Bad Day To Be Sony

Not only is Sony no longer selling the RootKit CDs, Arend writes "According to a USAToday article, Sony is to pull their controversial rootkit CDs from store shelves." A nice gesture, but a little late. bos writes "Sony's DRM rootkit has been found by Dan Kaminsky to have infected at least half a million networks, according to an article by Quinn Norton for Wired News. Dan has even put together some pretty pictures of the breadth of the infection." With so many people infected, it's unfortunate that wiredog writes "From The Washington Post comes the news that serious security flaws have been found in the software that Sony is distributing to users who want to remove the Sony rootkit. The article says: 'Because of the way the tool is configured ... it allows any Web page that the user subsequently visits to download, install and run any code that it likes.'" Oops. Even Microsoft is getting into the act. ares284 writes "Microsoft said it would remove controversial copy-protection software that CDs from music publisher Sony BMG install on personal computers, deeming it a security risk to PCs running on Windows."

Comments

How to boycott?

[dada21]

I'm not a "boycott!!!" kind of guy. When I was younger I used to be, but no one ever stuck to it. This "error in judgement" is definitely something that I am adding to my (really small) short list of company-groups I won't buy from. I already won't buy CDs without the "CD" logo. I won't buy Sony TVs or receivers for the last 4 years because of their terrible support policies. I won't buy anything from Menard's either. And now Sony music CDs are permanently out.

How do those who are active boycotters stick to it? Do you actively pursue telling others, or is it just a "one person, one dollar, one vote" kind of life lead?

I could care less if other people want to support Sony artists or Sony products. All mercantilistic (using government to acquire wealth) corporations are bad, but that doesn't mean that every business is bad. Sony has actually been one of the least mercantilistic corporation I've tracked over the years, but their releasing of items without proper quality control is what kills them time and again.

And I believe that is the problem with this rootkit. Sony didn't test it properly. If they had tested it properly and kept it within its own little world on a customer's PC, I don't think the fallout would have been so excessive. They didn't test the product, they relied on the customers to do so. Luckily for Sony, the customers weren't happy and were vocal about it.

That is the free market at work. People unhappy about a company or a product have much more of a voice with the web being so readily available. The more the Internet allows billions of citizens to align on different issues, the more we'll see that a free market "democracy" is better than a democracy built around the use of force.

Vote with your dollars.

Re:How to boycott?

[Anonymous Coward]

you did not type that all in the 30 seconds since the story was posted....

Re:How to boycott?

[Anonymous Coward]

Well, do what I do. First, I get really pissed: then I will have nothing to do with the product or service. For example, I've been boycotting Slashdot.org for months now because of my disagreement with the modderation system. So,err, there! That's how you do it!

Re:How to boycott?

[jedidiah]

Nevermind boycotts. These sorts of shenanigans deserve nothing short of civil litigation and criminal prosecution. People should be showing up to the local DA's office with pitchforks in hand. Nevermind silly little boycotts.

Re:How to boycott?

[Anonymous Coward]

It's a lot easier to download something from p2p than to go out and buy it. Easy boycott.

Re:How to boycott?

[achacha]

Have to agree with you, I have added Sony to my very small list of companies not to buy things from. Yesterday I bought a camcorder from Canon even though both Canon and Sony were final runner ups, I put my 800$ on a Canon for one reason... Sony DRM is an insult to consumers and I am sure my miniscule decision will not matter but I feel good that I will not be giving money to a company that thinks it is ok to distribute a rootkit with their music CDs. And I actually checked the music CDs I was buying to make sure they were not from Sony. The only way we can have our voices heard is not by making noise but by not spending money ontheir products... when you affect their profits it hurts a lot more and while I am one person and my immediate actions will not even affect the company, I am hoping there are more people out there that believe in honest practices.

Re:How to boycott?

[enraged78]

I myself have been boycotting CD's produced by the any label associated with the RIAA for the last three years. I have not purchased any CD's for myself, or as gifts for others. I do not plan to do so until three conditions are met. First, artists are properly compensated for their music. By properly compensated, I mean more than a nickel a disc, which works out to less than that due to 'questionable' accounting practices. Second, that that RIAA ceases all current lawsuits against users who "illegally" downloaded music, and returns all moneys garnered from users who "settled" with the racketeering, um, I mean consortium. Third, that the RIAA cease to destroy both public domain, and fair use policy. In order for the public to respect the RIAA's property, the RIAA needs to stop illegally extending copyright by purchasing politicians. Oddly enough, all this purchasing power seems to stem from the 12-18 year old market. That same market does not possess the ability to vote, and I find it rather strange that all their hard earned dollars are being redirected towards buying our public officials for the highest dollar. Sony products in general will no longer be purchased by me until these and many other wrongs are rectified. Their policies are criminal, their once good hardware products are now sub-par, and their greed is insurmountable. This is no longer a free market question. This is now a corporation buying legal power to function as a makeshift mob. I for one will not stand for it by purchasing thier products.

Re:How to boycott?

[DroopyStonx]

Boycotts don't work with companies as large as Sony.

Even if you were lucky enough to gather a large amount of people, their producs are so intertwined with everyday technology that your actions won't make the slightest dent in their profits.

It might seem like a good idea on how to "stick it to the man", but in reality it's not quite so effective.

Even with all this bad publicity, they'll probably see a temporary dent in their stock, but 6 months from now all will be back to normal.

Then the PS3 comes out, yadda yadda...

Won't work.

Re:How to boycott?

[linguae]

There is nothing wrong with having a business that relies on the government as long as you provide society with products and services that it needs.

Yes, there is something wrong with businesses that need the government in order to make profit. It's wrong because it goes against the nature of free markets. Have you heard of corporate welfare? If a business cannot make the profits necessary, then it should either change its business plan or die, and not have taxpayers pay to keep it alive. There is a huge difference between governments contracting corporations in order for them to build infrastructure and schools, and governments subsidizing businesses (e.g., corporate welfare). He's talking mainly about subsidies.

Re:How to boycott?

[SoCalChris]

I quit buying Sony crap over a decade ago. I used to buy their products more often than other brands, because they used to be higher quality. Then, I had a string of high end Sony items go bad (Usually within about a month of the warranty expiring).

I had a Sony cell phone (This was when cell phones were first starting to come out, and were about the size of a brick). It was several hundred dollars. I went through 7 of them before the warranty expired, and I finally replaced it with another brand. I had a laser disc player whose drive motor kept dying. I had a boom box whose tape drive never worked right, even after sending it in for work several times. Then I had a Sony AV receiver, that one day decided not to turn on, unless you picked it up a few inches and dropped it. After that string of bad products, that Sony wouldn't stand behind, it was easy for me to stop buying their crap.

I don't actively try to dissuade people from buying Sony stuff, but if asked my opinion, I will gladly tell people about my experience with them.

Re:How to boycott?

[Fishstick]

also

If you believe a Sony Music product has a manufacturing defect, please call our Quality Management Department at 800-255-7514; 856-722-8224 in New Jersey).

Re:How to boycott?

[Dammital]

Oh, I don't know... that smug feeling you get is worth something.

Two years ago I stopped buying Belkin products after their routers started redirecting port 80 queries to their own adservers. Can't say that I miss 'em.

Re:How to boycott?

[grahams]

Too bad Sony makes many CCDs for Canon cameras....

Re:How to boycott?

[Zathrus]

How do those who are active boycotters stick to it? Do you actively pursue telling others, or is it just a "one person, one dollar, one vote" kind of life lead?

If you actively pursue telling others you'll just annoy them and get labeled as a wacko. So it's pretty much up to you and your money. If the opportunity presents itself to discuss the topic without having to stretch for relevance (e.g. -- a friend/colleage/random stranger complains about a CD not working on their computer or something), then go for it. Otherwise keep to yourself. The only real exception here is demonstrations -- if you can get a reasonable number of people together then you don't look like quite such a loon; instead you look like a group of loons. But at least then you're in a flock.

As for boycotting Sony specifically -- first, write them a note telling them why you're boycotting and what they need to do to end your boycott. The second part is extremely important -- if you don't give them a method to regain your money, then why should they even bother? And in that vein, it has to be reasonable. I don't expect Sony to never issue non-CDs with DRM. I do expect them to never use this piece of crap again and to fire/relieve from their existing duties any managers that were involved in the approval of XCD.

Second, try to make sure you don't give them any money. If you want to be strict about it, then only punish Sony-BMG Music. That means no buying CDs from them. If you want to be more liberal then don't buy anything from any Sony division -- no CDs, no DVDs, no movies, no electronics (including PS2 and so forth), nothing whatsoever directly associated with the company. If you want to be even more liberal then don't buy anything that will funnel money to the company -- all PS2 games are licensed, so none of them. Similarly, many movies may use music that's owned by Sony, so start checking those music credits first! And if you want to be a complete whacko then avoid any thing that funnels money to them through cross-licensing, partnerships, and so forth. Given how big Sony is, if you take this route then I suggest you sit quietly in an open field and hope they break before you die of dehydration or starvation (pray for rain and small, harmless furry animals to wander nearby).

