Slashback: Guido, Games, Felines

This time, an astute reader points us to the place where Guido Van Rossum speaks out on the Python license issues recently posted about here on Slashdot, and an Everquest enthusiast points to the Official Word (well, chatroom response) to Everquest server emulators. Oh, and remember that CueCat scanner you picked up last week (and quickly wrote a Linux kernel driver for) -- did anyone at Radio Shack mention something about an embedded serial number? Hmmmm. I thought not. Good thing reverse engineering isn't yet a capital offense ...

That's one long and winding snake of an issue ... Kevin Reichard writes: "Since you covered the original issues surrounding Python licensing, you may also want to note that Guido van Rossum of PythonLabs has officially responded in a Linux Today interview. He has many interesting things to say."

Which things notably include: "The sad thing is that all of this is based on technicalities: Stallman agrees that Python is free software, but a technicality in the licenses prevents compatibility. The choice of law clause in the CNRI license, which is causing the incompatibility, is very common is software licenses, and CNRI doesn't want to drop it because the validity of the general disclaimers in the license may depend on it. At the same time, Stallman doesn't want to allow any choice of law clauses, because one could stipulate the law of "Unfreedonia" which might reverse the meaning of the GPL."

Abort, retry, fail, bend, fold, spindle, mutilate? L Fitzgerald Sjoberg writes: " A recent posting on the official EverQuest boards by a spokesperson for Verant states that even RUNNING an EverQuest emulator violates the EverQuest license agreement.

If the emulator is legal, and emulators seem to be making a lot of legal headway these days, doesn't this essentially amount to Verant forbidding you to use a competitor's product? Not a good sign, if you ask me."

"Sir! Sir! There's something wrong -- this knob goes up to eleven!" Signal 11 writes: "I took apart a cuecat and did a rundown of the circuit tracings on the board. What follows is a short summary of what I found. I'm working on putting together a schematic for it and hope to have it together within a couple weeks.

The cuecat is fairly simple. It uses a pair of infrared LEDs to direct light onto the sheet of paper with the barcode on it. It is then picked up by an IR detector, whose output is tuned by a single potentiometer (adjusted at time of manufacture, I would guess) and then fed into the analog input of a microprocessor. The detector is the same type one can pickup at radioshack. All you do is enclose it in a box and then make a pinhole at one end. Cheap, but it works well enough.

The microprocessor I haven't had time to put together a circuit from the specs provided by texas instruments to download the microcode out of it. It is also a matter of me not wanting to learn about microprocessors although I understand it is common in the industry.. I'm an analog guy. :) I suspect it is nothing more than running the output through a ACD (analog->digital) inside the microprocessor and then referencing the binary input with a list of values to produce the barcode string. After that, as has been previously noted, it is passed to an XOR algorithm, and then modulated to be fed out onto the PS/2 interface. There are a pair of transistors on the board near the outputs of the microprocessor - I suspect these are used to either boost the signal to run over the PS/2 interface (the microprocessor may not have enough power), or as part of an oscillator to get a clock for the processor. Until I finish tracing out the board paths, I can't say for sure.

Somewhere in the chip they probably set the serial number into the nvram, which is prepended to the output. The software does the rest. As has been demonstrated, there isn't much to do on the software side either - one could just create an indexed array containing scancodes. One might even be able to write a new key definition file under linux.. no programming required.

This is a really simple device. This is also probably why they were so concerned about competitors.. it wouldn't take them more than one afternoon with an EE and a microcode programmer to reverse-engineer it and produce their own. Then again, the device was probably designed in the same amount of time, likely by a random contractor. The reason it took me so long? I've been messing around with electronics for all of three months, so yes, I'm not a professional - I also haven't gotten into DSP technology yet, which is all the cuecat is. As always, if someone could provide me with a basic circuit for reading the contents of the processor's memory out, I'd appreciate it!

Anyway, DigitalConvergence - I'm waiting for my cease and desist now."

Comments

Re:btw..

[British]

What about those of us who alreeady have TV tuner cards?

Re:Query

[outlier]

The implication is that if you set up some type of cataloging system [...] you can only use one particular scanner to do retrievals unless you take the time to strip out the (seemingly 5) ASCII output characters that are unique to each character.

My cataloging program was written in VB (Shut up, it was fast and easy). It grabs only the bar code info, checks to figure out if it's a book (you can look at the field before the bar code, or just see if it starts with 978) or a CD (all the UPCs I've seen for CDs have a 3 before the check digit). It then hits the barpoint.com database and grabs author/artist and title info. I'm gonna have it grab track info for CDs next, and then maybe a graphic...

Anyway, its trivially easy to do the encoding stuff without having to worry about the serial number.

Re:Cue Cat Reality Check

[Accipiter]

No name, nothing to tie me to an "ID" number.

You'd think that if there were some sort of attempt to track scans vs consumer they'd be a little more attentive about getting, like, my name, or something.

Um, that's because it's not Radio Shack's responsibility. You give your personal information when you install the software.

-- Give him Head? Be a Beacon?

it's NOT rocket science...

[OmniGeek]

As I racall, the Motorola 6800 apps manual (not the 68000, the 8-bit 6800 chip) had a neat example program on reading Code 39 barcodes in software. It's really NOT all that tough to do this; you measure time intervals between bar edges, normalize them for swipe speed, classify them as wide bar/narrow bar ==> 1 and 0, and you're most of the way there. Then you need only identify the barcode type using the standard characteristics of each encoding (and they are designed to facilitate just this identification), do a simple forwards/backwards check in case the moron scanned the label right-to-left, test the check digit with a simple algorithm, and you're done. Not trivial, and there's effort required for handling multiple code types, but CERTAINLY not rocket science. (And I DO rocket science for a living...)

