Are Your Peripherals Monitoring You?

An anonymous reader writes " Engadget is reporting that 'Lexmark, makers of printers and scanners, has been caught monitoring users' printer, scanning, and ink cartridge usage.'" Newsgroup comp.periphs.printers readers noticed the software; the Engadget report says that "Lexmark say they're just tracking printer and cartridge usage, but the registration information and packets being sent say otherwise."

Comments

Not clear?

[BoldAC]

Not clear what they are monitoring?

What am I missing? Couldn't somebody just install the program and sniff the information out of the packets?

Gesh, this is slashdot...

Re:Not clear?

[sl4shd0rk]

Certainly. The problem is, capitalism is fleecing the privacy of people, and it's very sneaky of Lexmark to conduct business this way. It is not surprising for Lexmark to do this. They have been cornholing their customers over ink cartridges for years. As far as I'm concerned, if your still running windows connected to the internet, buying Lexmark gear, and reading this with IE, then you deserve everything you get.

Re:Not clear?

[arivanov]

Lexmark's attempt to use DMCA to prevent thrid party cartridges sank in court a few weeks ago. They are bound to start looking for a different means to achieve the same goal as their printers are sold at dumping prices and they generate profit mostly from cartridges. In order to chose the next move they definitely need some reconnaissance data. Alternatively they are looking to move the grounds of enforcement on what the customer uses from suing competitors to sueing customers (what a novell idea...).

2. Lexmark AFAIK is one of the companies who are participating in the stupid law assistance program where software and hardware should detect common types of currency and refuse to copy or print it. Going from there to ratting on the ones who scan/print it is only one step.

Re:Not clear?

[surprise_audit]

participating in the stupid law assistance program

That's really only going to work on a counterfeiter dumb enough to have an Internet connection on his currency scan'n'print LAN.

The people they're most likely to catch are the kids that watch National Treasure, and then start scanning $bills and loading the images into a pirated copy of PhotoShop to see if they can find the clues...

Re:Not clear?

[Kaemaril]

uses from suing competitors to sueing customers (what a novell idea...).

Uh ... no. That's an SCO idea, not a Novell idea :)

Re:Not clear?

[rpozz]

As far as I'm concerned, if your still running windows connected to the internet, buying Lexmark gear, and reading this with IE, then you deserve everything you get.

While virtually everyone on slashdot knows to install anti-virus, anti-spyware, firewall, firefox etc, it's all getting way out of control. Who the FUCK (except from a tin foil hat nerd) would expect a PRINTER DRIVER to spy on you? Isn't it great how this sort of crap is legal, but (for example) modding a console isn't?

Re:Not clear?

[h4rm0ny]

Just why is this stupid? Counterfiting is illegal and undesirable. Please explain your opinion.

I'm neither the original poster, nor do I necessarily agree with him. But I think I can do a good job as advocate for the Devil.

The obstensible objection to the hardware and software currency detection would probably be that it does nothing to catch actual counterfeiters but does inconveniance legitimate users. Do you really think that people such as these are going to be bothered by such little measures. In order to procure the equipment, inks and papers to forge modern currency (at least in Europe), you have to be a professional. The only remaining result of this technology is the inconveniance to legitimate users.

Now that said, there is a secondary reasoning behind objecting to the law which is less commonly stated, but often underlies such arguments.

You stated that Counterfeiting is illegal and undesirable. Placed in a criticism, this indicates that you feel the law is essentially a good thing and that legality is an indication that something is acceptable. There are many who would agree that counterfeiting is undesirable (it reduces the value of their own / family's money) but would not instinctively add illegal as a criticism. This is because many now feel the government is an adversary, especially in recent times and especially in the US and the UK. They are heavily concerned about increasingly unjust laws and this is colouring their view of the entire legal process. The relation of something as large as this to something as small as the anti-counterfeiting technology is twofold. Firstly, in foisting this technology on innocent people, they naturally resent the presumption of wrong-doing. Much the same as you would feel about having people come around to search your home for stolen goods without grounds for suspicion, or having someone wire your car so that it couldn't go over 70mph to prevent speeding, or outlawing firearms (in the US). It's insulting to many people who no longer feel the government is their friend. It's especially insulting that this redundant technology was diseminated secretly and sneakily amongst people who did not know that what they bought had that it had been fiddled with by government agencies. Remember, many people no longer regard the government as friendly.

The second secret reason behind the objection may be that in order for this technology to work there has to be some subversion of people's computer systems. It can't be implemented in The Gimp and if Photoshop or Lexxmark is calling the FBI when it detects a banknote, then this is basically taking control away from the user. He can no longer trust his computer. Who knows what information it's providing to other parties. This will be especially true with technologies enabled by Trusted Computing. The issue about the anti-counterfeiting technology is not the thing in isolation, but that is part of a broader sweep of taking power away from the user and making their computers work for someone else, not their owner.

Okay, that's my analysis. Of course, the OP may not think this way at all, purely basing his comment on the fact that the technology is flawed (which it is) and inconveniances innocents (which it can do); but I think that many people do feel the way that I've described.

For myself, I just want someone to post the pattern so that I can mix it into my own images and mess with people's heads.

Re:Not clear?

[Anonymous Coward]

So when are some of our state attorney generals going to get off their butts, review their respective computer use laws, and apply the law against these felons?

In Nebraska, it is a class IV felony to use another party's computer resources without their consent. As Lexmark has continued to deny their software is conducting surveillance on its customers, it is pretty clear they've lost an argument that their customers gave them consent to spy on them. This is pretty evident unauthorized use, and needs a few AG's to get busy (please, none of this "overworked/underpaid" crap which I've heard AG offices use before. Everyone is overworked and underpaid. Get used to it or resign so we can find someone competent to work in your office using our money).

Slashdotters using these products should sent registered letters to their state AG office filing a complaint and requesting criminal investigation. Follow up in thirty days if no progress has been made and send letters to your governors office indicating the AG has not proceeded in a corporate criminal investigation. Contact your newspapers and let them know that the AG's office is permitting corporations to spy on state citizens without consequence. Spyware is becoming a significant fear for common people and AGs that ignore it will soon be returned to private practice.

The other thing that needs done is closing up the EULA loophole. Lexmark presumably did not try specifying its right to spy on customers in its EULA, but others do and given increasingly restrictive return policies on technology products by retailers like Best Buy (as reported on /.), burying spying consent in a EULA is unacceptable. Spyware must be opt-in and states need to establish a separate consent agreement that must be used independent of EULA, contract, service agreement, etc. Imagine a separate form that you must sign that states that you have been advised that your product being purchased has spyware and will monitor your activities, requiring your signature and reference to verification documents (e.g. drivers license) to authorize.

Absent this form, vendors using spyware should be *criminally* responsible. This is obviously a wish-list item, but would have an appropriate limitation on corporate spyware. Having AGs enforce existing laws, on the other hand, should be done immediately and informed Slashdotters can have an influence by submitting complaints and following up. As always, send those letters via certified/registered mail - it's the way to let the other party know you're putting them on notice.

Re:Not clear?

