*BEWARE of the Bear (Onflow Warning)
 

BearShare is now officially Beware Share!

In the interview on Zeropaid.com with Vinnie Falco, creator of Bearshare, he said that he was making income from "targeted advertising". I found this a bit suspicious as lately I’ve encountered a lot of software that collects information about web users without making itself obvious in order to establish a market demographic for advertising.

So I had a look at the Bearshare homepage and found the following information in the Bearshare privacy statement [http://www.bearshare.com/about.htm]:

“Bearshare.com does not store cookies or other information on your hard drive or in browser memory. BearShare.Net uses cookies as necessary to support the operations and features of the DC Forum software. Free Peers, Inc. does not collect any personal information about site visitors except for the country of origin for statistical reporting purposes. The BearShare installer and application do not collect, store, or send personal information about you or your computer anywhere, except as required by the Gnutella protocol for the operation of the software as stated in the User Documentation. This does not apply to third party software included with the BearShare distribution; See the privacy policies of the appropriate bundled software to find out more.”

Sounds pretty good so far except for the last couple of sentences so I downloaded the latest version of Bearshare to see what software is bundled with it. With either type of install there are 2 software components:

1) Bearshare
2) Onflow Rich Media Plugin

After installation there is no automatic way to deinstall the Onflow plugin. I went to the onflow site www.onflow.com and read their privacy policy for their player which contains the following:

“Player Privacy: The following information is specific to the Onflow Player, which allows users to enjoy rich multimedia displays through your browser. Data transmitted: Each time the Onflow Player displays images, it transmits data to our server such as the serial number of the Player, the image displayed, the web page in which it was shown and whether you moved your mouse over the image or clicked on it. This data does not identify you. However, it can convey data about the preferences of the person using that particular Player.”

So what does onflow do?
It’s an advertising banner player basically.

Quoted from their site: “The Flow for Web Viewers: Download the Onflow Player - a quick, one-time requirement that enables powerful, effects-filled animations in a Web browser. View a page containing an embedded Onflow ad. Experience unprecedented, broadcast-quality animation. Remember and act on the ad’s content, at rates far above static or slow-loading ads.”

As far as I can see, Spyware is a bit of a hot issue currently on the web. Steve Gibson of Gibson Research Corporation is one well known person particulary opposed to this ( http://grc.com/optout.htm ) and there are a number of sites springing up around the web in opposition to user profiling and transmission of information for advertising or other purposes, even if it is anonymous. Major companies like Netscape, Real Media and Aureate have had a few issues due to this ( I think Real Media was the first one to have PR problems due to a similar strategy ). I would imagine that the Gnutella community would probably not be too enthusiastic about this either.

My only personal objection here is that there is no easily accessible information about what the player does unless you actually go to the Onflow site (not that I can find anyway ) and I don’t feel any great need to install something that’s going to show me advertising better : )

How to deinstall Onflow: I couldn’t find any way to do this automatically but after asking the Onflow support team I found that you can uninstall it conduct a find and replace of all files *onflow*.dll on your local hard drive and erase them. These files will include:

nponflow.dll
ieonflow.dll
onflowplayer0.dll
onflowplayer1.dll
and onflowreport.exe

So, if you’ve installed Bearshare and think you’d like to get rid of the Onflow player that should do it!

Vinnie, stop lying about Onflow, you might want to read 'The Cluetrain' instead.

The Kid -- "It's your right to question what is your right."

------------------

Onflow is designed to allow rich multimedia presentations using very small pieces of downloaded content. In less memory, Onflow banners produce more entertaining and visually exciting effects than animated .gif files or Flash files.

Yes, the purpose behind Onflow is to get a better rate from advertisers, since rich media is proven to be more effective in generating click throughs and increasing brand awareness. Bundling Onflow with BearShare is a great move, since it keeps BearShare free, it allows BearShare.Net to have interactive rich media presentations (some in the form of ad banners, and some just for fun), and it does not require installation in order to use BearShare.