Cue Cat Reality Check

[Monte]

I just walked into RS and asked for the "Cat thing that reads barcodes", bingo, a guy hands me a bag with the Cue Cat and a catalog (praise "Bob" they're not selling the things any more!), he says "Y'know, you can scan anything - soda pop, chewing gum, whatever!", I wave goodbye and I'm out of the store.

No name, nothing to tie me to an "ID" number.

You'd think that if there were some sort of attempt to track scans vs consumer they'd be a little more attentive about getting, like, my name, or something.

Then again, this is Radio Shack we're talking about.

Anybody else miss the free flashlights?

Re:Cue Cat Reality Check

[outlier]

No name, nothing to tie me to an "ID" number.

Yeah, but if they have a persistent code that gets sent to them whenever you use the :cue:crap to scan something and query their server, regardless of whether you're using their software or your original registered name, you maintain a trail.

Let's say one day you scan something in the radioshack catalog and you then order it online (or you scan a bar code and you enter a contest or something). You've given RatShack (or DigitalInsurgence or some other partner) your personal info, they share it and all your old and new behavior (remember when you scanned the barcode on a copy of penthouse, just to see what it would do?) is now associated with a name, address, cc#, etc.

Remember, these are not human beings you're dealing with, they're marketing people. Their goal is to capture as much info about your use of their tool as possible, and if they can match things up (a la doubleclick's dream), they stand to gain.

To use their software (which is their goal here), you are supposed to register an email address, they then send you a registration code which is apparently some hash of your email address, because you have to enter the same email address into their program when you enter your registration code. Now, if you use their software even once you've associated the code (your email address) and the serial number.

Interestingly, even if you got the thing at radio shack, and you gave your real name and number they still wouldn't have enough to tie you to the reader, since the radio shack guy scans the barcode on the reader, which is just a generic product upc, with no info about the serial number (using recursion to confirm this is a problem left to the reader;-).

On a somewhat related note, does anyone else have the model 68-1965? Most of the ones I've seen are 68-1965A. The major differences visible outside are:

• The A has a dark filter where the cat's "mouth" is, the other one has no filter
• The A appears to use 2 LEDs the other one has only 1
• the A has 4 small screws, the other one has 2 big screws
• The A has a sticker saying 06A00, the other one has no sticker
• The A works *much* better than the other one

Haven't had a chance to open the A up yet, so I can't comment on internal comparisons.

Re:Cue Cat Reality Check

[pos]

I asked for one and the guy asked me all kinds of info which I didn't want to give him. He told me that they have to record who is getting these things and wouldn't budge even though I argued with him. I ended up walking out without it.

You might have just gotten lucky. Seems like "corporate policy" only goes as far as an employee cares to enforce it. =) I need to find me a Ripoff Shack that emloys "slackers".

-pos

The truth is more important than the facts.

Re:Cue Cat Reality Check

[alhaz]

The ammount of corporate buyin among radioshack store managment varies quite a bit. Tandy has a long history of abusing them.

Mostly it goes back to the way they reeled in their privately owned franchises. The way it used to work, every year the franchise owner had to fill out a silly form and send it to Tandy, and every year Tandy would send back a form letter letting them know they're still a franchise.

Then one year, an aquaintences father, who owned a 'shack franchise, sends his form in, and gets back a letter saying something like "your franchise has not been renewed, here is a check for your original investment. While ownership of this store has been shifted back to Tandy corporation you will be allowed to keep your position as manager at a salary of $26,000 per year" - of course, that investment was made in the early 70's and no account was made for interest, increased value of the property, inflation, etc. 20 years and they basically told him to take his ball and go home.

So he contacts some other private franchise owners, finds out they all got the same letter and check. At this point, they figure they're screwed out of their businesses but not out of the actual value of their stores, and contact a lawyer to see if they can sue Tandy for the increased value of the stores.

The lawyer does some research, finds out this was nation wide. In one fell swoop, Tandy shut down every privately owned 'shack in the nation and gave every one of them the shaft. This becomes a class action lawsuit. Other greivances are brought up.

For instance, the franchise agreement stated that Tandy would aquire the merchandise and then sell it to the franchise at 10% over wholesale cost. Many franchise owners suspected over the years that they were not getting this deal, but hadn't rocked the boat. Some investigation was done, and several of Tandy's asian suppliers were identified. Many of these suppliers were contacted and told that a group of investors was considering starting a chain of electronics stores, and was seeking sample merchandise and quantity pricing for a list of items. The suppliers responded with an exaustive price list and sample merchandise.

The sample merchandise proved to be identical to radioshack merchandise, and the price list showed that the wholesale cost of the items was far below what Tandy had represented. Indeed, some popular items were being marked up as much as 600% before being sold to the franchises.

In the end, Tandy lost. Big. In excess of one million dollars per franchise.

It would be safe to say that i have no love for Tandy or the shack. It would also be safe to say that this is a corporation that doesn't engender much loyalty in their lower management.

What's more, two out of the three I've got were handed to me by teenagers, who obviously don't care. There are five shacks within 10 minutes of home and they keep separate customer databases.

Re:Cue Cat Reality Check

[powerlord]

To make things even more fun I just received a CueCat in the mail from Forbes magazne... seems they are sending them to all their subscribers and are going to include barcodes in future issues.

<sarcasm>YIPPEE</sarcasm>

Re:ID

[askheaves]

I have to laugh because when I picked up my :CueCat, I just walked into Radio Shack and got it. He asked me if I shop at Radio Shack (I do for parts) and if I use the catalog (I never had before). He scanned the catalog with his barcode scanner, slid it toward me on the counter, and said "That's it."

I was startled because he didn't ask my name, address, or even Postal code (which they always ask for when I buy resistors... they must really want to know which parts of town are buying the most resistors).