[budgenator]

It's stupid because they can't detect the image of a countefit currency, they can only detect a yellowish pattern of 5 circles printed on the currency. If I try to print anything with the pattern, the software fires up my webbrowser to a website that tells me about how counterfitting is wrong. Now If I am a clueless teenager, I see the site and think "OMG they know" and stop doing the stupid shit like scanning currency it's good. If I am somebody who is trying to print out someting completely legal, but happens to have that pattern I think "but this is not money, what are they talking about" and try again, sooner or later the Secret Service see my IP address a shitload of times and comes to call just to say HI, and to let me explain myself before a trip downtown to jail for a little chat.
Another possibility is some printers, if they get more than a certain number of images with the pattern lock-up, requiring an expensive service call from a factory rep, who's policy is when they see that error code, will report it to the Secret Service. Immagine what it could do the the Secret Service's ability to investigate real crimes if I posted some pictures of Sara Michelle Geller nude with the pattern on a P2P network.

Re:Not clear?

[Anonymous Writer]

making their computers work for someone else, not their owner

Nicely put. That's a really simple and concise way of stating the problems with all this "Trusted computing", DRM, and anti-counterfeiting ruckus. Now if someone could only explain this to the computer industry and lawmakers.

Re:Not clear?

[1u3hr]

Not clear what they are monitoring? What am I missing? Couldn't somebody just install the program and sniff the information out of the packets?

Yes, but nobody has yet. I read this on the newsgroup last week; the two articles in the Slashdot "summary" obviously haven't investigated it beyond quoting these articles.

The news posting in full is:

From: Commander (Commander_rn1@yahoo.com)
Subject: Lexmark Printer Users Beware of Spyware
Newsgroups: misc.consumers, comp.periphs.printers
Date: 2004-11-09 08:17:25 PST

Yes, Lexmark is now in the Spyware business!

Just the other day I purchased a new Lexmark X5250 All-in-one printer.
I installed it as per the instructions and monitored the install with
Norton as I do with all new software.

On reviewing the install log I noticed a program called Lx_CATS had
been placed in the c:\program files directory. I investigated and
found a data log and an initialisation file called Lx_CATS.ini.
Further investigation of this file showed that Lexmark had, without my
permission, loaded a Trojan backdoor on to my computer. Furthermore,
it is embedded into the system registry, so average users would likely
never know it was there and active.

This Lexmark Trojan was programmed to monitor my use of the printer by
way of data collected from two DLLs in the c:\program files\lexmark500
folder. The Trojan would then send information on printer usage,
including types of print activity, scanning activity, OCR activity
etc., back to a hidden URL at 30 day intervals.

The URL, www.lxkcc1.com, is identified as being owned by Lexmark.

When I called and spoke with Lexmark support, they denied all
knowledge of any such program, and suggested I had somehow been
infected by a virus. When I challenged them with the facts, they
ultimately aknowleged that this was indeed activity tracking software
that reported printer and cartridge use back to them for "survey"
purposes. Lexmark said that "no personal data" was relayed by the
program, and that I could not be personally identified by it. However
- the program transmits the printer serial number, and when I
registered the warranty with Lexmark, they recorded my personal
information along with the serial number. How much effort does it take
to match the two?

I call it spying! I was not advised of this part of the installation,
nor was I asked to agree to be part of any such data gathering
activity. I see this as a breach of my privacy, and as deplorable
behaviour by Lexmark.

Lexmark users beware! But, they may not be the only ones stealing your
private information.

Re:Not clear?

[karniv0re]

As far as I'm concerned, if your still running windows connected to the internet, buying Lexmark gear, and reading this with IE, then you deserve everything you get.

Damn straight. There's no way my Lexmark z23 is spying on me, because it doesn't even work in Linux! Yeah! Take that Lexmark... oh, wait...

Re:Not clear?

[LiquidCoooled]

The pattern placed onto banknotes is called the EURion constellation.

It is a pattern of 5 small circles that is like the Orion constellation.
It has apparantly been included on the back of the new $50 bill. (http://en.wikipedia.org/wiki/U.S._fifty_dollar_bi ll

I even found a program that supposedly adds the marks to your own dowuments, but you iwll have to look for yourself, because I can't view either postscript, or pdf.
link here: http://wildspark.com/eurionize/

Re:Not clear?

[kcbrown]

But of all the human systems tested to date, capitalism has proven to be best-immunized against corruption and abuse.

Well, not pure, unregulated capitalism. Regulated capitalism, perhaps.

You see, capitalism by itself encourages corruption and abuse. Consider, for instance, a society that operates under "pure" capitalism, and which has no laws against murder, assault, etc. A corporation which provides an essential good or service (such as food) in that kind of environment would literally eliminate its competition, by assassinating the owners and executives of any competing firms. Eventually that corporation would have no competition because nobody would be stupid enough to risk certain death in order to compete.

The reason things would go down that way is that capitalism encourages unethical behavior. Think about it: unethical behavior is basically behavior which does not follow a certain set of restrictions (e.g., on killing or harming others). Capitalism encourages this because it rewards those who are willing to go further to get what they want. Someone who acts ethically is restricting the set of actions he can take, while someone who acts unethically is not restricted in that way. The person acting unethically has available to him a superset of actions available to the person acting ethically. That means that the person acting unethically has more options than someone acting ethically, and some of those additional options will give him an advantage, and being unethical he will use those. Since the system doesn't have any built-in mechanisms to discourage such unethical behavior, the person who behaves unethically will win, pretty much every time.

Organized crime is what you get with unregulated capitalism.

God I hope not

[LooseChanj]

I don't think anyone or anything could stand the sight of me before clothes or caffeine.

Please clarify

[Anonymous Coward]

First you tell us this:

Lexmark, makers of printers and scanners, has been caught monitoring users' printer, scanning, and ink cartridge usage."

Then you try to tell us this:

"Lexmark say they're just tracking printer and cartridge usage, but the registration information and packets being sent say otherwise."

So the evil Lexmark tells you that they are tracking printer and cartridge usage, which is what you tell us is what you found. Then you claim that the packets being sent tell you something different. Well, spill it! What did you find that Lexmark didn't say they are tracking? It seems that they told you what you'd expect to find if you monitored their packets.

I don't like the idea that some company is building drivers that call home. But it's not because I think my privacy is somehow invaded. I just don't like someone using up my bandwidth without my knowledge.

If I was really concerned with privacy, I doubt I'd be using a computer, much less connecting it to the Internet.

Re:Please clarify

[Anonymous Coward]

Anything that calls home unasked and silently is a backdoor. Anyone working for a foreign agency is a spy and will be treated as one, no matter if he has blown up that power plant *yet* or whatever his orders were.

Spying is spying, no matter if it happens daily or monthly. And who are you to be sure they don't collect other info, send ascii-only copies of your printed documents, scan for keywords and worse. Calling home once a month is enough to report back every info you hold dear. Plain ASCII, zip compressed doesn't need more bandwidth.

But none of us has a problem with others monitoring what we say or do. I have nothing to hide. I like orange jump suits and cable ties. I like the president. I am a happy citizen and I will go back to work now.

Re:Please clarify

[Anonymous Coward]

If I was really concerned with privacy, I doubt I'd be using a computer, much less connecting it to the Internet.

Well I'm concerned with privacy, but I still want to use a computer and also connect to the internet. I don't necessarily disagree with your argument but you weaken it here.

Re:Please clarify

[surprise_audit]

The concern is that, if you fill out the printer registration card with name, address, phone number and serial number and if the spyware sends the printer serial number along with the other information, then they can tie cartridge usage to a particular name/address record, along with the IP it came from.

Which immediately suggests a course of action to "poison" the information pool - register as Darl McBride and start copying something illegal...

