Slashdot Mirror


Will Your CD Player Tell on You?

An anonymous reader writes "Ever feel like not being a marketing statistic? Well just by playing certain store-bought compact discs in your home or office computer, your new music disc may be transmitting your listening habits in real time to the respective record company...." Charming. Read on for more... Anonymous Continues: "A company by the name of Bandlink is providing technology to record companies that allows a cd played in a personal computer to contact their server and relate statistics such as what track you're listening to and when you're listening to them. This information is then compiled into customizable reports that allow the record company to develop "User Profiles". There are benefits listed for the consumer such as cd-specific chatrooms, concert information, etc but the question remains: What's your price for privacy? The only indication that the cd you're purchasing is Bandlink "enabled/disabled" is a small logo on the packaging. There is no mention of a opt in/opt out agreement when the cd is inserted on the website and none was displayed in a personal demonstration.

Favorite quote from their website: "Virtually any information you want to know about your fan or the quality of your release can be obtained.""

79 of 693 comments (clear)

  1. What sort of idiot? by Trusty+Penfold · · Score: 5, Funny


    What sort of idiot has their firewall configured to let their CD player send packets out?

    1. Re:What sort of idiot? by smittyoneeach · · Score: 5, Insightful

      The Average Idiot.

      --
      Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
    2. Re:What sort of idiot? by BlackGriffen · · Score: 4, Insightful

      The kind who uses a CDDB, or who doesn't have a firewall.

      BlackGriffen

    3. Re:What sort of idiot? by rant-mode-on · · Score: 4, Informative
      • And how do you configure your firewall to stop your CD player from sending packets out?

      Whilst that's something that iptables/chains just can't cope with (sadly) I have Norton Internet Firewall, for my remaining Windows PC, which is application based. ie, you can accept/deny any connection for each application. Its a great facility, one which I wish was available on Linux. There's nothing like knowing which applications are spying on you...

      Of course, NIF is too complicated for your average Windows user, but ZoneAlarm has similar facilities, and is much easier to get to grips with.

      Gawd, never thought that I'd be promoting a windows app...
    4. Re:What sort of idiot? by hitzroth · · Score: 5, Funny

      Idiots aren't average. That's why they're idiots.

      --
      In mathematics, one does not understand things, one merely gets used to them.
      --VonNeumann
    5. Re:What sort of idiot? by windex · · Score: 4, Informative

      grsecurity let's you limit network access to specific uid/gid's. You could in effect make programs setgid 'network' if you want them to be able to access the network and blanket deny the rest of the lot.

    6. Re:What sort of idiot? by soulsteal · · Score: 5, Funny

      No, the average median person is an Idiot. What scares me is that 49% of the population is dumber than that.

    7. Re:What sort of idiot? by Tingler · · Score: 5, Funny

      I guess you haven't been to a mall lately.

    8. Re:What sort of idiot? by Cokelee · · Score: 3, Insightful

      The same damn person that is running iMesh, or KaZaA. Both of which are INFINITELY worse about privacy.

    9. Re:What sort of idiot? by denisdekat · · Score: 3, Informative

      maybe you should download zone alarm, it's good for those who don't know too much about securing stuff ...

    10. Re:What sort of idiot? by shaitand · · Score: 5, Insightful

      I'd suggest that a very large chunk of those who find slashdot interesting enough to read are above average at the least. First they read, this alone indicates they are probably above the low set as average. Second they are interested in technological innovations, science, physics, mathmatical puzzles, computer programming, and free speech. True there are those who just hang around to see what the newest mp3 player is. But for the most part there is a reason that the opinions you see on slashdot tend to differ from what you see mainstream, mainstream is in very large part those average and below average intelligences at work.

    11. Re:What sort of idiot? by TheLink · · Score: 4, Funny

      Still, it seems a very large chunk can't read but can post :).

      --
    12. Re:What sort of idiot? by weave · · Score: 3, Insightful
      I don't see how zone alarm can stop spy packets that go through http via IE via a COM object call. Any little proggie can grab a page such as "http://spysite/stats?uid=xxxxxxx&cd=nnnnnnnnn&tra ck=n" and then discard the results. You'd never know about it and your zone alarm will not stop it unless you stop all traffic from IE and use a different browser. (probably not a bad idea...)

      A com object call requires the target program (like IE) to be running and if it's not, will launch it. It's like a remote-control of the external app and hence I believe that app (IE in this case) would be the one grabbing the page and returning the results. It's not like a library call. The process should be identified as IE to zone alarm (and hence a good guy).

      If I'm wrong, I'd love for someone who knows how COM works to tell me. But I'm betting I'm right...

  2. My desktop is my property by Sean80 · · Score: 5, Interesting

    You know what? I think the law should start considering my computer desktop and my network connection as my personal property. Want to display a popup on my desktop? Sure, $5 a time. Want to send some bits on my behalf? Sure, $1 million a time. If you try and steal advertising space on my desktop, or steal some of the bits that I own, then you go to jail.

    1. Re:My desktop is my property by Jon-o · · Score: 5, Insightful

      On the other hand, you DO control your computer, and can and SHOULD be careful about what you run on it. In this case, simply turning off the ridiculously stupid autorun when you put in CDs is enough to foil whatever the cd does when you insert it.

      Same goes with javascript and ad popups - just turn them off! It's your computer!

      Sure, there are conveniences that you lose in doing that, but many conveniences come with security risks and other annoyances. It's just like the security problems with Outlook autorunning attachments and scripts all the time - it's a ridiculous way of writing software, and never should have been included, and anyone with a clue either turns it all off or gets a different mail program. For some reason, people don't see javascript and autorun and similar things in the same way. I do.

    2. Re:My desktop is my property by General+Wesc · · Score: 3, Interesting

      I've never had anyone else put a pop-up on my desktop. I have to run the javascript/ECMAscript that opens the window. I have to install the program to access the website, I have to (implicitely or explicitely) grant it permission to run Javascripts/ECMAscripts, I have to tell the program to visit the website with the script.

      You're trying to fine people for writing a script. Sounds like the DMCA to me. (Note: the DMCA is a bad thing.)