I walked out of the place feeling like I got away with breaking the neighbor's window. I don't know if this is happening elsewhere, or if I encountered the laziest Radio Shack employee ever. I like that I got something free and that DC doesn't have my address tied to the serial number. This way, when the revolution comes, Digital Convergence can't yank me out of my own home.

Accurate CueCat information / internal pictures

[Anonymous Coward]

go to this site matrixpm.com/~haveblue/cuecat

Re:Accurate CueCat information / internal pictures

[toh]

On the serial id number, there has to be a way to program the device once it is assembled, so that means that it is probably done with a special sequence through the connector. Maybe even by typing in a special code!.

Barcode scanners are nearly always programmed by reading in some special barcodes. This makes sense because you've already got a perfectly good input mechanism on the device (the scanner head), and you save the cost of an additional interface. For commercially sold programmable scanners the sheet of codes will be included with the device. Generally there will be an especially obscure code that puts the device in programming mode, a state-based sequence of codes that change whatever settings are available (including a set of numerics or alphanumerics if one is to software-set something like a serial number), and another code to return it to the regular operating mode.

However, I doubt that these scanners have programmable serial numbers - as others have suggested, the number is probably burned into the EPROM when it's manufactured. Having them individually programmed would just be way too labour-intensive for an extremely mass-produced device that's to be given away free (and probably worth about 50 otherwise).

Re:Accurate CueCat information / internal pictures

[askheaves]

I have a completely different :CueCat. I mean, COMPLETELY different. There is a complete packaged led/detector assembly (a 1.5inch Black plastic box). There are no exposed uChips (possibly under the metal shielding on both sides of the PCB.

On the PCB:
(HM+H Rev 1.1)
016-000370-10105

It appears that there are more than one version of the CueCat out there. Has anybody done an investigation as to how many versions there are? In addition, how does the idea of multiple versions complicate the "legal" matters brought about by DC?

Re:Accurate CueCat information / internal pictures

[eclectro]

This is the same as my cue cat. And here I thought I was going to do well by the play by play of the circuit!!
I got delayed because from the description it became apparent that we are talking about two different cuecat internals.
Post #43 talks about it being a toshiba CPU. Specifically, this cpu belongs to TLCS 870 family of microcontrollers. It is register rich and C code compiles to it very easily. You use this kind of core if you want to do a lot of math on your data (so yeah, you could do a linux port!)

My Cuecat, like the one pictured in the above link, has a Hyundai 90c54 which is an 8051 knock off. Everybody and their dogs makes a souped up 8051 which this probably is. The memory is 8k byte wide (64k) which is a lot for a little microntroller. So, they must write their code in C, and do alot of processing on what it reads. My guess is that they switched to the 8051 core for cost reasons, as there is a bit of loss lead taking place. While the first response of some would be "I would have used a pic" I have found that in a manufacturing enviroment that 8051 can be more cost effective, just because there are so many of them available. Pics are good for small scale manufacturing.

Notice that the inside of the cuecat is black, and the top part of the housing has some black carboard material, black plastic piece cover, and the sensor had black tape around it. That's alot of effort to keep out extraneous light. They probably don't want _any_ extraneous reads (work first time). Nice touch to improve product acceptance.

The chip next to the photodiode is probably an OTA, (i.e. transconductance current amplifier), and the opamp next to it probably is used as an amplifier/comparator combination that feeds into the microcontroller.

From the description, it looks like that optics have been simplified also to remove the IR module and replace it with a photodiode/led light pipe combination. Again, cheaper to make. Notice that the photodiode sits an inch hehind a lens, and the diode has a pinhole covering. I think that achieves a camera obscura effect that probably means that it is very sensitive, can read at different angles and no miss reads. So it can probably read other barcodes where other readers might fail. Very cost effective design. I think that this optical systen is probably covered by patent "4,816,659 Bar code reader head".

Metrologic has three patents on barcode input going to browsers and the World Wide Web. So I would worry about them before I would worry about Cuecat.

On the serial id number, there has to be a way to program the device once it is assembled, so that means that it is probably done with a special sequence through the connector. Maybe even by typing in a special code!. So you 31337 types can get busy. Myself, I'd rather think about a more cost effective/easier to manufacture design. It is easier to design something anyway than to reverse engineer the whole thing. A great place to start is h ere, thanks to Mr. 1010011010 and his post #52 below :-)). I would use a pic in this, because it would be quick and easy. I also looked through the expired patents and got some good ideas how this design could be simplified.

The Cuecat does reflect alot of engineering that results in a robust design to achieve high performance. This is probably necessary to ensure consumer acceptance. I do not think it is the most efficient design though. For somebody who wants to make a cheap barcode reader for their own CD/book inventory, there are cheaper and easier ways to make their own, and achieve the same result (outside of obtaining more Cuecats/other bar code readers).

More on the CueCat internals...

[Pope Slackman]

Trying this again, logged in... >:/
(Note: Your device may vary, but I doubt it.)

The microcontroller in the CueCat is a Toshiba TMP87PH47U 8- bit microcontroller.

After a little searching, I came up with this:
TMP87PH47U Datasheet.

It has 16kb of OTP EPROM, and 512b of RAM and appears to run at 8Mhz.

There are two other chips on the board, a 4066 and an 8-pin SMT chip that I have yet to read the number off of. IIRC, the 4066 is a CMOS bilateral switch.

--K

---

Virginia is Unfreedonia

[JoeBuck]

Guido van Rossum writes: At the same time, Stallman doesn't want to allow any choice of law clauses, because one could stipulate the law of "Unfreedonia" which might reverse the meaning of the GPL. Even though the state of Virginia does no such thing!

