Slashdot Mirror
Real Networks And More Privacy Concerns
Arrogant-Bastard writes: "Lauren Weinstein's Privacy Forum Digest V09 #15 reports
that RealNetworks' "Download Demon" forwards the details
of any download (i.e. URLs, filenames) to RealNetworks.
See The Digest
for details. " Now, granted, this time the program, if you read the fine print, says that it will do this - but c'mon people - how many bone-headed moves do you have to make?
We live in a digital age. It is becoming ridiculously easy to track people wherever they may go, in real life, or on the Net. I have a very different opinion to that of most people I have spoken to- namely that I accept that in all probability people are watching me to some extent,and accept it without qualm.
For example, my bank would be able to tell me that at the start of this month, I went away for a weekend to London by car, while I was there I travelled mainly by Tube, I visited Kingston and Wimbledon, and that I probably stayed with a friend. That's quite a lot of information to be derived from a few transactions on my debit card- but it's perfectly possible to infer this from just a small amount of information.
My cellphone company could tell me I have family in Scarborough despite the fact they've not got their address.
... and so on. Fact is, it's very very easy to track someone through their real life. As far as I understand it, why should life on the Net be any different? I accept that anonymity is nigh-on impossible in real life, so why should I expect more on-line? Cookies can be used to track where users go on the net, and indeed are. Why should I care? I accept the fact that I have no / very little privacy and live with it.
This may seem very scary to some of you, but why? Unless you've got something to hide, why do you need your privacy? I don't think you do. I know I certainly don't.
--
Said it couldn't last, said it wouldn't last... This is the last stand against tomorrow's world.
it has become clear that the terms of the license agreement should be compared in the same way as price when making an informed buying decision.
Great insight!
Many programs are available for download for free (as in free beer), but there is still a cost. People are not charging money for the product, but that does not mean that they are not making a profit from your use of the product.
Free email accounts on the web, free dialup accounts, free streaming media software... You don't pay any money for these products and services, but what do you give up in exchange?
Often you are asked for information such as an email address, and other contact information. If they are particularaly cheeky they might ask you for your age and education/occupation and annual salary.
The software might be free, but if the EULA includes a statemant like Each use of our product constitutes agreement to pay a $1 fee billed to you through your ISP after stripping your IP. coupled with the now standard statement at the end Any part of this EULA may be changed without notice then there is a cost, but it is in a place where we traditionally do not look for a cost.
The price or cost of using a piece of software is agreeing to the terms and conditions of the EULA. We are used to the others not knowing what is happening on our computers. However, with dedicated connections to the internet and software that reports back to the owner about what is happening on your computer, we are no longer able to disregard the EULA with by thinking "what they don't know won't hurt me".
Several others have made the comparisson to a trojan horse. What I am waiting to see is what will be the first piece of software to report back to it's owner about other software on your computer. When will a program relate all of your keystrokes back to the owner while the program is running? All the software on our computer? The contents of the files?
Many people (probably not on
Is it ok (legaly or ethically) for software to do anything it wants to simply because you agreed to let it in some obscutre clause of non-standard licensing agreement?
For now I don't see any solution other than to read the EULA very carefully before using the software. As LaNMaN2000 said in the above post, the EULA thould be looked at like a price tag. Know all of the hidden costs of a product before you agree to use it, as enforcement of these terms is becoming easier and easier for the owners.
And as one last piece of advice for those creating software that they want people to use: Use of a standardized EULA will greatly increase the ease and comfort of agreeing to your license. When I see that the EULA says GPL, I know in three letters what that license entails. Create a license that is basic enough that you can use it on all of your products with minimal additions. (doesn't have to be the GPL, but stick to a standard) If I see that the EULA for a piece of "ripicheep Corp" software is their standard license with the addition of the following terms, then once I know what that standard license is, I don't have to search through the fine print to determine if I am willing to agree to the EULA.