    3. Re:My desktop is my property by cioxx · · Score: 5, Funny
      Don't agree to their EULA and you are fine.

      That's what I do. I usually click "YES" in the EULA popup and install the program, but deep down inside I don't agree with it.
    4. Re:My desktop is my property by chipwich · · Score: 5, Insightful

      But you're missing the point... As technology becomes ever more integrated with our lives, the option of "just turn it off" becomes increasingly less possible. No, not from a technical perspective, but from a *social* perspective.

      Sure, you could turn your cell phone off when you're not making a call so that telco's and gov can't triangulate your position, but do you?

      Sure, you could pay for everything in cash instead of credit to avoid an electronic trail, but do you?

      Sure, you could wait 10 minutes at the bridge instead of using a new electronic toll payment system, but do you?

      Smart agents and networked technologies like this erode our privacy. But do we get enough in return?

      How much would you sell *your* privacy for?

    5. Re:My desktop is my property by Jon-o · · Score: 3, Interesting

      Turning on autorun is like telling the the third party that they now have your permission to send or receive information. If I run software on my computer, it's because I trust it enough to do so.

      Now, if I don't know that it's running, or it shouldn't be running, (because it's doing so via a security hole, for example) it's a different story. But in this case, the computer owner has configured the computer to run software on CDs when they are inserted, and then he has inserted a CD.

      Of course, debates on whether autorun should be ennabled by default are welcome - I know which side I would be on. But calling this "hacking your system" isn't very accurate.

  3. And how is this different... by NetDanzr · · Score: 5, Insightful

    ...from all those players (including WinAmp) that analyze your CD and download the songlist for you? And this applies to 99% of retail CDs, not only those that are enabled by this technology.

  4. maybe they'll discover something important by gasgesgos · · Score: 3, Insightful

    this may not be all bad.. "Virtually any information you want to know about your fan or the quality of your release can be obtained." maybe they'll finally realize that everyone knows that the quality of their releases is mostly TERRIBLE... and that most people buy cd's for more than 1 song... this may actually lead to entire CD's being quality once again...

  5. DOD? by Squareball · · Score: 4, Funny

    So does this info go to the DOD to see if you're a terrorist? God help me if they know that I like Avril Lavigne!

  6. I prefer Tiny Personal Firewall by Bonker · · Score: 5, Informative

    I use Tiny Personal Firewall 2.0 to stop this sort of crap under Windows. It'll block any application from 'reporting' back home via the internet. It's a pro at keeping apps like Real Player or guys like this from tattling. It's not open source, but the 2.0 version was freeware. I'm not sure about the 4.0 version.

    I strongly suspect that this won't even be an issue for most Linux users.

    --
    The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
  7. Solutions... by Mwongozi · · Score: 5, Insightful

    Buy a Mac? Use Linux?

    Uh... disable autoplay? Come on, not tricky, this one. :)

    1. Re:Solutions... by chunkwhite86 · · Score: 5, Insightful

      Well sure, I'm certain most of the /. crowd is fully capable of these things, plus firewall and proxy configuration to block the offending packets.

      The real problem here is the general public who doesn't know any better, and even worse - doesn't care.

      In itself, knowing what CD tracks you listen to is obviously not a serious threat as far as privacy invasion goes but...

      Knowing what CD tracks you listen to and when, what groceries you buy and when, and videos you rent and when, who you call and when, where you go and when, and the list goes on and on. The sum of these things is just a bit too much information for corporate america to be keeping detailed track of.

      Perhaps you know how to disable most of these tracking systems, do you really want these big corporations watching the every move of your grandmother - who unlike you, doesnt know any better?

      --
      I'd rather be a conservative nutjob than a liberal with no nuts and no job.
    2. Re:Solutions... by Phroggy · · Score: 3, Interesting

      Knowing what CD tracks you listen to and when, what groceries you buy and when, and videos you rent and when, who you call and when, where you go and when, and the list goes on and on. The sum of these things is just a bit too much information for corporate america to be keeping detailed track of.

      I think there's an important point here that you missed. Corporate America is not a single entity, and each of these things is not added to a sum. Sure, Safeway knows what kind of food I buy, and Blockbuster knows what videos I rent*, but there's no way to corrolate my food purchasing habits with my video rental habits. Even if Safeway and Blockbuster were both owned by the same parent company, they don't use the same database.

      The other important point is, if the only thing this information is being used for is gathering statistics to help the companies market more effectively, I don't care. They're not invading my life.

      * Not really; public libraries are wonderful things.

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
  8. Who runs an EXE they weren't expecting? by DDX_2002 · · Score: 5, Informative
    Yeah. One more reason why "autoplay" is unchecked on my machine.

    Is this USA only, or are these for sale in Canada or in Europe? Because if they are, Canada's PIPEDA and the EU DPD mean wake up and smell the lawsuits.

    --
    MHO. YMMV. Any resemblance between this post and real persons, or reality in general, was accidental.
  9. Here's the real question... by Dr.+Bent · · Score: 5, Insightful

    Does it transmit data when you rip a CD?

  10. I read their site a little more closely... by shylock0 · · Score: 5, Informative
    First of all, my earlier post was right: Only works on Windows-Compatable PCs. Second, the privacy risk here isn't all that great:

    Bandlink Support

    Bandlink is designed to be run simply by inserting the CD into a Windows Compatible PC. The first time you insert the CD you will need to agree to the Bandlink User License and download the remaining program files. Bandlink should do the rest from then on.

    As you can see, there's a consumer agreement component here. It's not an unimpeded, unstoppable invasion of privacy, like what TiVO was doing. You have to agree as well. In which case, if you don't really care about your privacy (and you like push content, which some people do) it might actually be seen as pretty cool.

    --
    Statistically speaking, there's a 99.998% chance that my IQ is higher than yours. Get over it.
    1. Re:I read their site a little more closely... by doormat · · Score: 4, Interesting

      So what happens if I dont agree with their license? Do I not get to play the CD, or do they just not collect any information. Or do they use misleading language to trick the consusmer into hitting yes?

      --
      The Doormat

      If you're not outraged, then you're not paying attention.
    2. Re:I read their site a little more closely... by tswinzig · · Score: 3, Insightful

      It's not an unimpeded, unstoppable invasion of privacy, like what TiVO was doing.

      TiVo sends aggregate information. How is that an invasion of privacy?