Re:Please clarify

[scifiber_phil]

I sometimes use my computer to earn money. Does the use of the computer mean sorry no privacy for you? If it does, who decided that? What gives them the "right" to decide that? How do we take that "right" from their hands? Because, the bottom line is, people need and deserve privacy. Notice that God has not given us the ability to read others' thoughts. If a measure of privacy is good enough for God, it should be good enough for corporate America and the government.

Data stealing

[Realistic_Dragon]

Linux can do it just as well as Microsoft and Lexmark! Admittedly, you do have to install it yourself, but the feature is there and just as good as these so called professional vendors can offer!

Re:Data stealing

[dougmc]

Admittedly, you do have to install it yourself

Yes, but that makes *all* the difference.

We (or at least me, though I seriously doubt I'm alone) generally have no problems with `spyware' if it's installation is *completely* voluntary and if the user is educated on what it is and does clearly (and not in some 500 page document) before it's installed. Especially if it's something that the person has to manually install the program, and especially if the program is benign and useful (counting linux users = benign, but not terribly useful for a given user.)

You may think this has something to do with Linux, but it really doesn't -- we generally don't have problems with Microsoft Update either, for example, even the automatic functions, and they phone home on a regular basis as well. This could change, however -- for example, if we were to learn that the program was reporting back more information than we were told it did.

ZoneAlarm

[TVC15]

Interesting, I just installed ZoneAlarm on a PC last week and it gave me an alarm that some Lexmark process wanted to make a network connection. I havnt had a Lexmark connected to that thing in probably 3 years (and can find no obviously labled Lexmark files) but have been too lazy to reformat the drive. Perhaps it's time to break out the install CDs.

Re:ZoneAlarm

[Captain Chad]

Would that have been the 'PDP RPC server' by any chance? I had the same issue with a Compaq-branded Lexmark printer. It took a bit of google searching just to find out it was from Lexmark and that 'PDP' stands for 'Print Driver Plus'.

Re:ZoneAlarm

[AndroidCat]

I guess we now know what the 'Plus' part is. :)

Re:ZoneAlarm

[AndroidCat]

Want sound effects for ZoneAlarm? (Shameless plug.)

Re:ZoneAlarm

[ImaLamer]

I've got a Lexmark Z705 on Windows XP with Sygate Personal Firewall.

After installing the printer I noticed the process "LEXPPS.EXE" trying to broadcast and do everything to get onto the network first then the Internet second. I simply don't allow it access because at the time I had a wireless hookup (with no WEP key) and was afraid that someone might try printing to my printer.

Even with that process blocked I could still print "over the network" so it wasn't even an issue and nothing has "broke" since then...

By the way, the process listens on 1026.

Posible reason

[coolsva]

I believe Lexmark recentl lost a case where they tried to apply the DCMA against a 3rd party ink cartridge manufacturer. Since now they cannot force he user to buy their high priced cartridges, perhaps this way, they would know that you used one of these cartridges and they can then void your warranty
However, this does not justify them sending the data without your knowing/asking. If they wanted to keep a flag in the printer and when you return the printer for a repair under warranty, they cold check for this flag and refuse to honor the warranty.

And, why would they want to hide their intent and send the data to a wierd sounding URL (lkcc1.com)? I would have first suspected some other scumware trying to phone home, never suspecting lexmark. Well, guess you cannot trust any compan to have honor ro ethics these days.

Re:Posible reason

[northcat]

No this dates WAY back - to 2001 google groups

Newer print drivers only?

[Anonymous Coward]

I have a Lexmark Optra E+ laser printer. It's several years old. I'm very happy with it as a printer.

I don't see any c:\program_files\lexmark500 directory even though I have the print driver, downloaded from lexmark.com, installed.

I've added the following to my hosts file just in case.

0.0.0.0 www.lxkcc1.com

Re:Newer print drivers only?

[mistered]

It's because the inkjet and laser groups behave very differently. From linuxprinting.org:

Lexmark produces two lines of printer: the Optras and the Color Jetprinters. The Optras are business-focused printers with the unique characteristic that every Optra supports Postscript and PCL; no other vendor has such uniform support for standardized printing languages. As a result of this, every Optra is 100% supported by free software. The Color Jetprinters are consumer-focused printers with the exact opposite characteristics: not a one of them supports any standard printing language, and not a one of them is 100% supported by free software.

The two groups in the company are very much separate, although the occasional Optra product is produced by taking a reasonable Color Jetprinter and nailing an Optra-style mainboard onto the back; this produces a Postscript/PCL networkable inkjet (like the Optra 40, for example). Efforts to obtain programming information for the Color Jetprinter protocols have been unsuccessful and will probably remain that way; Lexmark apparently feels that the details of the protocol reveal some of the engineering techniques they use to make the Color Jetprinters so competitively inexpensive.

printing ripoff

[pchan-]

okay, enough of these printing scumbags. printers are getting worse, print quality is crap, ink cartridge prices are obscene while lasting for shorter durations (my gf's printer will not print in black when the color cartridge is empty), DMCA restrictions on refilling ink, spying on users...

bullshit. i will never buy one of these printers again (this means you lexmark, canon, hp, and your friends). when will a manufacturer stand up and sell good quality printers, refillable by the user using just an ink bottle? there is a market of people who are willing not to buy the cheapest piece of shit printer because they know how that turns out. who will fill it?

Re:printing ripoff

[Helix150]

I recommend the canon multipass series... I have a MP730, its a combo printer/scanner (w/ feeder)/fax/copier, very nice machine. A bit expensive ($300) but IMHO well worth it. The Canon ink tanks are clear so you can see the ink inside them, and there are no chips on them. The printer measures the ink level by shining a light through the tank. They are quite easy to refill, and LaserMonks has replacement tanks for IIRC about $5 each. Replacement official tanks are about $7 each. Four colors, CMYK.

Re:printing ripoff

[Timesprout]

I recommend a pencil and paper. One caveat is to always use a single sheet of paper instead of a pad though so spies cant find out what you wrote by rubbing graphite over the pad. Also tell the recipient to eat the page after they have read it.

Re:printing ripoff

[Lisandro]

Get an used (old model) HP Laserjet. They can be found at reasonable prices, with service and replacement parts still available, and it's toner lasts forever. The printer will too, they are some of the most relaiable printers ever built. Too bad HP has been going down the crapper lately.
Laser printers are expensive at a first glance, but the price per page is a fraction of a inkjet. It's overall a much better value.

Still, if you want a cheap one, try the newer Cannon inkjets. You'll still be forced to buy overpriced, half-filled ink tanks, but they work as expected, the printing heads don't clog and the print quality is top notch (for an inkjet). I have a Cannon S1000 at work that has been working perfectly for almost two years now. I wish i could say the same about Epson printers.

Re:printing ripoff

[jridley]

I also recommend Canon printers. I have an i970. While not designed intentionally for refilling, it's about as good as it gets these days. As you say, the tanks are just clear plastic boxes with ink in them, refilling is a snap. I've previously refilled Epson and HP, and the Canon is by far the easiest. After refilling Epson/HP, you have to let the ink settle overnight to eliminate bubbles, and do a lot of fiddling to get it printing right. I've refilled my Canon tanks about 15 times so far and haven't had to even do a nozzle cleaning pass once. The printer does automatically do a nozzle clean if it hasn't for a while during idle time after a print job.

