Uninstall the NightOwl app

“In case the Agreement is amended as described, we will post an updated version of it in our website, at which time it becomes active and binding”

Several years ago, a friend entered into a contract with Comcast for business internet and phone service that had similar wording and no actual URL for the site. My instinct was that would be unenforceable and unconscionable, but you’d think Comcast legal would have thought it through.

Any lawyers out there familiar with this type of wording related to contract changes being posted on a website, particularly where no notice is given?

Could maps.me also be in a similar state? It used to be a good OpenStreetsMaps frontend and it was bought (possibly twice) by some investor firm to generate profit.

I don’t know what is the state of this app now. Does anyone know? What is the profit scheme (I suspect it might be similar to this one described here) and to which app would you switch instead?

It has been struck down and probably would be again if anyone felt like suing: https://arstechnica.com/tech-policy/2007/07/court-says-no-to..., https://scholar.google.com/scholar_case?case=592583419165850...

> [Safeway] reserves the right to, from time to time, with or without notice to you, in [Safeway's] sole discretion, amend the Terms and Conditions for use and purchases regarding the online shopping services. Any amendment by [Safeway] will be effective only as to orders you place after [Safeway's] revisions of these Terms and Conditions as displayed on the Web site. [Safeway] will plan to notify you of any material amendments to these Terms and Conditions; however, it is your responsibility to review the Terms and Conditions before submitting each order. [Safeway] has no responsibility to notify you of any changes before any such changes are effective.

> Defendant argues that, at the time of their safeway.com registration, Class Members agreed to give Safeway the authority to change the terms of the contract without notice to them, by indicating that they agreed to the version of the Special Terms that are in effect at the time they make their subsequent orders. Defendant's version of the Special Terms states that customers agree to the terms "and the form in which they appear at the time your online transaction is processed." ECF No. 187 at 16-17 (emphases added). In order to complete their registration, Customers were required to manifest agreement to the Special Terms shown to them by clicking a link. Defendant contends that, as a result of users' agreement to this Special Term at the time of their registration, Safeway was not required to notify customers of future changes to the terms for those changes to become effective. Safeway contends that, because Class Members read the initial registration contract, every time they opted to go forward with an online purchase after registration, they were on notice that they were assenting to a new contractual agreement, governed by the Special Terms operative elsewhere on the website at the time of that purchase.

> The Court rejects this argument. The safeway.com agreement did not give Safeway the power to bind its customers to unknown future contract terms, because consumers cannot assent to terms that do not yet exist. A user confronting a contract in which she purports to agree to terms in whatever form they may appear in the future cannot know to what she is are agreeing. At most, this term in the safeway.com agreement could be read to indicate that a customer agrees to read the terms and conditions every time she makes a purchase on the website in the future. But the Court also concludes that, even in light of their agreement to the Special Terms at the time of registration, customers' assent to the revised Terms cannot be inferred from their continued use of safeway.com when they were never given notice that the Special Terms had been altered.

was there a similar (policy or functionality) change to "the great suspender" chrome extension recently? Browsers seem to have marked it as unsafe.

NordVPN does this as well. Google and Amazon own large blocks of IP ranges for their cloud services, so it’s fairly easy to detect bots built on AWS and Google cloud.

On the other hand, Verizon also owns a large block of IP addresses that they give out to their residential customers.

NordVPN takes advantage of the fact that people like Netflix and Amazon don’t want to block out Verizon’s ip ranges, and disguise network traffic as residential traffic.

As a maintainer of a semi-popular chrome extension[1], I receive so many buy-out offers that I started publicly collecting them[2] for everyone to see.

[1] https://chrome.google.com/webstore/detail/hover-zoom%20/pccc...

[2] https://github.com/extesy/hoverzoom/discussions/670

>I hate silent takeovers so much.

This is a great app idea. Monitor the app owner. If the owner changes overnight, alerts to the moon.

That's the problem with free apps. Very few people want to donate, no decent company is interested in buying the app and making it profitable, so all that's left are the worst kind of companies who buy these extensions and apps to exploit the users.

