Shareware, Adware, Spyware

Dr. Dobb's Journal October 2000

By Al Stevens

Al is a DDJ contributing editor. He can be contacted at astevens@ddj.com.

I just returned from a weekend in Tampa, Florida where I attended the Shareware Industry Conference 2000, an annual meeting of shareware authors and support companies where they exchange ideas, try to sell stuff, and hand out awards to one another. The conference is presented by the Shareware Industry Award Foundation, which gives out awards in various categories to authors of shareware programs. They have two sets of awards -- those voted on by their members and the People's Choice Awards voted on by the user community. The categories are similar, and there's usually a lot of overlap. The Association of Shareware Professionals is an active participant in the foundation, and they also hand out awards to shareware authors. Ziff-Davis was represented, too, and they passed out the ZDNet shareware awards. Well, what they really did was announce the winners on signs posted throughout the lobby during a party and let the winners stand next to the signs. Maybe Ziff-Davis knew they were about to be bought by their competitor, CNET, for a paltry 1.6 billion smackeroos and didn't think they could afford a formal awards ceremony. Anyway, there were enough awards that it seemed everyone could get one, but it didn't work out that way. I didn't get one.

I was there as a speaker to conduct a technical session on testing and debugging, a subject close to every programmer's heart. I had about 30 attendees, mostly programmers. They were all males, too, so when I gave out Dr. Dobb's T-shirts, there was nobody to offend with wet T-shirt jokes, so I didn't bother. I resurrected an old talk with video slides from a conference a couple of years ago but worried that today's Internet-intensive applications and operating environment might make that discussion obsolete. Not to worry. The programmers quickly took over the session and I gladly demoted myself from lecturer to discussion moderator. I went through the motions of paging through the slide show for a while, but the attendees really drove the discussion, so I just turned the thing off and let the session take wing. I learned that when you let a group of programmers do most of the talking and you do a reasonable job of moderating the discussion, people say afterward what a great speaker you are.

This conference was supposed to be about shareware, and a lot of it was, but the hot subject this year was what I will carefully call "adware" for this discussion. I say "carefully" because the term is the name and registered trademark of a company (http://www.adware.com/) that supplies software to advertising agencies, and I don't want to wake up their lawyers. But yet another new industry has sprung from the loins of the Internet, and its users and providers freely use "adware" as a generic term to describe what they do. And what they do is very interesting to programmers. Some pundits have unfairly called it or otherwise associated it with "spyware," and I'll talk about that issue, too.

Adware is an opportunity for software developers to leverage their user base to make more money. If you have a program that others might want, adware might be the way to go. Adware might also be the marketing model that spells the demise of traditional shareware. You typically give your adware-enabled application at no cost to the user and require the user to read commercial messages on the screen when using the application, or, with one adware product, when surfing the Web. More about this model later. First let's see what's right and what's wrong with shareware.

Shareware

Shareware is an old -- in technology years -- marketing technique wherein users acquire a copy of a software application to try out before they pay for it. You like it, you buy it. You don't like it, you discard it. The honor system. The benefit of shareware marketing has always been that it minimizes marketing, packaging, and distribution costs, giving the small-time software author a way to distribute programs without spending big bucks. Some developers have done quite well by releasing their programs as shareware.

Old-school shareware advocates insisted that the program a user tries out must be the same one the user pays for. No crippled functions or missing features should be allowed. When shareware authors found that this approach did not work well enough, they tried strategies such as so-called "nag screens" to encourage users to register and pay. Others released smaller shareware or freeware versions of the application with upgrades to full-featured commercial versions for registered users. Still others offered documentation and tech support only to registered users. Some authors use all of the above, and these approaches make a difference, but many shareware authors find that users either just don't register or else they freely give away copies of their registered pro versions. Authors have tried registration passwords and such to battle the bootleggers only to find counterfeit user-identification codes and passwords posted to so-called "cracker" sites on Usenet and the Web. Without a way to reach into the computers of users of cracked programs, the authors were at a loss as to what to do. They devised strategies to address this problem, and one session at the conference talked about such strategies, but shareware authors generally agree that if someone wants to break into code and publish a crack, they can do it, no matter how clever the developers are.

People have been trying to figure out how to use the dot-com explosion to make money for a long time. We have this monolithic wired anarchy called the Internet, and everyone on the planet wants to get connected. With that kind of reach, people are bound to try to find ways to get other people to part with their money. Prior to this explosion, shareware authors uploaded their products to electronic bulletin boards and distributed diskettes wherever they could. The Internet opened the door to an unlimited resource to expose any kind of product to billions of people, some of whom have money to spend, and shareware naturally found its way there.