The i970 is a 6 color printer, FWIW. Photo printing is quite nice.

Re:printing ripoff

[Anonymous Coward]

I prefer the Leeloo Dallas Multipass.....

Re:printing ripoff

[Pfhreakaz0id]

get a laser! If you print a fair amount, it pays for itself. Price per page is WAY lower, quieter, faster, and maintenance problems are far fewer. My wife prints a lot for her stay at home contracting gig. (It's oodles of paperwork), and we love our little Samsung 600dpi laser. It was like $150 after rebate. Sure the toner cart's are like $60, but they last a LONG time (like about 9 months, several 500 page reams of paper).

Also, we don't miss the color. Wife or myself takes the camera or media card to the drug store and crop and print a picture for 25 cents. (less if doing multiple prints)

Re:printing ripoff

[xornor]

I have an HP Laserjet 4MP I think I got in 1995 for close to $1300. I'm on my second toner and it has yet to have any problems printing anything... You get what you pay for I guess.

Re:printing ripoff

[whovian]

I've used a LaserJet 4 Plus at home for c.2 years now. The gods alone know how many pages it had printed

Actually if you force the printer into test mode, it will print one or two test/info pages, and the page count will be on printed on one of those. Though it may be the page count since the toner cartridge was last (re)installed.

Re:printing ripoff

[Todesmetall]

Maybe then a laser printer instead of one of these crappy inkjet printers is an option for you?

I have bought a Lexmark printer that supports Postscript and I have been very happy with it since it works very well with a relatively simple setup on the Linux side - thanks to the ps support.

However, after these stupid stunts from Lexmark I probably wouldn't buy from them again.

Re:printing ripoff

[Dance_Dance_Karnov]

I have a hp laserjet 4L that had been in my friend's closet underneath 3 feet of stuff, took it out, pluged it in, it worked like a charm, been using it for about 8 months and still haven't had to replace the tonner cartridge that was in it when i debo'd it.

Re:printing ripoff

[stu72]

Not going to happen w/inkjet. Buy a laser - it will pay for itself with cheap toner, better quality & long life.

Usenet post

[nstrom]

Original usenet post from comp.periphs.printers on Google Groups here, or here for a news: link.

That's ok...

[jmcmunn]

Just as long as my Dvd burner isn't monitoring what I am burning...

Didn't the users agree to this monitoring?

[Secrity]

Somehow I don't believe that Lexmark would install this spyware without having the EULA cover it. This may be another example of people just hitting "AGREE" (effectively signing) without actually reading the EULA (a legally binding agrement). Stupid laws? Stupid people? Both? You decide.

Re:Didn't the users agree to this monitoring?

[cliffski]

you have to be kidding. EULAS are a waste of time. you are seriously telling me you read them? I am 35, I dont have many years left ;) I aint gonna waste half of them reading longwinded legalese drafted by some creep in a suit who earns ten times my salary.
If I buy a printer, it should print what I tell it too and fck all else. Adding a clause in a 30 page eula that says using this printer signs my kids over for experimentation isnt exactly playing fair.
fck lexmark.

Re:Didn't the users agree to this monitoring?

[jdreed1024]

This may be another example of people just hitting "AGREE" (effectively signing) without actually reading the EULA (a legally binding agrement).

Legally binding? I don't think so. EULAs have questionable legal status at best (I'm sure some lawyer could argue for the fact that the fact that the EULA is not printed on the box and the fact that some say "If you do not agree, you cannot install this software" could very well amount to coercion or something. EULAs have never been tested in court.

I would love to see a EULA with some seemingly innocuous yet annoying clause such as "By agreeing to this license, you give everyone the right to call you 'butthead' for the rest of your life." and then have that tested in court. Ideally, there would be one of two outcomes: EULAs become illega or software vendors are legally obligated to accepted returned opened software if the user did not agree to the EULA. (Which means many software vendors would stop stocking software with crap EULAs, and maybe the software industry would get a wake-up call.

And the older crowd here will remember that EULAs didn't always used to suck. They used to be printed in fine print on envelopes containing the CD or floppies, and said in big letters "If you open this envelope, you agree to the license". Which is much better, because if you didn't agree to the license, you could take the software back and if the diskettes were unopened, the place would almost always accept returns.

Re:Didn't the users agree to this monitoring?

[the_brat_king]

Better than that, when I had a retail shop a few years back, we had some QXPress and MS Software CDs, on the jewel case it said "By opening this case you agree to the enclosed license agreement"

Re:Didn't the users agree to this monitoring?

[jdkane]

So far I see responses to your post saying EULAs are stupid, unenforceable, and ignored. However I'm curious about if the EULA "covers" the tracking software aspect.

Does ANYONE WITH A LEXMARK PRINTER (that has the tracking software installed by Lexmark) have a EULA that they can post for us to see? That would be great so we can check it out ... no matter how dumb, boring, or theoretically unenforceable it might be. Some of us just want to see if it covers that tracking software aspect.

TIA

Re:Didn't the users agree to this monitoring?

[uid7306m]

I don't see why people need to restrict the
bad idea of a unique EULA for each object
that you own to software.

See http://bunop.com for pencils with EULAs.

That'll fix the guy up above who recommended
using pencil and paper for security...

Re:Didn't the users agree to this monitoring?

[roger_ford]

Actually, as a legal conclusion this is far from true. Many academics have questioned whether "shrink wrap" type licenses are binding, but the court cases pretty unanimously hold them to be binding. See for example ProCD, Inc v Zeidenberg, 86 F3d 1447 (7th Cir 1996).

From Judge Easterbrook's opinion:

In Wisconsin, as elsewhere, a contract includes only the terms on which the parties have agreed. One cannot agree to hidden terms, the judge concluded. So far, so good--but one of the terms to which Zeidenberg agreed by purchasing the software is that the transaction was subject to a license. Zeidenberg's position therefore must be that the printed terms on the outside of a box are the parties' contract--except for printed terms that refer to or incorporate other terms. But why would Wisconsin fetter the parties' choice in this [*1451] way? Vendors can put the entire terms of a contract on the outside of a box only by using microscopic type, removing other information that buyers might find more useful (such as what the software does, and on which computers it works), or both. The "Read Me" file included with most software, describing system requirements and potential incompatibilities, may be equivalent to ten pages of type; warranties and license restrictions take still more space. Notice on the outside, terms on the inside, and a right to return the software for a refund if the terms are [**10] unacceptable (a right that the license expressly extends), may be a means of doing business valuable to buyers and sellers alike. See E. Allan Farnsworth, 1 Farnsworth on Contracts 4.26 (1990); Restatement (2d) of Contracts 211 comment a (1981) ("Standardization of agreements serves many of the same functions as standardization of goods and services; both are essential to a system of mass production and distribution. Scarce and costly time and skill can be devoted to a class of transactions rather than the details of individual transactions."). Doubtless a state could forbid the use of standard contracts in the software business, but we do not think that Wisconsin has done so.

(IAN[Y]AL)

Re:Lexmark sucks

[dattaway]

The trouble began when I had to buy new cartridges, I bought 3 in a row, and they were all empty, what the hell is up with that.

You are an engineer for [evil printer company] and are told to increase profits 50%. So you increase i=20 in the cartrige purge program.

Another Posible Reason

[Lead Butthead]

Lexmark could also very well instruct the device driver to STOP WORKING if it detects a third party ink cartridge...

