The mystery of spontaneously installed Growl
Product mentioned in this article
Back in 1984, the original Mac could only run a single program at a time. But we’ve come a long way in the last quarter century and these days our computers can do more things at once than we can—or often want to—count.
Growl ( ) is a notification service that helps you keep track of all those things. It manages those events and keeps you in the loop. An application tells Growl that something happened and in turn, it will present that information to you in a method of your choosing. The default notification (and likely most popular) is with little translucent boxes that appear in the upper right-hand corner that fade out after several seconds with an icon and some text.
Growl isn’t part of the OS; it’s third-party software. Many third-party programs use Growl, and sometimes a program will install Growl without making it obvious to the user. And that has created a bit of stir with the Growl developers.
The strength of Mac OS X is in the software on the platform: some good, some bad, some expensive, others free. The question is, how does a good, free piece of software that is even copied on other platforms, end up with angry users?
I recently talked to two of the people behind Growl and the issue of its installation. (Instructions for uninstalling Growl are available on the Web.)
Derik DeLong: Who are both of you?
Cristopher Forsythe: I’m Chris, the Project Lead for Growl.
Peter Hosey: I’m Peter Hosey, lead developer on the Growl project.
CF: Essentially we both have final say the direction of Growl, with Peter focusing on developery things, and Chris focusing on the other stuff.
Peter is also a Developer on Adium, and has spent a lot of time on his blog talking about programming and providing applications to help people with all sorts of things.
Myself, I was previously the Project Manager for Adium, and I’m the Project Manager for Perian. I also have the most awesome 6-month-old on the planet.
DD: For those that don’t know what Growl is, what is it? What does it do for a user?
PH: It’s a free, open-source notifications system for Mac OS X.
It enables applications to send the user notifications, which, by default, Growl displays as little rounded-rectangle bubbles that fade in and out on the screen. Growl also enables the user to configure how it displays the notification; options include alternate styles of bubble, reading the notification aloud via text-to-speech, and even sending SMS messages or (with a third-party plug-in for Growl called Prowl) iOS push notifications.
CF: Growl is this cool notification thing for OS X that we’ve been working on for about seven years now. Say you have a few applications open on your Mac, and you receive an e-mail. Without having to go over to your mail program, you can get a summary of what’s going on.
What I use Growl for is very limited, actually. In Adium, I like seeing notifications from people if Adium isn’t the directly used/front/active app. I like knowing when uploads complete in Cyberduck, and then a few random things in iTunes.
Other people love things like our HardwareGrowler, which tells you when some hardware is plugged in and unplugged, or when they get onto a new wireless network. And of course people love GrowlMail.
DD: A lot of people have been angry with you on your mailing list. Why?
PH: Some applications install Growl on the user’s system without asking the user for permission. When the user discovers Growl on their system, they blame us, not knowing that it was somebody else’s software that installed it.
They usually find out Growl is installed through Growl’s own update notifications. This happens because the applications install what is now an old version of Growl, so the next time that it is out of date and does its update check, it finds that it is out of date and reports that to the user. This is intended for users who chose to install Growl; users who didn’t choose to install Growl mistake it for an ad.
(Growl is completely free. It has no ads of any kind in it.)
Most applications either install Growl with the user’s permission, by using a framework that we distribute that asks for permission before installing, or don’t install Growl at all. The vast majority are the latter. We know of four applications so far that install Growl without the user’s permission; a tiny minority, but at the same time, entirely too large.
CF: In the last year and a half we’ve seen a change in the way that developers distribute Growl. First, there was Dropbox. Dropbox decided to basically install Growl if you left a box checked when it installed. If you removed Growl, then Dropbox would reinstall Growl whenever it needed to use Growl. (Dropbox has subsequently released an updated version that fixes this reinstallation issue, but Dropbox does still install Growl without prompting the user. —Ed.)
PH: The user must make a specific change in Dropbox’s preferences to prevent this. This is the leading cause of “I uninstalled Growl and it came back!” e-mails.
CF: Crazy, right? You decide to remove something, and something else reinstalls it? You have to know that you should go to Dropbox and disable a checkbox. The best part? Dropbox has had a fixed version in their forums for months, and hasn’t released it to the general public. Plus, they asked us to remove our notice that Dropbox is one of the problem applications. Dropbox has promised to release a new version which addresses this, but that means that all users would need to update before the problem goes away for us, the people working on Growl. (The Dropbox developers declined to comment.—Ed.)
We amazingly didn’t get that many hits on it, though. Either Dropbox didn’t have a lot of users at the time, or most of those users had Growl already installed.
This all changed recently. When Adobe shipped CS5, they decided to install Growl without even telling people at all. We didn’t even know about it for two weeks after CS5 shipped. Around the same time, it seems that the Dropbox users started flooding in more, and we even found another application doing the same thing, but in a worse way.