At least send the letter and try to stick to your boycott, at whatever level you choose. They've already done a lot more than I expected by recalling the defective CDs. Now they need to post a public apology (from a Japanese company that's a big deal), post a non-ActiveX method on their website to completely and utterly remove the DRM (and the decloaking junk), and appropriately punish the management involved in this cock-up. That would make me happy at least.

Re:How to boycott?

[PunkFloyd]

Here's to correcting the worlds grammar one person at a time.

Wouldn't that be the world's grammar? :)

-pf

Re:How to boycott?

[Milican]

Well, I just bought a 32" TV 2.5-hours ago at Circuit City. It was between the Sony and the JVC. Both looked good and were at similar price points. Guess which one I bought? Thats right, I bought the JVC. Thats $500 less for Sony. All because of this XCP fiasco. They better wise up and remember that they are in the business of selling music and electronics. Not treating their computers like thieves and fscking up their computers.

JOhn

Re:How to boycott?

[idontgno]

He smiles with his mouth, but not his eyes.

I've noticed this phenomenon too. Because there's no involvement with any facial muscle groups other than the lips, people have trouble interpreting the expression.

In this case, I assume folks are using cultural expectations of the behaviors of spokespuppets in TV commercials to resolve the lack of direct evidence and essentially assuming the grey-haired chap in the Menards' commercials is smiling.

But I've figured out the truth. It's not a smile, it's a predatory tooth-baring snarl.

Which is why the Menards' guy scares the bejeebus out of me. That, and how he's always going on about my nards. You leave my nards out of it, dammit.

Re:How to boycott?

[Esion Modnar]

People unhappy about a company or a product have much more of a voice

I recall that a certain popular tax preparation software (TurboTax, that's it!) got into hot water when, in the effort to curb piracy, they started mucking with the customer's boot sector, or some such. (Couple years back.) They ended up retracting their software naughtiness, and doing a profound mea culpa.

Anyhow, will these companies ever learn that the bad press from borking their customers' computers, will cost them much more than piracy ever will? Sure, they see piracy as a problem to be met with DRM, but they're losing all perspective. Their DRM hammer is leaving holes in the wall.

Good will is a commodity which is built up slowly over many years, and can be lost overnight.

Re:How to boycott?

[Total_Wimp]

Boycotts usually happen to achieve a goal. What is your goal? If your goal is to get Sony to pull the CDs and send a patch then Bravo! your work is done. If it's something else then I'd start with what that goal is and work your way back.

Possible goals:

- Better patch
- Pledge to never do it again
- Give money to spyware erradication groups
- Give money to the EFF

Note that Sony alread seems pretty willing to whatever it takes to make this go away, so I'd stick to the important stuff. If you feel you can make them do something like give $100 to everyone who bought a CD then a) you'll never win and b) you, the protestor, will look like the asshole.

Remember, boycotts should happen only in extreme circumstances. If they fix the extreme stuff then all you'll have left is the trivial, and thats no reason to go boycotting.

TW

Re:How to boycott?

[Aumaden]

Boycotting Sony BMG will have the same effect as boycotting RIAA.

"Wah! Our profits aren't humungous!
Boycott?
No, there's no boycott, its them pirates!
Arr!"

Find an artist you like who is on one of Sony's labels (there are over 20 labels held by Sony BMG, so you should be able to find something). Take a few minutes to track down contact information for the artist. Now, write them and their agent a nice letter explaining how you really like their music, but are not buying their album because you don't want to risk being infected by Sony's defective copy protection. Let them yell at Sony.

Re:How to boycott?

[thegnu]

If you actively pursue telling others you'll just annoy them and get labeled as a wacko. So it's pretty much up to you and your money. If the opportunity presents itself to discuss the topic without having to stretch for relevance (e.g. -- a friend/colleage/random stranger complains about a CD not working on their computer or something), then go for it. Otherwise keep to yourself.

I disagree a little. I, as a nerd, take it upon myself to say something when people ask me specific advice about a product. That's sort of what people expect of us. If someone asks me about laptops I say, "I like IBM and Toshiba, because the experience I have with Dell and HP shows inconsistency in product quality. Sony sometimes makes great laptops, sometimes they're terrible and unsupported and Sony doesn't care. I don't buy Sony because they put on the market a virus that invades their consumers right to privacy."

Lots of times it affects people's buying decision and appreciate being told in a non-offensive manner.

But I don't walk up to people and say, "SS-S-SSO-OO-ON-N-NY'S EVIL!!! AAAHHH!" if that's what you're talking about.

Re:How to boycott?

[poopdeville]

I don't listen to music so...

You monster!

Re:How to boycott?

[MisterLawyer]

This DRM trojan horse issue isn't the only reason to call up the militia! Sony has been sh*tting all over its customers for years. Take their EULA, for example:

Sony's End User License Agreement requires the following things of all consumers who purchase this "content protected" music:

1. If your house gets burgled, you have to delete all your music from your laptop when you get home. That's because the EULA says that your rights to any copies terminate as soon as you no longer possess the original CD.

2. You can't keep your music on any computers at work. The EULA only gives you the right to put copies on a "personal home computer system owned by you."

3. If you move out of the country, you have to delete all your music. The EULA specifically forbids "export" outside the country where you reside.

4. You must install any and all updates, or else lose the music on your computer. The EULA immediately terminates if you fail to install any update. No more holding out on those hobble-ware downgrades masquerading as updates.

5. Sony-BMG can install and use backdoors in the copy protection software or media player to "enforce their rights" against you, at any time, without notice. And Sony-BMG disclaims any liability if this "self help" crashes your computer, exposes you to security risks, or any other harm.

6. The EULA says Sony-BMG will never be liable to you for more than $5.00. That's right, no matter what happens, you can't even get back what you paid for the CD.

7. If you file for bankruptcy, you have to delete all the music on your computer. Seriously.

8. You have no right to transfer the music on your computer, even along with the original CD.

9. Forget about using the music as a soundtrack for your latest family photo slideshow, or mash-ups, or sampling. The EULA forbids changing, altering, or make derivative works from the music on your computer.

Refer to the following for details:

• List of Affected CDs
• EULA analysis
• Rootkit analysis
• Continued rootkit analysis

(From a Brendan Ribera, Amazon Post)

Re:How to boycott?

[poot_rootbeer]

And I believe that is the problem with this rootkit. Sony didn't test it properly. If they had tested it properly and kept it within its own little world on a customer's PC, I don't think the fallout would have been so excessive.

What.

It's a rootkit.

It's intended functionality is deleterious to the consumer. Better testing might have made it better, but it could never have made it Good.

Re:How to boycott?

[wintermute740]

"And I actually checked the music CDs I was buying to make sure they were not from Sony."

I quit buying from RIAA member companies awhile back. I'll listen on the radio, but I haven't heard anything worth buying for a long time. And I station-surf through commercials :P If I do buy music, it's from one of the local unsigned artists who haven't had their sound watered down to what the RIAA wants.

As for Sony, I am done with them. My last TV was a Sony, but my current one is some German company that I can't pronounce. My Sony stereo has been abused for way too many years. I will not be replacing it with a Sony. My digital camera needs replaced. I'm thinking Canon. My notebook computers are Toshiba, and my desktops are custom-built and Sony-free. As mentioned above, I don't buy Sony-label (or RIAA-label) music. I haven't gone to the movies forever, and my (non-Sony) DVR watches TV for me, and most shows get erased unwatched. I think that about covers it... Well, except for gaming. My last console was an Atari 2600 and I don't do much PC gaming. When I do, it's usually Blizzard. So, Sony, what are you going to do to get my business back? Remove a couple of crappy CDs from store shelves? Not likely to get my business back. They're gonna hafta go through a lot of chapstick to accomplish that!

Re:How to boycott?

[poopdeville]

It's a real shame that you've had bad experiences with them. This is one (relatively minor) reason why conglomerates are bad for the consumer. Sony owns something like five audio equipment firms, most of which are crappy. Their boutique audio firm is actually really good. But they all get a bad rap since they can't differentiate themselves. The same thing goes on in the video market.

OK, that's not exactly right. Their plain old consumer line used to be decent, but quality has slipped in the last 10 years. Basically, if your AV receiver has a useless LCD interface or other gimmicky shit that appeals to upwardly mobile young people, you're gonna get reamed. Their lines get progressively better until you hit the Broadcast line of equipment, and finally their Boutique line. But you do pay a premium since these things are produced on a much smaller scale (and with better components)

Re:How to boycott?

