Dr. Apps's dashboard

Hi Josh,

Great question. :)

Our logo was created by an incredible Australian designer named Dale Harris. His website is http://daleharris.com. There are tons of awesome logos in his portfolio.

Take good care,

Dr. Apps /Andrew
Community Guru
OpenCandy

@drapps

Internet Unibomber,

Thanks for re-posting this over here.

Ok, I’ve got a lot to cover here. so let’s go!

But when your plug-in is sending back ANY KIND of info off my machine that I do consider a form spying. For example the apps I have installed on my machine. That is only for me and the other users of my machine to know. NOT for some company of the internet.

When I was referring to being forced into installing third party apps I WAS NOT referring to the recommended app but to the OpenCandy plug-in its self. Isn't it a kind of app considering its code being executed on my machine? Maybe it doesn't have any power without the host installer but nonetheless it’s still code I never consented into executing. Personally I don't like it when an app I choose to install comes bundled with stuff I never consented too.

We’re working with our publishers to ensure that they are (and we are) making it crystal clear on their websites and in their EULA that their installer is OpenCandy-powered. With better disclosure and transparency, comes the choice of whether or not to consent to executing an OpenCandy-powered installer.

One thing I want to make clear is that we do NOT send a list of the applications installed on a user’s computer to our servers. The only information we receive, again non-personally identifiable, is installer analytics on the publisher’s software you’re installing; what recommendation was made, whether you accepted or declined the recommendation; if you accepted a recommendation, whether you downloaded and install it; as well as operating, operating system language, language of the publisher’s installer, and country. The information we collect is very similar (albeit scaled back) from what you send Mozilla when you use the Firefox browser. The non-PI information we collect is more scaled back than what most websites collect from visitors, and many of them store IP addresses (which we do NOT).

As far as our plug-in is concerned, it has caused some confusion and annoyance for being left behind. That’s why we’re eliminating un-install tracking (which we thought would be useful to developers) which removes the necessity of leaving the plug-in on users’ computers.

So, over the course of the next month all of our publishers will have updated to the newest version of our Publisher’s Kit which (as I explained in the other thread) will make sure OpenCandy provided files are NOT permanently stored (or installed, left behind, etc) on users’ computers. :)

Blocking Installers from Net Connections

Also you said it yourself that when the installer is blocked from the internet OpenCandy won’t work, so then what purpose does it serve? In other words what will be in it for you guys at OpenCandy and the developers say a lot of people blocked it?

No purpose, nothing’s “in it” for publishers, users or us. :)

If an installer which has integrated OpenCandy’s plug-in is blocked from the internet, publishers won’t receive anonymous installer statistics nor will they be able to make recommendations which help them subsidize the continued development and support of their (in most cases, free) software. And users won’t receive recommendations for software that is (hopefully) useful to them.

Hard-Coded Recommendations

Fantastic question!

Most publishers bundling software, outside of the OpenCandy network are pushing the same generic software (i.e. toolbars, “weather bugs”, “smart shoppers”, etc.) to every single user -- and of course it’s opt-out. Sometimes it’s done in a non-transparent way and sometimes multiple pieces of software that aren’t relevant at all are shown. Many times the quality of software is pretty low.

We know how powerful this distribution channel (recommendations during installation) can be. OpenCandy exists because our team believes that we can help developers use this channel in a positive way. Specifically, by making relevant recommendations while ensuring a positive experience where users have the clear ability to opt-in to installing the software they’re offered. Another cool thing is that developers can recommend software they actually use and really like, regardless of financial incentives.

Here are some more reasons why we decided an installer plug-in was the way to go:

#1) “On-the-fly”. With our installer plug-in, publishers can add or remove products from their pool of potential recommendations at any time. They can do this without having to build new installers for each piece of software they want to recommend. Our system then dynamically chooses the “best” of the available recommendations to show to the user.

#2) Less development time and QA. Our plug-in takes about an hour to integrate into an installer. Hard coding recommendations or “bundling” takes significantly more time and resources. Never mind that publishers or advertisers have to go out and strike individual deals which takes another significant chunk of time.

#3) Negligible increase in installer size . With traditional software bundling installer sizes increase dramatically, and if a user doesn’t find a recommendation useful, they just wasted bandwidth downloading a bloated installer. Going the plug-in route means installer file sizes stay close to the same (our plug-in weighs in at 400KB) and the plug-in only has to download a list of recommendations (text file) and then a graphical screen for the recommendation it decides to show.