Re:Another Posible Reason

[Anomalous Coward]

More likely they would instruct the driver to go into "crap quality" mode. Then they could point to the lousy print you get with 3rd party ink and say "See! Those other ink cartriges aren't as good as ours! Look how much better the print is when you use genuine Lexmark brand ink cartriges!"

At least, that's what I would do if I was a sleazy, money-grubbing corporation....

Re:Another Posible Reason

[Lord_Dweomer]

That's all you'd do? Why not generate them some ad revenue as well. Every time you print with a non-Lexmark cartridge, the printer prints a small ad on the bottom of your document with a coupon for $1 off a Lexmark ink cartridge.

Now THAT would be sleazy.

Sites to block

[Anonymous Coward]

lxkcc1.lexmark.com
www.lxkcc1.com
lxkcc1.com
ww w.lxkcc2.com
lxkcc2.com

ips
192.146.101.0 - 192.146.101.255

Didn't TFA indicate that...

[gargonia]

... the information was being stored in a file? Perhaps someone who has access to a copy of the file can post it somewhere. I'm sure there isn't going to be high security on it, so perhaps someone can crack it open and we'll see what kind of information they're getting.

Re:In Soviet Russia...

[j0e_average]

Sadly, the joke, in this case, would be:

In Soviet Russia, you monitor your peripherals!

Inkjet cartridges...

[Krankheit]

Lexmark obviously wants to track ink jet cartridge usage because that is where they get their most profit. They probably want to know when consumers start switching to a more viable printing technology so they can jump on the bandwagon.

Lexmark sees you need a new model....

[zakezuke]

google groups link

I don't find this at all shocking. Lexmark makes those lovely OEM Dell printers that you sometimes can get free with a PC. Not only is the software a commercial to buy ink from Dell but the cartages are keyed so you have to mail order the ink. Now Lexmark can track you by serial number and possibly detect if you've been a naughty user and used 3rd party cartages or refilled you cartages. Can anyone say warranty void? Even better still, they can collect enough information on your printing habits and offer you bigger and better printers.

There are good reasons to object to this. What we need are some solid facts as to what exactly is reported to Lexmark, and how to prevent this. Would adding "www.lxkcc1.com 127.0.0.1" to the hosts file be effective?

In Soviet Russia...

[goldspider]

...your monitor monitors you!

Why wasn't this popularised before?

[northcat]

A quick search on google groups reveals that this has been going on since as far back as 2001 (google groups). Why am I seeing an article so late?

Whaddya bet....

[Rick Zeman]

....buried 500 paragraphs into a EULA that the user "consented" to be monitored?

Xerox network lasers

[prestwich]

We caught a xerox network laser printer trying to send mail, by itself back to xerox; it tried three different outgoing smtp servers that fortunately our gateway blocked.

I don't know what was in those mails - but a google search revealed an article about a large data mining system based on Oracle; I think the main intent was to detect reasons for early failure - but who knows what happened to the data.

Re:Xerox network lasers

[CrystalFalcon]

Xerox printers can be configured to automatically order new supplies when the current ones run low. You're sure it was not something like this?

Also, they can be configured to send out e-mail to supply adminsitrators (in this case, picture Carol, the PHB's secretary in Dilbert) to ask for ordering new supplies with a handy web page served from the printer, if human intervention is desired. You're sure it was not something like this?

As every printer manufacturer...

[Z00L00K]

This is probably only the top of an iceberg. All printer manufacturers are trying by different means to keep up the incomes by secondary sales in some way. Some more intrusive than others.

Personally I dislike inkjet printers since they usually are causing a mess by spreading the ink everywhere, and the printouts are normally not water-resistant either! Another thing is that the ink cartridges tends to dry up and cause messy pritouts if any if you leave the printer unused for some months. Only way out is to buy a new cartridge.

Laser Printers are a little better, as long as you have a decent vacuum cleaner arond to catch any excess toner. At least they don't mind being offline for a year in decent conditions. (maybe you will have to shake down the toner in extreme cases)

In all, tracking printer use should only be acceptable if the user is notified beforehand, and that the data communicated is easy for anybody to check regarding it's content. The user must be able to disallow any usage tracking.

A legitime use of printer usage tracking that I see is actually to let the printer manufacturer find out the most common errors occured with a printer, and which colors that are most frequently used in order to optimize coming models on the market. But as noted beforehand, the user must have his/hers last say in this. Relate this to the error reporting that Microsoft offers for Windows XP. (Not that it actually catches ALL problems)

My 1/2 cent opinion...

Re:As every printer manufacturer...

[mangu]

A legitime use of printer usage tracking ... which colors that are most frequently used in order to optimize coming models on the market

There are two much less intrusive ways to do this:
1) design the printer to use separate cartriges for each color, or
2) offer a used-cartridge trade-in discount and check how much ink is left of each color.

Re:As every printer manufacturer...

[yasth]

The problem with the trade back scheme is lots of people keep on printing after they run out of a color (or two). I mean the carts always run out at the exact wrong time, and some people are just lazy. Besides they generally know what colors run out first, the problem is there is variance based on subject matter.

Re:As every printer manufacturer...

[AhabTheArab]

2% Ink
5% Cartridge
15% DRM chip
7% ???
+70% Profit!!!
______
99%
+ 1% Evil spying software
______
100%

Re:As every printer manufacturer...

[arivanov]

They are right that the head gets damaged - their head is not part of the cartridge. They are also right in the way they determine it. They mark it as empty if the level is low enough to allow the system to draw a bubble into the pipeline. I wish car manufacturers were so anal retentive - I know more then one person who have managed to kill their ignition systems (Fiat and some GMs) by running them dry. The thing I do not like is that on a system that is obviously designed for a refill, and used to be refillable (just look at a 1991 stylus) you have to swap a cartridge. Anyway, loads of pros and cons with one major pro in their favour - it actually works. You can forget Epson unused for half a year and you can still print on it (at least their laser printers). They are nasty like all printer manufacturers, but not as nasty as Lexmark, Canon or HP.

www.lxkcc1.com aka 192.146.101.142

[skinfitz]

Duly firewalled.

Well then...

[Flizesh]

Can they track why their craptastic printers keep breaking all the time? Never buying one of them again.

broadband routers

[Vladimir]

my router logs all in/out connections and keeps bandwith utilization statistics. Last morning it informed me there is a new firmware update (so it called home). It is also capable to establish VPN tunnels via IPsec so it can send anything it likes without any possibility to examine content. Does it spy on me? Who knows..., but I started to think about installing a normal Linux box instead.

I don't know about periperals...

[Anonymous Coward]

...but the toaster has been laughing at me from time to time.

Are yet just, plain, mad?

[steve_l]

I dont understand lexmark. They crossed the boundaries of the sensible with the DMCA suit, now they are up with this spyware print driver thing.

Are they in league with the MPAA or something? Or do they just want to get extra money from users.

The fact is, refill cartridges perform a valuable role: they keep the retail cartridges within bounds. If it wasnt for the refill biz, the vendors would be tempted to charge even more.

As for the spyware stuff -if this is in UK print drivers (as the zdnet UK article implies), then it could be illegal under our data protection laws. It certainly ought to be banned. All spyware should be illegal.

That is the nice thing about OSS -you can check the print drivers, and anyway, like linux.org or sf.net cares about your printing. Interestingly, spyware is very rare in the macos world too. There is something about windows that just encourages it. I think it is the fact that Ms effectively ship windows with spyware-to-MS preinstalled, then the home PC vendors join in, giving the green light to everyone else.