[Moofie]

"Vote with your dollars."

I don't have enough of them to matter.

Re:How to boycott?

[Koiu Lpoi]

Member of DMusic by any chance? If not, it's a great resource for non-RIAA music. And, there's a heated debate on the front page about this very rootkit.

Re:How to boycott?

[R3d M3rcury]

"As for boycotting Sony specifically -- first, write them a note telling them why you're boycotting and what they need to do to end your boycott."

Dear Sony,

I am boycotting all Sony products until the following demands have been met.

1. Give me a tool to remove the spyware from my system.
2. Remove all infected CDs from stores.
3. Replace all infected CDs that have been purchased with uninfected CDs free of charge.
4. A public apology and a promise to never use DRM on CDs again.
5. Susie Suh. In a string bikini. At my place. Tonight.
6. I'm having a little get-together this weekend and it would be great if Santana could be there and play a few songs.
7. Three words: Dump Michael Bolton.
8. One...million...dollars.

Thank you for your time.

Re:How to boycott?

[Lehk228]

Sony makes components for lots of companies, however it is nikon who uses sony CCD's Canon rolls their own for DSLR's.

Ouch

[Anonymous Coward]

To have Microsoft call you on your bad business practices...

Re:Ouch

[blincoln]

To have Microsoft call you on your bad business practices...

Yes, how wonderful and convenient that a benevolent company like Microsoft has bravely stepped up to remove the software of one of their biggest competitors from the computers of the helpless computer-using public.

Clearly the only proper course of action is to support this generous and gentle giant of the technology world by purchasing their new gaming console - coincidentally just released - and as many games and accessories for it as possible.

And their mp3 player sucks too!

[ReeferCpe]

:D

Not to worry

[Anonymous Coward]

I'm sure they'll find some sort of way to cheer themselves up...

PS3? No thanks, Sony; you screwed the pooch

[Rude Turnip]

I'd like to thank the fine folks at Sony for helping me decide which next-generation gaming console to buy (hint: It doesn't begin with the letter "P" or end in a "3"). It's a sad state of affairs when Microsoft has to come to the rescue and un-fsck your security blunders.

Thank god for Sony

[sedyn]

I'm all in favour of letting the average person know the truth behind what content distributors are willing to do to protect "their" property.

Let us hope that people find out about DRMs before they saturate the market any further.

Re:Thank god for Sony

[olddotter]

I agree, in the grand scheme this might be a good thing.

And if for nothing else this has been very funny to watch the problems snow ball for Sony.

Wow...

[Premo_Maggot]

the virus writers have done something good for us!

I sincerely apologize for this...

[LithiumX]

The DRM WANTS to be free!

Re:fp i hate sony

[rovingeyes]

you should have tried $sys$fp. Then see if the moderators would have caught you. Oh well...

Now look at the mess you're in, Sony.

[apflwr]

In the end it probably would have been cheaper and much less hassle to just let us download the damn mp3s.

The natives are restless..

[grub]

Read the comments for this protected disc by Van Zant on the Sony label.
,br>OUCH.

Re:The natives are restless..

[msormune]

I specially liked the quote containing lyrics to a Twisted Sister song "We're not gonna take it". Okay people, get back to your American Idol reruns, nothing to see here.

Re:The natives are restless..

[PagosaSam]

I just sent this comment to Amazon...

This product violates Amazon.com's policies.

"Items that infringe upon an individual's privacy. Amazon.com holds personal privacy in the highest regard. Therefore, items that infringe upon, or have potential to infringe upon, an individual's privacy are prohibited. Additionally, the sale of marketing lists (bulk e-mail lists, direct-mail marketing lists, etc.) is prohibited."

Sony'd DRM rootkit violates my privacy by "phoning home" to report on my computer's usage. These products should be banned from further sale, imediately!

Looks like they crossed the threshold...

[jenkin sear]

Looks like Sony crossed the threshold from nuisance to crime. While DOJ is almost certainly going to soft-pedal this, a savvy attorney general with political ambitions from a state unencumbered by Hollywood and the RIAA could probably ride this case into the governor's office....

"Paging Eliot Spitzer, Paging Eliot Spitzer, Mr. Spitzer white courtesy phone..."

Re:Looks like they crossed the threshold...

[the eric conspiracy]

"Paging Eliot Spitzer, Paging Eliot Spitzer, Mr. Spitzer white courtesy phone..."

To me the biggest surprise in this saga is that he hasn't been all over this.

Re:Looks like they crossed the threshold...

[jenkin sear]

Especially since he's already successfully sued the RIAA for "lost" royalties, and served notice (and got a settlement) from Sony BMG on payola...

Might be an interesting idea for a New York resident to make a phone call to his office...

Re:Looks like they crossed the threshold...

[DysenteryInTheRanks]

Any further mega-cases would only waste time that he would rather spend campaigning. /cynical

Frankly, I am glad there are at least _some_ incentives to reward people like Elliot Spitzer who try and force corporations to comply with the law -- because there are HUGE financial incentives for the corporations to flaut the law.

Maybe you'd like to explain how society should hold corporations in check after it throws away any recognition, title (politics) or money (lawsuits) awarded to those who do so. It seems to me that we should not leave corporate money as the sole remaining incentive or insist that public advocates live like monks.

Re:Looks like they crossed the threshold...

[Kenrod]

Spitzer's usual tactic is to threaten corporations with civil or criminal suits, then agree to drop/reduce charges if the corporation will pay large fines/reparations, admit some form of wrongdoing, and/or make some significant public contribution. Guilty or not, most corporations will settle out of court rather than suffer the bad publicity, spend millions on lawyers in court, and possibly be found guilty anyway by a jury that has to weigh enormously complex law vs a big Evil Corporation.

It's very telling that when Spitzer does get someone in court, he usually loses. He is much less interested in correctly prosecuting the law than in generating PR for himself.

If Spitzer were truly interested in making corporations pay, he would refuse to settle the big cases, drag companies into court, and really make them pay (and establish good legal precedent so other corporations would shape up).

Nooooo!

[Anonymous Coward]

The Brotherhood of NOD has taken over 75% of the United States!

Vulnerability

[Anonymous Coward]

So we have a vulnerability on machines that was pushed out intentionally by somebody. We know who that somebody is.

The question is, will they get punished for this by the authorities? The FBI and police seem to be happy to jail writers of virii or worms or those who spread vulnerabilities to unsuspecting systems. Why shouldn't the product manager responsible for this pay for his crime of making the nations computers even more insecure?

Considering the rootkit is installed without owners realistically being aware, doesn't that make it equivalent to a form of worm, virus, or other type of nasty?

I seriously believe that someone should be doing jail time for this. Such a punishment would make any other malfeasants think twice before thinking that they don't have to obey the law.

Get 'em good

[Anonymous Coward]

Go to http://cp.sonybmg.com/xcp/ or http://cp.sonybmg.com/xcp/english/form14.html

Where it asks for the Artists name type in some diatribe

Where it asks for the Album Title, type in more diatribe

Where it asks for Store Name, type in yet even more diatribe

Where it asks for email address try something that will cause them trouble such as uce@ftc.gov or some chronic antispammer advocate.

This will hopefully force Sony to make the "patch directly downloadable." ...since Sony says over 2 million disks containing the rootkit have been sold, that puts them under the gun for roughly U.S. $150 billion in damages :)

Perhaps the copyright owners could offer to settle: have Sony repay all of the people who have been extorted for money because of filesharing (double for damages), and promise to stop all such activities in the future. That would only run them about $100 million, so it would be quite a deal.

Boycott Big Music

[drdanny_orig]

I suggest people consider boycotting _all_ RIAA member labels, not just Sony. They just happened to be the fools who fell for this particular version. It's not hte implementation that's anathema, it's the concept of DRM. When in doubt, consult RIAA Radar. Don't buy discs produced by RIAA members, it't that simple.

Who was held accountable?

[Murphy's Paradox]

I wonder how many people, and their positions in the company, were shipped off to Sony's Siberian department for this debacle. I also wonder if anyone Even though the programmers were told to do this by management, I'm sure they are getting in trouble for not being sneaky enough with the code.

[OT] Re:How to boycott?

[dada21]

I use a PDA Phone to browser /. and type everything into MS's PDA version of Notepad. Then I copy and paste it into /. so I don't lose my comment from one of the billion reasons I have in the past.

I subscribe because it allows me to read the articles before they're /.d by the mass onslaught of others when the article goes live. The $10 a month or whatever I pay is well worth the consideration I receive from other regulars here, and has been very helpful in composing my views and thoughts on certain subjects. Yeah, the signal to noise ratio gets worse and worse here every day, but /. has probably increased my online reading rate at least 300% over the years, so it balances itself out :)

Re:[OT] Re:How to boycott?