Then the floodgates opened. We’ve received more complaints about this single problem than about anything else. People are angry, calling us names, calling Growl names. Thank goodness we have a good reputation, and that we have good users who are defending us.
Now, some of the people contacting us are nice, they tend to just want to know what Growl is. Some call us horrible things. Either way, the situation is just awful.
When we really noticed the problem is when we put out a new version. Our version updating system is in dire need of being improved, and is going to be in 2.0. We’ll be switching to Sparkle then. However, that doesn’t fix the older versions. So after we got past the bump of people who had installed CS5 and Dropbox, and thought we were in the clear, we ran into an issue where end users were being told to install this Growl thing that they just don’t know about at all.
So, say you are a user who installed Dropbox and left the default on today. What would happen is some time in the next 24 hours, you would receive a popup saying that a new Growl is out. You can either update that, but most likely you’ll try to figure out what Growl is. Say you get that far, figure out what Growl is, and you remove it? Is that all? Nope, because the next time Dropbox needs Growl, it’ll install Growl. An older version of Growl. Within 24 hours of that happening, Growl reappears.
It’s enough to make anyone want to scream at the screen. So some users just scream at us instead.
DD: Is there any recourse you can take against these companies?
PH: Not really. Nearly all Growl software, including the core Growl software and the Growl frameworks, is under the BSD license, which pretty much allows application developers to do whatever they want with it. Thus, they are complying with the letter of our license, though not the spirit.
CF: Against the companies? Not really. We could talk bad about them in public, but what’s the use in that? That just makes them irritated, and isn’t good motivation to fix the problem.
We could send users their way, but at the point that they’ve found us, I’d rather we just help them through the problem, and fix it for them. It doesn’t fix the big picture, but it does help that person. Which is what we’ve come to think matters. We’ve always tried to make things work for people.
The companies meant to do good, but did it in a way without thinking about the users.
One user asked us about legal recourse. I don’t want developers working with Growl fearing that we’ll take them to court, so to me this just isn’t an option. I just want Growl to be shipped in a way which doesn’t cause us or users problems.
DD: Is there anything you can do to prevent future products doing the same?
PH: Nope. It’s the same problem faced by digital rights management: If an application developer can get their hands on an end-user installation of Growl, they can install it on their own users’ systems the same way. Anything we might implement to try to thwart such installations (e.g., having our Installer package leave some token for the installed Growl to check for), they could defeat by mimicking the same action (e.g., by leaving the same token).
Moreover, anything we implement in a new version of Growl won’t affect the old versions still installed by applications.
CF: We’ve been talking about a kill switch today, but that won’t help with the older versions that these applications are shipping. There’s not a whole lot we can do. Any application can ship any version of Growl that they want to.
Now, we have for years provided a way to ship Growl, but that method validates that the user wants to do this, and also should not prompt again. We’re going to try to beef that up for 2.0, but we don’t have a lot of people/resources to do that.
DD: What have you done so far to help these unhappy unintentional users with their plight?
PH: We provide detailed instructions on how to get Growl off your system and keep it off, and an explanation of how this happens in the first place, on our Website.
CF: We’ve basically done a few things:
- Received promises from the offending companies that they will put out updated versions;
- Tried to make it easy to contact us. Just sign up for the Google group and ask questions via e-mail or the Web;
- Put up a page describing the situation;
- Tried to be nice when they are not. I’ve not always been the best person at this, but when people call what you think of as your baby (metaphorically) and have worked on for an extended period of time, some days that is difficult.
DD: What would you like to personally say to them?
PH: That we hate this, too. We hate it when people install software—any software, including ours—on other people’s systems without permission.
We ask users to contact the developers of these applications to ask them not to do this. They’re the ones doing it, so they’re the ones who need to be told to stop.
There is nothing we can do about it. If there were, we would do it, but there isn’t.
CF: I’m sorry they are in this situation. I’m not sure what else I’d say to them to be honest. The situation is horrible to be in. On the plus side, there’s a way out of it.
DD: Do you have any advice for people looking to develop similar framework software in the future?
CF: Be prepared for all sorts of weird stuff. We never saw this coming.
That said, when we made Growl we had no idea it would get this popular.
PH: If your program gets popular enough, be warned that some developers might like it a little too much and be a little too eager to share it with their own users. Make it as easy as possible to uninstall and provide users with clear instructions on how to do that.
DD: Is there anything else you’d like to share?
CF: If anyone has any contacts at Adobe, Dropbox, or any of the other offending vendors, please ask them to get the update shipped soon. Other than that, if anyone has ideas for helping to improve the situation, we’re glad to work through that. Just hit us up on the discussion list.