Adobe modifies hosts file to detect whether Creative Cloud is installed (osnews.com)

by rglullis 171 comments 344 points
Read article View on HN

171 comments

[−] Duanemclemore 39d ago
I have been an Adobe user since 1996. Starting with Photoshop 3. Then, using the rest of their programs since 1999.

Between this and the fact that they've just 1. Changed all the old accounts to "Adobe Creative Cloud Pro" 2. DOUBLED the monthly fee, now charging you for the AI features whether you want them or not, and 3. Removed any tiers that have full program access but no AI, I am walking away forever when my current month expires.

Not to mention, students now only get the old $19.99 membership for the first year.

I teach visualization and representation tools to architecture students. I had always taught them Adobe products before. Now I can't in good faith sign them up to have their expertise tied to using this program stack forever. So tomorrow I am giving them a lecture on free to use and FOSS versions of the same tools. And I'm going to teach the class from them in perpetuity. Congratulations, Adobe that's 50+ students a year who won't be using your products when they graduate.

[−] mishkatronic 39d ago
Is that not potentially detrimental to your students if the use of Adobe products is a more common industry practice?
[−] Duanemclemore 38d ago
No, the concepts are the same. The button you push is incidental.

For example, the GNU Image Manipulation Program now has non-destructive workflows and adjustment layers - and can easily easily be configured with photoshop-like keybinds anyway.

That's not to mention free-to-use tools like Affinity.

The things an architecture student needs it for are:

Photo adjustment:

Lightroom -> Darktable

Photo retouching:

Photoshop -> Affinity Pixel or Gnu Image Manipulation Program

Vector drawing (which for us is mostly processing from 3d modeling programs):

Illustrator -> Affinity Vector or Inkscape

Board and Book Layout

InDesign -> Affinity Layout or Scribus or VivaDesigner

Plus, for motion graphics and video processing, my partner and I have had great luck replacing AfterEffects and Premiere with Blender and DaVinci Resolve, respectively.

And ... believe it or not, I've had excellent luck with LibreOffice Draw as a PDF editor, so anything they would have needed Acrobat Pro for is covered by that (and / or PDF SAM).

The real "sticky wicket" is Revit. Autodesk has been a FAR more abusive company for FAR longer, but it's what we're stuck with - although the emergence of the BIM Workbench (Building Information Modeling) with the release of FreeCAD 1.0 [0] and the continued development of BlenderBIM (oh, now called BonsaiBIM) [1] at least gives some hope.

Anyway, for the Adobe replacements, here's more [2] based on [3]

[0] https://wiki.freecad.org/BIM_Workbench

[1] https://bonsaibim.org/

[2] https://github.com/KenneyNL/Adobe-Alternatives?tab=readme-ov...

[3] https://x.com/XdanielArt/status/1799474607055102257/photo/1

[−] benterix 38d ago

> Autodesk has been a FAR more abusive company for FAR longer, but it's what we're stuck with - although the emergence of the BIM Workbench (Building Information Modeling) with the release of FreeCAD 1.0 [0] and the continued development of BlenderBIM (oh, now called BonsaiBIM) [1] at least gives some hope.

I believe AutoCAD is the epitome of what is wrong with Autodesk. It's expensive, there is no permanent license, there is basically no real alternative, and they aggressively go after pirated copies.

If I were a vibecoder, instead of silly toys like a half-broken compiler that nobody uses, I'd focus all my energy and tokens on creating a real Autodesk alternative. And if it really worked, including seamless witch, the authors would quickly make tons of money.

[−] SpaceNugget 38d ago
I think at the current level of LLM code I have observed there's basically zero chance they can produce a competitive cad/cas. Maybe they could approximate an open source kernel like opencascade but I don't see the point in that when freecad already exists.
[−] Duanemclemore 38d ago
Unfortunately it looks like BricsCAD has gone the SaaS way, but they are an extremely mature alternative to classic AutoCAD 2d and 3d [0]

Additionally, Rhino has always been a good drafting tool [1] but my understanding in the current WIP (which if I'm guessing will probably be released as 9.0, within the next 6-12 months) is making a huge push to include better drafting tools. McNeel, the developer, has no plans to go to a subscription model.

