Sophos News

Java updater to stop pushing Ask Toolbar, will foist Yahoo search on you instead

Oracle’s Java, infamous in the past for bundling the Ask Toolbar as part of its install and update processes, is ditching Ask in favour of Yahoo’s search engine.

The news was announced by Yahoo CEO Marissa Meyer at yesterday’s shareholders meeting, although no details were revealed on how much Yahoo will be paying Oracle for the privilege.

As with Ask, the Yahoo “option” will be checked by default in both new installs and routine updates, so anyone in a hurry or not paying much attention will find themselves facing some unexpected changes to their systems – both the default search (the engine used when you type something other than a URL into the browser address bar) and the default page when you open a new tab will become Yahoo.

That is, if they’re not already, although that’s fairly unlikely given that Yahoo’s share of the search market is fairly small compared to the main players, Google and Microsoft’s Bing.

Java users have regularly complained about Oracle’s policy of bundling search changes with their (frequent, often crucial) security updates.

While it can be argued that businesses have a right to “monetize” software they are giving away for free by teaming up with the likes of search providers, most people would agree that such bundling, if it really has to be done, should be taking place on initial installation only.

The problem with the approach taken by Java is that their “offers” are also included in the update process. This risks prejudicing users against applying updates in a timely manner, if they know they are going to have to be on their guard against unwanted “foistware”.

Previous incumbent Ask has been all over the headlines lately, after Microsoft’s security products started labelling the toolbar as malware.

At least, that’s how many understood the recent changes, although some more sober reports gave a more accurate view of what was going on.

It seems that only older version of the toolbar were being blocked, as they were not in compliance with new policies introduced by Microsoft banning any software from trying to prevent changes to the default search on a system.

As Ask was locking down search to stop others from stealing the users it had (generally) tricked into using its services, this meant that anyone still running older, un-updated versions would see a malware warning.

The same will have happened with many other products, mainly in the foistware field but some security products did the same, mainly to block the unwanted actions of foistware.

The value of getting more people to use your search engine is immense, as can be seen from Google’s epic revenues. Every extra browser which defaults to your search engine means more income from advertisers, and more data gathered from tracking those users to fine-tune targeted advertising, so there’s considerable effort made by all sorts of players to manipulate the search engines we use.

A whole industry has built up taking pennies from search providers to get them more users, generally by bundling search-altering code with other software, using techniques ranging from devious through duplicitous to downright sneaky.

On that scale, the efforts made by Oracle to push Yahoo on Java users is relatively tame, but still annoying to many. Anti-foistware crusader Ben Edelman of Harvard Business School, who has been highlighting the dodgy tactics of Ask and others for over a decade, described the Java Yahoo “offer” as “still a despicable tactic”.

The lesson to be learned here is always, always pay attention to each and every screen presented to you by software, whether during install or updates, and make sure you know what each click you make means.

Whether it’s an OK or a Next, if there’s text or a checkbox on the screen, you could well be agreeing to something, so make sure you know what that might be before you click.

Of course, you may want to use Yahoo, or indeed Ask, as your search provider, but it’s not a massive task to make the necessary changes for yourself.

If you spot something trying to foist unwanted system changes or junk software on you, it should be treated as a warning sign and should make you think, do I really want or need this?

If it’s Java, there’s a good chance you don’t, at the very least not in your browser.