I despair.

Re:Are yet just, plain, mad?

[ScrewMaster]

Well, the business model that Lexmark (and HP, Canon, and the rest) follow is that of selling a cheap printer and expensive consumables, with the costly ink subsidizing the initial low price of the hardware. We can all agree on that much, I think. And, honestly, that approach did make a lot of sense when printer technology was improving by leaps and bounds and users were continually tempted to upgrade their equipment. But nowadays, inkjet technology is becoming fairly mature and you really don't see major improvements in price/performance anymore. That being the case, I'd rather pay a hundred bucks more for my printer, right up front, since I'll probably be keeping it for a while, and then pay a more competitive price for the cartridges.

Frankly, I think you may have it backward. Lexmark isn't the crack dealer: we are. They get the first hit (i.e., we give them fifty bucks for the printer) and then they keep getting periodic hits every time we run out of ink. The problem is, printer manufacturers have growned accustomed (nay, addicted) to this way of doing business: they like that unending revenue stream from little boxes filled with ink. It's the way of the modern world, i.e. don't just sell somebody something once, sell it to them over and over and over.

I'd like to know how many ink cartridges you have to buy before you've paid them back for the loss they took on the printer itself (assuming they take such a loss, China makes things pretty cheap nowadays) and when those sales start becoming pure gravy. Hell, if Lexmark wants to use those spyware drivers to help their customers they could do this: keep track of the number of times the cartridge has been replaced, and when the company has made back what it lost on the printer sale, send the user a discount card. The user could then take that card to any store that sells Lexmark cartridges and get some money off. Hell, if Lexmark wants to accumulate personal data in spyware fashion they should give something to their customers for the privilege, much like the major grocery store chains do.

Whatever, I really don't like Lexmark anyway and I'm proud to say I've never owned a Lexmark product. Talk about a company that is ethically challenged ... they wear their unlightened capitalism as a mark of honor. I hope they choke.

Re:Are yet just, plain, mad?

[Tim C]

There is something about windows that just encourages it.

Two main reasons for that:

1) historical "everyone runs as admin" meant no pesky user permissions getting in the way of what you wanted your software to do

2) orders of magnitude larger install base - you have X amount of time to develop this crap, do you target 95%+ of the market, or just the remaining 5%?

Re:Are yet just, plain, mad?

[ScrewMaster]

I've never owned any HP stock, but if I did, I'd have gotten rid of it the moment Carly Fiorina started making noises about Compaq. Match made in Hell, if you ask me, right up there with Time Warner and AOL as one of the all-time great stupid mergers.

2 Computers

[nurb432]

The safest thing to do is have 2 computers:

#1 - for internet useage only...
#2 - for everything else...

Re:2 Computers

[crash24601]

> The safest thing to do is have 2 computers:
>
>#1 - for internet useage only...
>#2 - for everything else...

I've actually recommend this to a couple people lately that had me build them second computers to do things like photo editing. One of them has followed my advice, the other told me it was great advice, then the next time I was at her house, she had plugged it into her cable connection with her other PC.

I run a second PC at home that is off the net, it can be a pain though. Software needs updates, some software makes it difficult to install and register without a connection. So many vendors now assume all pc's are net connected.

Or just spoof data

[steve_l]

Imagine a perl script to generate spoof statistics. Imagine a million ./ readers running the script as a cron job.

They'd soon stop trying to spy on the users, if the data was all that everyone keep on printing the same url all the time, something with "goat" in the URL...

Closed source considered harmful

[wikinerd]

It's just another example of how much control software companies have over you when you use their closed-source software (and drivers): You have no idea what the software really does!

Ethereal?

[herko_cl]

It would be very interesting and fairly easy to find out what the software is doing while it's "phoning home". Won't someone that has a Lexmark printer (Canon myself) please install Ethereal (or whatever floats your boat) and just try to capture whatever the software is sending?
While we may not find out what all of the data is, at least it should be fairly easy to establish whether they are collecting your name, or your username, or your IP. If this is installed quietly, it seems unlikely that they would bother with encryption. They don't seem too interested in privacy in the first place.
As an aside, I can see how real usage information from the field could be extremely valuable to a printer company, but it should say in big red letters "this product phones home". If the consumers are acting as their research lab, they better be volunteers...

Within seconds of blocking it in my firewall ...

[sho-gun]

Nov/13/2004 09:48:08 Drop TCP Packet From LAN 192.168.0.2:1654 192.146.101.142:80 Rule: Lexmark Block
Nov/13/2004 09:48:00 Drop TCP Packet From LAN 192.168.0.2:1654 192.146.101.142:80 Rule: Lexmark Block
Nov/13/2004 09:47:56 Drop TCP Packet From LAN 192.168.0.2:1654 192.146.101.142:80 Rule: Lexmark Block
Nov/13/2004 09:47:41 Drop TCP Packet From LAN 192.168.0.2:1502 192.146.101.142:80 Rule: Lexmark Block
Nov/13/2004 09:47:34 Drop TCP Packet From LAN 192.168.0.2:1502 192.146.101.142:80 Rule: Lexmark Block
Nov/13/2004 09:47:30 Drop TCP Packet From LAN 192.168.0.2:1502 192.146.101.142:80 Rule: Lexmark Block

and I wonder just how often its trying to phone home.

charge 'em with a crime, sue 'em in civil court

[scotty777]

Isn't there a law against spyware? Federal?

And can I claim violation of my right to privacy under a civil rights act?

Any lawyers out there? Ralph Nader? Public Citizen?

Does no one else check for drivers *first*?

[pla]

When considering the purchase of new hardware, I start by picking something with support already built into my OS. With Linux, this often means the difference between it working or not. With Windows, this means the difference between having to run a dozen tiny third party apps that appear to do nothing at all (beyond take up memory, disk space, and as per this topic, spy on my activities).

It really amazes me when I go to help someone with their PC, and I see a list of startups dozens of entries long. When I see a system tray that stretches halfway across the screen. When their process list requires scrolling down for three pages to see them all.


For a good default policy, when you buy new hardware, throw away any software it came with. You don't need it.

Printers? They all speak PCL or PS (unless you very unwisely bought one that does not, which goes back to "check for driver support first"). End of story.

Scanners? Okay, once upon a time, these could take some work to get up and running. But anything less than five years old (and if older, you can get a better quality replacement literally for around $20)? Free hint - Plug it in, open MS Paint, and check out the "from scanner or camera" menu. Simply amazing, eh? Everything you need to scan, already built in.

Cameras? I had two of my users actually install the software for new cameras we got just this past week. Do you have any idea what a pain it took to remove that software, when they discovered that not only did they not need it, but they couldn't use it due to some vague, irregularly-reproduceable conflict with other software they actually do require? Anyway, point of story - After removing every last trace of Kodak's crappy software (including a very large application, a boot-time driver, and a service! Ack!), I demonstrated to my users that they just need to connect the USB cable and turn the camera on. Poof, all their pictures appear under "My Computer" as a removeable drive named similarly to their camera's model.

How about video cards? Okay, no argument that you would do well to run the newest actual video driver from the manufacturer, but do you have any idea how many people I've see that also have 3Dfx's task manager, NVcpl and Nwiz, or ATi's set of up to half a dozen useless crapware blobs, all loading at startup (I won't even go into startups such as MS Messenger, Office startup, Quicktime, and all the rest that suck memory at the whopping "savings" of 5 seconds the first time you run the relevant program)? Sad. Truly sad, that people let such software steal their memory and CPU cycles.