[Oliver Wendell Jones]

American Express charges more than most major credit cards and companies that live on thin margins often times will not accept American Express.

This is very prevalent at places like computer shows where they quote cash prices and charge a percentage extra to cover credit cards - American Express will almost always cost you more to use than a Visa or MasterCard in such a situation.

To me, not taking American Express is a way of saying "we're doing everything we can to keep our prices as low as possible and pass the savings along to you!"

Now, I'm sure that someone will point out that Wal-Mart accepts AmEx, but I'd be willing to bet you that someone from Wal-Mart went to AmEx and said "here's the deal - reduce your cost to us or your out" - and I think we can all guess the outcome of that...

Re:[OT] Re:How to boycott?

[Rasta Prefect]

Why Menard's won't do it is beyond me. Home Depot is always around the corner, and we're finally getting Lowe's here as well, in the Midwest.

Because American Express rewards their customers by charging much higher merchant fees than their competition.

http://www.usatoday.com/money/perfi/general/2004-1 2-22-amex_x.htm

Re:[OT] Re:How to boycott?

[hunterx11]

But you could be against eating turkey sandwiches, and even encourage others not to eat turkey sandwiches, and still want them to be legal.

Re:[OT] Re:How to boycott?

[Frymaster]

To me, capitalist is sort of like 'pregnant.' Either you are or you aren't.

virtually everyone who calls themself a 'capitalist' isn't. to be a capitalist, you must live off the revenue generated by capital you control. i suspect stronlgy that dada21 and others like him actually live by trading their labour to people who are, in fact capitalists.

Re:[OT] Re:How to boycott?

[Schemat1c]

Capitalism - in it's true form that dada is trying to distinguish - is one that leads to life.

Or maybe just a slower form of death. Capitalism seems good to us in the western world but spreads poverty and hopelessness to the third world countries that get exploited because if it. In the long run I believe it is unsustainable. It's like an organism feeding off of it's own body, eventually the entire body will die. I wish I had an alternative system to offer but due to the greed and selfishness of most humans I don't think any system has a snowballs chance in hell of working.

Re:[OT] Re:How to boycott?

[uncoveror]

The problem with free market theories is that they advocate the law of the jungle and the law of the land being the same. That flies in the face of civilization itself. Under such a system, big tigers get the meat, and small ones starve. Might is right. Humanity never would have needed civilization if that had worked.

Capitalism as an economic theory has its attributes and flaws, but capitalism as a religion is the worst thing ever foisted upon humankind. If you let "do as thou willst be the whole of the law" in business, you give businessmen a license to rob and loot. Guess what. They will use it. Bowing before golden calves called "competition" and "the markets" is all anarcho-captalism is, and libertarianism is basically the same.

Re:[OT] Re:How to boycott?

[MBraynard]

Your completely wrong in every possible way.

Capitalism is the savior of the third world. It works every time it's tried. Just look at the Asian tigers.

You should really sit down with some Ayn Rand. I'd even offer to buy a book or two for you if you'd read it. I'd recommend Capitalism: The Unknown Ideal.

Re:[OT] Re:How to boycott?

[simon_hibbs2]

Perhaps you should read some Adam Smith. He's widely regarded as the founding father of capitalist economic theory. He's a bit of a bugbear to socialist, but is often badly misrepresented. In fact he was insistent that regulation by government was vital if capitalist economics was to realise the maximum social good. He believed that capitalism is simply a means to an end, which is the welfare of the general population and the promotion of civil society. Much of the modern terminology we use in this area was 'invented' after his time, but the same ideas are there in his books.

You are raising a straw man. Yes it's possible for capitalist theory to be taken too far, but in practice you won't find many people actualy promoting such extreme forms of it. Well, outside the White House anyway.

Simon

Re:[OT] Re:How to boycott?

[harlequin516]

Libertarianism, with a Big "L", has more to do with freedoms of individuals. When Libertarians talk about free markets, rarely are they talking about multinational corporations, they don't belive in them. You are right about all the other stuff.

Today's article of LWN.net about Sony

[njchick]

http://lwn.net/SubscriberLink/160023/27b2a2ec75f19 81b/

FBI? NSA? Homeland Security?

[The Rizz]

Why hasn't Sony been raided by the Feds, yet?

If this had been an individual, or small business, you know they would already be behind bars awaiting trial for violating some law or another... possibly even being brought up on some sort of national security-related charges.
( Someone in a secure/top secret/classified government network has probably stuck one of these CDs into their machine at some point.)

I want to know why the Feds aren't treating Sony like they would anyone else ... break into their offices, confiscate every single piece of electronics and CD in the place, and never give them back, ever (or at least, not until years after you've replaced everything).

Re:FBI? NSA? Homeland Security?

[SilverspurG]

Because we live in a democratically elected plutocracy.

By associating it with democracy, though, that makes it all better. We're all supposed to be happy that corporate profits supersede individual rights and property.

Re:FBI? NSA? Homeland Security?

[Guppy06]

"Why hasn't Sony been raided by the Feds, yet?"

Two words: campaign contributions.

Re:FBI? NSA? Homeland Security?

[OneFix at Work]

Someone in a secure/top secret/classified government network has probably stuck one of these CDs into their machine at some point.

No, they probably haven't. The kinds of machines that are in these secure environments are locked down big time...most don't even have a CD-ROM attached to the machine. The networks are closed (no direct internet access) and the machines with CD-ROMs/RWs have their lasers aligned differently so as to not be able to be read on a standard drive...one of the benifits of purposefuly misaligning the laser that writes the disks to be read in these machines is that you can't just insert a standard CD...

Yes, contrary to what the media would have you belive, the folks in secure/top-secret/classified government positions are not stupid...

buy second hand?

[speedfreak_5]

I'm a music nut. I've tried the boycott thing with mixed results. But what has "worked" for me lately is buying CDs and vinyl second hand. Unfortunately, They may already have the money from the original purchase of the music, but if you buy second hand, someone gets money and you get a CD or record and the RIAA partners get nothing.

Re:buy second hand?

[Anonymous Coward]

Personally I buy as straight from the artist as I can.

Buy your music from allofmp3.com, then send an envelope with three or four dollars in it to the band. Join the fan club or whatever. Can there be a better way? Look at all of the benefits:

1. Price. The net price will be far below what you'd pay for the CD. And if you decide the music sucks, just delete it and don't bother paying the band. You're only out ~$2.
2. Convenience. Buy music at 2 am in your underwear, listen to it in minutes.
3. Flexibility. No DRM and the music is already encoded in your choice of format at your choice of bitrate (including FLAC lossless, if you want).
4. Artists get paid. More than if you bought the CD, actually.
5. Labels don't get paid. Well, they do, but not much. Almost nothing, actually, and I think what they do get is a flat license fee that is independent of how much stuff allofmp3.com sells.

Really, the only downside is the possibility that you're supporting criminals in Russia. But the other alternatives are supporting criminals in LA, or not buying music at all. And the Russian criminals in question seem to be very fair businessmen. I was impressed to see that when they tell you you're paying two cents per MB, they in fact charge you exactly $.02 for every 1,048,576 (2^20) bytes, and they calculate it to the tenth of a penny and don't deduct it until you've successfully completed the download.

Re:buy second hand?

[mrchaotica]

But the other alternatives are supporting criminals in LA, or not buying music at all.

Using P2P is an alternative, too.

Boycotting Sony is a great idea...

[Dante333]

Now that I have already got GTA: Liberty City Stories for my PSP.

Re:PS3? No thanks, Sony; you screwed the pooch

[geekoid]

NOt to change your mind or anything, I would like to point out that at Sony's size, the different divisions have little or nothing to do with each other.
So the same people who make decisions for the music products are not the same people who make decisions at the playstation divisions .

From what I hear, there is some pretty intense inside fighting going on between the people who make mop3 players, and the music division.

The applicable phrase is...

[Engineer-Poet]

Hoist by their own petard (definition #1).

What do you bet that spyware/rootkits on music CDs disappear for the next few years?

They are still being weasels...

[Zocalo]

When the say "remove the rootkit CDs from the shelves" they mean just that; "rootkit CDs" specifically meaning those with "XCP-Aurora" installed and not with any other kind of DRM they are currently shipping. I wouldn't be at all surprised if they are even going to extend that to the specific version of "XCP-Aurora" people are complaining about on those CDs already known to contain it.

What a shame that Scott Adams' "Weasel Awards" for 2005 have already been awarded. There's always 2006 I suppose, but this will probably have been long since done and dusted by then... unless it's still churning though legal systems in the US and elsewhere of course.

