IS LavaSoft homepage using tracking cookies?

[PepiMK]

Hi everyone,

While looking into some tracking cookies for the next release of Spybot-S&D, I came across a cookie of coyote.com. Curious as I am, I had a look at it. At over 200 Bytes it was quite big, and it contained 4 urls for just one visit. I told one of my beta-testers, who found the same cookie on his system.

Well, why shouldn't the people at LavaSoft don't use cookies? There are also useful reasons for cookies...

But it was interesting to us why the cookie was so large, and so my tester (fred) posted a question at the LavaSoft forum to ask what the cookie does. I read the message shortly after he posted it, but quarter an hour later, the message had vanished.
So he posted again, saying again that he wasn't charging them with anything, just asking for the purpose and contents of the cookie. I also read that second posting, so it was definitively online. But guess what? An hour later it was as if he never had posted it.
Both postings were not offensive, just asking.

I think this forum is more neutral and also interested in the question what is so special about the cookies that they delete two postings asking about it. I you guys at LavaSoft visit here, please tell us!!!

(I really don't want to bad-mouth LavaSoft, and I can't imagine they would misuse cookies, but I am very curious what they have to hide to go as far as to delete postings!)

[spy1]

Pepi - I have personally PM'ed every mod and admin at the LS site about this.

Look for answers either here or there. Pete

[Mr.Blaze]

OHHHHHHHHHHHHHHHHHH Hell no they didn't.

Im up in arms Blaze grabs shot gun and a 6 shot rotery multi launcher 36mm.

Blaze open up trunk of his lowrider jimmy 4x4 lets roll up on them mofoes hang them upside dowen from a tree and pull out our rusty chains lol.

I think we all want answers lets lock and load baby wilders 4 life lol=)

lol lol ok so its a bit dramatic but its just my opnione lol

[Mr.Blaze]

http://thequintessentialq.freeservers.com/music/Bodies.swf

[Coyote]

http://tomcoyote.com/Privacy.html

I do not control the placement of the cookie by the server on which my site resides and that is stated in my privacy policy


I did not know of any postings till now



Information collected
There are cookies set by the server that this site resides
on to monitor page views and bandwidth
and unique stats associated with the site to allow me to
verify needs of this site as well as monitor this aggregated data.


You can block the cookie and my site will still function

[Ann]

http://tomcoyote.com/lsindex.html *is a mirror site and not the Lavasoft "homepage" as mentioned here.

The Lavasoft site is found at www.lsfileserv.com and does NOT use tracking cookies.

Ann

[mitch_shrader]

I registered for this forum to make one statement. *Tracking cookies ARE in place on TomCoyote's site, to monitor usage.
Today there were 21000 (twenty one thousand) page views.
Of these, 21 (Twenty One) were page views of the Privacy Policy. *If you block cookies, you won't have any cookies. *The site still works. *If you wish to communicate with TomCoyote personally, there is a link on his site and it works. *He also moderates in spywareinfo.com 's * chat room, and is usually there every evening. *I also do this. *I will be happy to communicate about any spyware related issue, to anyone who wishes to join the chat. *Thank You All, for allowing us to address this issue. *Mitch_Shrader

[Mr.Blaze]

i think real qustion is will lavah soft be updated to detect this cookie and get rid of it lol

[Coyote]

{QUOTE-> http://thequintessentialq.freeservers.com/music/Bodies.swf <-QUOTE}


Why do you post a link to the same server host that my site resides with?

[HP]

Umm so a cookie was placed for visiting reasons...so?

[luv2bsecure]

I appreciate the work of Lavasoft and AdAware - especially for free, so it's hard to complain!

I am confused as to who "Coyote" is (as it was not signed) and who Ann is. Are one or both associated/own Lavasoft? *If so, thanks for coming here to help explain the cookie situation. I DID understand the message from Mitch was as a representative of the TomCoyote.com site which is acting as a mirror.

But I'm still confused. With all due respect, the main question from our member, PepiMK, was not answered. Not only was it not answered, it was shooed away like flies at a picnic by simply saying, " I did not know of any postings till now." If this was a representative from Lavasoft, I am sure more than just PepiMK and myself are curious as to why there was not more concern shown about posts being removed. This is a security forum, so naturally there's an interest in cookies. It seems any questions could have beeen answered (as they were here) rather than be removed, apparently twice! Who moderates the forum? Who has the ability to remove posts? Why, if one of the posts was from a Lavasoft representative did we not here that removing posts about legitimate questions won't be tolerated on the Lavasoft Forum?