Okay, I'll grant that more exotic hardware may well require third party support. But that quite simply does not apply to 99% of machines out there.


So I suppose the moral of all this, to stay on-topic... Why do people install Lexmark's own drivers in the first place? Don't ! Use the built-in drivers, and you can get all the same functionality without the spyware or the bloatware.

Not to imply that Microsoft doesn't pull similar crap as Lexmark (time.windows.com, anyone? Which if you run your own NTP server, you will notice does not speak plain ol' NTP). But just because one company likes riding us bareback doesn't mean we need to spread for the rest.

Re:Does no one else check for drivers *first*?

[TheLink]

It's not The People's fault that they install Lexmark's drivers when they buy Lexmark's printers AND they get spied on by Lexmark.

Let's not change the norms of proper social and civilized behaviour OK?

LaserJet 4 Plus is hard to beat.

[Nick Driver]

Excellent, sturdy-built printer. Probably one of the best medium-size laser printers that HP ever built. I have one that I found outside sitting next to a garbage dumpster full of old 486 and 1st generation pentium pc's. That's right, I got it for free. Took it home and found all the rubber rollers were nasty and the unit was filled with paper dust and assorted debris. It had never been maintained or serviced since new. I disassembled the unit, vacuumed out all the dust and crap, and carefully cleaned every moving part with isopropyl alcohol, bought a refurbished toner cartridge from OfficeMax for $50 and have had about four years of trouble-free printing at a total investment of some labor and less than the cost of two average inkjet cartridges.

Re:really!

[Barryke]

10 sell printer
20 sell inkcartage
30 disable inkcartage via internet
40 goto 20

printer ink prices

[Hachey]

did you know that printer ink is one of the most expensive liquids that common consumers buy in the world?

i looked at work a while ago for the cheapest non-generic printer cartridge with the most ink for your buck. if you were to fill you car with printer ink from this cheapest of ink cartridges, it would be about $3,059 dollars a gallon. (how much is my tuition again?).

lexmark needs to stop being so greedy. they already make money hand over fist. the common printer company tactic of making cheap cheap printers that eat cartridges like candy that cost $35 a piece (mind you, printers have a color and a black ink cartridge) should be enough for those guys. shoot, i already feel dirty enough shelling out that money, but having my computer sniffed is going too far.


--no sig.

Osama bin Scanning

[nxs212]

Hey, I am sure they are doing it in the name of national security!
Their plan to catch Osama was to flood Afghanistan with cheap Lexmark printers and hope that he or one of his buddies buys one. Then wait until Osama or one of his followers prints his digital camera pics on one of those printers. [Assume anyone in Afghanistan who can afford such a printer has Internet access as well] It should not be that hard to match and existing [reference]photo of Osama's face (embedded in that DLL file) with one in a solo or group photo.
It's not that hard to track someone down once you have their IP address.
Don't forget about the $20million reward!
The right way to do this would be to trigger data upload only if match was found, otherwise sit quiet.
OK, that was movie-of-the-week fantasy, but what they could have really done is monitor anyone scaning or printing $20 or $100 dollar bills.
Doesn't Photoshop alert you if you are trying to scan US currency? (or is that another urban legend?)

You need to think some more.

[twitter]

If I was really concerned with privacy, I doubt I'd be using a computer, much less connecting it to the Internet.

I'm concerned with privacy, so I use free software. Sure, my ISP can log my web habits but I don't have to worry about them selling information about what I do inside my own network to spammers. Nor do I have to worry about being compromised by some kind of email worm or malicious web site, which are just as large a threat to privacy.

You might be a little more concerned if you think about how any business can function without internet connected computers and what information your company might want to protect. All of that gets thrown out the window with M$ junk.

Net Assumption

[nurb432]

When i run into those issues, i call them and they either get me another way to do it, or "i will return the product due to its being unuseable"..

Normally they get me what i need, and I dont have to threaten them with a law suit....

Re:What about Macintosh Drivers

[drinkypoo]

Ha ha ha, you bought a multifunction device and now you're bitching about the driver? You're a fool to even buy one of those pieces of crap. You can get an inkjet printer for $40, a 1200 dpi flatbed scanner for $40 (That's what I paid for the Canon lide scanner I have here) and a modem for about ten bucks. If one of them fails, you only have to replace that device. If the scanner on your printer fails, you're left with a big ugly scanner/faxmodem. Everyone knows those things suck and AFAIK they are all PPA devices, meaning the host generates a bitmap and sends it to the printer. I don't want any printer that doesn't speak PCL and/or PostScript. Both of our printers now are PPA (well, one is, that's what HP calls it - I dunno what to call the dell printer) and they suck, but they were both free.

Re:HP Printers?

[beyond_the_blue]

Any moderately current HP printer or multifunction device has the same kind of monitoring software. There was a number of executables and services that would install right after the printer finished Plug-n-Playing, one of which is called HPScout, or something like that. That application monitors ink useage and printer stats just like the Lexmark app. I can't tell you what information was sent: I wasn't privy to that. I can, however, tell you that I had to disable that app along with a few others that get installed automatically to keep the amount of system resources that the printer was using down to a reasonable level. Also, I worked for the Windows side of support, so I can't tell you what it looks like on the Mac side.

Article doesn't say packets were sniffed

[handy_vandal]

Not clear what they are monitoring?
What am I missing? Couldn't somebody just install the program and sniff the information out of the packets?

What's confusing is that the original post:

Engadget report says that "Lexmark say they're just tracking printer and cartridge usage, but the registration information and packets being sent say otherwise."

Wrong: the Engadget report doesn't say that the packets being sent say otherwise -- there's no reference to packet sniffing:

The newsgroup posting claims that the program, found on the X5250 installation software, embeds itself in the registry and monitors the use of the printer through DLL files in the c:\program_files\lexmark500 folder.

The program sends the information, which includes print and scanning data, to the URL www.lxkcc1.com. According to the internet Whois database, this domain name belongs to Lexmark International in Kentucky.

As you suggest, packet sniffing is the next thing to do.

-kgj

Re:Not clear? - profit of course !

[Alain Williams]

All that we know is that it is making a connection, so how about something like this:

1. Read serial number from ink jet cartridge
2. Send serial number back home
3. Check with home 'has the cartridge been used before ?'
4. If it has been used before then it has probably been refilled, so degrade print quality and squirt ink all over the place.
5. User sees: poor quality and blots on the page
6. User never buys refilled cartridges again
7. Profit for Lexmark!

HP

[lateralus_1024]

I worked at hewlett-packard's All in One division and we wrote software that did the same exact thing and sent the data back to HP over http.
This software would be installed within the gigantic 120MB setup file. Somewhere deep in the EULA is a sentence about HP being able to process user activity data.

What? No one remembers the Printer sourced...

[digital photo]

What? No one remembers the printer embedded logic bomb which kept taking out the computer system of a certain power facility some decades ago when a disgruntled employee knew he was being fired/laid off and write a program into the memory of the printer unit which could initiate a communication to the main computer and wipe it out?

By sending packets out like this, Lexmark is opening up a can of worms.

All this means to me is:

• Continue to use Gimp-Print+CUPSd to handle my printing needs.
• Avoid Lexmark products just like I avoid Belkin products.
• If I NEED a windows based print server, put them on restricted segments of the network.