A support industry grew up around shareware. There are web sites that serve as download depots for hundreds or thousands of shareware applications. By posting an application to one of these sites, an author vastly increases the potential number of downloaders. Other sites provide various e-commerce and product fulfillment services, accepting credit cards and shipping the product.

So why doesn't shareware earn lots of bucks for the majority of its authors? Simple. The fundamental disadvantage to shareware has always been that many users do not bother to pay for the applications they use, and there's little anyone can do about it. Big companies and government agencies have strict policies about their employees using nonregistered or bootleg software, and these policies are probably what has kept shareware alive, but they don't help much for the little guy who releases his killer game application to the public at large. Industry estimates are that 90 percent of shareware users are using unregistered copies or bootleg copies of registered shareware programs.

Is it only coincidental that one of shareware's greatest advocates in the early days, a fellow who for a time operated a successful company that marketed shareware programmer's tools, a close friend of mine and excellent writer and programmer, had to close his doors several years ago and go into hiding from his friends and creditors? I won't reveal his name because many of you know of him and his now-defunct product line. (He knows who he is; I wish he'd call me.) Rumor has it my friend is making an anonymous comeback as the proprietor of adult web sites. My old pal abandoned shareware, to which he was always faithful but which sent him underground, and turned to the only sure-fire Internet-based money maker -- pornography. Or so the rumors go.

Adware

What if you gave your product away with no registration at all and still got paid for it? Sounds good. How do you suppose that works? Well, look no further than your local radio and TV stations. It's exactly what they do. You get their programming at no cost, and, in exchange, you have to sit through a commercial every now and then. What's that you say? You still have to pay for basic cable? Well, disconnect that coax and rig a coat hanger to the antenna terminals. If you are anywhere near a city, you'll get some kind of reception. Take it from me, there was a time when that's the only way it worked. (And we had no remotes and walked barefoot to and from school in the snow, uphill both ways.) You'd buy the TV, plug it in, hook up your antenna on the roof and view everything for free. And radio still works that way. I remember hostile public reactions when the notion of "pay TV" was suggested in the 1950s. People were not about to pay a monthly fee for commercial-free TV programming. No way. TV was supposed to be free. Now we pay for the cable channels and have to watch commercials, too. Progress.

Giving away content with embedded advertising is not a new business model, and that's how adware works. If you have a program to distribute, you can establish a partnership with one of the adware companies. There were several such companies at the conference courting the shareware authors to join in, among them were Web3000.com, Radiat.com, Cydoor .com, and Conducent .com. I'll discuss the business in general and you can go to the companies' web sites and see how they work specifically. I know this commentary raises a lot of technical questions, and I asked most of them while I was there. The answers were mostly acceptable, which only means that I'm not about to think of something that the smart programmers in those companies haven't already considered and covered.

There are two basic models of adware advertising. In one, your application displays the ads and the adware company sells space in the applications of its partners to advertisers. The adware company shows you how to make room in your application for an ad banner and how to interact with their software, which you include in the distribution that users download. Every time a user opens your application, they see banner ads, different ones at different intervals. This exposure is called an "impression." The banner displays are controlled by the adware software, which keeps track of impressions. In some systems, you get paid by the impression. They use the acronym CPM, which stands for cost per thousand impressions. You get paid by the CPM.

The other adware model is quite different. When users install your program, they also install a DLL that affects not your application, but the user's Internet browser. Subsequently, when users surf the Web, the browser displays a button in the title bar. The button displays, in a scrolling text display, the names of advertisers. When users click the button, the server goes to the web site of the advertiser being displayed. This activity has nothing to do with your application. You get paid a one-time fee for each user who installs your application and then only if the same user has not previously installed a different application with the same partnership.

Adware works even when your application does not depend on an Internet connection. Adware software loads ads into a local cache when the user does log on and uses the cached ads whenever the user runs your application. If the user never logs on, I don't know what happens. That's one of the questions I forgot to ask.

Obviously, in both models of adware, the more users who install and download your program, the more money you can make, which means you probably need to use the services of download sites, and the circle is unbroken.

I don't know whether the adware model will prevail or even sustain. But you might want to consider it as an alternative to traditional marketing methods for turning your programming efforts into profits. (Shareware is old enough to be considered a traditional marketing model.) For it to work, the adware company you partner with has to stay in business. It has to sell ad space to advertisers and keep its servers humming away to flash those banners on your application and record those impressions for you to succeed, too.

