Slashdot Mirror
Real Networks And More Privacy Concerns
Arrogant-Bastard writes: "Lauren Weinstein's Privacy Forum Digest V09 #15 reports
that RealNetworks' "Download Demon" forwards the details
of any download (i.e. URLs, filenames) to RealNetworks.
See The Digest
for details. " Now, granted, this time the program, if you read the fine print, says that it will do this - but c'mon people - how many bone-headed moves do you have to make?
What would you rather have, Windows Media Player?
Well, since you've asked, yes.
(1) WMP works better than the RealPlayer -- it crashes less often (note: "less often", not "rarely") and AFAIK supports more formats. Besides, I don't really watch anything in RealAudio/Video anyway.
(2) RealNetworks has a very consistent pattern of trying to spy on its users -- much more so than Microsoft.
(3) Given a choice between dealing with a big lumbering dinosaur (e.g. stegosaurus) and a smaller more aggressive one (e.g. velociraptor), I'll take the big one any time.
Kaa
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
I think however that you might find that similiar situations are going to become "industry standard".
As a point in case, I recently installed a "personalized firewall" product on a friends machine. As a confirmed paranoid, I had a packet sniffer running at the time and guess what?
Suprise, suprise, it fired of a packet to it's creators to let them know that it had been installed at that IP address. My advice to my friend was simple - get ride of it.
The moral of my tale is obvious. If your stuck using Windoze in certain situations, get yourself a packet sniffer first and worry about your multi-media ( and other utilities ) later.
This kind of idiocy is becoming so pervasive it's gone beyond a joke. The only reason why it even gets of the ground is simply because the general public doesn't know. If they did, they wouldn't touch these products and companies would very quickly learn to leave the issue alone.
You might be strangling my chicken, but you don't want to know what I'm doing to your hampster.
Howdy,
I just installed RA last night on win2k, funny coincidence. ZoneAlarm from ZoneLabs started warning me as soon as I restarted that something was up. First, Real Jukebox wanted to access the internet. Now way, Sorry. Then something called main_program (I think, this is from memory) tried to access the internet. Again, no way.
At this point I started to uninstall all the crap that I didn't ask for. When I got to the Zip download thing, after I hit the uninstall program they provided, main_program wanted to access the internet again. jeez, these people are desperate for stats I guess.
So not only does is keep track of download stats, it also wants to know when you install and un-install the app.
--mark
Does this come as any surprise to Real? Quite the contrary, they know that people generally read at most the first page of those agreements; they were counting on it. They could have put the notice about the software's logging in big bold letters at the top of the agreement, but they didn't. Why? Because they knew many people wouldn't agree to it; that's why. You can scream "caveat emptor" until you're blue in the face, but the fact is that a merchant that cheats his customers is still a villain, even if the customers should have known better than to be taken in.
-rpl
Is there a technical solution to this?
/* Not recognized */
Some sort of bionic-chroot-on-steriods might be the answer for running untrusted binary-only software. FreeBSD has jail() which is like an improved version of chroot(), but what's needed here is something more sophisticated.
Ideally you'd make it so that _all_ access to the outside world can be filtered through some userland process. Preferably a Perl program, hehehe. This is roughly what I have in mind:
filter_syscall() {
if (call is 'open file for reading') {
if (filename one of those allowed) {
return OKAY;
} else {
modify the 'open' call so the mode is
set to read-only; return OKAY;
}
} else if (call is 'read') {
return OKAY;
} else if (call is 'send data over network') {
check to see if the data is being sent
back to RealNetworks - if it is then
return FAIL_SILENTLY;
else return OKAY;
} else {
warn("program is doing systemcall we haven't
seen before");
return FAILURE;
}
}
It could be quite a lot of work to do this _fully_ for any large program, but a quick hack to allow all system calls except those sending private data, or to overwrite any private data being sent with 'X' characters, might be quite easy.
-- Ed Avis ed@membled.com
Folks, you might want to read the article. The problem is with a piece of software called Download Demon, a part of Netzip, NOT Realplayer. It's the same company, and you might want to stop using their products on principle, but don't rush off to find an alternative to Realplayer just because you're worried it'll track personal information...
What would you rather have, Windows Media Player?
~P
Rather than getting indignant every time Real (or similar companies) are found violating peoples privacy like this, why don't we just work towards obfuscating their data set. What about a little hack that sent random junk data to them rather than whatever it is they're trying to collect?
This could have the additional benefit of making companies act more overtly about their data collections, if that is the only way they can successfully collect accurate information.
-Spazimodo
Fsck the millennium, we want it now.
Fsck the millennium, we want it now.
Millennium Crisis Line: 0890 900 2000 [calls cost 50p/min]
Download Demon may well claim that "this is all anonymous, we don't link names with activity, blah blah blah" but as we have seen in the past with DoubleClick (who just created a special privacy panel within their company to act as window dressing while addressing privacy issues) companies start out collecting 'anonymous' data and then later suddenly decide to link the data to names.
I work in Marketing Research, where data collection is mostly what we do and so privacy issues, especially internet privacy, is "suddenly" a hot topic. MRA has a forum where any marketing research issue, including how you feel about your privacy, can be addressred. If you are interested in having some voice in how that data is used and collected, please post at www.mra-net.org/forum/. MRA sets a lot of marketing research industry standards which our members follow, and I'd rather privacy was a bigger concern, not a brief one or two lines buried in policies somewhere. We don't even have a privacy policy right now.
You can keep marketing research from doing what other industries are doing.
*shrug*
They shouldn't be allowed to do that. I don't know how to stop them, but that shit should be illegal. Or at least force them to advertise functions which do not directly relate to the purpose you bought the software for: it's like buying a word processor with an undocumented feature which changes your networking settings, it's not what you bought it to do.
But how many people are ever going to read down that far?