#4) Retain current installer platform and maintain control. We didn’t want publishers to have to change the installer platform they’re using. With our plug-in, they are able to easily integrate into the installer platform they are comfortable with. Nor did we want to go the “let’s create our own proprietary installer” route and make publishers switch to it.

On the whole, our recommendations are so much “personally” tailored to specific individuals as much as they’re personally tailored to categories of applications that pair well together. We make assumptions, such as, people installing a PDF creator are more likely to want an online backup service to protect their files (personally I think EVERYONE should do some offsite backup!), then we’re able to validate our assumptions by analyzing the aggregated anonymous statistics we collect.

OpenCandy, Open Sourced?

I shouldn’t have summarily dismissed open source possibilities in my previous response. But the presence of money moving through the system makes things a bit more complex. But... we have considered open sourcing certain components off the OpenCandy platform and we will continue to consider doing so. (No, I don’t have any announcements to make :) ) The goal in open sourcing a component would be to provide something of value to software developers that could be leveraged and extended by everyone. Open source software will always be something we consider, given our backgrounds; that some our team members are open source developers; plus, we are all open source software users ourselves.

Registry Keys and “Recommendation Loops”

1) You said that with the latest version the OpenCandy folder and its contents will be deleted after install of the app/apps (assuming the recommended one was chosen) . Will the regkeys and cookie also be removed?

We DO NOT use Internet cookies (like username@site.txt) as part of the recommendation process. We do use registry entries though. They contain bookkeeping info about the publisher’s software install and recommendations as well as a non-reversible ID that is created by a random number generator. This helps us combat fraud/ gaming and enables our algorithm to significantly discount a declined recommendation or remove it from being recommended in the future. Registry entries are also temporarily used to manage the download and installation of an ACCEPTED recommendation, but are removed once installation is completed or canceled. Currently, it’s at the publishers’ discretion about what registry entries they remove during uninstall. A lot of software publishers like to leave their registry settings intact in case someone decides later on to re-install their software, so they won’t have to re-input their settings.

2) Say someone did install an app with OpenCandy and did choose the recommended app will the recommended app also include OpenCandy and if so where will it end?

Excellent question!

Currently, we have few partners doing cross-promotion, which is where this would occur, and the recommended app does NOT show a recommendation. It’s something we’ve discussed internally but we don’t have a hard-set guideline yet. Part of me thinks I’d get annoyed if I got “stuck in a recommendation loop”, but the other part of me thinks “well, if the recommendations are good then would I really care?” In any event, as it comes up we’ll be looking for feedback from the community. We like to keep the experience as user-friendly as possible, which is why we only allow one recommendation or offer per installer in the first place. That applies to OpenCandy recommendations as well as non-OpenCandy offers. So software publishers allowed in our network can’t show (for example) a browser toolbar and then an OpenCandy recommendation.

Running Out of Good Subheads

I’ve got to go finish up our FAQs so I can FINALLY get them posted here and on our website. And as I mentioned before, I’m working on a more detailed privacy policy that includes the information I’ve posted here on GS and on other forums. :)

I want the community to know that I’m your voice at OpenCandy. Part of my many responsibilities are listening to what you want, and then vocalizing and prioritizing it to the rest of our team.

Thanks again for your questions. I hope this info was helpful.

Dr. Apps

@drapps

Drapps [at] opencandy [d0t] com

PS: Internet Unib0mber: I know there is still some redundancy in this post, but I haven’t a choice since people unfamiliar with my previous responses that end up reading this need a baseline to work from. When someone emails me, I don’t have to re-hash stuff they already have heard from me. Sorry about that. :) It’ll be better once I get the faqs/facts up. :)

We do have an "open forum" here on GetSatisfaction. Since the conversation has gone beyond OpenCandy in regard to Miro (and since Miro doesn't provide OpenCandy recommendations anymore), I'm going to see if the GetSatisfaction peeps can move the last post from "Internet Unibomber" and the previous 3 posts from Clay over there so I can answer their respective questions. Probably won't be tonight though.

Thanks.

Dr, Apps
@drapps – Dr. Apps, on August 11, 2009 01:22

Clay, man, I'm a nice person, please give me the benefit of the doubt first. :) I didn't deliberately change your words or try to ignore your question -- I did misunderstand though. Sorry.

Disclosure = Choice

I think that's all related to proper disclosure... That way you have a choice about installing software from a publisher. You can also choose to download & install it and do what I do 99.9% of the time, block installers from accessing the Internet using a software firewall.

There is always going to be some percentage of people (albeit a small one) who don't want to see OpenCandy recommendations or help the publishers of software they're installing by providing anonymous statistics.