"A witty saying proves nothing." -Voltaire
My feeling is that if your product is going to act in ways that you know are distasteful to many potential users you are ethically obligated to point that out in a clear and obvious manner. Saying it in the small-print legalese may satisfy legal requirements but doesn't satisfy ethical ones, IMHO.
And as I understand it, the product in question is installed in the process of installing other products, so the user may not even know that there is a potential issue to consider. That puts using a nonobvious warning even further outside the pale, ethically speaking.
What would you rather have, Windows Media Player?
Well, since you've asked, yes.
(1) WMP works better than the RealPlayer -- it crashes less often (note: "less often", not "rarely") and AFAIK supports more formats. Besides, I don't really watch anything in RealAudio/Video anyway.
(2) RealNetworks has a very consistent pattern of trying to spy on its users -- much more so than Microsoft.
(3) Given a choice between dealing with a big lumbering dinosaur (e.g. stegosaurus) and a smaller more aggressive one (e.g. velociraptor), I'll take the big one any time.
Kaa
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
Perhaps they plan to use this information to gauge software piracy. They could sell data to corporations to see where/how often files identical to theirs are being downloaded. I doubt any legal action could be brought against anyone downloading a file that appears to be illegal, but the info could be usefull to companies. Real could make a fortune doing that. I hope I'm wrong though.
How am I supposed to hallucinate with all these swirling colors distracting me?
Does anyone have a page listing alternative (preferably free) software to play the formats that Real Player supports?
The net will not be what we demand, but what we make it. Build it well.
I recently download the new Yahoo! Player Beta. It's free (beer), looks nice, uses CDDB and skins, and hasn't crashed for me yet. Does anyone know if the Yahoo Player is a "real app" or is it just a skin for the WMP or RealPlayer??
cpeterso
On a side note such scripts would be useful for congressional bills as well.
Stuart Eichert
Stuart Eichert
I am really, really tired of RealNetworks trying to spy on its users. This is not the first time and clearly they are going to do whatever they can get away with.
I think I'll now classify RealNetworks as a "don't let a packet come withing three hops of them" company. I am fairly sure I don't have anything of theirs installed, but I'll check just in case.
Kaa
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
Come on, folks, did anyone *really* expect a company that once proudly proclaimed that they were sending email to 53,000,000 people in every run to suddenly get a clue?
:)
RBL listings, plural, did not get these people to fix their problems.
My response? I donated a computer to http://www.free-expression.org/, and got my employer to donate them a license for another OS they might be able to target.
Give it a look, and if it seems interesting, get involved. If we replace RealAudio, RealNetworks will die quietly, which is pretty much the best they deserve.
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
but c'mon people - how many bone-headed moves do you have to make?
Exactly one. You know, this community seems a little lax on actual integrity for being so chock full of zealots. That's fine if you don't really follow the party line; respectable even, but I see so many people who don't practice what they preach. I suppose that's fair, as that there are so many different agendas here (I like free software, but I'm not of the RMS be-all-end-all persuasion).
But what really gets me is how short most people's attention span is. DVD's are evil! Lucasfilm is evil because they won't release Star Wars on DVD! Double fricking standards here. Half the people I know who bought DeCSS t-shirts also went out and bought new DVDs the same day. Now, I can't be the only person here who honestly believes in some of this crap. I know there's more out there.
My point? Real Networks fucked up a LONG time ago. I haven't touched one of their products since, and I don't plan on it. So they're at it again, I'm not surprised in the least. Yeah, they "fixed" the problem the first time around, but the whole point of a general boycott is to protect the people who are too stupid to protect themselves. If they start making this known from the get-go, (ie, the first thing you see during the install, and you can opt out) then the problem will be gone. There shouldn't be any need for ANOTHER boycott of Real . . . anyone who felt strongly about it the first time should STILL be boycotting.
Just my opinion though.
Bad things often happen to good people,
It is up to them to see that they remain good.