      --

      "And like that ... he's gone."
    3. Re:I read their site a little more closely... by radish · · Score: 3, Informative

      No they are not. Do you even know what aggregate means?? The information gathered by Tivo DOES NOT identify you. It doesn't even contain "unnamed individuals". To use your first analogy, it's like some guy stood at the edge of my town and made notes of who drove in and out. And frankly, I don't care if someone wants to do that, it in NO WAY undermines my privacy. The Tivo data just says "XZY program was watched by 20% of users, of who 35% also watched ABC program". Big f***ing deal.

      Oh, and for the over paranoid tin-foil hat wearing brigade out there, one call to Tivo and you're off the list.

      God it's 3am and I'm responding to some privacy-nut FUD-spreading troll. I need a life.

      --

      ---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"

    4. Re:I read their site a little more closely... by leviramsey · · Score: 3, Interesting
      thats not necessarily true. CDs can play in normal cd players and not cdroms all the time...thats the biggest issue with copyprotection...its the datatracks that are corrupted which only cdrom drives read.

      Very true, but how the hell could you have the data tracks switch between unplayable and playable states based on whether you agree to an EULA?

    5. Re:I read their site a little more closely... by ucblockhead · · Score: 3, Informative
      No, you do get to play the CD just fine...you just don't get to use their "extra" featuers.

      This is a pretty typical "we'll give you personalized content in exchange for personal data" deal. Hardly new and alarming.

      --
      The cake is a pie
  11. Moot point by pctainto · · Score: 3, Funny

    I can't wait to get this technology with a "copy-protected" cd that won't play in computers. Unless they would do it to try to get information from the people who break the copy protection by using a sharpie...

    --
    I think my principles are reachin' an all time low
  12. Yikes. But they must have some amazing tech... by eric434 · · Score: 4, Insightful

    ...if it can make your CD 'phone home' when playing it in a regular CD player (as mentioned in the article) that's not 'net connected!

    In any case, this is seriously scary. While I don't think most Slashdotites (being technically literate) will be affected, think of your mom, little sister or brother (if any), peers at school (if any) - all those people who click "OK" mindlessly whenever a dialog box pops up. It's THOSE people that this kind of stuff targets - because those people don't know better. The only way to stop it is to TELL THEM ABOUT IT. Get the word out. Post flyers. Put it in your sig. Whenever you fix someone's computer, tell them about the new 'spy' CDs while you're digging around inside their case or (more likely) plugging in their eithernet cable.

    I'm sure someone will come up with an anti-spy software for this soon, so give out as many copies (assuming the antispy software is freeware) as you can.

    Look how well it worked for CD copy protection, at least for the first wave. We can do this.

    --
    This .sig temporary until a better .sig can be constructed.
    1. Re:Yikes. But they must have some amazing tech... by Sly+Mongoose · · Score: 4, Funny
      ...or (more likely) plugging in their eithernet cable.
      EITHERnet?

      Supports Ethernet and Token Ring simultaneously?
  13. The Great Privacy Principle by dpbsmith · · Score: 5, Insightful

    The fundamental principle underlying current privacy practices in the United States is: "It is perfectly acceptable for a company to violate your privacy so long as it is for the purpose of selling you things."

    Obviously companies believe this, and on present evidence I'd say that most consumers believe this, too.

  14. Sick and twisted minds, those reps by peculiarmethod · · Score: 3, Insightful

    You would think that if they use slashdot in order to find software and techniques that crack their attempts at 'protecting investments,' that by now they would understand that 'user profiling' is not generally liked or condoned by informed users.. in my humble opinion the modern day equivalent of 'racial profiling'.. the initsself modern term for a commonly rampant tendency for humans to generalize and profit of those generalization and the fears that follow. In this case, push technology is their answer to piracy finance losses. When I say loss I say it loosely and in a 'predicted forecasted maybe finacial gains report' kinda way. So, Why can't they get a grip and let customers come to them (with their supposedly superior product)? Why must they collect info on already paying customers when its been written as a disliked idea in popular science fiction (and general fiction/ some nonfiction) forever?

    I give up.. I'll never rant again

    HEY IN ANYONE HERE IS THINKING OF STARTING A COMPANY..

    respect privacy..

    nevermind.. I'm wasting my breathe.

    pm

    --
    ** "It's not my job to stand between the people talking to me, and the ones listening to me." -- Pego the Jerk
  15. So how does it work? by Tet · · Score: 5, Insightful

    There are few technical details on their web site, but it appears to just be a mixed mode (data and audio) CD, which when played using Bandlink's CD player software, will give the "benefits" described. Since I don't have any intention of using their software, it's not a problem. Until, of course, people start producing music that can only be played with their player. So far, record companies haven't been brave enough to test such a tactic in the market, although with copy protected CDs, they're getting awfully close to the line. The depressing thing is, I suspect the general public would just meekly go along with it :-(

    --
    "The invisible and the non-existent look very much alike." -- Delos B. McKown
  16. RIAA Self Destructs Again by KanSer · · Score: 5, Funny

    Wow. How did this line of thinking go?

    RIAA Exec #1: "Let's start spying on people. It's not like they have a real reason to steal music anyways."

    RIAA Exec #2:"Yeah! And we can have pop-ups that tell them Big Brother is watching!"

    RIAA Exec #1:"No... That would be stupid... right?"

    RIAA Exec #2:"Perhaps... But surely this will make people want to buy music as opposed to downloading it. Right? Right?"

    RIAA Exec #1:"..."

    RIAA Exec #2:"RIGHT?!"

    RIAA Exec #1:"Oops..."

    Me: "Thanks guys. Now I have a morally sound reason to download Britney's newest album! MERRY CHRISTMAS!"

    --
    • MOD PARENT UP by Anonymous Coward Wednesday April 20, @4:20
  17. A little paranoid? by sfe_software · · Score: 5, Informative
    From the Bandlink web site:
    Installation:
    1. Insert you Bandlink CD into your Internet Connected PC. (Bandlink should autostart on Windows).

    2. Click "I Agree" to the Bandlink License and select "Connect" to install Bandlink.

    3. Bandlink should detect your CD, begin CD playback, and display artist content.

    So it's nothing more than some Auto-Run software. Which makes sense, I can't imagine any other way a CD would just magically contact a remote host.

    Solution? Disable auto-run (which I do anyway), or in this particular case, don't accept the license agreement...

