The saga of Patchou and his short lived MVP award

I had originally decided not to blog or otherwise comment publicly about Patchou's short lived MVP award because I felt it was not appropriate for me to participate in the online maelstrom that blew up around his award because of my previous blog and Web site entries about the Sponsor Program and Patchou.  Therefore, I made no public comment, leaving it to others to speak publicly about what they thought of the situation. 

Unfortunately, some of Patchou's supporters at www.msgplus.net have forced my hand.

"Sunshine", Female Elite Member, Msg Plus! Official Tester, Msg Plus! Sound Moderator, Dutch Msg Plus! Forums Smod, SPNG Betatester, Messenger Plus! SoundPack DB Admin (CR), and a long time participant at the msgplus forums, says in a message here:

Note: you will need to be a registered with, and signed in to, msghelp.net to access this URL
http://www.msghelp.net/showthread.php?tid=67092&pid=739699#pid739699

Edit: the original forum threads have been deleted, but preserved at the following links - these pages may disappear as well:

http://random.menthix.net/Patchou_MVP/Patchou%20Lost%20MVP%20Status%20-%20page1.htm

http://random.menthix.net/Patchou_MVP/Patchou%20Lost%20MVP%20Status%20-%20page2.htm

Sunshine said: "All this happend because, asfar as my eyes can see, two MVPs (namely Sandi Hardmeier and Christopher Boyd) complained and threathened to withdraw themselves from re-evaluation if Patchou kept his MVP status."

She continues on saying "Wilted Flowerhat they don't seem to get is the fact that Patchou gotten this status because of his programming work/skills in total...not the optional sponsorprogram...All they see is ohh deary me you could install some adware (not even looking for the reason behind why there is such a thing), not what Plus! (and with that Patchou) done for Messenger.

Microsoft knows what Plus! means for Messenger..that's why he was given that status (i still think patchou deserves MVP status) and tbh i don't get why they revoke it over 2 people complaining. Asfar as i know there is no voting on wether or not someone gets MVP status...i know MVPs can suggest people for MVP status, but the final decision lies with Microsoft..not other MVPs! A much fairer decision would have been to let Patchou keep his status and look again when it's re-evaluation time...all this doesn't make Microsoft look all to good either. Now i don't know about all them rules for becoming MVP and if there is such a rule that one can't make revenue of a program written (and surely Patchou has bugbusted messenger along with us all too)..this is just my opinion on the whole matter."

And then, when some who *are* in a position to know what I did or didn't do posted to point out the errors in her statement she said:

Note: you will need to be a registered with, and signed in to, msghelp.net to access this URL (the original thread in forum has been deleted)
http://www.msghelp.net/showthread.php?tid=67092&pid=739718#pid739718

"Those two did start it, ever heard of followers? Besides i don't think they are the ones deciding on wether an award is to be granted or not."

Fine.  Since Sunshine wants to argue the point, I shall respond on my own behalf.

Sunshine's allegations are completely and utterly false.

Here are the FACTS:

1) I did not complain to MS about Patchou's award, nor ask MS to rescind the award.

2) I did take part in discussions on some private email lists and agreed to sign a petition that was being composed BUT the petition was not my idea AND I was only one of many who said they would sign the petition AND the petition was not finalised or sent because Patchou's award was revoked before that could occur.

3) I did NOT threaten to withdraw myself from the MVP Program.

4) I said nothing in the public MS newsgroups until AFTER Patchou's award was rescinded.

5) I said nothing in the private MVP newsgroups until AFTER Patchou's award was rescinded, and then only because I was referred to by name.

6) Some MVPs even queried why I was being so quiet about the whole situation.

7) I was not interviewed for any of the online articles that appeared - instead, my previous writings were quoted.  I did not give my permission for my writings to be used in any of the news articles.  I received email one request for an interview, but did not read that email request until after the reporter's article went live because the request was sent to my spamtrap email account.  I *would* have given my permission if I had been asked, but the fact remains that I did not have the opportunity to give, or withhold, my permission.