Sorry, Guido, Virginia is Unfreedonia. It is the only state that passed UCITA without modification (Maryland passed a highly modified version that struck out some of the more obnoxious provisions). UCITA contains many horrors for free software developers and software users alike. Stallman pointed out many of these problems in this article. Virginia is the worst possible state in the US to specify as the jurisdiction where disputes over licensing will be settled.

I don't know if RMS's warning about UCITA potentially subjecting free software authors to liability (while exempting those who use shrink-wrap licenses) is correct or not, but it is a worry.

If Python is incompatible with the GPL, what it means is that people won't be able to link together Python code and GPLed code. This will be a major pain in the butt, so I hope that it can be fixed.

I don't know why everyone is giving RMS so much crap when it is CNRI that is making a change to a more restrictive license than it used in the past. CNRI created the problem, not RMS; as Guido said The new license was imposed by CNRI on Python 1.6 (the last release done from CNRI's code base).

The best solution will be to find some language that satisfies CNRI's concerns without causing these problems.

Re:Virginia is Unfreedonia

[FFFish]

Right off the bat, ianal, but...

CNRI seems to be doing RMS a biiiiig favour. It's bought to the front an important potential flaw in the GPL. CNRI's motivations are suspect (what with the UCITA issue), but the outcome may be an overall Very Good Thing for GPL.

'cause it seems to me that if the GPL doesn't stipulate the choice of law that will be used in taking GPL to court, then it could easily be taken to court in Bermuda... and I'm fairly sure that the Bermuda government wouldn't be shy about making anti-GPL laws should a big business promise to bring big money into the country.

CNRI's actions may force RMS to specify choice of law, which will in turn make the GPL more secure.

Perhaps the geek community can even influence a State into passing GPL-friendly law, instead of UCITA. That'd really help the software community.

--

Re:Virginia is Unfreedonia

[nehril]

Indeed, I think lots of people here are bashing RMS more out of habit than out of rationality.

Some posters here perhaps don't realize that RMS isn't forcing the GPL on anyone. If the Python crew want to release a license that is not compatible with the GPL, they are perfectly free to do so. They just have to accept the consequences, for themselves and for the python community.

On the other hand, Stallman HAS been fairly consistent in his goals and interpretation of the GPL. He also has somewhat of an obligation to all the people who have chosen to use the GPL, to defend it to the letter. Anyone who has (freely!!!) chosen to use the GPL did so because they believe in this particular mechanism to release "Free Software," and in the FSF to defend it on their behalf. If any coder had problems with FSF/GNU, they would have used a different license and dealt with the possible consequences.

If Stallman were to "just ignore that trivial little incompatibility" in this case or that case, he would be doing do a disservice to everyone who got on to the GPL bandwagon. He can't stop now.

That being said, RMS does sometimes seem to go over the top. But otherwise we would have a GPL that is routinely breached, with not much consistency and totally watered down. Not the stuff of revolution.

Re:Virginia is Unfreedonia

[Arandir]

Before you start clammoring over unfreedonia, ask yourself one questions:

Since the only difference between the new Python licence and the tried and true BSD licence is the jurisdiction clause, where are the UCITA or UCITA-like clauses in the BSD license? Or for those hard of hearing, what is there in the Python license that some Unfreedonia ndictator can latch on to?

Re:Virginia is Unfreedonia

[Arandir]

I can see your point, but I don't understand why RMS and others are rolling over on this issue. Has no one read Thoreau?

Just ignore UCITA! There is nothing in the Python language saying that the agreement (read contract) can be unilaterally breached without consequence. Read Thoreau and start practicing civil disobedience. When CNRI comes to sue you for violating a future license, make *them* extradite you. And if your state or nation caves in, then countersue them for breach of contract.

The fact of the matter is, the Python license is 100% free, completely and totally. Instead of crying into our beers over UCITA in Virgina, someone should be getting a case into the Supreme Court over it.

Re:Virginia is Unfreedonia

[Samrobb]

So... where *would* a GPL court case be tried, then? Without a doubt, if it ever comes to pass, the legal eagles for the large corporations will do whatever they can and need to do in order to make sure it occurs in a venue as favorable to them as possible.

While I can understand that RMS might be unwilling to place a restriction in the GPL to the effect that any contest of the terms of the GPL would happen in the courts of state X or country Y, would it be possible to add a similar clause that states that legal matters regarding the GPL will be settled in whatever venue the FSF chooses?

Re:Virginia is Unfreedonia

[Jason Earl]

Since the only difference between the new Python licence and the tried and true BSD licence is the jurisdiction clause, where are the UCITA or UCITA-like clauses in the BSD license? Or for those hard of hearing, what is there in the Python license that some Unfreedonia ndictator can latch on to?

Part of the problem with UCITA is that it allows you to change the license retroactively. In other words the CNRI could simply be waiting for the entire world to become Pythonistas (hey, Python is cool, it could happen) and then they would change the license on us and charge us huge money.

UCITA makes that fair and square. The guys at Infoworld call it "sneakwrap" and it's only one of the very evil parts of an utterly despicable law. It's no wonder that RMS doesn't want the jurisdiction specified, especially if the jurisdiction happens to be Virginia.

With the regular old BSD license at least the people who don't live in Virginia or Maryland would have some sort of recourse. Because they could choose their home state as the venue for the trial.

After all... no one expects the Spanish Inquisition.

Comment removed

[account_deleted]

Comment removed based on user account deletion

reverse engineering is fair use

[sethg]

If you're downloading the microcode for the purpose of reverse-engineering their protocol, your right to do so is protected by copyright law (at least in the US). See the cases I cited earlier.
--

Re:Very true...