Re:They are still being weasels...

[AltGrendel]

I like Userfriendly's take on it.

No Refund

[rozthepimp]

From Sony regarding the XCP CD received today in an email: Sony has already addressed the issue of the security concerns via the Service Pack 2 update on our website. According to the terms of the EULA that you agreed to when first installing our software, you agreed to obtain and install any recommended updates. All major security vendors have and Microsoft have announced that the installation of the SP2 update removes their concerns over the original technology used on our CDs. Sony BMG does not offer a refund/return program for this product.

Re:No Refund

[Intron]

All well and good? I downloaded Service Pack 2 and looked at it:

strings -n 5 Update071105.exe |more

1.2.1
  deflate 1.2.1 Copyright 1995-2003 Jean-loup Gailly

Then I went and took a look at the zlib site http://www.zlib.net/

"zlib 1.2.3

July 18, 2005

Version 1.2.3 eliminates potential security vulnerabilities in zlib 1.2.1 and 1.2.2, so all users of those versions should upgrade immediately."

Sounds like Sony needs to trot back and have a whole nother look at those "security concerns"

Silver Lining

[happymedium]

DRM is poised to intrude on our lives even more in the form of the HD-DVD/Blu-ray copy protection, Windows Vista, and the digital TV broadcast flag... isn't it about time Slashdot's least favorite acronym (besides SCO perhaps) got some bad mainstream press?

This Sony incident could help convince consumers and businesses alike that intrusive DRM is a bad idea.

Re:How to boycott? Website

[saskboy]

I just found the website claiming to lead the charge http://www.boycottsony.us/ in the boycott.

I've been including information I think is important about the Sony case on my blog too since the story broke, but other sites have much more detail. I just try to break it down so the average joe knows what's going on if their brain turns off at acronyms like DRM.

Isn't there a word ...

[Daniel Dvorkin]

... for a political maneuver where you first propose something so outrageous that it's sure to get shot down, and then withdraw the proposal and advance something only slightly less outrageous? Like, let's say Senator Boughtandpaidfor introduces a bill requiring the death penalty for anyone who cracks a copy-protected CD, and when that gets the desired uproar, he says, "Oh, okay, let's compromise and make it fifty years in prison instead" -- and that bill passes because it's more "reasonable."

Which makes me wonder what Sony's got coming next.

Re:Isn't there a word ...

[Fnkmaster]

It seems related to a behavioral finance effect calling anchoring, which I believe was part of Kahneman and Tversky's Nobel-winning work. From Wikipedia:

As a second example, according to Daniel Kahneman if an audience is asked firstly to memorise the last 4 digits of their social security number and then to estimate the number of physicians in New York the correlation between the two numbers is around 0.4--far beyond what would be expected by chance. The simple act of thinking of the first number strongly influences the second, even though there is no logical connection between them.

Basically, people often don't have any absolute framework for judging what is reasonable in a particular situation, so their mind subconsciously focuses or anchors on the first number they see, even if there is no rational basis or relationship between the number presented and the judgment call being asked for.

Re:Isn't there a word ...

[suwain_2]

I don't know the word you're looking for, but let's call it a Miers-Alito.

Oops.

[AWhiteFlame]

You know you screwed something up when Microsoft comes in and calls it a threat to the security of windows.

[OT] Re:How to boycott? mercantilism

[dada21]

I'm not Marxist, in fact, as an AnCap I am the opposite of an Marxist.

I'm not young (31) and have been writing from a pro-market anarchism persepective for over 8 years.

Roads, bridges and schools can be much better built, maintained and managed by the free market of competition than by the force/coercion market created by government and the cronies of government.

Lincoln's War Between States was fought to create a mercantilistic country out of a free market country (not slavery as many people believe). Since the War, our country has slid into a really bad Warfare-Welfare State, focused on disposing the middle class workers of their income and giving it to the wealthy elite in control of the monopolistic use of force.

I study at last 40 hours a week the various documents that help me reinforce the views I hold dear to me. Slashdot is a great outlet for finding other people with similar beliefs who just don't know it, as well as getting a great peer review system that helps me find my mistakes. Even those on my "Foe" list give me some amazing insight into mistakes I make in my rants and recommendations.

If you're interested in why government is bad for roads, bridges and schools send me an e-mail.

I vote we do

[guardiangod]

this....

Disclaimer: In case those lawyers from Sony is not being work to death right now from all those demage lawsuit- I am joking.

How about Criminal Charges.

[Anonymous Coward]

If practically every kid who cracks into some network gets jail time; how about some criminal charges against whomever the idiot in Sony that approved this.

Seriously - if some company hires a hitman to do illegal stuff they get in trouble. Why can Sony hack my network without any repercusions.

Wow

[realmolo]

Sony really screwed the pooch on this one.

They actually got the Department of Homeland Security to denounce them. I knew it had to be good for something ;)

The great thing about all of this is that now that the Feds are aware of this evil DRM bullshit, they will start regulating it a little better. As it stands now, the DMCA basically give all the media companies "carte blanche" with regards to copy-protection schemes.

Joe Random, hacker ..

[RedLaggedTeut]

Joe Random, hacker, reading slashdot:

rootkit.. bad
microsoft.. good
hacker.. head explodes

Criminal charges against Microsoft too.

[Anonymous Coward]

From TFA: "Microsoft said it would remove ... copy-protection software

That's a clear DMCA violation.

If DVD John gets in trouble for less, surely whomever at Microsoft decided to do this should suffer the same.

Re:Criminal charges against Microsoft too.

[vwp]

It doesn't say that Microsoft will be circumventing the copy protection software. Just removing it from the PC. The CDs in question will still be copy protected.

Nice try.

Re:Criminal charges against Microsoft too.

[frieko]

Removing the DRM from the computer means that the CD can then be easily copied by that computer. This is like saying DVD-shrink is DMCA kosher because it doesn't modify the original DVD.

Re:Criminal charges against Microsoft too.

[Surt]

Only if the copyright holder objects. Do you expect sony to object given the publicity in this case?

There will be no DMCA challenge of the titans based on this incident, unfortunately.

Re:Criminal charges against Microsoft too.

[harl]

The rootkit modifies Microsoft's product so that it no longer performs as they wrote it. Does the DMCA prevents them from changing their own product back to how they shipped it? That's seriously fucked up. This is a battle I'd love to see in court.

Re:Criminal charges against Microsoft too.

[TheLinuxSRC]

Actually, I believe if you read the articles closely, you will see that MS is not removing the DRM functionality of the software. A subtle but important distinction.

Re:Criminal charges against Microsoft too.

[Sloppy]

That's a clear DMCA violation.

No, it isn't. Sony's malware is not a "technological measure that effectively limits access" to the work, unless using their malware is required for accessing the work. That is, if you are able to play the music CD on a classic audio CD player, read the CD with cdparanoia, etc, then the CD simply doesn't really have access controls. The software in question is simply a bonus feature for MS Windows users, and only MS Windows users.

Still, it's a great idea, and your perverted thoughts make me like you. :-)

Re:Criminal charges against Microsoft too.

[Em Adespoton]

I believe you're confusing your DRM software -- the software you're talking about is by SunnComm, and those audio CDs are still being distributed by Sony. This software might have its own legal issues, but not in the same class as the Sony RootKit.

Re:Criminal charges against Microsoft too.

[hazem]

That would be the case for normal copyright infringement, which is a civil case. But doesn't the DMCA provide for criminal prosecution? In that case, the government could make a case against Microsoft for violating the DMCA by circumventing Sony's DRM system. It would be the US Government vs. Microsoft, not Sony vs. Microsoft.

If I assault you and put you in the hospital, the DA can still make a case against me, even if you don't want charges pressed. Of course, your refusal to participate weakens the DA's case.

Re:LGPL and/or GPL?

[LilWolf]

A bit of info about can be found here.

http://www.the-interweb.com/serendipity/index.php? /archives/52-Is-Sony-in-violation-of-the-LGPL-Part -II.html

Re:Hey Dan

[ryanr]

Yup, I thought I had finished reading the article, but I had gotten distracted and didn't read that far. My fault.

I was hoping that Dan had done some remote scanning. When I looked at the rootkit, I noticed that it registered a named pipe, which ought to be remotely reachable, and probably exploitable.

Buying CDs is unsafe...

[ncoder]

Download them from the net. It's much safer. ;)

Re:Buying CDs is unsafe...

[Anonymous Coward]

You jest. I've never downloaded a single song and I've always felt that while it wasn't criminal it was immoral.

I've changed my mind. Sony has destroyed any inhibitions I have against getting it for free from here on in. And I'm not kidding.

Re:PS3? No thanks, Sony; you screwed the pooch

[Guppy06]

"I would like to point out that at Sony's size, the different divisions have little or nothing to do with each other."