PepiMK's question was more geared to that, and even went out of the way to not question the cookie itself (except asking about the size, which is what the post that was removed, was about!).

{QUOTE-> But it was interesting to us why the cookie was so large, and so my tester (fred) posted a question at the LavaSoft forum to ask what the cookie does. I read the message shortly after he posted it, but quarter an hour later, the message had vanished.
So he posted again, saying again that he wasn't charging them with anything, just asking for the purpose and contents of the cookie. I also read that second posting, so it was definitively online. But guess what? An hour later it was as if he never had posted it.
Both postings were not offensive, just asking.

I think this forum is more neutral and also interested in the question what is so special about the cookies that they delete two postings asking about it. I you guys at LavaSoft visit here, please tell us!!!

(I really don't want to bad-mouth LavaSoft, and I can't imagine they would misuse cookies, but I am very curious what they have to hide to go as far as to delete postings!) <-QUOTE}

I think that's a fair question. As one very much interested in privacy, I hate to see questions about cookies or anything else being posted to a software forum and removed rather than answered. That's the real question and some of us would like to know who would do that, and why?

For most of us in this security forum, that Wilder's has done such a great job of building and bringing a community of those interested in these issues together, TRUST means everything in deciding to use, or not use a product. If a company was taking down posts they are possibly embarrased by, or don't want to deal with, I am guessing a majority here would have questions about that. Someone apparently removed the posts - why?

Are there any answers to the central question posed by our fellow member here at Wilder's -- PepiMK?

John Little

[Coyote]

I did not see the posts, but I am the owner and sole operator of TomCoyote.com and I am also Coyote of TeamLavasoft 2002

I did not know of the posts in our forum until I was told of them by spy1 and immediatly came here to find out more.

Personaly, I feel that this could have been handled differently by both sides, to start with, my email address is publically displayed on my site, as well as a privacy policy that states the purpose of the cookies.

If the posts were made appropriately I do not know why they would have been removed from our forum,
as I did not see them I cannot be the judge, I have posted in our mod forum information about my site for the future for mods to know about.

As it is my site and not Lavasoft's, I wish that you consult with me about improper things on my site.

I work a full time job before I start sitting down to my computer each day to help on catching and removing spyware from the internet and users computers and I had just signed on today when I got the PM from spy1 and to say the least, I am surprised that I was not given the opportunity to explain anything by email and rather had to find out that someone was investigating me just because of a cookie. You people should know better than that.

And I am a registered user here so that information is there.
Ann is Bee from Lavasoft

Tom~Coyote webmaster@TomCoyote.com
coyote@lavasoft.de
TeamLavasoft 2002

[fret]

As this topic is a little about me (I posted the two questions at the Lavasoft Forum) I would like to state that at first I just wanted some clarification. But now I have adistinct feeling that Lavasoft has beek kind of hyjacked. Even if I send an e-mail to bee (Ann-Christine) I got answered by TomCoyote. We, security minded users) have aright to get informed of crucial changes to Lavasoft. Trust us and we trust you. Be open about everything because the spyware-companies are closed like a shell.

[Coyote]

Fret

I answer most of the emails that come through Lavasoft as that is my responsibility.

you can PM Bee at the forum for confirmation of this fact.

[Checkout]

For peace, and peace of mind, two issues need investigating further:

Why were the posts removed

What is the actual content of the cookies.

I'm also an AdAware user, and I'd hate to see users' trust in a fine product eroded. *So, best wishes.

[Paul Wilders]

I'm no party in this thread, other than the forum adm.

On that title, I feel the need to make some remarks:

1) Fret: IMO your questions have been valid ones. On the other hand there is no reason in any way to conclude LS "has been hijacked" - that's just one step too far.

This thread is not mend to turn into somekind of controversy.

2) Tom: IMO there's nothing wrong in asking a valid question in a decend way over on the LS board - that's what the board is for. In my view it would have been reasonable if th one(s) responsible for deleting the postings had informed you at the spot - and answered likewise to the question asked. This would have avoided all this happening.

Deleting postings in regard to polite and valid questions on the LS board is bound to have an effect: the same question will be asked on a different board. Since you mirror for LS (a good thing - I applaud you for doing so), being a mod and LS Team member as well, it's not that strange at all this question has been asked on the LS board; as it shows in this thread, it's not that clear for anyone to distinguish where LS stops and coyote.com starts. I'm sure none of the LS Team members nor mods would be happy if anyone would email them personally instead of taking the obvious way: posting on the LS board.