[Detritus]

The CPU on the chip can still read the ROM. The security fuse prevents external devices from reading the ROM. The typical programming sequence is:

1. Burn data into ROM.
2. Read back data from ROM and verify correct values.
3. Blow security fuse.

An Everquest emulator is hardly a competitor

[vertical-limit]

While its legality could still be proved valid, to consider an EverQuest emulator a "competitor" to the legit EverQuest service is a joke. An EverQuest emulator is clearly a derived work -- you need the original data files to play the game, and the emulator's game world is still reliant on Origin for new material. To file a "leech" like the emulator in the same class as Meridian 59 or Ultima Online -- both of which are completely original programs -- is absurd, and no court would ever hold up and opinion like that.

That's not to say that an emulator isn't legal -- certainly, it's not in any danger of killing off the EverQuest craze^H^H^H^H^Hlicense to print money anytime soon. But it's certainly not competing with EverQuest; after all, if the actual EQ world went out of business, the emulator authors would be left without any new material! An emulator is a derived work and has been legally proven to be such.

Re:An Everquest emulator is hardly a competitor

[Chasuk]

I honestly don't care whether the EQ emulator is legal or not. It certainly won't curtail their profits, which, as Verant is a corporation which exists to make profits, is the only ethical consideration. Notice that I said ethical: fuck legal considerations when they are overshadowed by morality.

However: if Company X releases a product (say, a cheese grater), which, as a condition of purchase, requires you to daily masturbate into a tuna sandwich, and you STILL purchase that grater, then you have given up your right to whine, IMHO. Verant, also IMHO, has the right to impose any sales restictions that they want. Again, fuck the law. If Verant doesn't have that right, they should. EQ is an indulgence, not a necessity (despite what EQ addicts might sometimes feel). No, the producer of life-essential goods shouldn't, MORALLY, impose restrictions which would mean that some people starved to death (those who believed that wanking guaranteed their place in hell, for instance).

Laws exist to protect us, to ensure that what _should_ happen, DOES. By following the letter of the law and not the spirit, the legal system makes an ass of the law.

To sum up: Verant has the legal right to demand whatever they want as a condition of purchasing their products. However, as this server emulator causes Verant no injury, you have no moral obligation to obey that law.

Verant: 0. Us: 1.

Re:ID

[AndyL]

"(which they always ask for when I buy resistors... they must really want to know which parts of town are buying the most resistors)"

Well, Big Brother always trys to keep track of The Resistance.

-Andy

Build your own scanner...

[1010011010]

The website h ere describes how to make your own RS232-output barcode scanner.



---- ----

Other chip

[Pope Slackman]

The other chip is a 93C46 serial EEPROM.
I'd imagine this is where the serial number is stored -- anyone have the equipment to read these things? I'm kinda curious what else may be on it...

There's a data sheet here.

--K
(And of course, my AC misfire gets modded up... ;)
---

Re:Really a Serial Number?

[MostlyHarmless]

Try looking at the output in your favorite text editor. (yes, text editor. it just sends the scan to the keyboard port; no special software required).

It looks like this:
.C3nZC3nZC3nZCxjWENrYCNnY.fHmc.C3f2Cxj2DNz1D3P3.
or, generally, .text.text.text.
The first one is the serial number, the second is the type of bar code, and the third is the value.

Here's another scan:
.C3nZC3nZC3nZCxjWENrYCNnY.cGf2.ENr7C3r1CNzZD3P1C xzYENP6.
Notice that the first part is the same.
--

If CueCat would have kept quiet, noone would care

[geekd]

The irony of the situation is that if CueCat would have kept quiet about the OS coummunity's so called "IP Violations", very few people would know or care about the various "hacks" to their product.

Now that they've made such a big stink, everyone and their brother fred is eager to tear it apart and figure out how it works.

Moral:

Pissing off the geeks only motivates them more.

Re:ID

[AJWM]

There's nothing on the :CueCat packaging to indicate the serial number of that particular scanner. Yeah, the RatShack guy scanned mine (and the other stuff I was buying, of course), but that's more for inventory management (why else track a $0.00 sale?) and such. Since the serial number isn't scanned they can't tell *which* scanner is yours until you register at the web site.

Which of course I have not done. I have no intention of using the thing to scan crappy bar codes in ads. I might use it to inventory my library, although that's way down on the priority list at the moment. Mainly it's gathering dust now after playing with it for the first afternoon I got it. Just like most of my other toys :-)


No, no, no. It ain't ME babe,
It ain't ME you're looking for.

Re:ID

[Donut2099]

Why else would they give this thing away if they could tie your interests to a person? That's what it's all about folks - directed marketing...

Yer damn right about that. I decided to go ahead and install it last night to see how well it worked. I scanned in a few items and most of the time it just takes you to the parent company's home page. Some things pop up a page congratulating you on scanning something not in their database and would you please tell them what the hell it was. One item I swiped was a pack of Camels, which duly took me to the RJ Reynolds web site...

So, today when I get home, along with my usual daily dose of spam, is an email inviting me to visit www.qcigs.com, and buy some cigarrettes on the internet.... Hmmmmmmm....

Re:Very true...

[Bill Currie]

The previous poster forgot to mention that this is for eeproms in micro-controllers (cpus for embedded devices). You are perfectly correct that a standalone prom with a security fuse is about as useful as a stale french fry.

Bill - aka taniwha
--

My cat's breath smells like cat food....

[Rude Turnip]

This is only a little off-topic, but I've found a nifty application for the CueCat under BeOS. Using no special software other than an MP3 query tool, I can scan the barcode on the back of a jewel case and if I've got the album ripped onto my HD, the query tool (MP3 Flashlight) will seek out the songs, load them into my mp3 player (CL-Amp) and start playing.

All you have to do is store the scanner's output in the Comments attribute of the mp3 file (the Be filesystem allows indexable attributes to be associated with files). This can be done manually for albums you're already ripped, or automatically for albums you're about to rip (using a tool like RipENC).

If you have your jewel cases right next to you it's a cooler way of playing an album than simply double-clicking on a playlist.