8) I did not write a blog post mentioning Patchou's award until today, again AFTER his award was rescinded and only because I was Slashdotted and I found it a good opportunity to talk about the power of the online community.  Even then I only mentioned that the award was short lived and made no further comment.

I actually feel very sorry for Patchou because it is not nice to have a gift or award given, and then taken away.  We have had some very reasonable and open discussions by email about our respectives positions on the various issues surrounding the sponsor program.  That being said, I am relieved that Patchou's MVP Award was rescinded although, of course, it would have been far better if he had not been awarded at all. 

MP supporters keep saying that the Sponsor Program is "optional", as if that somehow makes everything ok.  It doesn't.

  1. Those agreeing to install the sponsor would not be aware of the risk that they are taking on by doing so.  They know that they are getting adware, but even if they read the entire EULA they still will not know that the advertisements that appear have a history of being used by malware pushers as a vector to try and infect computers.

  2. The advertisements generated by the lop.com adware that is the heart of the Messenger Plus Sponsor Program are a direct security risk, with malware pushers using pop-up advertisements generated by the sponsor as an infection vector to attempt to install malware such as winfixer onto user's computers.  These attempts can infect older systems, or systems with reduced security settings. Patchou seems unable to stop this from happening, yet is unwilling to forgo the income that the advertising generates.

  3. Patchou said a long time ago, and I quote, "if no one installs the sponsor with the new agreement window, I'll change it back, sorry".

  4. Patchou's work on Messenger Plus! does not, and can not, outweigh the fact that his Sponsor Program has been used as a malware infection vector, that it is presenting age inappropriate advertising to his underage users (and he must know that he has underage users - all you have to do is spend some time in his forums to see that) and that the advertisements generated by his Sponsor Program can put his users at risk.

  5. Yes, Patchou knows that malware pushers use his sponsor program as an infection vector.  He has addressed individual examples of malware pushers using his Sponsor Program to spread when I have informed him that it is occurring, but that is not good enough.  I can't and won't spend all my time policing his Sponsor's advertisements for him.  There are many sites out there that use pop-up windows for advertising that do not have a problem with malware pushers or fake anti-spyware services hawking their wares.  So why can't Patchou's current "distributor", Circle Distribution, do the same? If his "distributor" does not have the skills or technology to clean up the advertisements then he should find one that does.

  6. Patchou's software is used by *kids* yet he will not or can not stop the gambling, dating and age inappropriate advertising.

  7. Some of the pop-ups generated by his sponsor program direct users to Web sites that are a security risk in and of themselves, also attempting to install additional adware or malware.

  8. The sponsor program advertisements promote adware, they promote betrayware, they promote sites that in and of themselves are risky to visit.

  9. Yes, Windows Live Messenger (aka MSN Messenger) has advertising, but those advertisements do not present a security risk like that described in this blog post, nor are fake anti-spyware products or malware advertised.

Update: Sunshine, after reading all of the above, posted an apology to the now deleted thread as follows:

"I've read what you linked to and i also read the Spyware Sucks blog...apparently someone slashdotted an article from her blog.

Let me explain how i got to think she had anything to do with it:
I saw a TeMerc commenting on vitalsecurity article, wich i believed was Sandi..contribution to that confusion is a forumthread i found on TeMerc's forum in wich in the second post someone says "Sorry to be the one to burst your bubble Sandi" from wich i concluded first poster must be Sandi. I sincerely apologise to Sandi for this misconception..it was TeMerc i should have been refering to (whoever that might be).

Point remains however that Patchou's MVP status wasn't "discussed" until that article appeared on VitalSecurity.org."