As long as people are willing to trade their privacy for (in this case) hypothetical conveniences --- "Here's my DNA, where's my free Happy Meal?" --- we will face a long, hard, uphill battle to secure the details of our lives. *Sigh*
The Mongrel Dogs Who Teach
FYI, Chomsky is an anarchist who probably hates the government more than you do. He's certainly gone to great lengths trying to expose the murder our government encourages (and commits) in the name of foreign policy.
FYI #2, it is still up in the air on whether click-through licenses are actually legally binding, mainly because nobody takes them seriously, and therefore do not read them. And besides, Real knows full well that people do not read them, so hiding the admission of some extremely intrusive behavior of its software inside the license rather than making it obvious on the download page or on a privacy statement shows an extreme amount of contempt for their users' privacy, and therefore they deserve all the bad publicity we can generate.
FYI #3, if you still think anyone who signs (or clicks) something without reading it is a moron (and I'm inclined to agree with you), consider a bill that was recently passed by the Republican controlled Senate:
http://cryptome.org/4th-sneaky.htm.
Why not use windows media player? First off, it doesn't collect data on you, beg for new upgrades every so often, is *stable*, and comes with the OS. If you're using Win98 you might as well use a stable media player instead of bitching about how buggy Windows is and how the people at Real are mini-fascists.
If it did steam real files I'd delete RP in a second.
At some point, data such as this will be used to spectacularly ruin someone's life. Perhaps a class of people will be screwed over en masse. I can imagine so many scenarios that there ain't no telling exactly what form this will take. It isn't a question of if; it's a question of when. Some person, group, company or government is bound to do it. The temptation is too great. Such a disaster is what will be required to get everyone's attention. We can warn people of the evils of all this glitzy Windows crap until we're blue in the face. They will not listen until it hits them where it hurts, in the wallet.
Wansu, th' chinese sailor
We need to ensure that this gets the same attention that caused DoubleClick shares to drop over 25% in a week. Only when they realize that their shareholders will not stand for this assault on consumer privacy will they alter their policy.
It is all a matter of publicity; most consumers have the impression that what they do not know--or take the time to read in the license agreement--cannot hurt them. With the passage of UCITA in various states, it has become clear that the terms of the license agreement should be compared in the same way as price when making an informed buying decision. Until people realize this, the only hope we have of avoiding agreements like Real's is to use the media to inform consumers.
ByteMyCode.com: A Web 2.0 code sharing community.
Howdy,
I just installed RA last night on win2k, funny coincidence. ZoneAlarm from ZoneLabs started warning me as soon as I restarted that something was up. First, Real Jukebox wanted to access the internet. Now way, Sorry. Then something called main_program (I think, this is from memory) tried to access the internet. Again, no way.
At this point I started to uninstall all the crap that I didn't ask for. When I got to the Zip download thing, after I hit the uninstall program they provided, main_program wanted to access the internet again. jeez, these people are desperate for stats I guess.
So not only does is keep track of download stats, it also wants to know when you install and un-install the app.
--mark
Does this come as any surprise to Real? Quite the contrary, they know that people generally read at most the first page of those agreements; they were counting on it. They could have put the notice about the software's logging in big bold letters at the top of the agreement, but they didn't. Why? Because they knew many people wouldn't agree to it; that's why. You can scream "caveat emptor" until you're blue in the face, but the fact is that a merchant that cheats his customers is still a villain, even if the customers should have known better than to be taken in.
-rpl
Is there a technical solution to this?
/* Not recognized */
Some sort of bionic-chroot-on-steriods might be the answer for running untrusted binary-only software. FreeBSD has jail() which is like an improved version of chroot(), but what's needed here is something more sophisticated.
Ideally you'd make it so that _all_ access to the outside world can be filtered through some userland process. Preferably a Perl program, hehehe. This is roughly what I have in mind:
filter_syscall() {
if (call is 'open file for reading') {
if (filename one of those allowed) {
return OKAY;
} else {
modify the 'open' call so the mode is
set to read-only; return OKAY;
}
} else if (call is 'read') {
return OKAY;
} else if (call is 'send data over network') {
check to see if the data is being sent
back to RealNetworks - if it is then
return FAIL_SILENTLY;
else return OKAY;
} else {
warn("program is doing systemcall we haven't
seen before");
return FAILURE;
}
}
It could be quite a lot of work to do this _fully_ for any large program, but a quick hack to allow all system calls except those sending private data, or to overwrite any private data being sent with 'X' characters, might be quite easy.