[0] https://www.bricsys.com/

[1] https://www.rhino3d.com/

[−] g8425 34d ago
I'm very interested in moving away from after effects - hearing of your success is encouraging! Can you recommend any resources for making the jump?
[−] Duanemclemore 33d ago
Our use case for After Effects was video stabilization. We have had good luck with Blender for this. I've also noticed that the old simple motion graphics I used to do - title overlays, etc - Blender can do easily. As for more intensive motion graphics, I can't speak too much to that.

As for any After Effects-style NLE capabilities - DaVinci Resolve knocks those out of the park. You'll also probably hear a lot of people singing the praises of Natron for NLE and Motion Graphics, and from our experience with that it seemed like the learning curve was non-trivial, but anything AE (and some aspects of Premiere Pro) could do, it could match... Good luck!

[−] raxxorraxor 38d ago
I think it is the opposite of detrimental and should have been best practice 10 years ago already. Same goes for software development, which I regard as a creative exercise as well. Today the software landscape is different and learning the common industry workflows is probably the least difficult part of any design curriculum.

Detrimental would be to subject students to the whims of Adobe, which doesn't really have that much moat any more.

[−] eqvinox 38d ago
Probably different at huge companies, but small employers I know don't care how you get your work done. If anything they're happy if they don't have to buy/rent licenses for you.

…now that I think about it, don't architects predominantly work in smaller companies?

[−] knigyfrrob 38d ago
Speaking as a lifelong graphic designer with over 20 years experience under my belt: it really doesn’t matter what kind of software you use, HOWEVER, not using the industry standard can bite you in the ass quite fast. PDF export can be finicky, colour management is hit or miss, collaboration is nearly impossible…

I wish someone would come and take Adobe’s monopoly down for good, but as it stands, shunting Adobe for something else in a professional environment is more trouble than it’s worth.

[−] Duanemclemore 38d ago
It's absolutely very important for students to understand what standard they'll be held to in industry. But few architects need an intricate understanding of the real publication-facing aspects of the programs. In our case, using these tools is pretty much always in support of getting the output of 3d modeling / BIM tools / photography of physical models into presentable shape. Going away from Adobe might be unwise were I teaching graphic design students, but for these students, those more sophisticated, domain-specific expertises are a lot less essential.
[−] Ylpertnodi 38d ago
What alternatives do you suggest?
[−] Duanemclemore 38d ago
See my comment below, or here [0] and the same on github here [1].

[0] https://x.com/XdanielArt/status/1799474607055102257/photo/1

[1] https://github.com/KenneyNL/Adobe-Alternatives

[−] ryandrake 39d ago
As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. Dumping crap all over C:\Windows or /usr or /boot or something? No way--the OS should make the developer obtain my consent (not just a blanket sudo-like escalation) to do these things. Sneakily modifying /etc/hosts to act against me? Get the hell outta here!
[−] inetknght 39d ago

>

Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine.

I used to have this opinion too.

Then I decided that I actually don't want random things to install to /usr/local/bin. They should install to ${HOME}/.local/bin. I should be perfectly capable of installing any application without modifying the system for every user.

[−] lmm 39d ago
You should have that option, but you should also be able to install things for all users. That's a pretty common case - most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer.
[−] inetknght 39d ago

>

most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer

Speak for yourself. For installing via system packages, yes. Otherwise absolutely no.

Most of the time if I install something on my computer without using the package manager, I am the administrator of that computer and I want the thing I installed to be available to a specific run-user, not to all users.

[−] tremon 38d ago

> I am the administrator of that computer and I want the thing I installed to be available to a specific run-user

Are you saying you use root access to install something to a specific user's home directory? That's gross.

A user installing something for themselves should not need administrator access. You only need admin access for making system-wide changes.

[−] lmm 38d ago
If you set up dedicated run-users for specific programs then you're very much the exception rather than the rule. I think it's reasonable for tools to serve the common case by default.
[−] Dylan16807 39d ago

> Speak for yourself. For installing via system packages, yes. Otherwise absolutely no.

That's an overly strong rebuttal given they said "most" and weren't talking about a specific style of install.

[−] armadyl 39d ago

> As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers.

Funny enough macOS, iOS, iPadOS and Android do this and they are constantly attacked for it.

I do think there needs to be more strict adherence by developers to standards like XDG but I don’t know how it could be enforced.

