Slashdot Mirror

TOR is already proven to be pretty unreliable since the exit node can sniff all the traffic, have enough exit nodes and you can track your target.

Even without compromising or joining up exit nodes, deanonymizing (see: 1 2) is a problem for the uninformed users of onion routing and proxies.

1. GnuPG. I don't have any books on PGP or GPG, but the online documentation is horrendously incomplete and inexact.

With GnuPG, it took me quite a long time to find out that the secret key is still encrypted even when it's exported, though the existing documentation says that's it's insecure to export your secret key. How then, if that's insecure, are you supposed to share a single secret key among multiple computers?

GNU / GPL (Copyleft) The spyware that Sony installs on the computers of music fans does not even seem to be correct in terms of copyright law.

It turns out that the rootkit contains pieces of code that are identical to LAME, an open source mp3-encoder, and thereby breach the license.

Sony complied with non of these demands, but delivered just an executable program. A computerexpert, whose name is known by the redaction, discovered that the cd "Get Right With The Man" by "Van Zant" contains strings from the library version.c of Lame. This can be conluded from the string: "http://www.mp3dev.org/", "0.90", "LAME3.95", "3.95", "3.95 ".

But the expert has more proof. For example, the executable program go.exe contains a so called array largetbl. This is a part used in the module tables.c of libmp3lame.

This discovery can have far-stretching consequences for the music giant, who claims only to protect copyrights. Previously, judges in Germany already forced various companies to release source code to the public and to deliver the goods necessary for compiling. It is also possible to demand financial compensation for damages.

Meanwhile, Other details are also becoming clear. The Electronic Frontier Foundation complains that the spyware makes the legal listening to the music on iPods impossble. The organisation is busy making a list of cds containing the hidden software and publishes this on her website.

Various calls to SonyBMG remained unanswered despite promises to call back.

Maybe Sony will get what it deseves then.

The spyware that Sony installs on the computers of music fans does not even seem to be correct in terms of copyright law.
It turns out that the rootkit contains pieces of code that are identical to LAME, an open source mp3-encoder, and thereby breach the license

http://dewinter.com/modules.php?name=News&file=art icle&sid=215.

Sony rootkit violating GPL?, Seems to include parts of LAME?
http://www.hydrogenaudio.org/forums/index.php?show topic=38700

The spyware that Sony installs on the computers of music fans does not even seem to be correct in terms of copyright law.

It turns out that the rootkit contains pieces of code that are identical to LAME, an open source mp3-encoder, and thereby breach the license

http://dewinter.com/modules.php?name=News&file=art icle&sid=215.

http://dewinter.com/modules.php?name=News&file=art icle&sid=215

Looks like the corporation defending copyrightsmay have some copyright problems of their own.

A computerexpert, whose name is known by the redaction, discovered that the cd "Get Right With The Man" by "Van Zant" contains strings from the library version.c of Lame. This can be conluded from the string: "http://www.mp3dev.org/", "0.90", "LAME3.95", "3.95", "3.95 ".

English translation at
http://dewinter.com/modules.php?name=News&file=art icle&sid=215

"A computerexpert, whose name is known by the redaction, discovered that the cd "Get Right With The Man" by "Van Zant" contains strings from the library version.c of Lame. This can be conluded from the string: "http://www.mp3dev.org/", "0.90", "LAME3.95", "3.95", "3.95 ".

But the expert has more proof. For example, the executable program go.exe contains a so called array largetbl. This is a part used in the module tables.c of libmp3lame."

"Nonetheless, the spokesmen of Sony BMG Nederland says that Xcp will be introduced in Europe, and therefore also in the Netherlands, in 2006."

The article further contains no less then 17 dubious features of the Sony software, basically the same ones as circulated the news lately. However, number 15 is interesting. Blankesteijn claims he received spam after entering his e-mail adres in the request form for the Xcp removal software:

"15. Not only is this [filling in a form] in-necessary complicated and time consuming, Beet (the magazine) immediately received spam from Sony BMG containing an advertisement for their multimedia software. It turns out somewhere along the road you could have clicked on a link to Sony MBG's privacy policy. There it says your mail address can be added to marketing lists. But is very well possible that the user will not notice this link. In any way, nowhere is asked for permission to do this, which will make this way of handling illegal in many countries."

Another interesting Dutch headline involves the discovery that the rootkit contains parts of LAME, a LGPLed mp3 encoder. A translation can be found here.

It is unclear what LAME is used for in the kit, but according to it's about page, Lame can also be used for decoding. In that sense, this usenet post by a first4internet employee shows that the company producing the rootkit at least has an MP3 player, which of course might be part of the Sony rootkit:

"I am currently writing an MP3 player with lots of bells and whistles including a wave editor, fades, reverbs etc. What I now need is to be able to protect the files it creates. I have already written the routine to convert the MP3 into a WMA file. Does someone have some simple C++ code which can write Microsofts DRM v1 properties that the user whishes to set (i.e. 3plays 4 copies etc) over the unprotected file to make it protected. There may be some cash on offer here if its easy to use! All I need is a procedure that performs this."

And if you're thinking you're safe for these kind of kits because you're on a mac, well, it might not be for long. Of course this is pure speculation, but at least one F4I employee is asking questions about mac programming issues...

A translation of the article can be found here.

You're absolutely right. Just last week FFII and Nutzwerk settled in a German court about, amongst others, FFII referencing to the translation of a Dutch article by WebWereld, also published in English on the site of the author, Brenno de Winter. De Winter published statements by Nutzwerk CEO Holzer where he called FFII Chairman Pilch a "catagoric lyar".

WebWereld reports(Dutch) that in the settlement FFII and Nutzwerk agreed that FFII stops commenting on Nutzwerk and Nutzwerk stops sueing them.

An interesting detail about Nutzwerk is that they used to maintain a link farm in order to get high ranks in Google. Amongst the files in the farm, was a file scheiss_juden.htm which was apparantly meant to increase the probablility googling jew haters would find their anonymity services. According to a German article, the link farm was set up as to allow only web-crawlers to the farm contents and at some point Google had 51.000 links pointing to the Nutzwerk site. At this moment only 908 remain, after apparantly the Google cache has been wiped.

Now some fun: Google for the combination of "Rene Holzer" (Nutzwerk CEO) and "Michael Koustiniko". You'll probably find this post, where Mr. Koustiniko signs as "Rene Holzer". Digging a little further shows that our friend used this alias to advertise his products.

What's also interesting is that in their previous legal actions against Cobion AG, during which 2 of Nutzwerk's software patents were invalidated, Nutzwerk was represented by Günter Freiherr von Gravenreuth, an attorney well known in the computer scene. For instance, he was was behind the much publicised Tanja campaign where he tricked computer users into sending a list of pirated software to "Tanja", on the receiving of which he sent them a cease and desist notice along with a request for payment, he shut down emule.de (German), extorted SuSE, demanded Linus Torvalds to drop the Linux name and last but not least was involved in the cases around MobiliX as the registrar of the trademark Obelix.