    They also mention this a lot:
    There is no encryption, anti-piracy, or any other playback prevention capability within the software.

    My first thought was that they could easily combine so-called "copy protection" with phoning-home, but at least with Bandlink this is not the case.
    --
    NGWave - Fast Sound Editor for Windows
  18. IN UNITED STATES OF AMERICA by jsse · · Score: 5, Funny

    CD Player listens to you!

    (At least people in Soviet Russia can grin on this)

  19. Everything else you do is being tracked by ToasterTester · · Score: 5, Interesting

    Every time you use a credit card, grocery store discount card, write a check they put through a reader, login to something, and so on and so you're are being profiled. I used to work for the second largest ISP, and everything you connected all your connection attempts and other info was beening uploaded during the connection. Many of the major corporation now run software that monitors your calls, and internet activity. We are being monitored, counted, tracked, profiled, and categoried so much does it even matter. All this is just business, if get into all the tracking the goverment does, and you'll really feel like a specimen under a microscope.

    Actually in many way I feel there is safety in numbers. If they were only monitoring a we few people I would be nervous, but when the amount of data being collected we are people just numbers in a statisitc somewhere. Just another brick in the wall.

    1. Re:Everything else you do is being tracked by base3 · · Score: 5, Insightful
      If they were only monitoring a we few people I would be nervous, but when the amount of data being collected we are people just numbers in a statisitc somewhere.

      This is true so long as you're not an outlier. Consider some examples of things that could make you an outlier:

      • surfing sites in Arabic
      • using or downloading encryption software
      • consulting non-mainstream media sites
      • Reading the Poindexter bio at thememoryhole.org

      I'm sure with minimal effort, others can come up with even more chilling examples. When the government of our corporate republic can legally trawl everything looking for outliers, safety in numbers doesn't make me so comfortable.

      --
      One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
  20. Long URL's (or is that URI ;-) )? by T-Kir · · Score: 5, Interesting

    Although I use the free ZoneAlarm.. I'm also pretty restrictive about what programs I allow access, i.e. why oh bloody why does WMP require internet access when playing a media file when all the required codecs are installed (pile of crap it is).

    But, the cynic in me keeps shouting out this idea... what is to stop the disc (well apart from disabling autoplay, unless MS has some other "backdoor" auto execution of something on new media) from opening up a browser window with a heavily customised piece of url every now and then? The default access permissions will allow any web browser to do it's stuff?

    Just food for thought.

    --
    Are you local? There's nothing for you here!
    1. Re:Long URL's (or is that URI ;-) )? by Bonker · · Score: 5, Informative

      Absolutely nothing.

      As a matter of fact, I've seen a few applications do just this to try to do 'instant' registration by using rundll32.exe to open a url that's a complex URL-encoded string with registration details.

      Imagine a URL like:

      http://www.company.com/registration.cgi?appname= Fo o&serialno=939848408930$userip=201.101.80.112

      etc...

      The one that comes to mind is PowerDVD. I've seen it do this on a coworkers PC.

      The solution to this is to deny your default browser's abilities to access the internet before installing a new app like this and then applying a deny rule against the IP or hostname it tries to access.

      --
      The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
  21. Re:IN SOVIET RUSSIA by Anonymous Coward · · Score: 5, Funny

    IN SOVIET RUSSIA "IN SOVIET RUSSIA" comments are lame

    Join the fight aganist lame /. comments

  22. Block DNS Call? by TrailerTrash · · Score: 3, Interesting

    Can someone with one of these CD's report the addresses they try to write to, and we add a map to 127.0.0.0 in the HOSTS file? That works with all kinds of spyware (e.g., doubleclick, redsherriff).

    Better yet, can someone distribute a universal HOSTS file of all known spyware and update often? I'd pay for the privilege. AdAware may be a good vehicle.

  23. So what do you do now? by Ayanami+Rei · · Score: 3, Interesting

    Do you play all the music that you want to listen to? Or did you just stop listening to music pretty much period.
    (This isn't meant to sound arrogant, I'm just curious)

    As someone else had posted earlier, it's not likely iptables would notice. It would probably look like a web page request on the client computer, which would be legitamate as far as the firewall is concerned.

    If this IS the case, thats cool because you could log the packets while the app runs after inserting the CD, and see how they talk to the server. Then using the logged data as a model, you could seed the database with misinformation, or "support" certain bands that you are partial to.

    --
    THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
  24. slippery slope and the problem with technophiles by ender's_shadow · · Score: 4, Insightful

    This is not a big deal now -- you have to install their software for the "feature" to work, etc. Therefore some of the people on this site are not concerned. After all, we listen to our cds on real cd players, and don't use their program, etc.

    The problem arrives when you must install this software to listen to the cd on your computer. Remember, copy protected cds are out there, and adding this layer wouldn't be very hard.

    The next step means loss of fair use. Maybe not for you or your friend who thought Napster was the greatest thing since a windows network on a university campus, but definitely for a lot of people.

    Over the last couple of years the fire has seemed to have burned out. We used to get pissed about this shit, and now the highest rated comments don't seem to care about it all. We're letting our guard down.

  25. Apparently,you and I live in very different worlds by jbf · · Score: 4, Funny

    The vast majority of people I deal with (in the real world) are idiots. And no, I'm not in tech support/customer service.

  26. What data is being sent? by SparkyMartin · · Score: 4, Insightful

    If a company wants to collect this kind of information I'd support it as long as it was purely entirely 100% anonymous. But what guarantee do I have that just the CD, track, and time of playing are sent?

    How do you know that they aren't sending your IP address when they say they aren't? How do you know they aren't sending info about files in 'My Documents' or what files are listed in the 'add/remove' section of the registry? And don't tell me the privacy policy says they aren't so they aren't-privacy policies are changed more often than my underwear, and I change that everyday!

    I don't mean to get all Mulder here, but I am so tired of companies trying to sneek things past me in a 10 page licence agreement for free software that exceeds the length of my deed if I buy a $300000 house!

  27. Re:good lord by base3 · · Score: 5, Interesting
    A modest proposal:

    PC's are cheap now--run two, one with an Internet connection, and one without. Network internally with IPX/SPX or NetBEUI. Download your entertainment on the Internet connected PC. Play the downloaded content on the disconnected PC. Voila`--the media players, etc. can't call home. For added security, don't do anything sensitive on the Internet connected machine.