After reading the thread topic about serial ID numbers in the CueCat's output, I decided to see it for myself.

Look at the scan outputs below. The top code is the output I got last night from doing a barcode scan of Motorhead's "1916" album. The bottom code was obtained just now from the same album, but using a different CueCat (I have 5, all from different stores).

.C3nZC3nZC3nYChPXDxzWCxnX.fHmc.C3r3DxD3DxT2E3f3.
** ***
.C3nZC3nZC3nYChTWD3D6CxnX.fHmc.C3r3DxD3DxT2E3f3.

The stars indicate differences in the scan outputs. Now, here is a comparison of the barcode output for Pulp's "Different Class" album using the same two scanners from above:

.C3nZC3nZC3nYChTWD3D6CxnX.fHmc.DhbYD3zXD3j1DNfZ.
** ***
.C3nZC3nZC3nYChPXDxzWCxnX.fHmc.DhbYD3zXD3j1DNfZ.

As you can see, the differences come up in the same 5 places each time. The last set of characters after the last dot seem to be unique to the album. So unless I go into the Comments attribute and delete out the part of the code where differences show up, I can only use one particular scanner to scan jewel cases and play albums. Worse yet, no one else who I share the mp3 with would be able to use their scanner if they happen to have the same jewel case.

Re:My cat's breath smells like cat food....

[Tau Zero]

Your asterisks aren't lining up with the appropriate text. Next time, use the and tags to format in a monospace font.
--

BarPoint, CueCat, ReaderWare

[1010011010]

http://www.barpoint.com/ offers a wireless laser-equipped barcode scanner, with a docking cradle, and software that gets you coupons and produces shopping lists. $29 deposit, plus $25/year. They were smarter than CueCat, in that they made it clear that they own the device, but also made it cheap and useful.

Of course, you can always use your cuecat to get a $25 discount on a 'real' barcode scanner...

Interestingly, http://www.readerware.com/ has added support for the CueCat to their software, and it does not report back to Digital Hemorrhoid. Normally, the CueCat device sends a request with your serial number and activation code embedded. THe CueCat output looks like this:

.C3nZC3nZC3nYDhv7D3DWCxnX.fHmc.C3rXD3T1C3nXD3nW.

It's an ALT-F10, your serial number, the bar code type, and the bar code data, spearated by periods and lamely base64+XOR67 'encrypted'. The CueCat software turns that into a request that looks like this:

http ://a.dcnv.com/CRQ/1..ACTIVATIONCODE.X.SERIALNUMBER .FhMC.c3Rxd3t1c3Nxd3Nw.0

YOu can actually replace your activation code with anything. My software replaces it with "ACTIVATIONCODE". It briefly replaced it with "MOTHERFUCKER" but I switched it back. The X seems to usually show up as "04" but doesn't have to be, and seems to be irrelevant in any case. And the Serial number can also be replaced.

Their game is to track all products and magazines, books, etc. scanned by their users in order to target marketing. YOu have to answer a long list of nosy questions when you install the windows software, unless you don't run the "autorun" program, and just run "setup" instead.

This probably explains why they're pissed about Free software existing. Mine, for instance, strips out the activation code unless you actually want to send it in. This anonymizes your scans.

Of course, I can't distribute my software because of some questionable legal shennanigans. I wonder if ReaderWare got a nasty letter... oh wait, they're a company that can probably afford lawyers, unlike me.

---- ----

Re:BarPoint, CueCat, ReaderWare

[1010011010]

Actually, capslock biffs it, as it makes everything all-uppercase.
No it doen't observe:
.C3nZC3nZC3nXDNf2C3zYC3nX.fHmc.C3fXDNPXC3n0C3j3.
.c3Nzc3Nzc3NxdnF2c3Zyc3Nx.FhMC.c3Fxdnpxc3N0c3J3.

Without capslock:
.C3nZC3nZC3nYDhv7D3DWCxnX.fHmc.C3DWC3nZCxnZC3z1.
with caps lock:
.C3NZC3NZC3NYDHV7D3DWCXNX.FHMC.C3DWC3NZCXNZC3Z1.
-M

---- ----

Re:BarPoint, CueCat, ReaderWare

[1010011010]

For those of you that are curious, all the CRQ software does is invert the case of the output of the CueCat scanner, and insert it into the SCANDATA section of the url: http://SERVER.dcnv.com/1..ACTIVATIONCODE.X.SERIALN UMBER.SCANDATA.0

... a simple case inversion.


---- ----

Re:BarPoint, CueCat, ReaderWare

[1010011010]

Since the scanner's output runs through your keyboard port, you can invert the case all by yourself by hitting caps lock. I wonder if
windows users would have trouble reaching web pages if they scanned with their caps lock on then?

Actually, capslock biffs it, as it makes everything all-uppercase.

---- ----

Re:Cue Cat Reality Check: 06A00 code

[Wholeflaffer]

Radio Shack includes product codes on [practically] all of the products it sells. 06A00 means that the unit was manufactured in June (06) of 2000 (00) by manufacturer A (the letter code is only important when more than one manufacturer makes the same product, such as a resistor or a battery, or a new [generally cheaper] manufacturer is employed to make an existing product such as a speaker or a videotape).

Do I have this right??

[yuriwho]

You buy a cluecat and give a fake name at R$. You creat a temp free e-mail acct at snotmail and complete your resistration to get your activation code. You think you are anonymous but the cluecat can now correlate your unique scan code with your IP number (even if it changes every time you connect) cluecat can now partner with doubleclick to figure out who you really are and correlate all your scanning with all your online browsing/purchasing.

Man...so much for privacy for the average person. I'm beginning to consider boycotting the net till we have some truly anonymous credit/debit card system like photocopier cards in wide use. ie Buy a card at the corner store with cash and have the ablility to add money to it anonymously from a bank machine at any time.