Microsoft issues a statement about why they revoked Patchou's MVP status:
http://msmvps.com/blogs/spywaresucks/archive/2006/10/09/164071.aspx

Published Sun, Oct 8 2006 23:51 by sandi

Comments

# re: The saga of Patchou and his short lived MVP award

Sunday, October 08, 2006 11:39 AM by Voldemort
"Tanto peca el mata a la vaca como el que le jala la pata." -Mexican Proverb

# re: The saga of Patchou and his short lived MVP award

Sunday, October 08, 2006 11:47 AM by Voldemort

Dont misquote things (patchou) You wont find adult oriented ads in the sponsor program, they took them out. Proof please

Sandi: It has been reported that adultfriendfinder.com advertisements were seen as recently as the past 24 hours.  You can search my blog for previous articles about the issue.

# re: The saga of Patchou and his short lived MVP award

Sunday, October 08, 2006 5:58 PM by Sunshine

Hey did you bother to read on?...i apologised to you for mistaken another one for you. You bothered to update the links, yet you didn't bother to edit your quote of my post....

Sandi: I thank you for your apology.  Perhaps you should talk to whoever deleted the entire thread from the forums if you're concerned about how many people get to see it.  I've ensured the opportunity to review the thread remains and do not feel obliged to do more. 

If it wasn't for others preserving the thread, I would never have seen your apology at all.

# re: The saga of Patchou and his short lived MVP award

Sunday, October 08, 2006 7:01 PM by Voldemort

Sandi, screenshot please.

That was one of the ads that we requested no to appear.

Sandi: I saw your highly unsavoury, bordering on abusive, "joke" in the msghelp forums about MVPs (now deleted but quoted by others) so I am sure you can understand why I am not particularly inclined to be helpful to you at the moment.  In any event my working day and a new working week is about to start, so I will not be doing any further work on this issue until I have some free time (yes, that's right, I work full time, not being financially supported by adware).   Considering I have three malware infested PCs sitting beside my desk awaiting analysis, reporting and cleaning, and more coming in, it may be quite a while till I do a full install and report on the latest situation with MP sponsors.

There is nothing to stop you installing the sponsor yourself and waiting for the ads to appear.  Going on what has been said to me in the past they are often country specific, so you'll need to find people all around the world to test and report, just like I have done more than once.

# re: The saga of Patchou and his short lived MVP award

Sunday, October 08, 2006 8:33 PM by bradley

Have I seen worse ads on the desktops of some folks?  Yes.  But there was/is online gaming, DUI drunk driving attorneys, and single dating ads with girls in it that ... well they aren't naked or anything, but the image of the young women aren't career driven or anything like that.

Software that is trustworthy does not add web site addresses to bypass popup blockers.  It doesn't add a BHO to IE. It doesn't make you disable antivirus software to remove it.  And it doesn't have a capcha prompt.  Trustworthy software does not change my browsing experience so that I don't have to worry about what web site just grabbed the focus.

"Oh but just don't install it, everyone knows the sponsor software is crap".  They do?

Sandi and Paperghost were not behind this.  This was a concern that even if I were not a MVP I would be bringing to the attention of Microsoft as a shareholder that it was not in their best interests.

If I am told "oh everyone knows that's just crap, don't install the sponsorware" then why have it in the first place?  It taints a piece of software that has valid uses.  But the mere fact that it is there means that you cannot turn a blind eye to the fact that the actions that it has in installing software onto a system are not evidence of a 'responsible software vendor'.

Go read the Security Development Lifecyle and the Writing Secure Code Second edition.

Would Michael Howard write software and then offer it bundled with adware like this?  Would Linus Tovalds?  Name one other professional, serious piece of computer software that uses this to earn revenue?

As MVPs or as mere leaders of a community I would hope that we set the bar on standards of care.  This is not a standard of software distribution that is deemed appropriate in the industry.  

In fact, if Mr. Patchou really wants to be a leader, he stop using this manner of software revenue generation entirely.  

The decision is up to Mr. Patchou if he wants to maintain the status quo or be a true leader in this issue of software revenue generation.  

# re: The saga of Patchou and his short lived MVP award

Sunday, October 08, 2006 10:08 PM by MenthiX

Sandi, your entire post is based on Sunshine's quote... Sunshine admits she was wrong and even takes the time to post here and say sorry... but you still insist on claiming she wants to argue with you?