Ann (major LS Team member together with Nicholas/Urizen) merely answered "the LS site is elsewhere - LS does not use tracking cookies" - which is true indeed. Although making clear your site and the LS site are not one and the same, no comment/explanation has been made in regard to your site - thus leaving the question wide open and unanswered. That didn't help in clearing up the issue at all.

No one is questioning your integrity as far as I see it.

That all being said:

Indeed question(s) remained to be answered (not all in specific by you, Tom!). *One of them is why the initial question has been removed twice from the LS board, instead of answering them - if only stating the matter will be looked into, and an answer would follow asap.

Most probably, many are still looking forward to a reply.

Finally: let's get this over and done with in a decend and mature way. All are adults, and fighting for the same cause. No one will benefit from controversy - *except the ones you are fighting.

regards.

paul

[Coyote]

I have stated all that there needs to be said in the open arena and I will not reply to this post or issue again here.


If you have further questions email me about my site (I have told you all the info I have on those cookies)
or contact Bee by PM on our forum.

I am not, and did not come here to baby sit this thread and we will take care of any internal matters about the way posts were dealt with internally and not in the public.

I wish for you to respect that decision and let this matter drop.

[Paul Wilders]

Tom,

{QUOTE-> If you have further questions...or contact Bee <-QUOTE}

I have, aprox. 10 hours ago. No answer yet. FYI: I merely asked to address this thread and explain to me in private mail.

{QUOTE-> we will take care of any internal matters about the way posts were dealt with internally and not in the public. <-QUOTE}

I'll take it, using the word "we" implies you are talking on behalf of the Lavasoft Team. Although it's LS perrogative to do whatever they feel like, as an impartial outsider I personally do consider this a very unwise decision in regard to this issue.

Deleting polite, to the point and valid questions/postings at random without providingany reason at all, will reflect badly on a board focussing on freedom of speech and privacy, and is bound to make people wonder.

Since you seem to talk on behalf of the Lavasoft Team, I kindly ask you/LS to reconsider.

regards.

paul

[spy1]

I have PM'ed Tom and apologized for the mix-up. Pete

[Ann]

The Lavasoft site (www.lsfileserv.com) does NOT use cookies at all.
As I said http://tomcoyote.com/lsindex.html is one of our mirror sites and
NOT the Lavasoft "homepage" as mentioned here before.

The two postings in question where entitled "Ad-aware contains spyware" and
"tracking cookie? cookie placed by Ad-aware"

Both statements are nothing more than downright lies and an attempt to intentionally discredit
our product and to mislead our users.
Neither does Ad-aware contain spyware, nor is "Ad-aware placing any
cookies".

And none of the above statements have even remotely anything to do with the
cookie placed by one of our mirror sites.

Since there have been several attempts to slander us in the same fashion a few
weeks ago, they were treated like all other attacks we have had on our board,
they were removed without prior notice.

If anybody has a legitimate question regarding any cookies placed by Tom's
site, they are welcome to post them on the board and they will be answered
like any other posting. But people who's only goal it is to create trouble
just like this one, are not welcome on our board and will be treated
accordingly.

It is tragic to see that slandering Lavasoft seems to be the only way Mr
PepiMK can promote his sorry attempt to create a product like Ad-ware.

The accusations you or one of your co-workers have made against us are very
serious.
So Mr PepiMk I would like you to explain to us in detail the cookie on
Tom's site and why it is considered a "tracking cookie" by you?

Considering the Ad-aware badmouthing that can be found in your forum I
think this all was a cry for attention nothing more nothing less.
Instead of trying to slander us, you should rather spend your time fixing
your software. It is accidentally (?) creating numerous registry keys while
"scanning" that are not related to your software directly. Are you trying to
thrash the users registry?

[Paul Wilders]

Hi Ann,

As for:

{QUOTE-> The two postings in question where entitled "Ad-aware contains spyware" and
"tracking cookie? cookie placed by Ad-aware" <-QUOTE}

In order to have this settled once and for all, I invite both PepkiMK and LS to post the contents and subject line from the posts in question. *This way, there will and can be no doubt for all concerning a possible slander - or not.

While waiting for the above mentioned, I urge all to refrain from bashing.