This tracking and correlating of everything we do on computers must stop! We need some laws against correlating this data to personally identifying databases and selling of those. Could be worth a letter to the man.

spooked

Capslock behavior depends on the OS

[yerricde]

By default, Windows systems use invert capslock. Apple II, Mac, and Linux* systems, OTOH, use toupper() capslock. The Apple IIGS computer's BIOS had a function that could change the capslock behavior.

*Keyboard I/O is a kernel function; GNU/not involved.
<O
( \
XGNOME vs. KDE: the game!

No, I did not get it backwards.

[JoeBuck]

Virginia, not Maryland, passed UCITA unchanged. I was right the first time.

CueCat's other product - the "convergence cable"

[Animats]

CueCat has another excitingly invasive product, the Convergence Cable. This connects the audio out of a TV set to a computer, which, using CueCat's software, then responds to "audio cues" from the TV to take over control of a browser on the PC to provide an "enhanced experience". This clearly needs some analysis, first to find out what's going over the TV audio signal (do they have FCC approval for this?) and second to find out what CueCat's PC application does with the data.

Re:Grocery Store Discount Cards, SAME???

[outlier]

When you fill out the little form at your grocery store to get one of those neat little cards [...] they now know who YOU are, and when they swipe the card and YOU'VE bought a jug of Vodka and a Playboy they know that YOU are the one who bought it......

I've been toying with the idea of setting up an exchange system for those grocery "savings" cards. You could get one (ideally with fake demographic info), then after using it, submit it to a pool and get another one. With enough people, the data would be useless (Well, it looks like 18 year old men are buying lots of maxipads and Cosmopolitans, and 45 year old women are into twinkees, Jolt Cola, and Maxim -- Let's send those ladies some viverin coupons!).

Damn details...

Re:ID

[Rude Turnip]

I've been to 5 different Radio Shacks and the experience varied. I guess since some employees think it's a "free" item, they figure there is no need to collect name/address info. Whether or not they take your name, they are supposed to scan the item at the register because (as an employee explained to me) it is nonetheless an inventory item. When the inventory level reaches a certain number, more are ordered automatically.

At the first Radio Shack, I (stupidly) gave them my name and address and they scanned in the scanner and catalog. However, my fiance was with me and they just gave her a scanner no questions asked and nothing got scanned. The next two stores asked for name/address and I gave them fake info. At the fourth store, the guy said, let's just scan this using our "dummy" account. At the last store, the kid just scanned in the cat and catalog but didn't request my name/address.

When it's all said and done, YMMV.

Stop the karma tax!

[Animats]

My karma is slowly dropping. I got up to 194 before the karma cap went on, and was still at 194 last week, but I'm at 191 this week. Yet none of my posts show as having been moderated down below +2. Is there a scheme to slowly drain away karma until it's within the cap, or what?

High karma ought to be good for something. Otherwise, why create well-researched posts with HTML and useful links? I'd like it to turn off the banner ads.

Wow...

[Pope Slackman]

That is /WAY/ different than my unit.
The optics are different, the uC is different, and the ~28 pin SMT chip isn't even on mine.

I'll put up some pics of mine in a little while:
http://sausageparty.net/cuecat/
(Not linked because I have finite bandwidth and don't want to get raped...)

--K
---

OT: No CueCat in Canadia

[TheTomcat]

Nobody at the local Radio Shacks has any clue what a CueCat is. I guess it's an American thing.

If any of you fine americans have a surplus of stamps and feel like snail-mailing me one, please feel free to email me for my postal info (-:

Re:Competition

[burris]

You can't copyright an algorithm. Only a specific implementation of an algorithm is copyrightable. "Clean Room" derived implementations of the algorithm are not infringing. You can patent an algorithm, in the united states at least, but it's expensive and time consuming, and too late in this case.

Burris

Sorry, you got it backwards.

[lythander]

Virginia passed a highly marked-up version of UCITA, Maryland is the one that rubber-stamped it.

Re:Verant/Sony, not Origin/EA

[Sick Boy]

Orgin no longer exists, it is now fully absorbed into EA.
--

Verant/Sony, not Origin/EA

[Speare]

An EverQuest emulator is clearly a derived work -- you need the original data files to play the game, and the emulator's game world is still reliant on Origin for new material.

EverQuest is produced by Verant, for Sony. Ultima Online is produced by Origin, a subsidiary of Electronic Arts.

That's not the problem

[eclectro]

There's no problem with a single company tracking purchases so they can target ad you. It's when all these companies take all this information, sell it to each other (tell Amazon what dark place they can stick their books BTW) and combine it - that's where the problem is.

Because they know what you have bought at all the stores, what you are reading, and what services you have ordered they can create a detailed profile of you. Then, by "data mining" they know what income you have, what possesions you own, what problems you have, what illnesses you have had in the past or might have in the future, what kind of employee you are, what kind of relationships you have, whether you should get insurance or not, wheteher you should get a house loan or not, do I need to go on???

Not reverse engineering

[Performer Guy]

Downloading their microcode from the chip is not reverse engineering, it's theft. If you can try to figure it out yourself, don't download their code.

OSS Community is not FSF community.

[werdna]

Don't confuse the "OSS community" with the "FSF community." Even RMS will agree they are not one and the same. The GPL is not the Alpha and Omega, and certainly neither the first or last of the free software licenses for open source software.

And Python is not the first nor the last new development environment to adopt non-GPL, but free and open source, licenses. In my view, the incompatibilities of the licenses remain as much an indictment of GPL as of Python-L. While it may limit the number of free libraries available for linking to Python, that environment is well beyond critical mass at this time -- and it is probably more encouragement for non-Python people to issue code under LGPL than it is a deterrent for others to work in Python.