-- Ed Avis ed@membled.com
This kind of snooping is so obviously a violation of privacy, i wonder if it is already covered with existing laws. If you took your car to a Jiffy Loob for an oil change, and they decided to install a GPS enabled oil-filter and they then logged all you travels in a database, there would be a huge public outcry, and probably a slew of lawsuits. How is Real's bahavior any diferent. This makes me ill.
- Josh "Yoshi" Steiner
---
Xiphoid Process Records - http://xiphoidprocess.com
San Francisco based electronic music.
got drum'n'bass?
http://mp3.com/vitriolix
Folks, you might want to read the article. The problem is with a piece of software called Download Demon, a part of Netzip, NOT Realplayer. It's the same company, and you might want to stop using their products on principle, but don't rush off to find an alternative to Realplayer just because you're worried it'll track personal information...
What would you rather have, Windows Media Player?
~P
Rather than getting indignant every time Real (or similar companies) are found violating peoples privacy like this, why don't we just work towards obfuscating their data set. What about a little hack that sent random junk data to them rather than whatever it is they're trying to collect?
This could have the additional benefit of making companies act more overtly about their data collections, if that is the only way they can successfully collect accurate information.
-Spazimodo
Fsck the millennium, we want it now.
Fsck the millennium, we want it now.
Millennium Crisis Line: 0890 900 2000 [calls cost 50p/min]
But I can't see where the payoff is for Real. I imagine that if everyone in the world was to use Download Demon for every download they ever made, then the resulting sending of information back to Real would cost them a small fortune in bandwidth. I can't see that they're going to make much money selling the information on either - if companies are particularly interested in finding out who's downloading their products then they usually make the user register or fill in a form before downloading.
Real's main software product, Real Player, is losing market share to Windows Media Player so it seems that Real needs all the goodwill it can get in order to survive. Although the majority of computer/internet users are not overly worried by the issue of privacy (certainly not to the same extent as the average Slashdot reader), more and more of their potential customers are going to become disillusioned every time Real pull a stunt like this.
Download Demon may well claim that "this is all anonymous, we don't link names with activity, blah blah blah" but as we have seen in the past with DoubleClick (who just created a special privacy panel within their company to act as window dressing while addressing privacy issues) companies start out collecting 'anonymous' data and then later suddenly decide to link the data to names.
I work in Marketing Research, where data collection is mostly what we do and so privacy issues, especially internet privacy, is "suddenly" a hot topic. MRA has a forum where any marketing research issue, including how you feel about your privacy, can be addressred. If you are interested in having some voice in how that data is used and collected, please post at www.mra-net.org/forum/. MRA sets a lot of marketing research industry standards which our members follow, and I'd rather privacy was a bigger concern, not a brief one or two lines buried in policies somewhere. We don't even have a privacy policy right now.
You can keep marketing research from doing what other industries are doing.
*shrug*
There is a big huge gaping hole in your opinion. The fact of the matter is that most people aren't smart enough, like you and I. Therefore companies that do such bad things will always profit, survive, and maybe even crush the competition who are not doing such bad things.
That's why we have a lot of laws in the first place! That's why "buyer beware" has never cut it in many many situations.
Now this situation doesn't result in anyone losing money or property without compensation(*), which is what most of our laws deal with. It deals with the loss of privacy.
Does privacy deserve the same protection as property? Does it deserve any protection at all? Is the shrink-wrap license enough?
I think a lot of us would argue quite successfully that yes, it deserves a hell of a lot more protection than it has now, and no, shrink wrap licenses should not be valid for half the stuff that is often in them.