    This setup isn't airtight, but it's a damn sight better than giving RealMedia, Microsoft, and every other spyware purveyor on the face of the earth unfettered access to the same machine that contains your financial information or files which indicate certain, um, proclivities.

    --
    One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
  28. Re:What sort of idiot? The most important thing by rock_climbing_guy · · Score: 4, Funny

    The most important thing to bear in mind concerning idiots is this. Consider how dumb the median idiot is. Half of them are dumber than that.

    --
    Wh47 d1d j00 541, 31337 15n't t3h r0xor5 ne m0r3???
  29. There is an opt-in/opt-out agreement. by bmetzler · · Score: 4, Interesting
    It's very simple. If you opt-in you put the cd in your cd player, and let the company profile you. If you opt-out you pass up the cd and move along.

    But I'm all for tracking people's CD usage. That allows companies to market more targetable CD's. Instead of producing CD's that people buy because they "heard" they were good, and then listened to only a few times before getting disgusted with it, it lets them find out what music people listen to over and over again.

    -Brent
    1. Re:There is an opt-in/opt-out agreement. by hysterion · · Score: 3, Insightful
      I'm all for tracking people's CD usage. That allows companies to market more targetable CD's. Instead of producing CD's that people buy because they "heard" they were good, and then listened to only a few times before getting disgusted with it, it lets them find out what music people listen to over and over again.
      Hmmm... Overlooked here is that their idea is to sell you many disposable CDs, not a few that you'll listen to over and over again.

      Lightbulbs aren't calibrated to maximize lifetime, but to make it as short as the market will bear.

  30. In short: "No it doesn't" by Oestergaard · · Score: 3, Informative

    I pop the CD in my box and play it. The CD is a "dead" media, it's not something that magically comes to life and starts transmitting information.

    Seriously, how stupid can people be? Ok, so the CD will buffer-overflow my player, and figure out how to access the outside world by executing it's malicious (processor and OS independent) code... You know what? No it won't!

    Shit like that doesn't just happen.

    So maybe *some* people run a player that facilitates said information gathering and transmission - that's their problem. Get a life, get a real player, get a real OS.

    But CD's magically coming to life and transmitting my listening habits (which I guess it stored in the big secret database facility on the moon, which is by the way run by aliens under contract with the government - which is again why they had to fake the moon landing, but that's another story) - no, please, just forget about it...

  31. Actually, this software seems pretty cool... by wirelessbuzzers · · Score: 3, Informative

    This software, if it is decently written, looks like it isn't nearly as bad as the article says it is. First, as many have pointed out, you don't have to install it. But notice what it does in addition to sending out your personal information: it lets artists give you access to bonus tracks, artwork related to the music, tour info (and discounts), contests etc etc. It lets you chat (and synch music) with people listening to the same thing, which, although I wouldn't do it, would be considered a perk by a lot of listeners out there.

    Furthermore, their privacy policy says they will not hand out required personal info, but only aggregate info. They do say that they will use your personal info to "contact you about services in which you have expressed interest," which may or may not mean spam. Really, "expressed" should mean a check box, but you never know. It looks like a loophole though. And of course, the artists can require your personal info to log in to their sites, but you can just refuse to give it and not log in if you think that's a problem.

    All in all, I the article is bullshit. If this system is what it says it is, it's just an above-average media player that comes with the CD (although possibly at the cost of, say, a quarter to the buyer). Nothing to bitch about, invoking "privacy" and all that. If you're a privacy zealot, firewall it. If not, there are still a zillion other programs that are more likely to spy on you.

    --
    I hereby place the above post in the public domain.
  32. Re:Linux functionality by radish · · Score: 5, Informative

    Just as an FYI re: one of your points, ZoneAlarm (at least) does checksum all the apps and compares them when they request a connection. If they've changed since you granted access, you are warned about it. So a malicous app would have to either magically hash down to the same checksum (unlikely!) or it would have to modify the database (hard, as it's protected) or modify the ZA checksum code (maybe easier). All in all, possible but not easy. I've never seen any mention of any app doing any of those things, the easiest is to simply invoke IE and have it make your connections for you!

    --

    ---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"

  33. Buy A Stereo by reallocate · · Score: 3, Informative

    ...enough said.

    --
    -- Slashdot: When Public Access TV Says "No"
  34. There are already laws protecting computers. . . by kfg · · Score: 5, Insightful

    against unauthorized access. Perhaps if the "average Joe" started to insist they apply to *his* computer as well the corporate server things would get, ummmmmmm, interesting.

    Of course if your computer software comes attached with an offensive EULA in which you "agree" to have no rights to your own system/network you might well be hosed. I'd like to see someone challange this in court *on the basis that you can't be coerced into signing away a basic property right, even by contract.*

    To my knowledge this hasn't been tried yet in America ( in some other countries the EULA is already considered invalid prima facie). All it takes is someone devoted to the cause with $50,000 American and five years of their life to devote to it.

    Of course there's another option. *Don't use EULAed software.*

    In that case the assumption of having to give some sort of explicit permission to enter your system ought to hold just as much for the personally computer as it does for the corporate/government computer.

    Hacking is a crime. Do your homework, secure your system, and then insist on *prosocuting* any "hacking" of you system, no matter who the "hacker" is.

    Laws are double edged swords that can cut the person who "bought" the law just as well as those it was intended to be a weapon against if the intended victim learns how to use the "weapon."

    KFG

  35. ZoneAlarm internals? by 0x0d0a · · Score: 3, Informative

    one of your points, ZoneAlarm (at least) does checksum all the apps and compares them when they request a connection.

    Wow, I would have thought that that would have been prohibitively expensive performancewise, which is why I would assume that only a "trusted OS" would do that. Interesting. So I'd assume (since Google fails to turn up a detailed whitepaper on the first few hits) that ZA MD5s the binary at the first socket access the app tries during an invocation (it certainly can't be every time the app tries to do something, or performance would be completely unbearable).

    But you really don't have to go to all this work. Copy (or contain) a copy of a trusted binary. Drop it into a directory somewhere. Drop a modified msvcrt.dll in the same directory, and let the program link to said DLL, and you've easily got untrusted code running within your "trusted" application.

