealing with download aggregator sites which used ‘installers’ bundling genuine updaters with adware. CNet’s Download.com (successor to VersionTracker) and Softonic come to mind. Recent developments suggest that MacUpdate may have to be added to such sites, despite previous noises to the contrary. So far, not all updaters are adware-bundled (yet), but the fact that MacUpdate is actively ‘moderating’ complaints and cautionary comments (scroll down) on the affected pages doesn’t help spotting the ones that are.

Contrary to CNet’s Download.com, the adware-installer hobbled MacUpdate downloads are not immediately obvious as such; only after downloading and opening the XYZ Installer.dmg is the user presented with a nondescript ’MacUpdate installer’ instead of the properly named software. Suffice it to say that one should NOT run these, but navigate to the original software publisher’s website (a link is present on the software’s MacUpdate page) and download the official updater or installer directly from them. I plan to update this post when more specifics become available.
_________________________
alternaut moderator

Top
#36984 - 11/04/15 10:12 AM Re: Caution: MacUpdate started using Adware installers [Re: alternaut]
grelber Offline


Registered: 08/05/09
Loc: North of 49th ||
Originally Posted By: alternaut
... Suffice it to say that one should NOT run these, but navigate to the original software publisher’s website ... and download the official updater or installer directly from them.

This is always the best policy, one I have followed from Day One.

Top
#37482 - 11/28/15 09:04 AM Re: Caution: MacUpdate started using Adware installers [Re: alternaut]
alternaut Offline

Moderator

Registered: 08/04/09
In the latest development (at least as far as I have experienced it), MacUpdate uses what it calls a ‘MacUpdate Bundle* to update certain software. I first noticed this today with MacUpdate’s Little Snitch 3.6.1 updater. It consists of a disk image containing several items, including a small Little Snitch updater file, (apparently to go with) the MacUpdate Desktop app, plus a folder called ‘Manual Install’ containing the LittleSnitch-3.6-5.dmg.

Note that this bundle does NOT appear to contain any adware**, but may be an attempt to increase the use of MacUpdate’s software auto-updating utility MacUpdate Desktop. The bundle image also contains a complete Little Snitch updater, albeit not the latest one, but version 3.6. MacUpdate also lists a link to the software publisher’s website, allowing the user to check or download an update directly.

Despite this potentially confusing development, I still think consolidator sites like MU are useful, if only as a means to track update availability. But their simple and safe usage may get compromised by 'value-added' bundles like these.


*) NOT to be confused with the MacUpdate discount software bundles.

**) I do not use the MacUpdate Desktop utility, and so cannot vouch for the absence of adware activities there, but I haven’t heard anything to the contrary either.
_________________________
alternaut moderator

Top
#37483 - 11/28/15 09:35 AM Re: Caution: MacUpdate started using Adware installers [Re: alternaut]
artie505 Online


Registered: 08/04/09
Originally Posted By: alternaut
I still think consolidator sites like MU are useful....

I always link to MacUpdate rather than developers' sites, because MU offers both positive and negative feedback and a link to the dev, whereas devs' sites frequently don't post negative reviews and rarely link to MU.

I guess that from now on I'll just have to add a caveat about carefully examining d/l's to see what's in them. frown
_________________________
The new Great Equalizer is the SEND button.

Top
#37509 - 11/30/15 08:54 AM Re: Caution: MacUpdate started using Adware installers [Re: artie505]
Ira L Offline


Registered: 08/13/09
Loc: California
I'm not sure you can always examine a download to see what's in it until you have done the installation, at which point it is too late. Yes, I know you can use applications like Pacifist to examine packages, but not all installers are of that type.

But you have provided a solution—use MacUpdate to see what's new, to read reviews, etc., and then use the provided link to the developer's site for a direct download. I use MacUpdate this way and find it to be a useful site and service.
_________________________
On a Mac since 1984.
Currently: 27" iMacs, Macbook Air, macOS 10.14.x,; iPhones, iPods and iPads galore!

Top
#37518 - 11/30/15 10:15 AM Re: Caution: MacUpdate started using Adware installers [Re: Ira L]
Virtual1 Offline


Registered: 08/04/09
Loc: Iowa
Originally Posted By: Ira L
I'm not sure you can always examine a download to see what's in it until you have done the installation, at which point it is too late. Yes, I know you can use applications like Pacifist to examine packages, but not all installers are of that type.

Pacifist is good for that but is trial-ware. There are terminal commands to do the same thing (Pacifist is merely a front-end for terminal commands) but they're not too user-friendly.

man pkgutil for more information
_________________________
I work for the Department of Redundancy Department

Top
#37532 - 12/01/15 12:49 AM Re: Caution: MacUpdate started using Adware installers [Re: Ira L]
artie505 Online


Registered: 08/04/09
(Damn!!! I ran across an in-depth discussion of this subject between a MacUpdate editor and a poster, but I forgot about this thread and failed to make note of it. Sorry, guys. frown )

As per this screenshot of alternaut's referenced Little Snitch d/l, no examination of the package is necessary; all you need to do is be careful to click on "Manual Install"...ONLY!