Thanks. :)

Dr. Apps
@drapps – Dr. Apps, on August 10, 2009 12:28

Clay,

We made a mistake with the way OpenCandy was disclosed with Miro, I said that two months ago. That's why Jesse put a disclosure on the Miro for Windows download page so that people knew it provided OpenCandy recommendations and analytics. As of version 2.0.5 Miro no longer provides OpenCandy recommendations anyway.

"opencandy's file, transfers personal use information over the net."

I'm not sure how much clearer I can say this: OpenCandy does NOT transfer or collect personally identifiable information (here's a good reference on PII http://en.wikipedia.org/wiki/Personal...).

As far as our privacy policy is concerned, it looks like being concise wasn't good enough. We're in the process of updating our PP to be more specific and eliminate ANY confusion people have as to the type of NON-personally identifiable information we collect.

On the whole we've done a lot of things right. I have no qualms about admitting when we make mistakes. We listen to the community and when changes need to be made, we make them. We're always looking and listening for ways to do things better.

Thanks. :)

Dr. Apps
@drapps – Dr. Apps, on August 09, 2009 20:41

An Interesting Sunday

Well this is an interesting break from trying to console my teething seven month old and taking care of mommy who isn't feeling well either. It’s not everyday I get asked questions by someone who choose to post under the name of a convicted murderer. But I digress; this information will be helpful to other people, so I’m happy to answer these questions.

Actually I don't disagree that an OpenCandy-powered recommendation is an ad. But OpenCandy isn't adware (http://en.wikipedia.org/wiki/Adware), adware is: a program that once installed shows ads on your desktop or in your browser or a whole slew of other crap we WOULD NEVER do. And we are certainly not spyware (http://en.wikipedia.org/wiki/spyware). We don't collect ANY personally identifiable information, and the NON-personally identifiable information we collect is very limited and not unique at all (see below).

TCP Connections, Anonymity and Privacy

Every website you visit knows your IP and the vast majority of them also log it. Yes, establishing a (legit) TCP connection means the return address is known (yes I'm way oversimplifying TCP :) ) –The only thing we do with an IP is figure out the country it originates from. We do NOT STORE ANY IPs in any shape or form.

Our system is based on a smart plug-in / dumb server approach so WE DON'T NEED to collect all sorts of other information about a computer (or "person" if you will). The fact that someone uses Microsoft Windows Vista and their OS language is English and they're located in the United States is NOT UNIQUE information at all.

Removing Our Dll / Blocking Internet Connectivity EDITED to add bold to this. :)

If you remove the OpenCandy dll (OCSetupHlp.dll), OpenCandy CAN'T/DOESN'T provide any functionality during un-install (btw, I should mention that when you remove the dll yourself you may receive an error during un-install since the file is missing but if you click 'Ok' or 'Continue' the uninstall will complete successfully. See my PS for changes we're making regarding leaving files behind). The same goes for blocking an OpenCandy-powered installer from accessing the Internet during install, we obviously can't provide a recommendation or installer analytics in that case. The exact reason I provided that information was for people who either; don't want to see a recommendation or don’t want to help provide anonymous analytics to the publisher of the software they're installing, or that want to remove our dll.

As far as forcing people to install third party applications, I'm not sure how a software recommendation you have to consciously choose to install could be considered forced upon anyone. Of course I'd never argue against the fact that concepts like GAIN or Cydoor DON'T work... they don't, I loath(ed) them and I've spent a considerable portion of my life cleaning up machines infected with that crap and other things.

Copyleft nor Copyright Determines Legitimacy

So if something is closed-source it's not legit? The reason why our platform isn’t open source is because part of it deals with money which means we have to deal with the potential of gaming/fraud. Legitimacy of a platform, product or service isn't determined by whether it’s copyleft or copyright.

Closing Thoughts

For some people, specifically those who have read my responses to questions in various places, yeah it can seem pretty repetitive (definitely not verbatim though). There's only so many ways for a person to answer the same question(s) and if a question is answered truthfully, then (IMHO) there's really only one (idk, maybe two) ways you can answer it.

Like I always say, I'm happy to have these discussions. When people have questions we're/I'm happy to give answers. I hope this info is helpful.

Thanks. :)

Dr. Apps
@drapps

PS: Two other things I should mention:

#1) Miro’s does not provide OpenCandy recommendations anymore as of version 2.0.5.