    Frankly, as long as the OS doesn't have pretty low level support for this, you're going to be able to bypass it.

    I wonder what ZA could do to fix this? MD5summing linked to DLLs would be kind of expensive, and wouldn't work at all if there was application-initiated (rather than load-time OS-initiated) dynamic linking going on. I guess you could do that, take the performance hit...then ZA could hook LoadLibrary() and handle application-initiated linking....

    Still, as you and I mentioned, the monolithic design of IE, providing application-level services and using components left and right, is pretty much an unstoppable impediment to securing a Windows-based system.

    1. Re:ZoneAlarm internals? by NexusTw1n · · Score: 3, Informative
      BTW, I can tell you firsthand that IE5.5 (as forcibly installed by TurboTax) and Frontpage98 both go around ZoneAlarm.
      Only if you accept the default settings, which automatically allow IEXPLORE.EXE, svchost.exe and services.exe. You can custom setup and then IE 5.5 or frontpage will not access the net without permission.

      And while the orginal parent post gets modded up, it would perhaps be more informative if he had actually used ZoneAlarm...
      Copy (or contain) a copy of a trusted binary. Drop it into a directory somewhere. Drop a modified msvcrt.dll in the same directory, and let the program link to said DLL, and you've easily got untrusted code running within your "trusted" application.


      A quick and simple test reveals that clicking on IEXPLORE.exe in the Program Files/Internet Explorer folder, allows internet access, (if ZA has been to set to allow it of course). Copying the exe into another folder - say My Documents, and running it, creates a ZoneAlarm alert asking if you want IEXPLORE.EXE to access the internet. Which reveals that ZA does indeed MD5 the binary PLUS the program path, making the script kiddy hack described above nigh on impossible.

      As Zone Alarm themselves say, no firewall is perfect, but IMO ZoneAlarm is pretty damn good. It's simple enough for any one to use, which vital in today's harry home owner DSL world, the basic version is free as in free, which is vital to encourage all Windows users to use it, and it contains decent (but not perfect) protection at application level, vital to stop trivial hacks like the one described above.
      --
      It has become appallingly obvious that our technology has exceeded our humanity. --Albert Einstein
  36. privacy policy by ragnar · · Score: 3, Informative

    The company's privacy policy is listed on their site. From a quick read, the only thing that upsets me is that they pass along your info to the recording groups. It appears that only basic contact info is gathered and there is a fairly easy opt out approach. Of course, they can publish a rosy policy and blatantly ignore it.

    From what I can tell, they are trying to impress recording labels with an avenue to add value to the CD. I read a lot of ranting about how the music industry is clueless and could leverage the Internet better. Maybe this is a positive more in that direction. It is hard to tell.

    I'm a bit paranoid about it as well, but since I use Mac OS X I'll let the Windows people cut their teeth on this one.

    --
    -- Solaris Central - http://w
  37. What about spoofing the data? by stoicfaux · · Score: 3, Funny

    I can imagine a few bored hacker types writing something to flood Bandlink with bogus data. "Wow, a million people a day are playing 'Baby Got Back' every hour on the hour!"

    I can imagine really, really bored hackers writing a virus to have infected computers spoof data. A new world-wide phenonmena: Polka Love songs!

  38. They're in Canada. by quantumparadox · · Score: 5, Informative

    I bought Santana's Shaman last month and it has the wonderful tracking technology built in. I was curious as to what the "Bandlink" thing did when I bought the cd (never heard of it before). Luckily, I went to their website first and saw the usage statistics crap and decided against installing it.

    I read part way through the EULA (which is apparently available on their website but I couldn't find it) but I didn't see anything about allowing them access to all information.

    I support the idea of adding content to cd's to make them more attractive to purchase ... but I don't want to have to give up personal privacy for those extras. If I just had to install and register I wouldn't mind, tracking is going too far IMHO.

    Since I couldn't find the EULA online (as promised) i've taken the liberty of posting it online (hopefully its not illegal but oh well).
    Its available here
    It weighs in at a hefty 12.8kB ... for text file!.

  39. Don't complain - instead generate bogus reports by karl.auerbach · · Score: 3, Interesting

    The best way to stop this kind of thing is to figure out what it is sending and then to generate reports about things we are not listening to. It will make the marketing reports useless.

  40. IP addresses to avoid... by raistphrk · · Score: 4, Informative

    This list came from PeerGuardian's blocking list. I'm guessing the BSA IP block at the end. If you really want to keep from reporting data to said parties, just add these (and whatever other beneficiaries of your private data) to your iptables, ipfilter, ZoneAlarm, Tiny, etc. blocked zones. Note that, if for any reason, you want to go to these parties' websites, you won't be able to; your firewall will block access.

    Or, to be perfectly safe, you could borrow a page from our current administration's sex ed book and abstain from downloading. ...but it just feels so good!

    OverPeer:65.174.255.255
    OverPeer:65.160.0.0-65. 160.127.255
    Ranger:216.122.0.0-216.122.255.255
    R anger:204.92.244.0-204.92.244.255
    MediaForce:65.1 92.0.0-65.192.0.255
    MediaForce:65.223.0.0-65.223. 255.255
    MediaForce:4.43.96.0-4.43.96.255
    MediaDe fender:66.79.0.0-66.79.255.255
    RIAA:208.225.90.0- 208.225.90.255
    RIAA:12.150.191.0-12.150.191.255
    MPAA:63.199.57.96-63.199.57.128
    MPAA:64.166.187.1 28-64.166.187.192
    MPAA:198.70.114.0-198.70.114.25 5
    MPAA:209.67.0.0-209.67.255.255
    NetPD:207.155.1 28.0-207.155.255.255
    NetPD:128.241.0.0-128.241.25 5.255
    UnknownC&DCop:64.106.170.128-64.106.170.192
    BayTSP:209.204.128.0-209.204.191.255
    Vidius:207 .155.128.0-207.155.255.255
    GAIN(spyware):64.94.89 .0-64.94.89.255
    GAINCME(spyware):66.35.247.0-66.3 5.247.255
    GAINCME(spyware):66.35.229.0-66.35.229. 255
    MediaDefender:64.225.292.0-64.225.292.127
    RI AA:208.192.0.0-208.192.255.255
    Xupiter.com:63.236 .32.50
    Xupiter.com(mirror):63.208.235.30
    BSA (?) 208.121.215.0-208.121.215.255 (Not sure)

  41. This has been going on for years on DVD disks... by Esterhaus_48 · · Score: 5, Interesting

    Many DVD disks include "InterActual" (previously known as "PC Friendly") software which is autorun upon DVD insertion on Windows machines. To the typical home consumer, the message presented appears as if it originated from the PC itself, prompting the user to install the software in order to view the DVD content.