Further discussion of Pacifist below, in case this issue descends deeper into the muck.


Edited by artie505 (12/01/15 01:03 AM)
Edit Reason: Emphasis
_________________________
The new Great Equalizer is the SEND button.

Top
#37533 - 12/01/15 01:02 AM Re: Caution: MacUpdate started using Adware installers [Re: Virtual1]
artie505 Online


Registered: 08/04/09
Originally Posted By: V1
Pacifist is good for that but is trial-ware.

I've run across three solutions:
  1. Pacifist app & QuickLook Plugin /$20 shareware
  2. unpgk app/Donationware
  3. Suspicious Package QuickLook Plugin/Freeware.
Here's a brief comparison of the three.
_________________________
The new Great Equalizer is the SEND button.

Top
#37537 - 12/01/15 09:40 AM Re: Caution: MacUpdate started using Adware installers [Re: artie505]
Ira L Offline


Registered: 08/13/09
Loc: California
I read on another site something that leads me to believe MacUpdate includes the "miscellaneous" installers only if you are not a paid subscriber.

I am a paid subscriber and have never seen these other issues. Can someone who has experienced them confirm your paid/unpaid status?
_________________________
On a Mac since 1984.
Currently: 27" iMacs, Macbook Air, macOS 10.14.x,; iPhones, iPods and iPads galore!

Top
#37540 - 12/01/15 01:13 PM Re: Caution: MacUpdate started using Adware installers [Re: Ira L]
artie505 Online


Registered: 08/04/09
Paid MU subscribers - I'm not one of them. - run ad-free (Scroll down at Upgrade Your Membership.), but I've never seen any mention of how/if paid status affects the installer.

As a matter of fact, I've never seen any reference to the installer other than in posted complaints and the exchange I forgot to bookmark. (I know from that exchange that the installer is only trial-basis at the moment, but I don't know to what extent it's been implemented.)

Have you tried d/l'ing Little Snitch to see if what you as a paid subscriber get differs from the screenshot I posted?


Edited by artie505 (12/02/15 12:43 AM)
Edit Reason: Delete rant
_________________________
The new Great Equalizer is the SEND button.

Top
#37544 - 12/02/15 03:19 AM Re: Caution: MacUpdate started using Adware installers [Re: artie505]
Pendragon Offline


Registered: 08/04/09
Loc: Georgetown, Texas, USA
FWIW I: I have a "paid" version of MU. Still, I routinely run DetectX & ScamZapper. So far, no miscreants noted. Whether 'tis a consequence of the "paid' MU or some other variable, I dunno.

FWIW II: Ya gotta love MU's business model: Feel free to use our site at no cost. Of course, you may well get infected. Or, use our site and not get infected. But to do that, you gotta pay us.

FWIW III: If you have LittleSnitch running in Silent Mode, you may care to check MU-- many connections to Google & the like. (I have blocked those with no adverse consequences.)

I don't harbor ill feelings toward MU. But a pox on their house would be nice...
_________________________
Harv
27" i7 iMac (10.13.6), iPhone Xs Max (12.1)

Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#37572 - 12/03/15 09:08 AM Re: Caution: MacUpdate started using Adware installers [Re: Pendragon]
Ira L Offline


Registered: 08/13/09
Loc: California
MacUpdate attempts to explain it all: Installer Info
_________________________
On a Mac since 1984.
Currently: 27" iMacs, Macbook Air, macOS 10.14.x,; iPhones, iPods and iPads galore!

Top
#37574 - 12/03/15 09:26 AM Re: Caution: MacUpdate started using Adware installers [Re: Ira L]
joemikeb Online
Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
After reading MacUpdate's explanation I can no longer recommend MacUpdate to my non-technical Mac using friends. MacUpdate is assuming too much knowledge on the customer's part. For even a technically sophisticated and reasonably aware power user or near power user it would still be "use at your own risk".
_________________________
joemikeb • moderator

Top
#37584 - 12/03/15 03:11 PM Re: Caution: MacUpdate started using Adware installers [Re: joemikeb]
artie505 Online


Registered: 08/04/09
From now on I'm going to link to MU for reviews and recommend d/l'ing via the dev's website link. Too many hoops to jump through otherwise. frown

Payment for functionality is fine; payment to avoid dis-functionality smacks of blackmail. mad
_________________________
The new Great Equalizer is the SEND button.

Top

Moderator:  alternaut, cyn