Cydoor has written us an e-mail, asking us to reconsider our use of the term "spyware" to describe their product. In their defense, the e-mail is cordial and contains no legal threats, unlike recent iDownload letters to security related websites. We include the letter in its entirety so you can judge the validity of its points:

In regard with your article, I would like to bring your attention to your categorization of our ad-serving technology as spyware#&46 I believe that this categorization is mistaken, and I would like to show you why. I would also like to request that you update your description of Cydoor to be a mild adware.

In the past, Cydoor’s client was defined as Spyware by several members of the press and the anti-spyware industry. The client itself was mostly bundled with free software for the sole purpose of enabling that application to display ads. The client communicated with a Cydoor host periodically in order to present new ad creatives and to report on ad performance. Though no personally-identifying information was ever transferred, this method was considered invasive because users did not explicitly agree to install a Cydoor component or to the transmission of information.

However, today Cydoor has significantly changed its technology to offer end-users and partners an unobtrusive ad-serving solution. With a greater emphasis on visibility and privacy issues, Cydoor provides its partners with a reliable source of revenue, while making sure users are aware of its activities.

How does it work?

Cydoor provides all its publishers with a complete interactive advertising solution, including ad serving, frequency capping, and performance statistics. Cydoor allows each publisher to implement a solution that provides them with the advertising flexibility that they require, including any and all communication to Cydoor’s servers. Cydoor has no presence on the end-user’s desktop in any way, and our partners can serve ads and generate revenue from their application or web property.

Users download the desired application, while noting that it is ad-supported. Cydoor strongly urges all its partners to state upfront that their application is freeware but is supported by advertising revenue, and most state it in their End User License Agreement (EULA). There is no installation, explicit or otherwise, of any Cydoor component on the user’s computer.

After installation, the partner application manages the various advertisements and their performance. The ads are served according to predefined impression requirements and caps and exposure is not based on any aspect of the user’s behavior. From time to time the partner application connects to Cydoor's servers in order to report aggregated performance records such as which ads were displayed, how many impressions they received, and which, if any, did the user click on. These are the same kind of performance parameters that are tracked by any online advertiser, including banners published on a web site.

I’d like to emphasize that the application does not download ANY information from the Cydoor servers aside from ad creative. The application reports only basic aggregated campaign performance parameters. Under no circumstance does the application report on any other user behavior or does it transmit any personally identifiable content.

I’d like you to note that as an example, two of our partners, Download Accelerator and PalTalk Instant Messenger are either certified as Spyware-Free or are working with the leading Anti-Spyware vendors to be removed from their Spyware list.

Please let me know if you need any additional information regarding my request.

Sincerely,

Orit Levy

Cydoor

Concerned with upcoming Ad/Spyware legislation, vendors have been on a massive PR and legal push to clean up their image in the media and among security vendors.

The primary thrust of that effort involves being sure each vendor's product is categorized as beneficial or harmless "adware" while less ethical applications are categorized as "spyware" (even if both sometimes utilize dubious code and aren't wanted).

This is being accomplished via legal threats against websites, and by offering spyware detection developers marketing deals to weaken detection criteria. We'll admit that Cydoor's request is the friendliest we've seen to date.

Some Cydoor reference:

•The Computer Associates "Spyware Dictionary" entry on Cydoor.•The Symantec entry on Cydoor.•The Spybot entry on Cydoor.•A Google Search offers up 106,000 references to Cydoor as Spyware.

Most respected anti-spyware software detects Cydoor as something that could impede computer performance and should be removed, even if it has cleaned up its act. Does it matter what we call it?