    There are several issues with this, and relavent to the topic of "illegitimacy of spyware":
    1. "InterActual" doesn't actually install an MPEG2 decoder filter, it merely uses the existing filter provided with a new PC
    2. "InterActual" software attempts to redirect the user to whatever content is available online relating (or not) to the title being viewed - spam essentially
    3. "InterActual" assigns itself as the default DVD playback application in Windows, and thus the user is subjected to the inferior quality of the DVD navigation software
    4. "InterActual", if the user performs the standard "click-thru" agreement to watch their DVD content, broadcasts information about what DVD content the user views

    Suffice to say, these points are easily discovered with a Google search, so I'll refrain from excessive linking and leave further research to the reader.

    Now, for the more-than-capable user (read: most of you reading this), an explanation for preventing/disabling/uninstalling this spyware is obviated. But as the initiated, it's our duty to explain this to those who may not understand (read: friends, neighbors, family) what happens with spyware such as "InterActual" software.

    On a personal note: After purchasing my last PC from Dell (please no "Dude" jokes) and inserting a DVD disk, it presented me with a dialog informing me that "InterActual" software was attempting to install and overwrite my settings, and gave me the option to block "InterActual" from installing on my machine. As expected, content is played through the standard DVD software provided by the OEM and I don't have to see that annoying banner anymore when I insert an "InterActual" or "PC Friendly Enabled!" disk.

    Cheers!

    J. Esterhaus

  42. CDs are SHIT by rice_burners_suck · · Score: 3, Interesting
    That's why I listen to the RADIO. Forget this alleged "anti-piracy" BIG BROTHER IS WATCHING YOU garbage.

    Besides, I don't take any of that garbage. Both of my home networks, which are physically separated for paranoia purposes, must pass through a two-stage firewall system powered by four separate OpenBSD boxen (two for each network's firewall). The configuration of these firewalls has evolved over three years' time, but suffice it to say that I feel relatively comfortable knowing that any site that is not specifically white-listed will NOT get accessed by any of my machines, nor will any whitelisted machines get accessed for protocols which I have not specifically allowed. The advantage here is that NO software is going to report JACK SCHITT about my behavior to NO marketer.

    One final note: I am a marketer by profession. B2B, specifically. And I refuse to employ any big-brother techniques in my work. This may be more difficult when marketing to enormous herds of stupid, technologically illiterate masses of IDIOTS, where you need to be stupid like that to make any sales. But I don't give a damn. I'm doing my part to avoid world-wide slavery by not doing that garbage myself.

    WAR IS PEACE.
    FREEDOM IS SLAVERY.
    IGNORANCE IS STRENGTH.

  43. Not new by ucblockhead · · Score: 3, Informative
    In Winamp:

    Go to Options - Preferences - Setup. The last checkbox is "Allow Winamp to report basic, anonymous program usage information".

    Most mp3 players have something like this, to a greater or lesser extent.

    I'm also amazed that the allegedly technical slashdot audience has not yet figured out that in order for these "bandlink" CDs to work, the user would need to install special software on their machine. I mean, read the fucking site. These "bandlink" CDs don't do squat unless the user specially and deliberately installs the software.

    It is very clear that this is not some sort of behind the seems privacy invasion but an above board trading of information for privacy. (Which, indeed, has issues of its own, but...) Other companies (Real, Musicmatch, etc.) do worse right now.

    --
    The cake is a pie
  44. Note to self: by dkoyanagi · · Score: 3, Funny

    the CD player knows too much...

  45. Re:Apparently,you and I live in very different wor by l1_wulf · · Score: 5, Insightful

    What really cracks me up is how this "holier-than-thou" sentiment is lavashed in a forum where we think it is important to be the bigger nerd but what I'd really like to know is how many of you tell your grandma/mother/aunt/girlfriend/whatever that they're an idiot for not keeping up with PC security, or for not patching their OS (what?!?! your grandma doesn't use Linux! What a fucking moron! I'm glad she's not related to me...). Gimme a break folks. How many of you immediately turned around and issued a security bulletin to your family about this horrid new CD technology. I can see it now..."I repeat, DO NOT INSERT THE CD INTO YOUR COMPUTER'S CD DRIVE!!! If you feel unsafe or unsure whether or not you are using one of these new CDs, please contact my secretary, er answering machine and schedule an appoint, er leave a message and I'll set a time for me to do a security visit with you to ensure you are not in any DANGER. I repeat you morons, DO NOT INSERT THE CD INTO YOUR COMPUTER'S CD DRIVE!!!! (yes grandma, this means you too)." Get real guys.

  46. Re:Apparently,you and I live in very different wor by jbf · · Score: 4, Insightful

    Perhaps. But on the other hand, it could just be that most people are incompetent at their jobs, driving, and whatever else.

    To wit: the left lane on a road is for passing. Most states have laws that restrict the distance that a driver can drive in the left lane before moving over. If you've ever driven long-distance, you know that there are those who insist on indefinately going limit plus 5 (or worse yet: limit) in the left lane. And no, I'm not breaking the law if I try to pass, I live in a prima facie state.

    Second: Examine for a moment a Motorola v60c. The earlier versions are the best example of this. The antenna easily bends in one's pocket. (They've fixed this with new antenna revs.) Worse, when extended, the antenna acts as a lever for the (bulky) antenna tip to use to exert massive force against the rest of the antenna. Net result: three antenna breaks in 6 months, two in-pocket.

    Third: Went to a fast food place looking for food and directions to a gas station. Someone (A) is trying to help me out by asking someone else (B). A: "you familiar with (cityname)?" B: "yeah, kinda" A: "are there any gas stations near here?" B: "whatcha looking for?" A: "gas"

    There's far, far more. These are the easy examples. But if you can honestly say you have not run across any stupidity in the past week, good for you! You're a far more patient being than I.