All these free apps have value but unfortunately it doesn't translate to any income for the developer so they find other ways.

ActionDash being bought by Sensor Tower comes to mind. One of the most invasive apps requiring insane levels of permissions (rightly so to perform system level functions) being bought out by an ad and data-selling entity seamlessly is absurd

<libertarian> What's silent about it? It's right there in the TOS, which you agreed to by using the software. Caveat Emptor, and all that. </libertarian>

> Huh? Setting a schedule/location for nightshift and setting the dark mode setting to auto will always change instantly

Not in my case?! I’d say there’s a 25% chance that Dark Mode enables at sunset. It’s been this way for years — even up til Ventura.

Has it worked flawlessly for everyone else the whole time?

In 2018, when NightOwl was released, some or all of these affordances didn't yet exist.

> It looks like Apple has revoked the developer certificate. Anyone know if there's a public log somewhere showing when it was revoked?

No, Developer ID doesn't use a Certificate Revocation List:

https://lapcatsoftware.com/articles/revocation.html

You can also put display settings directly in the menu bar using:

Settings > Control Center > Display > Always Show in Menu Bar

I'll concede it takes a second click to toggle dark mode, but you also have night shift as an option, and it's 100% native.

Another very simple way is to make your own thing with the default Automator app.

* open up Automator and create new application

* select “change system appearance” and select toggle light/dark mode.

* save the ‘app’

Now, whenever you want to toggle light/dark mode, just open up spotlight and open up whatever you named the app. There’s probably a way to do it with Shortcuts too.

If toggling between modes is all that is needed, it can be done right through BetterTouchTool. I just assigned a right-click+option+cmd globally for it and it works like a charm

We should all have our own EULA’s that they implicitly agree to… lol.

I should start doing this with big websites. And of course my EULA is a 10MB file I’ll send with every request until they accept… :)

Can you imagine if that caught on? DDOS by EULA!

Common licenses specifically go out of their way not to imply such a contract. This is the start of the all-caps portion of the MIT License [0]:

> THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO […] FITNESS FOR A PARTICULAR PURPOSE

…and the GPL has nearly the same text in section 15. [1]

[0]: https://opensource.org/license/mit/

[1]: https://www.gnu.org/licenses/gpl-3.0.html#section15

I mean, contractual terms that are implied by statute exist. In English consumer contract law—which since 2015 has been extended due to the EU Consumer Rights Directive to cover digital content—includes an implied term that the goods are of satisfactory quality, and when it's a continuing service (including something like a digital content service like Netflix or Spotify, or a software product with updates), it doesn't radically depart from what's initially offered.

See https://www.legislation.gov.uk/ukpga/2015/15/part/1/chapter/...

Most jurisdictions have something broadly similar (albeit often not quite up-to-date around software and digital products). Everywhere in the EU will have laws that implement the EU's Consumer Rights Directive.

Which is great and would apply if you'd paid money for it. NightOwl is free (as in beer). The expectations the law sets out regulating the sale of goods and services do not apply when no money has changed hands.

Which I'd argue is pretty much right: while it sucks that companies get taken over and have spyware crap put into products, the idea that, say, a teenager who is hacking around and building stuff to learn how to code, puts up a project they've made as open source or a freeware download, does something silly like the left-pad debacle, then gets sued—potentially by a big corporate behemoth with very deep pockets and very scary lawyers—for a series of acts which involved them writing some software for no money. Regulation of technology should rest far heavier on the shoulders of Google, Microsoft, Apple and so on than it does on a hobbyist or small indie dev creating freebie menubar utilities or Chrome extensions or whatever.

The difficulty of ensuring those little freebie and open source apps don't become a vector for supply chain attacks remains difficult. Much better sandboxing and OS app-level permissioning, good network monitoring and anomaly detection on a per-app level, and building trust into packaging/distribution processes - these are all slow, grinding, incomplete ways to improve this. Lawsuits probably aren't.

I mean UPnP is a horrible spec but it’s a stop gap for restoring the fundamental capability of internet-connected devices in residential settings. All p2p apps (Tailscale for instance) need to act as a server temporarily and allow incoming traffic. Without the capability you’re a second class citizen, so to say. It’s infantilizing the user.