#2) Now is as good a time as any to announce this. :) We are currently wrapping up the latest version of our Publisher’s Kit which changes the way our recommendation process works. Going forward our files (OpenCandy_Why_Is_This_Here.txt and our dll, OCSetupHlp.dll) will ONLY be TEMPORARILY copied to a folder within the publisher's program installation folder – IF – a recommendation is accepted. Once the recommendation (again, IF it was ACCEPTED) is downloaded and installed, the OpenCandy folder, dll and text file will be removed automatically. – Dr. Apps, on August 09, 2009 17:34

Disclosure -> Transparency -> Choice

The Problem? Disclosure!
The Solution? DISCLOSURE!

Some of you know me from other threads, but for those that don’t, I’m Dr. Apps, Software Community Guru for OpenCandy. I joined OpenCandy at the end of February of this year. I discovered OpenCandy when I was updating MediaCoder in November, 2008 (see here: http://twitter.com/drapps/statuses/1018127759). (Sorry, can’t help but intro myself.)

Jesse and I discussed this thread at length over the last two days and I realized I’ve been missing the message on what you said you wanted. Which is disclosure. At OpenCandy we are passionate about doing what we do in a way that is respectful of users. If there is a way to do it better, we are all for it.

We have already begun work on messaging for the Miro download page to inform people that Miro’s installer includes recommendations powered by OpenCandy.

Disclosure is all well and good. But if people don’t know what we actually do, why we do it and most importantly HOW we do it, they aren’t going to be able to make an informed decision about OpenCandy.

What We Do

We provide technology and a network to enable software developers to choose software (or services) they love or believe their users will find valuable and present it to users as a recommendation during installation of their software. Our network is moderated; meaning those that wish to participate must meet certain guidelines to ensure safety, security and transparency to users.

Why We Do It

Yes, the people who started OpenCandy were former DivX founders, executives and engineers. Yes, they made business decisions while at DivX, for DivX that I personally (as a user-advocate and computer fix-it guy) didn’t agree with. This isn’t about DivX though, this is about OpenCandy. After leaving DivX, they realized that some of what they learned about software distribution could be applied to something that revitalized the software community for the mutual benefit of USERS AND DEVELOPERS. They saw how third party bundling was being done in a non-user friendly manner (from the install experience to the privacy issues) and created a vision and framework to do it in way that DOES offer an optimal user experience. OpenCandy was born.

How We Do It

The OpenCandy Installer Plug-in.

#1) Recommendations

The OpenCandy installer plug-in (otherwise known as OCSetupHlp.dll) is what publisher’s integrate into their software’s installer to enable recommendations to be made. The plug-in ONLY functions during installation (and optionally) un-installation of the publisher’s software and in accordance with our Privacy Policy.

If you decide after receiving a recommendation that you don’t want the OCSetupHlp.dll on your computer, feel free to delete it. I guarantee it won’t magically re-appear.

#2) Installer Analytics

The plug-in also enables publishers to learn ANONYMOUS aggregate statistics like how many times their software is installed and uninstalled. This helps developers create better software and drives competition in the software community. The thinking is that if a software publisher knows how many times their software is installed and uninstalled then they’ll be able to notice, for instance, if one month a new version they released results in a statistically higher rate of un-installations. Then they can reach out to their community (via blogs, forums, etc) and say “Hey, the recent release of our software is resulting in 30% more uninstalls. If anyone has any ideas why, please chime in and let us know what you think is causing this.”

To reiterate: The OCSetupHlp.dll has ZERO functionality by itself. It only runs as part of the installer it was integrated with.

User Privacy

Our privacy policy is very straight forward and crystal clear on what information we collect. (Personally, I think ALL privacy policies should be.) What sets our policy and our actions apart is that we don’t want your personally identifiable information. That’s why we don’t store your IP address or any other personally identifiable information about you. Here’s an example of what we know about you: A Windows (XP, Vista, whatever) computer residing in the United States (or some other COUNTRY, yes just COUNTRY) accepted or declined an OpenCandy recommendation during installation of Miro.

Wrapping it up :)

I know it’s hard for people to understand (or accept) what OpenCandy does unless the information is readily available. Our new website will be launching soon and I’m also working on getting our FAQs up here (on GS).

I’m glad to be able to have this conversation out in the open for everyone to be a part of. That way we can be sure we’re doing the right things and that our actions match what we’re saying. :)

We are really proud of what we’re doing, why we’re doing it and most of all, HOW we go about doing it. That’s why we have awesome partners (like Miro) working with us. They’ve had the chance to learn our story because we’ve communicated and shown it to them, but until now we haven’t had the chance to share it to the rest of the world. :)

Thanks,

Dr. Apps / Andrew