    Incidentally, I don't mean to disparage those who can't use computers. I can't perform brain surgery; just because others have no expertise in my area doesn't make them idiots. But when people cannot do their jobs or comprehend basic English (where English is their native language)...

  47. Re:There are already laws protecting computers. . by Lumpy · · Score: 3, Interesting


    Of course there's another option. *Don't use EULAed software.*


    good idea, but that rules out the bigger of the linux distros then.

    redhat- HAS EULA on the cd pouch when you buy it.
    SuSe - EULA
    Lindows - well it really isnt a big distro.. slackware users outnumber this one 5 to 1.
    licoris - well yeah... same as above....

    Basicaly as linux users we should have a ZERO tolerance to Eula's on anything that is linux. and yes that meant taking a direct shot at redhat.

    REDHAT makers... why do you have a eula? why did I have to return the package to the store? I wanted to buy it, but I refused to agree to your eula printed on the install discs envelope..

    I loved redhat very much, it's great for the newbie and corperate... but the Eula makes me want to stay away from it.

    --
    Do not look at laser with remaining good eye.
  48. Re:What sort of idiot? The most important thing by John+Sullivan · · Score: 3, Funny

    Nope, the mode is 90. The median is 135.

    --
    This is my World Wide Web of Whatever
  49. Re:Apparently,you and I live in very different wor by Blkdeath · · Score: 3, Insightful
    Maybe your "common sense" is a non-sens for some other people. I guess all of those you find stupid think the same thing of you. Maybe it's just people don't have the same priorities and values. Just a question of perception.

    I'm not talking about (stateful) firewalls; I wouldn't expect my family, friends, or other average users to understand those concepts. I was talking in a somewhat more general sense (the thread was about "average idiots", no?).

    What I was referring to is the sheer number of people who routinely do stupid things. Be it work-related, traffic, personal (social), or other; people do not think things through. People who use hair dryers in the shower, who apply make-up, eat, read a newspaper, use their laptop, etc. while driving 100KM/h on the freeway, or those who can't understand that smoking while filling their car's gas tank isn't a terribly good idea, and that creating personal rocket projection systems to propell themselves into their cottage lake is probably inadviseable, or that standing in the middle of a doorway, contemplating life and their surroundings in a busy hallway isn't quite considerate or practical, or that speaking loudly on a cell phone in a movie theatre, exclaiming things like "Sorry, the sound is too loud, I can't hear you!" will probably incite rage in the other movie goers, or all the ladies (term used loosely, if you'll pardon the pun) who get surprised that, after having unprotected sex with several men and find themselves either sporting a child or an STD (nb; it's entirely common that the surprise child will be the second, third, or fourth), or the people who don't 'get' that drinking a pair of 40oz bottles of [insert favourite alcoholic beverage here] will quite possibly find them in the hospital spitting up blood and fragments of their stomach.

    There are, of course, infinitely more examples, but I think they limit the upper size of these comments somewhere (and $DEITY forbid I should create a database size overflow or something. ;) )

    But to get back to this thread - people who do not understand [cars|computers|electronics|mechanical devices] yet who insist upon taking them apart and/or servicing themselves, then blaming the manufacturer/retailer for selling them defective equipment. Or worse - people who don't understand these things and go against the advise of a trained professional and cause serious detriment for themselves and/or others around them.

    As to the above references to my parents/grandparents; I do tell them what I think when they try to crack their computers and/or administer the installed software. It took me about five years, but my family finally understands that when they do something to the computer, it generally goes wrong and they need my help to fix it. When I do something to the computer, it works, because I do this for a living and know what I'm doing. Generally they feed me and keep my [coffee|beer] [cup|glass] full for my trouble, and everybody's happy.

    The difference being, of course, my family smartened up - other people don't.

    One of the higher standards I try to hold people to, and I realize it sounds horribly cliche, is to know one's limitations. For example, I know that I can change my oil (and filter), top up my fluids, and perform other small routine maintainance tasks on my car. I probably could figure my way through brakes or other aspects, but I don't. Instead, I leave it up to the trained mechanics who have years of experience and industry certifications that say they can do the job properly.

    Another standard I hold people to, for those who are definately literate, is to read atleast the basic instructions before desperately phoning for help. I can't count the times I've had to help people (or been asked and refused) because they wouldn't open the fold-out "Step By Step" instruction set that came with their new purchase. The fact that many of the installations I've performed were insultingly simple is beside the point; the instructions spelled it out so clearly that a child could figure it out. This excuse adults use that technology is so complex that only the younger generations have a chance is complete rhetoric, and complete nonsense. If a University educated individual can't figure out how to connect something with colour-coded, size-differentiated connectors that are labelled at both ends and comes with a step-by-step instruction manual; something's wrong.

    So no, I don't expect that people will understand stateful packet inspection, ingres/egres filtering, bogon filters, application versus network versus physical layer differentiation, or any of the other industry specific jargon I could name; but I do expect people to be able to perform in real life without their hands being held, lest they should manage to kill or maim themselves or someone around them in the process.

    --
    BD Phone Home!

    Shameless plug. Like you weren't expecting it.

  50. Windows is becoming the new television by BeBoxer · · Score: 3, Interesting

    It seems to me that Windows, especially in the consumer domain, is becoming much more like TV. That is, television isn't a service provided to the viewers, it's a service provided to the marketers. The viewer's attention is the actual product which is being sold. The content on the television is not the primary business of television networks, selling advertisments is.

    It seems like Windows is becoming the same way. The fact that a Windows computer can actually do useful things for the owner is becoming secondary to it's use as a vehicle for advertising and gathering marketing information. I think it's one of the things that turns me off the most about Windows, that constant feeling that you can't trust "your" computer at all, because you really can't. Every other program is co-opting "your" computer for the purpose of advertising to you. And it's not even just "free as in beer" software that does it, even stuff you paid good money for feels the need to steal your attention for advertisements. And they all, uniformly, require you to agree to EULA's.

    It's one of the main reasons why I hope Linux never takes off on the desktop, because I don't want to have to deal with all that crap. Fortunately, one of Linux's strengths is that even if some distro does take over the desktop from Microsoft and inherits all the spy-ware and ad-ware, I can just run some other distro that doesn't suck. Not an option with Windows: they all suck.