Now, you can of course open the ports yourself, but this is inaccessible to the vast majority of users due to undiscoverable, inconsistent and complicated UX. Most people don’t know what a port is.

Let me tell you about family members that have a mac because "they don't want the hassle of a windows laptop". They also don't want the hassle of not having uPnP, that setting is going to be turned on whether you know better or not.

Disabling UPnP makes your system more secure, but unless you also disable all NAT ALGs in your router, you're still exposed to its dangers.

I don't think most routers have a setting for that, so if infected devices are part of your security model, it would be wise to assume NAT is entirely non-functional because of [NAT slipstream attacks](https://samy.pl/slipstream/). An infected device can modify the router's NAT table to effectively act like UPnP, except they don't provide a user interface for you to audit.

If you're NAT free (i.e. only use IPv6) disabling UPnP can be a decent security measure if you're willing to manually do all of your firewall exclusions, but honestly host firewalls are the only reliable protection method for most people these days.

Do you deny the need for UPnP entirely? This is a confusing statement.

So, usually I associate super-shady things with hiding the fact that they're super-shady.

I'm thankful, but also genuinely curious, why they put this explicitly in their TOS.

It just kind of seems to be like the kind of person/org who would implement this shady stuff in the first place, would also actively hide that they're doing it.

Is there a legal reason that protects NightOwl by explicitly putting it in the TOS? E.g. does this prevent them from being sued for any of it, where they could have been successfully sued otherwise? Like it's technically do to all this shady stuff but only as long as it's in your TOS?

I guess "modifying their device’s network settings" is already covered under whatever permissions we had to give it to perform the original task of switching on/off dark mode? That's a bummer. Would be nice if app permissions were more granular if that's the case.

> "enables"

it's not a violation of your freedoms and privacy, it's an opportunity!

/s

Name and shame the developers and the company.

Or LuLu!

I've paid for Little Snitch every time I could. I never want them to consider selling.

Could be useful. Though people might as well do it themselves? I just pasted the whole thing to chatgpt and told it to summarise it into bullet points.

Related, this just brought back the memory of the Southpark episode ‘Human centipad’ where people accept the iTunes T&C without reading them :)

FYI... last time I tried, I could get the equivalent of a HTML <PRE> block by putting two spaces at the beginning of every line. Here's an example. Each line was indented two spaces:

  #include <stdio.h>
  
  int main() {
    printf( "Bonjour, totes le monde!\n" );
    return( 0 );
  }

Because the expansion of the wildcard needs to happen with the privileges granted by sudo. If you just ran "sudo rm ..." the expansion would be done by the current shell, which doesn't have the required privileges.

If I may ask, how much did you offer, and... who are you? :-)

> I assume this is being used by those services that sell scrapers "real domestic IP addresses", where in fact they are selling a botnet.

The author alleges as much in TFA.

    osascript -e 'tell app "System Events" to tell appearance preferences to set dark mode to not dark mode'

You can also use BetterTouchTool for that. I have CTRL-OPTION-CMD-M set up on macOS :)

Yes.

Yes, the OS function works fine. Haven't used the app in a while, just had it still installed. I just found this by searching for "proxy-gw1-europe.squidyproxy.com" which seemed odd when I found it in my .ssh/known_hosts file.

NightShift is different (but somewhat related) functionality: it adjusts the color profile to be warmer/reduce blue light. Both can be scheduled to correspond to time of day[light] however.

I have it set to a custom schedule that starts at 4am and ends at 3:59am, effectively leaving it enabled all day long.

What are you talking about? The whole point is you leave it on and it tracks the sun. Does this not work for you?

Apparently the perpetrator who sold out their users to the highest bidder is named Benjamin Kramser and they even freely admit the deed on their homepage! (https://www.kramser.xyz/)

I don’t think it’s fair to blame the developer unless you can prove that they knew this was going to happen

yes, you're paying his rent probably right? What did he do? Did he sell his app? I would sell any app I own for the right price btw.