[−] nulld3v 39d ago
They are constantly attacked because they prevent users from modifying the system configuration, not just app developers.
[−] simondotau 39d ago
From the operating system’s perspective, everything is the user. Or everything is an app developer. Depends on perspective. Disambiguating reliably, in a way you’d consider reasonable, is not trivial (and arguably impossible).
[−] Dylan16807 39d ago
Phone-style isolation is more like giving each app a separate user account. With that level of isolation and robust permissions, apps can do very little "on your behalf".
[−] simondotau 39d ago
How do you do anything on a computer that’s not via an app of some description? Do you make arbitrary exceptions for the likes of zsh and chmod? How does the OS know that chmod was knowingly run by the user, and not by some “sudo wget” exploit?
[−] Dylan16807 39d ago

> How do you do anything on a computer that’s not via an app of some description? Do you make arbitrary exceptions for the likes of zsh and chmod? How does the OS know that chmod was knowingly run by the user, and not by some “sudo wget” exploit?

I'm not sure what the purpose of the question is, because a unixy command line doesn't use phone-style permissions. I didn't say everything works this way.

If I installed photoshop with phone-style permissions, it wouldn't be able to invoke chmod and wouldn't even be able to access my downloads folder.

(Trying to tighten down a command line shell ends up being a tangent, but the short answer is that zsh itself would need to be trusted and hardened, and wget would not be allowed to run chmod. When it comes to downloading a script and then running that script on purpose, you probably just have to accept that doing so bypasses the permission system. Thankfully I very rarely need to do something like that.)

[−] selcuka 38d ago
So you installed a text editor and wanted to edit /etc/hosts. Should the OS permit you to save your changes or not?

Now what should happen if the text editor decides to modify /etc/hosts without your knowledge?

[−] Dylan16807 38d ago
The secure answer is that the OS gives you a trusted file picker and it grants access to that specific file to the text editor.

This works better with a GUI, but you can adapt it to a console too.

[−] lmz 38d ago

> Now what should happen if the text editor decides to modify /etc/hosts without your knowledge?

Pop up a UAC prompt of course. It worked so well for Vista.

[−] nulld3v 39d ago
I'm not sure I fully understand you. All those OSes try very, very hard to disambiguate between apps and the user itself?
[−] lmz 39d ago
A program touches a system file. Is it due to its own logic, or is it your editor saving a file?
[−] semiquaver 39d ago
If a user can do a thing, then an app can ask the user to delegate those permissions to it. And since 99% of users don’t read permission dialogs, the two ideas are completely equivalent. The only way to prevent an app from doing a thing is to make it impossible.
[−] gjsman-1000 39d ago

> I do think there needs to be more strict adherence by developers to standards like XDG but I don’t know how it could be enforced.

It can't be enforced. Developers can and will always do whatever they want with the tools available. For good ends (Adobe) or for ill (malware).

If you try to fix it with sandboxing and closed app stores (Apple forcing sandboxing and using SIP), you get attacked. If you don't try to fix it and let devs do as they please (Microsoft allowing host file editing), you get attacked. The conclusion of these incompatible goals? HN and nerds have zero relevance in policy discussions, because they don't have a consistent policy to offer [1].

[1] Unless, of course, you define "devs shouldn't be able to do anything bad even if they choose" and "users should be able to anything bad if they choose" and "users should be able to write their own software capable of bad things while simultaneously not being held to the standard of devs" as a compatible principled position.

[−] massysett 39d ago
Meet macOS System Integrity Protection. Even root can’t do some things. Some hate it, I love it and would never turn it off. I know some parts of my system haven’t been gunked up by random vendors.

https://en.wikipedia.org/wiki/System_Integrity_Protection

[−] mikkupikku 39d ago
I thought the days if needing to "sudo" to install applications on windows were long gone; doesn't basically everything happily do user installations now? I would view a demand to escalate as basically proof that the application is about to do something janky, if not outright malicious. On linux, if I can't build and run software with just my user account, that software has some explaining to do. Virtually every desktop application should be able to run without escalated privileges.
[−] mhh__ 39d ago
I won't name names just in case I'm misremembering but I'm pretty sure a remote desktop program you've heard at one point was adding a global LD_PRELOAD and pointing it at a shared library that anyone could write to.