They're associated well enough to have the name "SONY" branded on them. Good enough for me.

Re:[OT] Re:How to boycott? mercantilism

[RsG]

>I study at last(sic) 40 hours a week the various documents that help me reinforce the views I hold dear to me. ...

Am I the only one who saw that as a disturbing statement? You spend 40 hours a week, which amounts to having a second job (I'm assuming that you're employed based on your previous statements) reinforcing your own point of view. I've met religious fanatics who don't spend that much time reading their religious scripture. Literally, you claim to be spending more time with whatever literature supports your views than a fundie does with a bible.

First off, if you wanted an informed opinion, wouldn't reading the opposition make more sense? If I want to know the full story about something, I find info from both sides, I don't just take the side I agree with as automatically infallable. Second, why the need to "reinforce" those things you already beleive? Sounds a bit too much like brainwashing for me - certainly if someone else was shoving their point of view down your throat that's the word I would use.

To kill DRM, make Joe Consumer Mad...

[Starker_Kull]

About the only way DRM will be tamed (I think, in the long run, it will be eliminated completely, but that will take people completely rethinking intellectual "property" as a lega concept) is if it intereferes or damages an average person's system. That is perhaps the biggest "problem" with DRM - its many failure modes usually screw you out of your content - or in this case, screw up your system. And it's a great, wonderful problem, because all we need are a few more screw-ups like this, and average people will start to associate "DRM" with "Sucks/Breaks" and avoid it like the plauge.

Go Sony! Do it again!

Quick!

[pegr]

They're yanking them from the shelves? Quick! Go get one so you can be harmed!*

(* "In a very real, and legally binding sense.")

Was the construction of this software illegal?

[threaded]

Was not the software used by Sony written by a UK limited company? Is not the commissioning and construction of such software illegal under UK law? (Computer Misuse Act 1990)

Re:Was the construction of this software illegal?

[NullProg]

Don't ask that question here. Ask your MP. I told my congress critter to either Drill ANWR or Sony, I don't care which :)

Enjoy,

Re:Was the construction of this software illegal?

[Tankko]

I told my congress critter to either

Problem is, your congressman has an email address that ends with @sony.com.

Re:What next?

[planetoid]

I'd prefer to see those responsible put behind bars, for at least two or three years. Every other virus writer, rootkit-using hacker, or other species of malicious computer-diseaser has gone to jail for the same crime -- there's no reason this should be treated any different.

Re:PS3? No thanks, Sony; you screwed the pooch

[Rude Turnip]

Let's look at this from the stockholder's point of view, as well as the customer's. If that type of conflict of interest exists between Sony's divisions, then that is telling me that management is *not* maximising shareholder value because the music division is harming the Playstation division by reducing the utility of the Playstation console.

That tells me that the only way to increase shareholder value is to break Sony into at least two companies: the entertainment division and the electronics division. Each division will then float on its own merits without impeding the other.

In a nutshell, we can add Sony's own *shareholders* to the list of people that are getting screwed by the management. My prediction? Look for a shareholder suit against the Board of Directors within 3 years to break Sony into two companies.

Where the hell were the anti-malware vendors?

[Daedala]

These CDs have been out since mid-2004, according to Sony. Why hasn't this been noticed? Were they all bought off?

This is what really disturbs me. Not "What was Sony thinking?" -- businesses can be really stupid. Not "How could they do this?" -- businesses can be really evil. Shit happens. Get over it. Bad security happens, whatever.

However, I did have some trust (not much, but some) for the anti-malware establishment. I'm in infosec; I believe that even in the biggest and stupidest infosec company, there will be people with the hackerish instincts (i.e. lower-than-average sense of self-preservation) to blow the whistle. However, the failure of all the big anti-whatever companies to notice and/or do anything about this, with full year of lead time, demonstrates that they are incompetent at best, unethical at worst.

I don't care, personally; I use a Mac. It's not a security panacea but it's a pretty darn good line of defense. Professionally, however, I feel downright ill.

Kudos to F-Secure and Sysinternals. Where the hell were the rest of them?

Re:Where the hell were the anti-malware vendors?

[bhima]

You should care, this affects us too! The Sony CDs have Mac Malware as well!

Perhaps it's time to install Clam (which I just did) and then call Jay Beale and ask him him how Bastille for OS X is coming along.

I have no idea, is there a malware app like addaware for OS X?

Re:Where the hell were the anti-malware vendors?

[tktk]

These CDs have been out since mid-2004, according to Sony. Why hasn't this been noticed? Were they all bought off?

Looking at the list of artists the DRM affects, I'm surprised it was noticed at all. Course, I am biased, I stopped regularly buying CD's about 10 years ago. Now I buy CD's only if I'm at a store, and really bored.

Re:Where the hell were the anti-malware vendors?

[Daedala]

The Sony Mac malware, as far as I can tell, required the user to look at the CD in Finder, double-click Start.app, and provide the administrator username and password. This is too much like work, especially since all I do with audio CDs is open iTunes, ping Gracenote (-- am pathetic traitor, conceded), and rip the CD to mp3. I doubt many Mac users go looking for the data track of an audio CD so they can install random unexplained Start.apps.

I may be wrong in my characterization of the Mac version. I haven't seen it. But that's what the interwebs tell me.

Quite the reverse

[Vainglorious Coward]

I would like to point out that at Sony's size, the different divisions have little or nothing to do with each other. So the same people who make decisions for the music products are not the same people who make decisions at the playstation divisions . From what I hear, there is some pretty intense inside fighting going on between the people who make mop3 players, and the music division.

That sounds to me like more reason to boycott, not less - the impact is not compartmentalised, but spreads across their entire business. It also gives ammunition to those on the inside who are fighting against the shenanigans. Sony need to get the message that their actions don't just do damage to their CD sales business, they also create a serious dent in the Sony "brand" as a whole.

Re:PS3? No thanks, Sony; you screwed the pooch

[anthonyclark]

I used to work at Sony back in the UK. The divisions are set up semi-autonomously, the thinking being that competition is good for innovation. Problem is, anything you think of that slightly invades the 'territory' of a more politically powerful division will be denied funding or just cancelled without explanation.

Bitter? Why yes I am, thank you for asking.

I worked project support for a great team of engineers who had some amazing ideas way ahead of their time. Can they use PS2 hardware? Write DVD related software? Other video related stuff? Nope. All because of inter-division competition. (I was intentionally vague on the those project descriptions) Then there's the snobby attitude towards software; once a project I worked on was forced to use a very expensive piece of hardware to do something they were already doing in software. Quelle Suprise, Sony couldn't sell the software and eventually the project was canned.

I really can't believe Sony has survived into the 21st century.

Half a million networks?

[NIK282000]

But the RIAA told me that because of file sharing no one bought new CDs any more. Im confused! ;)

Excellent

[Anonymous Brave Guy]

Blockquoth the AC:

That's a clear DMCA violation.

Let's hope so. With a bit of luck, this case will demonstrate the idiocy of both draconian copy protection mechanisms and draconian anti-copying laws. If it becomes Sony vs. Microsoft, there will be a big, high profile case with both sides sending zillions of lawyers at each other and zillions of lobbyists at the government, ultimately with no winning option for either side since any outcome will hurt their corporate interests in the longer term even as it protects them in the short term. The government can't suck up to both parties forever, and public opinion is bound to sway against things like the DMCA, DRM, and so on the longer it goes on.

Re:Excellent

[bizitch]

Great - now how do we lobby a district attorney to go after Sony?

Who's the doochebag that went after DVD Jon? - Lets melt his phone lines until he knuckles under!

Re:Excellent

[Em Adespoton]

Of course, this won't really matter, as the court case will go on for the next 30 years, by which point the outcome will be meaningless as various new bits of statute law will have already been created to deal with such situations. Eventually Sony and MSFT will only have one junior lawyer on the case each, and it won't be covered by popular media at all.

Re:Excellent

[Mad_Rain]

The government can't suck up to both parties forever

I believe you underestimate the federal government.

I agree! Throw the Sony execs in Jail!

[hpulley]

Why reserve jail for just script kiddies?

Luckily my tastes in music do not run parallel to the crap Sony pushes these days. I ran the rootkit remover and was pleased to see there was nothing to uninstall. But can I trust it? Hmm....

Phone Sony about the problem

[Anonymous Coward]

[...] with pitchforks in hand. Nevermind silly little boycotts.

Although I can quite understand your feeling, I think it's always wrong to resort to violence, and in my mind even to boycotts, if you haven't at least tried to talk to the other party.

According to the feedback page for Sony USA, you should call their Quality Management Department at 800-255-7514 (609-722-8224 in New Jersey) "if you believe a Sony Music product has a manufacturing defect".