"convergence cable" -- FCC approval?

[satch89450]

The Convergence stuff uses audio in such a way that the radio transmission spectrum isn't altered, so the FCC doesn't care. If DigitalConvergence had tried to use out-of-band audio cues, then the FCC would take notice. I suspect that they are using tones under 150Hz, because damn few people would notice low-level signals in the bass, even if they had super home theatre systems. This would be especially true if they phase-modulated a really low tone, like 55 Hz. Dunno, but a spectrum analyzer would pick this up. Anyone know of any audio signal that carried the Convergence signal?

Re:ID

[Phexro]

whenever i go to check out at rat-shit, the exchange goes somewhat like this:

Employee: Can i get your phone number?
Me: No.
Employee: umm...

they just can't seem to handle any deviation from the usual reply. of course, it seems like they only hire the people who just couldn't hack it at mcdonalds.
--

Getting the CueCat to work with InternetExplorer

[Anonymous Coward]

Just stick this at the end of the perl code for the CueCat that's on FreshMeat

use Win32::OLE;
my $app = Win32::OLE->new("InternetExplorer.Application");
$app->{Visible}=1;

while()
{
chomp;
$decode = CueCatDecode($_,3);
$isbn = substr($decode,3,9);
$checkdig = CheckDigitISBN($isbn);
if($checkdig == 10)
{
$checkdig = "X";
}
$isbn = $isbn.$checkdig;
$app->Navigate("http://www.amazon.com/exec/obidos/ ASIN/$isbn");
}

Re:What URL does their s/w go to?

[Russ Nelson]

Silly Russell, somebody just posted that information, PLUS it was in one of the other slashdot articles about the :Foo:Cat.
-russ

If you give a mouse a cookie...

[Mooset]

Okay, let me get this straight. You walk into Radio Shack and get the free scanner, catalog, and some software, and you are supposed to go home and install the software and register to buy things from the catalog online. But, because the software that was designed for the purpose of ORDERING THINGS requests your NAME and ADDRESS, it is equated with being a tool of Big Brother?

You people crack me up.

Tracking purchasing patterns is neither a new thing or an evil thing. There is no big "He ordered a case of Jolt, he must be a communist revolutionary! Notify the authorities!" conspiracy going on. It's simply a matter of statistics. If patters show that people who buy lots of Jolt and porno mags also like to buy copies of Everquest, and a store records a surge in Jolt and porno sales, then they better stock up on copies of Everquest. The exact same thing applies to how Radio Shack operates its online catalog. It's called basic marketing, and if you don't like it, don't pick up a CueCat. Your privacy isn't "infringed", Radio Shack saves money by having more CueCats for legitimate customers, and everyone is happy.

CueCat innards

[Rambo]

As someone who has done their fair share of embedded design and programming, I can assure you the CC is NOT simple, and it neither contains a DSP nor is it nothing more than running the output through a ACD (analog->digital) inside the microprocessor and then referencing the binary input with a list of values to produce the barcode string. The fact of the matter is, it's a fairly complex process decoding barcodes, as there are a fair number of flavors, such as UPC-A, and UPC-E. Each format is a little (or a lot) different, and last time I checked into writing such a beast, I canned the idea pretty quickly. Also, try pricing out the "wedges" that decode the output of barcode wands sometime; they're not cheap. Anyway, my whole point is the difficult part of the CC design is not the electronics so much as the software running on the microcontroller.

Who cares? I mean who acutally installed the SW?

[Anonymous Coward]

I have the reader built into a custom box bolted onto my monitor-less keyboard-less mouse-less Linux server. I have cards with bar codes printed on them which when swiped perform verious tasks. There's:

the reboot card
the system halt card
the cut the internet connection card
the kill all the print jobs card
the boot off all lusers card
and the FBI raid card (unmounts all encrypted filesystems)

Without the software, no serial number is being sent over the net.

Response

[Booker]

It's prepended to the output each time you scan.

---

Serial Number on My Forehead: Stolen!

[webword]

Someone forgot to tell me that my serial number was stolen and put into my glorious Raid E O Shaq scanning device. I woke up this morning and the Mark of the Beast was no longer on my forehead! They took it and actually put it in the device itself. They stole my identity. They own me. What is the world coming to? I mean, this is like we are back in 2053 when pure humans still existed. How am I going to buy food if they can't scan my head!? What's going to happen, the scanner is going to scan itself and then give me food? Help! We must revolt against Raid E O Shaq and get back our souls!!

Re:cuecat corrections: correction

[Matt_Bennett]

Actually, it works both ways. Many infra-red LEDs (particularly the very bright ones) have some visible light output. I have a VCR remote control that I can see the output from in a darkened room, if I look directly at the die. I've been able to see light from many clear packaged IR LEDs (without a filter window in front of it). The vast majority of the energy is still going to the IR component of the light, as demonstrated by an IR flourescent detector, in my case.

LEDs are not spectrally pure, they put out light over a range of wavelengths. The wavelength given for a particular LED is just the center of the band. Just as visible LEDs have output in the IR region, the IRLEDs have output in the visible region. The dark window/encapsulant of the IR LEDs block the majority of the visible light.

But since I don't have a cuecat- I have no idea which applies in this case. If the light output of the cuecat is dim, I'd guess that it is actually IR, since they want to get as much power output as possible, to get the best signal/noise ratio at their detector. IR LEDs are usually a better choice because they are much more efficient than visible LEDs in terms of candelas/milli-amp.

big brother

[brokeninside]

Well, Big Brother always trys to keep track of The Resistance.

True, but in Orwell's 1984 at least, Big Brother also was the resistance .

Emanuel Goldstein was construction of the party to help weed out people that needed to be re-educated. Now doesn't that put a whole new spin on 2600, the hacker quarterly.....