The main goal for LS/Adaware and SpyBot S &D is fighting a common enemy - fighting one another will make this common enemy laughing all the way to the bank.

regards.

paul

[Eagle1]

Tom has indicated he is not in control of the cookies on his site and does post a notice regarding such with a link to his providers privacy statement. I don't see what more he can or should do with respect to that. *

These cookies are orginating from freeservers. These tracking cookies I'm quite certain go beyond just tracking tomcoyote.com site related matters and IMO most likely track across the mishmash network of sites and servers maintained by the registrant of freeservers which is *About, Inc. About Inc, is the registrant of *Northsky and the aboutwebservices.com network of sites. All of the sites in the About group are free service types (Freeservers, Bizhosting, Community Architect, 50megs, SiteTracker, FreePolls, FreeStats, RankPeople - real yuk on the last one).

So it is likely that tracking is being done across the board of sites within this network, *which can be handled easily with a simple killing of the cookie. There is no reason why freeservers should be using cookies to obtain aggregate data on the site IMO. It is totally unneccesary to gather the type of data they claim they are using the cookies for.

As a side note and simply an FYI the apparent owner of the entire mess is either a part of the Above.net network or above.net is their service provider. I'm still not certain which. The trail is pretty clouded here. But in any event the Above.net network is owned by MFN which is currently 3.3 billion in debt and unable to make interest payments so I would expect that some interuptions and changes to occur over the next couple months on this net block.

[Paul Wilders]

Hello Eagle1,

In essence, you might have a point here, and it's worthwhile to look into this further.

Nevertheless, let's keep the two seperate issues separated:

1) Tom's site and related cookies;

2) The contents and headers concerning posts made on the LS board. I'm fairly sure posts can be reproduced - and it will be plain to see for all what has been going on.

regards.

paul

[fred]

This topic is spinning wildly out of control. We, the SpyCatchers, should be cooperating, be friends, instead of having arguments, fighting like enemies.
I've mailed to TomCoyote and Bee to offer my excuses if I caused them any distress. I never wanted to slander them. Ad-aware, SpyBot, X-cleaner, and.doxdesk, and averybody else on the anti-spyware side, should be a closed front. If not, we will lose the struggle. So, accept my humble appologies, let us shake hands and close this topic.

Fred ;D

[Paul Wilders]

Seems fair.

thread closed.

regards.

paul

[Paul Wilders]

The author from SpyBot S & D asked me to post his personal and final comment - which I applaud:

{QUOTE-> I didn't intend to bad-mouth LS, and I certainly didn't want to start the small war it has grown into. In fact, I always respected LS as the makers of a good competitor (until I saw how two of their people handled this question).

I connected the tomcoyote.com cookie to LS as multiple tries to access lavasoft.de were all routed to the tomcoyote mirror (I personally do take a repeated redirect as the 'homepage' itself); and I expect especially from security concerned people to select their mirrors with care. Before rousing any suspicions, I searched for a privacy link there first, but couldn't find one on the main page, faq or under 'more resources' (especially not the one Coyote posted; should I save the pages now to have a prove later?).
I suspected it of tracking as there were 4 urls inside the cookie file, and it was much larger than those of other forums i compared it with (as I already wrote, even though Ann seems to not have read this).
As I wasn't quite sure about it, and couldn't image any intended misuse, I wrote to one of my testers, Fred, to look wether he had the same cookie, and what it's contents was. Maybe Fred was a bit over-eager and posted the questions at the LS forum - with a provocing subject, but a valid question (sorry that I have no copy of it). On all other forums I visit it is common to answer offending topics with a short notice and closing it; keeping it another day online so the offender has a chance to see and knows to do better the next time. IMO that's the way support should work.
But after the second wordless removal, I got curious, and after they hadn't pm'ed Fred in 24 hours after, I started this topic. I didn't send an email for two reasons. One: I didn't think I would get a private answer after public questions were ignored (even deleted). Two: I thought a public question would show that I _want_ the opinion of other (neutral) people _before_ calling it a spy. If I wanted bad-mouthing, I would have done it somewhere else where they wouldn't have noticed. Or I would have written the style Ann did.

I apologize to everyone who has misunderstood my initial posting as bad-mouthing. I'm sorry I haven't been at home (many witnesses *) to make things clear before they got out of control. I certainly didn't want any bad blood! <-QUOTE}

Thread closed - for good this time *;)

regards.

paul