I would seem reasonable to give them the courtesy of doing what they ask for, and phone them before doing anything else.

Re:Phone Sony about the problem

[swillden]

According to the feedback page for Sony USA, you should call their Quality Management Department at 800-255-7514 (609-722-8224 in New Jersey) "if you believe a Sony Music product has a manufacturing defect". I would seem reasonable to give them the courtesy of doing what they ask for, and phone them before doing anything else.

Yes, please call them.

Several times.

Per day.

Each.

:)

Re:Phone Sony about the problem

[TheUnknownCoder]

Well, you all know how Sony treats its (ex-)customers, and calling them will get you nowhere. So instead of calling or emailing Sony, contact the US Department of Justice , and demand an action against Sony. They have never charged a big corporation with a computer crime, but I believe that Sony should be the first one, and let it set an example.

Re:Phone Sony about the problem

[MrNiceguy_KS]

I just sent them off an email and I'll call tomorrow when the switchboard is open. I'm sure I'm not the only one. Just remember, be polite and reasonable, and if using email, read over your message before you send it. Don't scream that Sony execs should be shot, just point out that Sony is breaking computer crime laws by damaging the security of thousands of computers. Point out their use of a fraudulent EULA that implies their software can be uninstalled. Mention that, even though they have recalled the CDs in question, the crimes have already been commited.

I don't think it will help a whole lot if the DOJ gets 100,000 emails that all look like typical /. posts.

Re:Phone Sony about the problem

[iambarry]

I called 800 255-7514. Turns out its just an answering service. They refused to forward a message about defective CDs.

However, they gave me another number to call : 212 833-8000 .

Re:Phone Sony about the problem

[Anonymous Coward]

I, for one, have written the USDOJ and upon a little research have found someone that I will vote against in the next appropriate election: Orin Hatch. I live in Utah, and I hate to admit, I'm one of the people that voted for him last time but that was before I read this: http://www.wired.com/news/politics/0,1283,59305,00 .html

Yes, it is an old story, but he seems to be advocating what Sony has done. I only stumbled upon the article because I googled "Orin Hatch contact" to send a letter to him like I sent to the DOJ, but now I won't bother. As sick as I feel for voting for him in the first place, I a) will not make that mistake again and b) will tell everyone who will listen (especially those in Utah) how I feel about it.

Below is my letter to the DOJ. I urge others to write letters to whomever they feel would be appropriate. I hope this gets modded up enough for people to notice it and learn about Mr Hatch and his evil ideology.

JazzLad
(PS - Sorry I'm not logged in!)

**** Letter to DOJ follows ****

Dear Sir or Ma'am,

Thank you for taking the time to read my email. I know you are busy, so I will keep it brief. I am not a lawyer, politician, or any other important person, I am just a common ordinary American with a concern. I am concerned about the recent actions of Sony BMG. I do not feel that any corporation, regardless of their size, should be allowed to install 'back door' programs on my computer. I also believe that persons or corporations that do so should be sufficiently punished so as to deter them from attempting the practice in the future. I am not after any money, I am merely maintaining my privacy. Further, this particular case frightens me to the extent that terrorists can use the back door (http://antivirus.about.com/od/virusdescriptions/p /sonystinx.htm) to use my computer (and other computers) to plan attacks, communicate and other things that I honestly do not want to think about. I am a careful computer user. I do not download email attachments. I do everything in my power to not have software installed on my computer that could be bad. I thought I could trust a company as large as Sony.

Please help a powerless citizen send a message. Please use your power to keep my computer safe. I am but one person, but my situation is shared by millions of fellow Americans.

I sincerely thank you for your time.

[signed with my name, address and phone number]

Re:Phone Sony about the problem

[mckennage]

I hope Sony feels the pain on this one. Maximum damage.

Here are a few ideas:
1. Spread the word: tell friends, post in your blog, etc.
2. Boycott Sony products: no PS3, no PSP.
3. Legal retribution: file criminal charges, lawsuits, etc.
4. Warn customers and vendors: rate Amazon products, notify the BBB, etc.
5. Warn the artists: tell them they are losing your purchase and why
6. Notify Sony: call, write, and email to complain

I've written up more details at http://henage.net/dan/security/sony-rootkit.html

So what's your point?

[Eric Damron]

That we can't hurt Sony by witholding our money so we shouldn't even try?

If you don't think a boycott is the way to go maybe suggesting something that you think will make a difference would be a good idea.

Way to shoot yourself in the foot, Sony!

[atomic_toaster]

Okay, I've fallen for your lines about downloading and not paying for mp3's "taking money away from artists", that downloading is illegal and immoral and God knows what else. Or maybe I've just gotten tired of trying to find a good copy of a song online. Or I might simply prefer to have a high-quality copy of my favorite album(s) so that, if for some reason my computer should crash, I can convert a new copy to MP3 and lose nothing but a little time.

For whatever reason, I buy one of your CD's, pay the $18 CAD or thereabouts for a new release. But this is the computer age, I don't even own a stereo, so I want to play the CD on my computer.

The first thing I notice is that the CD is DRM-ed to death so it's a pain in the ass to convert the songs to MP3 format; so much for listening to the music that I've bought on my iPod. (If I live in Canada, I may have also paid for this music twice, once through the purchase of the CD, and a second time through the levy on my iPod as "blank media".) Oh yeah, and for some reason, neither iTunes nor Winamp will play the CD.

The second thing I notice (because who really reads the EULA?) while researching how to crack the DRM, is that, among other things, if my house is burgled I will have to delete all the mp3's from this disc. (Because, you know, a burglar would spend all that time copying the MP3's from my hard drive instead of stealing the whole damn computer. And man, if I own a laptop, they're just going to leave it on the desk and take my crappy TV instead...) Also, if I don't update the software whenever it prompts me to, I will lose all access to the music that I have purchased. And I can't listen to the music on a work computer, nor can I re-sell the CD that I have just purchased. WTF?

But then my system crashes, and some virus I can't get rid of keeps me from accessing all the data on my hard drives that I haven't backed up in ages (of course). And how did this virus get on my system? Through a root kit that the Sony CD installed without even telling me it was doing so, thank you very much. ...

Alright, Sony, now you've shot yourself in the foot. You've basically persuaded millions of CD buyers out there (you know, the people who were actually paying for your product?) that it's easier, safer, and plain old less annoying to yoink MP3's from thier favorite website or file-sharing program.

Way to go.

(Idiots.)

Re:PS3? No thanks, Sony; you screwed the pooch

[oGMo]

They're associated well enough to have the name "SONY" branded on them. Good enough for me.

Ah yes, broad generalization and stubborn ignorance, that'll solve the problem. Isn't that why they want DRM in the first place?

Why does Microsoft look so good here?

[spankaroo]

I don't fully understand why Microsoft comes off looking okay here. Why is it so easy to "patch Windows APIs" and override kernel operations? Why is this common practice? From the original SysInternals.com article: "Rootkits that hide files, directories and Registry keys can either execute in user mode by patching Windows APIs in each process that applications use to access those objects, or in kernel mode by intercepting the associated kernel-mode APIs. A common way to intercept kernel-mode application APIs is to patch the kernel's system service table"... Sony did it and didn't think it through - left some bugs, and generally made a lot of people angry and worried... but Microsoft is at the heart of the issue isn't it? Why is it so easy to patch these APIs? Isn't this all just a Microsoft security hole that allowed Sony to make another one?

Re:FBI? NSA? Homeland Security? BullSh***

[coinreturn]

The kinds of machines that are in these secure environments are locked down big time...most don't even have a CD-ROM attached to the machine. The networks are closed (no direct internet access) and the machines with CD-ROMs/RWs have their lasers aligned differently so as to not be able to be read on a standard drive...one of the benifits of purposefuly misaligning the laser that writes the disks to be read in these machines is that you can't just insert a standard CD... Yes, contrary to what the media would have you belive, the folks in secure/top-secret/classified government positions are not stupid...

All I can say is I am in the know with regard to such matters and you are so amazingly wrong it is unbelieveable. There may be EXTREMELY isolated cases of such Machiavellian security measures, but it has been my experience that music CDs are always making it into secured areas and being played on secure machines.

The most bizarre aspect to this story...

[anandamide]

Did anyone look at some of the titles they chose to infect with this thing?

Bob Brookmeyer - Bob Brookmeyer & Friends
Horace Silver - Silver?s Blue
Dexter Gordon - Manhattan Symphonie
Ahmed Jamal - The Legendary Okeh and Epic Recordings

Bob Brookmeyer???? Was Sony afraid of the cadre of L33t h4xx0r d00dz pirating their catalog of elderly jazz trombonists?

Has anyone filed a criminal complaint yet?