There are certain types/sizes of 'contracts' which are valid when made 'in passing', and others that need a lot more than an 'in passing' contract, that need signed documents, adequate two party communication and understanding, and adequate compensation. How many of us have heard of contracts or events being overturned by courts because there wasn't a signed contract? We all know that there are some contracts that the courts won't enforce with at least a token measure of compensation. And some that aren't enforcable when that token is effectively meaningless. And others that are deemed 'fraud' because the 'contract' was so obscured and desceptive.
Personally I think this world will degenerate into hell if we don't produce an adequately balanced system of legislative, enforcement, and legislative system. Human beings in general are just too stupid to 'figure it all out for themselves' and solve it through individual actions as you suggest.(**)
-NH
(*) Here's a unique argument. Information *IS* property. We've got that ingrained in our society. So how come this information isn't worth anything or isn't protected? Shouldn't I be in control of who obtains this information from my life? Shouldn't taking this information without my consent or compensation be illegal?
Now of course it was in the disclaimer/shrink-wrap license. And you are getting 'compensation' in the form of software that does work for you. But is that enough?
If someone came up with a new way to screw people over and get 10-50 bucks from them without them really noticing that they had agreed to it, don't you think there would be a clamour to deal with it legislatively? We've already done so in many cases. We're seriously cracking down on phone-'fraud' organizations that do this exact thing to old and gullible people.
(**) Some of us don't like having to wade through the shit that your idiot friends effectively allow in this world. And some of us take pity on your idiot friends who are in effect powerless to protect themselves or change the world, because hey, they're idiots. And most of us take deep offence to shucksters and con-men depriving the weak of their property and rights.
IE: If you want to go live in the wild west, take your damn six shooters with you, we don't want your kind around here.
So you want a company to spend their time and money on creating and running a great site but you expect them not to use advertising? /. or CNN.com. If you eliminated all the ads, you would have to revert to a pay-per-view or subscription based model. I think that it is very important that free mediums still exist. Advertising allows companys to create sites that everyone can use, rich or poor.
You realize that by using junkbuster you are hurting the sites you are visiting that depend on advertising revenue. Personally, I think that longer download times are a small price to pay for a great site, like
-- soldack
According to this article Real has just released a new product that bundles RealAudio/Video, RealJukebox, and Netzip (which they have renamed RealDownload) together into a single product called Real Entertainment Center.
Work for Change & GET PAID!
I have no affiliation with the following:
Steve Gibson has been a real help to many with his Shields Up! and SpinRite, but a little known program on his site will take out the Aureate VIRUS.
Everyone that uses CuteFTP and many other shareware programs have the Aureate VIRUS in thier computer. It is installed with the program With NO UNINSTALL PROGRAM !
It sits, and waits for an internet connection to send constant information back to ads(x).adsoftware.com and there have been a lot of problems with system lockups because the software can't make contact !
From the ABOUT tab in the program
The OptOut Web Site at http://grc.com/optout.htm contains an extensive summary of the issues and problems surrounding the use of advertising agent programs, parasites, and spyware. You will also find extensive information about OptOut's current capabilities (they will keep growing). Please click the link above to visit our site to learn about this problem and OptOut.
--
Me again: It is small 38k, written in assembler and is free (as in beer) until sometime in July.
Get it and use it And RTF Agreements BEFORE installing software on your machines !!!!!
- Save The Whales
Success is not the result of spontaneous combustion, you must set yourself on fire.
So, if something doesn't bother you it shouldn't bother anyone else either? And if it bothers someone, he/she must be a criminal.
Tell me, is it nice living in such a fantasy world of pure black and white?
You say you don't have things to hide. Well, congratulations. However, most of us do have things we prefer to keep away from prying eyes. Nothing criminal. Just petty, boring details such as our credit card number, sex life, political/religious affiliation, medical history and other things which in the end paint rather a detailed picture of each of us.