Sandi: <sigh> I claimed no such thing. 

People will just need to read 2 pages full of discussion to figure out she actually admitted she was wrong and doesn't want to argue over it?

Sandi: That's what I had to do to find it.

You put time and effort in updating the URLs to my mirror, but you can find the time to make a update on what was originally the entire point of your post?

Sandi:  I saw the apology *after* the update.

I said thanks for the apology in her comment, and that thank you stands.  If you want me to go and find her verbatim apology and post it I will do that, but after work when I have more time to go digging and edit the post.  My lunch break is short.

# The ethics of ....

Monday, October 09, 2006 2:30 AM by E-Bitz - SBS MVP the Official Blog of the SBS "Diva"

Between HP and the recent issues of the Board of Directors, to threads on PenTesting forums , there&#39;s

# re: The saga of Patchou and his short lived MVP award

Monday, October 09, 2006 12:48 PM by streather
awww poor msgplus fanboys, i rarely back them but ms were right to revoke mvp status for patchou, despite how many people tell me sob stories how he codes msgplus in his spare time for free, he doesn't he's getting paid by the sponser program to put their program in msgplus and it includes adware/spyware and that is unacceptable under ANY circumstance what so ever in my book, tbh i only use msgplus for the tabbed messages if someone did a patch that allowed me to do that on its own i'd be very happy :-) regards aragami

# re: The saga of Patchou and his short lived MVP award

Monday, October 09, 2006 4:18 PM by Annonymous

Honestly now, this is pure immaturity. Patchou deserved the award. Period. Microsoft Revoking it makes Microsoft look incredibly bad. Seeing Microsoft do this makes me think twice before I buy another thing made by Microsoft... They have no right to do that. They gave him the award because he deserved it, but took it away because of YOUR complaints and OTHER MVPs complaints.. End of story.

# re: The saga of Patchou and his short lived MVP award

Monday, October 09, 2006 6:00 PM by Chris

^ Holy ***. Pay attention.

Microsoft GIVING the award in the first place is what makes Microsoft look incredibly bad. (nb. 'Microsoft Gives MVP Award to Adware Pusher' media coverage)

They have every right to revoke it, how on earth could you think otherwise? You know nothing about the MVP award or how it works.

They revoked it because they became aware of the link with the sponsor, which they weren't fully aware of when deciding to award him.

If Microsoft genuinely felt he should keep it, he would have. Other MVPs could complain all they like, even withdrawl themselves, but it wouldn't make a difference. Your perception is all wrong. Microsoft makes the decisions, not MVPs.

Patchou keeping the award is more harmful to the status and reputation of the MVP program than the simple quick fix of removing him, with the only people complaining are potty mouth imbeciles.

# re: The saga of Patchou and his short lived MVP award

Tuesday, October 10, 2006 2:08 AM by Mark Rubins
Patchou getting the Award was a travesty and a disaster waiting to happen no matter what fanboys say about it. Myself and other ppl in the IT Security industry were very upset when we heard about this and if Microsoft wants to keep themselves as an enemy of Malware as opposed to a supporter they had no choice but to revise this decision. Whether it was due to not enough research on their part or just sheer ignorance and incompetance does not matter. By Patchous association with LOP Malware, he removes himself from being considered seriously as having made valuable contributions to the community at large. He has already chosen the way of greed and must accept the consequences or change his software. Thats all.

# re: The saga of Patchou and his short lived MVP award

Tuesday, October 10, 2006 7:59 AM by Tim

I believe that most comments about how Plus! is optional, are about the software being pushy. I don't think it's pushy, although choosing LOP as a sponsor was a mistake.

# re: The saga of Patchou and his short lived MVP award

Tuesday, October 10, 2006 9:09 AM by James

I say well done, when i first installed that plus addon, i was infected with all sort of adwares and spywares; it took me long before i could clean up my whole system.

here is an example that all developers should not follow!