That having been said, let me address the issue of privacy. The Onflow technology was carefully evaluated, and a conclusion was reached that it is not in the best interests for Onflow to collect any objectionable information about users in any way.

Why? Because if they did engage in such activities and got discovered, the resulting bad publicity would lead to a widespread de-installation of the plugin. Without the plugin installed, no impressions are generated and therefore, no revenue. So they have a very strong incentive to go through great lengths to respect privacy. Considering the history of other companies that have tried to go down that road, as the ones you mentioned, I strongly doubt that consumers would tolerate an invasion of privacy if it were discovered. Thanks to the efforts of people like Steve Gibson, we have a good body of resources for identifying the real troublemakers as opposed to those doing honest, legitimate business.

The reporting system used by the plugin is absolutely no different than the regular banners which appear on a web page. Every web site maintains visitor logs, and link exchange / affiliate banner programs all pool information about visitors together. The plugin reports the same information that a web log reports, including which banners you saw, how long you remained on the page, and whether or not you clicked. The difference is that these banners can be entertaining and interactive, and help keep good software free.

I'm not sure about your motives in raising this issue. Perhaps they are genuine; but I all to consider the relevancy of these comments, and whether or not there is a real problem versus an imagined one.

The problem is twofold.

1) The notion of invisible data sying and browser "enhancement" seems to be counter to the entire spirit that spawned the p2p phenomenon in the first place. Ask any random Gnutella client user, "HEY! You want to be able to view web banners with NEW and EXCITING effects in less memory than flash or gifs? And, do you want to download a bunch of system patches to enable it? And do you want to let us collect data about you while you view?" And they will tell you to go take a flying leap.

2) Disingenuousness
Most were aware of this Onflow stuff until some tenacious whistleblowers started making explicit what was previously several levels deep at the BearShear site. In fact, people started reporting download/install errors with the word "Onflow" in them, and Vinnie responded saying only that these were benign errors and to ignore them. What this means is that Bear Share appears as if they are willing to deceive users (though strictly speaking the info was there... but only in a CYA sense.) and therefore users may not trust Bear Share going forward.

This is unfirtunate on the whole because so much about Bear Share, the technology, has been done well; it looks like a piece which was engineered with some love for the space. By way of contrast, the notion of collecting money via banner adverts is ineffective at best, certainly rather archaic by now. Research shows that people now automatically tune out that familiar banner-sized rectangular aspect, even if it is not a banner at all. Myself, I can count the number of banners I have clicked on in the last few years on one hand. So... where the implementation of the technology looks to be creative and passionate, the implementation of strategy seems to be formulaic and cynical. What is the disconnect here? Feels like a marketing department that is at odds with a development group, philisophically...

Should the above imply otherwise, it should be noted that I am a Bear Share user and fan, and am simply disappointed in this series of events...

freepeers is just one guy i think he's a good programmer but obviously he doesn't have the time to pursue the marketing so he took up the offer with onflow so at least he will get something

i dont know why everybody is makin a big deal, i just install onflow every time and later delete it

A good site that addresses Ad-Ware/Spyware issues is:

http://www.spychecker.com

...Go to this link for DL's:

http://www.spychecker.com/download.html

I DL'd Ad-Aware and it detected OnFlow and gave me the option to delete everything related to it INCLUDING registry settings.

Thank you Rat Rage Kid for posting the note and the instructions on how to delete the files.

I don't know how Onflow got on my PC, but I didn't ask for it and didn't want it. I found an uninstall program that seemed to claim to remove the code but it didn't do anything except issue some warning that I needed to close any browsers and Windows Explorer.

If I didn't have a firewall in place I wonder whether I would have known that someone had put this crap on MY machine.

Thanks again.

Get rid of this?
 

So how do I get rid of this spy packet that people are talking about? Is there a firewall that will block it?

Re: Get rid of this?
 

Download Ad-aware ( http://www.lavasoft.de/aaw/ ) or OptOut ( http://grc.com/optout.htm ).