Adverse Reactions to Adware

Some people, developers and users alike, don't care for adware. Perhaps it's because the paradigm they're accustomed to is changing, and people don't like change. Some users don't like adware because they have to look at banner ads whereas before they did not. Developers don't like adware because some users say they don't like it. Users, however, are the real winners if it's done correctly, and the adware companies insist that their data indicate that users overwhelmingly support the idea. Of course they have to say that. Users do win because application programs are free. No cost. That might not mean much to someone who routinely uses unregistered or bootlegged software, and maybe those are the users who are the most vocal with their objections. Developers should pay such users no attention because those users don't pay for software with or without advertisements.

If you resist the idea of mandatory advertisements as the cost of free software, consider when you surf the Web what's been around and working for a while. Many web sites include banner ads. If you want to look at your favorite stuff, you have to put up with the ads. Click an ad and jump to the advertiser's web site. The site with the banner gets paid a stipend, sometimes just for the clicks, and probably if you buy anything. Want free Internet access? Set up an account with Juno.com, iFreeNet.com, or any of the other services that offer free access. They'll give you a local phone number, and bingo, you've got free e-mail and web surfing. Only thing is, you've got to look at banner ads whenever you are online, even when the web site you view does not use them.

How about paying for software and getting ads, too? How would you like that? No? Well, purchase and install Windows 98 and take a look at your desktop. What do you think all those shortcuts to online services are? They are advertisements clearly intended to get you to spend more money.

Spyware

Which brings us to spyware. Several months ago industry media commentators were abuzz with reports that some adware companies were exploiting users' Internet connections to gather information about the users without the users' knowledge or permission. They called such usage "spyware." The reports, some of which are still posted on the Web, none of which have been corrected or retracted, single out one of the adware companies and call its product a "Trojan horse" and a "spyware application," saying that the product sends to its server data about a user's activities and demographics without the user knowing about it. This report is completely untrue. There is nothing to indicate that this particular company's software sends anything to its server from a user's computer without the user's knowledge and permission. When I asked the reporter about evidence to back up his claim, he admitted that he has none. I searched the Internet for anything that would support these allegations and found nothing. What I did find was another site that defines spyware, points the same accusatory finger at the same adware company, and then, in the wake of the hysteria it raises, announces commercial software that you can buy from the site to disinfect your computer from the adware installation's intrusion. What happened? Didn't these guys make enough money from Y2K? The same site promotes sniffer utility programs that exposes all Internet transmissions to and from a computer and could be used to uncover spyware, but nowhere could I find that the site's proprietor used these programs to sniff out any spyware activities by any adware programs. There is no smoking gun.

I do not identify the adware company because the accusations against it do not stand up to close examination, the case against it was baseless and has mostly blown over, and I don't want to get it started again. I do not identify the reporter or the web site because to do so would dignify them more than I care to. Besides, you can find them for yourselves with a careful Internet search. What troubles me is that a journalist, perhaps operating from bad information, working for a nationally known and respected publishing house, falsely maligns a software company and does nothing to repair the damage when the accusations turn out to be unfounded. Oh, well, there is precedent. Jimmy Carter's White House Chief of Staff, Hamilton Jordon, is still waiting after 20-some-odd years for prestigious investigative journalist Mike Wallace of CBS to apologize for reporting falsely that Jordon used cocaine. I guess this guy I'm talking about is in pretty good company, after all. Makes me want to find a more honorable occupation such as repossessing pacemakers.

Why these people targeted adware companies, I do not know, except that one of them is selling a product to disable adware and needs people to distrust it. Adware has no privileged access to your Internet connection that any other program does not have. Any programmer who takes the time to learn some of the more arcane Win32 APIs can write a program that retrieves sensitive data from a user's registry, documents, and browsing history and send those data anywhere on the Web it wants to. The next time you download and run some innocent looking game program, keep an eye on the little dual green screen icon in the system tray. If it's flashing when nothing else is going on, beware.

Case in point: I usually open Microsoft Word 97 by double-clicking a document. If I am not connected at the time, Word loads that document right away. If I am connected, it takes quite a while longer and those little green screens flash during the delay. I wonder what's going on. What can my computer and some Microsoft server have to say to each other? Has some other nefarious entity attached itself to Word? Do I worry about it? No. There's nothing in my computer that Microsoft or anyone else cannot see. In fact, I wish the kids in Redmond would take a close look at the mess their operating system can make of a computer. That notwithstanding, I don't care what they find in there. Not everybody can be as cavalier about their privacy as I am, however. Some folks have genuine concerns about others seeing what's going on in their computing activities. I for one don't particularly care if some faraway server finds out that I snuck a peek at the Swedish Blonde Babe of the Day in a weak moment. I don't care. Maybe that's the problem. Maybe that's what the spyware bashers are really worried about. Somebody's going to find out where they've been. Maybe they should call it voyeurware. "Where do you want [me] to [see you] go today?" I know where you've been and I know what you've been doing. Snicker.

DDJ