# re: The saga of Patchou and his short lived MVP award

Tuesday, October 10, 2006 9:17 AM by NoName

Patchou has always been a greedy moron. It was an insult to give that idiot the award in the first place. Good thing they revoked it. I only regret I couldn't see his ugly face when the award was taken away from him.

# re: The saga of Patchou and his short lived MVP award

Tuesday, October 10, 2006 10:47 AM by Matthew

Wow, I stumbled on this strictly by accident, and what I've noticed is that Sandi may have turned on all the features in MSGPLUS, to show others the worst. But, if all that info is being installed on my 65+ year old father's computer NO WONDER he says it's slow all the time.  

My 2 cents:  MS is trying to keep themselves from getting into a deeper hole. Maybe it looks like they mistakenly offered it, but they are so big that mistakes can happen. Remember MS BOB?  :)

# re: The saga of Patchou and his short lived MVP award

Saturday, October 14, 2006 10:17 PM by Phil

the optional sponsor program is not from lop.com.

# re: The saga of Patchou and his short lived MVP award

Sunday, October 15, 2006 4:09 AM by sandi

Not another one - how easily people are fooled by some legal semantics and a quick name change....  ok, let's try this once more with feeling.

1)  Read the Sponsor Program EULA.  It says:

"..If you encounter any problems during the uninstall process or have any other questions about the Software, please contact us at "support@lop.com". DO NOT ATTEMPT TO USE A THIRD-PARTY UNINSTALLER OR ANTI-SPYWARE PROGRAM, INCLUDING AUTOMATED SCANS AND REMOVAL SWEEPS. The use of a third-party uninstaller or anti-spyware program may damage the Software and/or otherwise constitute a violation of this license."

and:

"SOFTWARE CONFLICTS Conflicts may occur with other software applications that may already be installed on your computer. The Software may report back to our servers what applications are running on your computer and this information will be used to help resolve these conflicts whenever possible. This will make the Software more reliable and provide you with products and services that are compatible with your current computer settings. In most cases CiD will only transmit this information back to CiD's servers if a software conflict has been detected. If you are having problems with a software product you have installed you may contact CiD's support department at support@lop.com for help."

and

"WHAT HAPPENS IF CIRCLE DEVELOPEMENT LTD. CHANGES ITS PRIVACY POLICY? By installing, using, or copying the Software you acknowledge that you have read, understood, given your informed consent to, and agree to be bound by this Privacy Policy. This Privacy Policy is subject to change by CiD at any time. Notice to you shall be made by adding any changes to this Privacy Policy document, which will remain posted at http://lop.com/privacy.html. You agree to review this Privacy Policy from time to time for changes and updates. Notice of any revisions to this Privacy Policy shall be considered effective when transmitted to the Software or posted on http://lop.com/privacy.html. "

2) http://spyware-free.us/2006/10/messenger-plus-writeup.html

Now, do you have any further questions Phil?

# re: The saga of Patchou and his short lived MVP award

Tuesday, October 17, 2006 8:56 AM by a user

give him back the award, Plus! is one of the things that make messenger usable at all & he deserves it.

Sandi says:
http://msmvps.com/blogs/spywaresucks/archive/2006/10/09/164071.aspx

# re: The saga of Patchou and his short lived MVP award

Wednesday, November 01, 2006 4:46 AM by Bodosan

I wonder how many of the defenders of this software really installed the sponsor software to help this person Patchou earn his income. Imo it should at least be all those who are defending the inclusion of such sponsor software with the program. If they didn't install the sponsorsoftware they are withholding income from their coveted programmer. Still they defend his decision to bundle sponsorsoftware with his app.

So who should install this sponsorsoftware? If nobody does there isn't much income and the whole purpose of bundling this software is futile.

# re: The saga of Patchou and his short lived MVP award

Monday, November 13, 2006 11:17 AM by TomX

What Patchou do ? An app.. that's it ? I think that a MVP must be a person who help on their own webpage or in forums. But give a MVP award just because he is good in some language ?

"technical expertise" ? Yes

"strong community contribution" ? Bullshit