But I might be making this up so not being specific lest I do a cheeky libel

[−] anal_reactor 39d ago
The problem is that you have 100 apps that want to overwrite system files for malware reasons and then you have 1 app that wants to do it for legit reasons and there's no blanket method to tell these two situations apart.
[−] qq66 39d ago
This is why I love iOS in many ways: it's very difficult for an app to have "action at a distance" inside your OS. If you force-quit the app it's pretty much like it never existed.
[−] dev_l1x_be 39d ago

> developers should not have free rein to modify my system's configuration

s/free rein/the ability/

I am a big believer in read only operating systems. /etc should not be writable.

[−] jbverschoor 35d ago
They can have all the root they want In a sandbox or vm
[−] matsemann 39d ago
Oh well, as a teenager, blocking adobe servers in hosts file was how you got to "phone activation" and could generate a code. So I guess we're even, heh.
[−] lousken 39d ago
How is defender not flagging this? Changing hosts file should raise alarms
[−] dblohm7 39d ago
I don't know whether is still does this, but 8-9 years ago I discovered that Acrobat overwrites the COM registry entries for Microsoft Active Accessibility (oleacc.dll) such that any application attempting to instantiate MSAA gets the Adobe DLL instead of the system DLL. This actually broke the stuff I was working on and had to override it in my app manifest to forcibly use the system version.

I inquired about it and got some BS about how they absolutely _had_ to do this to intercept MSAA instantiations across the system, when in reality they were using a global solution to solve a local problem.

[−] basilikum 39d ago
I'd like to answer the closing question

> At what point does a commercial software suite become malware?

The vast majority of commercial software is malware.

[−] hypeatei 39d ago
Looks like they got a wildcard certificate for *.creativecloud.adobe.com[0] so that the HTTPS connection works and so they don't have to publish DNS records for the "detect-ccd" subdomain to obtain a cert. Pretty neat setup, but also kinda hacky.

0: https://crt.sh/?q=creativecloud.adobe.com

[−] lemoncookiechip 39d ago
Adobe really relishes being a villain. I don't understand how one company can be so anti-consumer.
[−] Terr_ 39d ago
Recycling a comment from prior discussion (4 days, 68 points, 13 comments): https://news.ycombinator.com/item?id=47617463

_______

Oh helllll no. Let's imagine an analogy for Adobe leadership:

1. You hired a night janitor to clean and vacuum your executive offices.

2. That janitor secretly stops at every desk-phone to alter the settings of voicemail accounts.

3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!"

What's your reaction when you discover it? Do you chuckle and say something like "boys will be boys"? No! You have a panic-call, Facilities revokes access, IT starts checking for other unauthorized surprises, HR looks into terminating contracts, and Legal advises whether you need to pursue data-breach notifications or lawsuits or criminal charges.

* Is it acceptable because they had some permission to touch objects in the rooms? No.

* Is it acceptable because the final effect is innocuous? No.

* Is it acceptable because the employment contract had some vague sentence about "enhancing office communication experiences"? No.

* Is it acceptable if they were just dumb instead of malicious? No.

No person that would blithely cross those lines can be trusted near your stuff, full-stop.

[−] hatradiowigwam 39d ago
Whether it's run as root/administrator or not - you can disable this behavior by setting the immutable flag on /etc/hosts. No user, including root, can write to a file with the immutable flag set(although root could _remove_ the attribute and then write).
[−] dpedu 39d ago
I installed Creative Cloud just last week. No such entry was created in the hosts file on my macOs system.
[−] cyanydeez 39d ago
Are we sure this is to detect Creative Cloud instead of, trying to detect whether you have/had a pirated version of Adobe installed? Some reference material I've seen often involved blackholing adobe hosts to prevent installation software from verifying or otherwise talking to adobe.
[−] stego-tech 39d ago
Honestly, I've been dealing with crap like this for so many decades that I'm a fervent supporter of every "installer" just showing and logging a Git PR-styled diff to the user of every file and system change, everywhere in the system, complete with the ability to rollback from it.

I am tired of inconsistent logging, opaque system changes, and vendors generally being malicious with endpoint security in the name of protecting profit.

Screw the "show me the log" option that scrolls by in a flash and you can't get back to, show me the damn diff first.