And you know what. Just as I am entitled to decide how much and which of my own feelings I show to others, I am also within my rights to keep these other petty details of my life secret. It's not a question of trying to hide something dirty. It's about controlling your own life and not letting other people run it for you. Being able to say "fuck you" to aggressive salesmen/advertisers, politicians or law enforcement agents trying to reach too far into your personal space.
No, the contract is with the Solarian photographers who spy on us with their cameras. The sun is simply a mass of very powerful camera flashes.
They shouldn't be allowed to do that. I don't know how to stop them, but that shit should be illegal. Or at least force them to advertise functions which do not directly relate to the purpose you bought the software for: it's like buying a word processor with an undocumented feature which changes your networking settings, it's not what you bought it to do.
Why would there even be such an expression as "the fine print" if not because this tactic has been used for centuries. Bury the zinger in a pile of mumbo-jumbo, and people won't look hard enough to find it. Make it much easier to go for the goodie than to get a lawyer to read the screen. Then sit back and commit whatever ethical violation you can stomach.
"Genius may have its limitations, but stupidity is not thus handicapped." --Elbert Hubbard (1856-1915)
This is becoming real annoying! How long till we have banner ads stapled to our forheads so that when we look in the mirror we can read about the latest sale?!?!?
Have a Happy.
> download (from within RealPlayer) an "update" for the player, as well.
Which update is that? I got two of these for my 'doze RealG2 install. The first was a few hundred K long, and without it, some of my downloaded South Park episodes wouldn't play (hey, I was away from cable for a few months, I downloaded 'em in the name of interoperability :-).
ObHack1:
On a whim, I took a checksum of every file on my Winblows machine, did the update, redid the checksum, and diffed the output. GNU utilz make DOS useful.
The "update" is merely the replacement/addition of a couple of .DLL files for the G2 codec. I backed up the .DLLs, restored the disk image and replicated the "upgrade" by simply unzipping the .DLLs into the proper directory. Which meant that only one Win9x install had to phone home to Real. The rest were done offline. Sweet.
RealG2 is now whining at me to get an update that's about 3.1M in length. Since all of my .RM files play just fine without it, I'm repeatedly telling it to fsck off. Why fix what ain't broke?
Request:
What I'd really like to see is a registry hack to permanently disable (or set the "30 days" limit to "30 years") the nag.
Thoughts:
The problem with .RM is the problem with .AVI and M$Word's .DOC. One file extension, multiple incompatible formats. Since they're traditionally generated with closed-source software, all Real has to do is disable the ability to generate "old-sk00l" .RM files in their encoder; content providers will subsequently generate data that can only be played back with "new-sk00l" players. Everyone's forced to upgrade in order to view content, and Real gets to install whatever trojans it wants. (At least most of the progress in .AVI codecs was made before the invention of spyware.)
The general rule of thumb I use is still never to upgrade any component of a Windoze system unless something is both (a) not working, and (b) there's reason to believe the upgrade will fix it.
Meanwhile, I'm also glad that MP3 is basically as good as it ever needs to be. For Windoze users - there will never be any reason to download "AOL-amp 9.99" that plays MP3s with embedded banner ads, and/or supports user profiling.
ObHack2:
Speaking of profiling, someone pointed me to a WindozeMedia video file (.ASF?) that, after it had played, spawned a browser and attempted to connect to the 'net and view a URL. Every time it was viewed -- even if you'd saved it to your local drive and were playing it locally. The URL was in ASCII embedded within the file. A few minutes with a hex editor solved that problem.
All of which is a long way of saying "me too". A cross-platform open-sourced solution for streaming and locally-stored video content would go a *long* way towards eliminating these kinds of abuses.
But how many people are ever going to read down that far?
Well, that's nice -- although it does seem awfully Simpsonsish of them:
I'm going to kick the air, and if you get in the way, that's your own fault!
Perhaps you should open the living room curtain whilst being intimate with your significant other. Would it be too difficult for you to leave your opened mail on your front porch? Maybe you would like to use the restroom with the door open while at work.
Privacy is privacy no matter what the medium. I do not want a third party to know what I am downloading, any more than I want people staring into my window while I shower.