A driver that goes out to a website to upload data could just as well go out to a website and download code. Someone who can hijack that domain will probably find a way to screw with the system.

Economics of Printer Cartridges

[hross]

We know that the printers are sold at a loss and the consumables are more expensive than Dom Perignon. But the reasons for this are not only due to the choices of the manufacturer.

Printer consumables (e.g. ink & paper) generate a lot of revenue for the retail outlets as well as the manufacturer. Companies that sell cheaper ink and more expensive printers will have difficulty placing their printers in retail outlets. The cost per page of large photocopiers is very low, but you don't see them sold at big-box stores.

While retails outlets were the primary source of printers this was a stable situation. What has changed recently is that companies like Dell have enetered the direct sales market and so cut out the retail vendor. Retail can still make some money on consumables since there is some compatibility (e.g. Dell OEMs Lexmark).

But manufacturer's have no forced commitment to retail stores and if the Internet allows them to bypass the middleman and do direct sales, they will attempt to do so. In fact they must in order to compete with companies like Dell. At the same time Dell can't completely undercut the existing price regime because Lexmark still needs to see positive economics for their own printers even though they also build printers for Dell. Cut price ink would cannibalize their own sales more than the benefit of the increased hardware sales.

In order to make up for the loss of retail sales - and the loss of retails sales information - both Dell and Lexmark have created software that tracks usage and directs the user to the manufacturer's website *before* they run out. Otherwise, people will tend to impulse buy from retail rather than wait a week for delivery.

So the manufacturer's want the information, they need it in advance of ink exhaustion to bypass retail, and they can collect all sorts of information that they probably don't need but might find useful.

It's the 'might find useful' category that causes the greatest privacy concerns, and are probably not necessary for the immediate purposes, but it's easy to collect and few people complain. So far.

Fight back

[AmiMoJo]

If I had a Lexmark printer, I'd fight back. Write a program to send bogus packets with false data to screw up their data. Distribute it to other pissed-off Lexmark owners. Release another program to disable Lexmark's spyware.

It's nasty and somewhat immoral, but sadly it seems like the only way companies will learn.

It's not the public's fault

[Anonymous Brave Guy]

As far as I'm concerned, if your still running windows connected to the internet, buying Lexmark gear, and reading this with IE, then you deserve everything you get.

Sorry, but I really don't think that's a very constructive attitude.

There is simply too much small print in an average person's life for them to read and absorb all of it. That would probably still be true even it it were written in plain $LANGUAGE, and not deliberately obfuscated by lawyers. Hence it is unrealistic to expect anyone to understand and, if necessary, challenge everything that they might not agree with if asked in isolation.

To protect society from the unscrupulous behaviour of those who would capitalise on this systematic weakness, we have a legal system. We elect people to form a government that can spend its full time in administration on our behalf, so we don't have to. Their remit is to look after our interests for us in cases like this.

The problem with a lot of technology is that it takes a fairly long time for the elected government's knowledge and views catch up with informed professionals (who, of course, can dedicate their whole working life to the technology industry, an advantage the lawmakers don't have). Consequently there is a fairly large window of opportunity for profitable spamming, spyware, adware, etc. that aren't really in the general public's interests before it becomes illegal.

The only realistic solution to this problem is to educate the lawmakers and draw their attention to new problems faster so they can act against them. Expecting to educate everyone in society about every potential threat to their finances, privacy, security, work-life balance, etc. just isn't a realistic possibility, which is why comments like the parent post aren't very helpful.

Re:What about Macintosh Drivers

[drinkypoo]

The thing about those things is that they really do have three drivers, but typically only one driver installer. If you're particularly unlucky the drivers only ever unpack themselves to ao temp directory, and you have to use that winhandle program to even figure out where it is half the time.

People buy a multifunction device for the same reason they use to buy macs - and I'm talking about when there was only one reason here, and that was because anything else confused them. The thing about that is that multifunction devices are more complicated, not less. They're harder to support (if something goes wrong you will have more trouble) and if your network should ever grow, well, you can't hook them up to a print server and still use their scanning and modem functions. And believe me, even people with no computer knowledge and/or experience end up asking people who do to set up stuff like print servers for them in their house so they can have two computers print to the same printer without having to make sure one is on :P

Multifunction devices are not cheaper, they're not easier, so what's left? The belief that they take up less space? Multifunction printer/scanners are almost all huge, because they have a flatbed built into them and a large printer mechanism underneath so there's an excuse for the ridiculous physical size. We have a 720dpi inkjet that's about one third the size of the average scanner/printer/fax. It and my scanner together, maybe one-half. My scanner is USB-powered, about 1.5" thick, and provides a pretty good 1200dpi scan, although not very rapidly. Won't be any worse than a combo box, though. It came with a cute plastic stand that will keep it upright on a desktop, but I usually put it on a shelf or something. When I'm not using it I unplug it from the front panel USB connector, but it's got a USB B jack on it, so you can just leave the cable connected all the time.

Postscript isn't about cool, and it doesn't have to be postscript, it can be PCL. The important part is to minimize the amount of data you send to the printer, which improves your print speed. Fast printing is convenient, much as fast CD burning is.

Being able to upgrade the individual components that are provided in one of those units is worth buying them separately all by itself. Being able to decide that the inkjet isn't working for you and move up to a laser without having to get a new scanner is the way things should be to say the least. We aren't getting modular devices where you could just replace the printer part of the combo unit, so it only makes sense to just buy the separate devices.

There is just one reason I can see to buy one of those things: If you wanted an inexpensive copier/fax machine. I wouldn't even want to hook it up to a PC, although I would consider hooking it up to one that did nothing but act as a print server.

Give them the 'Gomer Pyle' treatment...

[Sam Nitzberg]

I remember an old Gomer Pyle show... (OK - I know - all Gomer Pyle episodes are old...)

Anyway, there was an episode where he would use a particuliar jeep. Everytime he had the jeep, his buddies would keep filling it with gas for fun, and not tell him. He thought that he was getting like 100 miles per gallon. When the sargent had the jeep, they'd siphon off the gas...

You could really screw with their numbers. Your Lexmark printer could report 200 reams per ink cartridge. Depending on the detail of their reporting back, you could make it look like you printed 1000 sheets all red, then all blue. You could mess with their metrics. Worse yet, if you falsify your registration number, you could fill their databases with fake data and even collide with other numbers already registered. How do they interpret data when the same printer is being reported numerous times with different behaviors. They shouldn've used strong crypto to ensure data integrity...

They probably should have had a click-to-authorize this activity as on option with their driver, with some benefit attached. Most would click it anyway, or not read the advisory...

http://www.iamsam.com

Easy 1-2-3 solution...

[crazyphilman]

Use Linux (or a *BSD) and CUPS to run your printers. Since you don't have to run any printer-company applications (because Linux has its own drivers for everything, all thoroughly vetted by the open source community), it is impossible for manufacturers to spy on you.

I'd include OS/X in that, but unfortunately, I'm using a Hewlett-Packard print manager on my iBook, which could possibly be spying on me right now. It's a bummer, but I paid 1800 bucks for this thing (the iBook, not the printer), and I don't want to quit using it until it dies of old age. Sigh...

In the meantime, I have a couple of old mil-spec laptops running Slackware that can take over when the iBook dies, so I guess that's pretty cool.