[Animats]

If you're a sysadmin cleaning this crap out of a big collection of computers, you're in a good position to file a criminal complaint with the Department of Justice. And you should. A crime has been committed.

Jennifer Granick, executive director of Stanford University's Center for Internet and Society, sees this as a question of how well written their EULA is, a topic of much conversation in the media lately.

But either way, she noted over IM, "if the EULA did not advise the user that s/he was installing software on the machine that would collect information and/or open the machine to vulnerabilities, then the software arguably violates 18 usc 1030(a)(5)(A)." That's a criminal charge. But Granick doesn't see criminal prosecution of Sony anytime soon.

"The (Department of Justice) is not going to charge Sony.... They have never charged a big corporation with a computer crime."

In order to invoke 18 USC 1030, you have to show $5,000 in damages or damage to a computer system used by or for a government entity in furtherance of the administration of justice, national defense or national security. That's another interesting point of Kaminsky's work, because it shows networks that are part of national security and civil infrastructure faithfully reporting their existance back to Sony, along with as yet unknown information about the compromised computers.

About that uninstaller

[kawika]

The Sony/XCP uninstall process requires you to fill out a web form that uses an ActiveX control. That control has several serious security issues including the ability to run arbitrary code and even a handy built-in reboot function. The ActiveX control gropes around your system and encrypts some information that is submitted in a hidden form field. Their privacy policy does not mention this.

Feel free to go over there and try it yourself. If you install the ActiveX you can remove it in Tools, Internet Options, Settings, View Objects, "CodeSupport Control". Here's what they send you:

From: contentprotectionhelp
Sent: Monday, November 14, 2005 04:22 AM
To: sony-bmg-sucks@invalid.com
Subject: Re: ContentProtectionHelp Email Form

Thank you for contacting Sony BMG Online.

Sony BMG and First 4 Internet have released a Service Pack 2a update that addresses recent concerns surrounding the cloaking technology component on SONY BMG content protected CDs which use XCP technology. These components are not malicious nor spyware however to alleviate any concerns that users may have about the program posing potential security vulnerabilities the update removes the cloaking component from their computers. Please visit the link below to install the SP2a update.

      http://updates.xcp-aurora.com/

If you do not want to install the SP2a update and only wish to uninstall the DRM software, visit the form below using IE 5.0 (or higher) from the computer where the software is installed. After submission, you will be emailed a customized uninstall link within 1 business day (M-F).

      http://cp.sonybmg.com/xcp/english/form9.html
      Your "Case ID" is: 9999999.

TIP: The uninstall request form will require an ActiveX plug-in.
                Also you may need to temporarily turn off any pop-up blocker
                software on the PC.

Thank you for the opportunity to be of assistance.

The Sony BMG Online Support Team
FKSZ

This message and any attachments are solely for the use of intended recipients. They may contain privileged and/or confidential information. If you are not the intended recipient, you are hereby notified that you received this email in error, and that any review, dissemination, distribution or copying of this email and any attachment is strictly prohibited. If you receive this email in error please contact the sender and delete the message and any attachments associated therewith from your computer. Your cooperation in this matter is appreciated.

- - - - -

Re:FBI? NSA? Homeland Security? BullSh***

[Jherek Carnelian]

All I can say is I am in the know with regard to such matters and you are so amazingly wrong it is unbelieveable. There may be EXTREMELY isolated cases of such Machiavellian security measures, but it has been my experience that music CDs are always making it into secured areas and being played on secure machines.

This guy is NOT a troll. He is far more correct than the GP is.

Re:PS3? No thanks, Sony; you screwed the pooch

[Guppy06]

The difference is that I don't have "pirate" stamped on my forehead. If Sony didn't want to milk its name recognition for every dime it's worth, they wouldn't have "SONY" written on everything they sell. Even if they didn't want to spin off their hardware division, they still could have followed Disney's example of "Touchstone," et al.

They want to make money on the Sony name, period. If there's going to be a consumer response, then the response should show the industry just what that "SONY" nameplate is worth.

Curiouser and curiouser...

[Thad Boyd]

Why, Microsoft is fighting this? Wow! Suddenly I find myself liking Microsoft much better than Sony! ... ... ...Say, what's this I hear about a major Microsoft product launch in a field dominated by Sony?

Sony CEO didn't support Bush in 2004

[Animats]

Sony isn't a Bush contributor. Here are the campaign contributions of Sony's CEO. He donated to Kerry and Hillary Clinton, but not Bush.

So Sony is in real trouble. Watch this turn into a criminal case.

A little harsh

[alanbs]

I have kept up with this saga of the Sony "root kit" and I think that the Slashdot-esque communities are reacting a little harshly to Sony.

I think that once people started referring to the software as a root kit, it really crossed the line to some degree because even though technically it might have been, it was not exactly malicious in the way other root kits are. Once tech zealots got up in arms about this, news media covered it and adopted the same terminology. Of course all readers of this media are not tech junkies so they require definitions for terminology, and I think that reporters who themselves are not techies cannot do justice to the situation when defining technical things.

Maybe this bit of trickery was deliberate, and well, I bet it was... I mean, not only is using a misleading discourse awesome, but it is also a blast to describe how to exploit systems with this "rootkit" and then even code up a proof of concept worm and let it free! After all, this is 1984 style, which is just wrong, so the end justifies the means, right guys, ... right?

Re:A little harsh

[Todd Knarr]

Robert Morris didn't intend his little worm program to spread as widely as it did, but none of the companies and universities whose networks were shut down by the Morris Worm in 1988 cared about intentions. They only cared about the fact that the worm killed their networks. When Sony's software starts playing games with my system I don't care what their intentions were, only what the results are.

That is what a rootkit does

[bluGill]

A rootkit is any set (which could be one) of software that an attacker uses to attack your (or other) computer and cover his tracks so you don't notice and cannot uninstall.

This meets both definitions. It covers it tracks, and it allows Sony to prevent you from ripping the disk.

A rootkit might include software to attack other computers, but the rootkit itself is whatever is used on YOUR computer AFTER it is cracked.

not a pooch, much bigger

[tomcres]

Sony didn't just screw the pooch, my friend.. this is more than that.. straight-up goatse!!

Where were Symantec, Microsoft, and McAfee ??

[softcoder]

It's all very well for the biggies to hop on the 'We will remove it' bandwagon now, but why weren't they the ones to discover it in the first place?
Groklaw has a nice essay on this, which reveals that these guys ALREADY KNEW what Sony was doing 8 months ago and turned a blind eye.
In fact the maker of the rootkit (UK company) is on record as saying they consulted with Symantec to make sure that their rootkit would not be classified as a virus.
The moral? The current PC/entertainment/gaming/recording industry is a scratch-my-back oligopoly.
Go for FREE(as in dom) SOFTWARE while you still have a choice.

As the news spread, check here often

[Puhase]

http://money.excite.com/jsp/qt/full.jsp?time=0&typ e=QT

This news story has really only begun to break onto mainstream media and just wait for it to hit the general public. I bet Sony cant wait to have regular Joe Schmoe think that when they buy a Sony CD, they are going to mess up and get a virus on their computer. And just before the Christmas season as well. Average consumers have no was to discern what the real problem was here, the concept of a "rootkit" would probably lead to potato or carrot issues, so they will just blanket Sony products with the "full of bad stuff" stigma. And then just wait for the sales #'s to come in after the Christmas season. This stock is going from bad to worse. Boycotts are fun, but when the guys who own $300 million in stock are getting screwed, then the fun really begins. Seppuku anyone?

Record Yet?

[Nom du Keyboard]

Are we at the record yet for most stories on consecutive days trashing the same company for the same beyond stupid bonehead move?

Or are we simply waiting for their current management to fall on their sword when the post bad-will boycott sales figures arrive?

My hope is that this will force companies to actually tell you what they've been able to hide behind the scenes and lawyers up to now.

Re:FBI? NSA? Homeland Security? BullSh***

[OneFix at Work]

You know, you're right...I don't know what got into me there...they would never do anything like that...

Always make sure your hardware is within standard civilian specs...wouldn't want to have problems reading that satellite data if you needed to run out to Wal-Mart and replace a drive would you?

What will work

[SuperKendall]

I also agree boycotts will not work. A major reason? Because there's no way Sony can measure what you are not buying. If you can get enough people not buying something it might work, but as the poster said that task is really impossible when it comes to Sony as a company.

So what will work:

Litigation. That's a great start because it costs them money they can count (legal fees) instead of four people not buying some Sony product. It looks like this might end up costing them big.

Harrass customer service. It is not as effective but if a lot of people start consuming customer service with calls, again this costs them a measureable amount of money and also makes the VP in charge of customer service very angry. You want angry people at the same level in the company as the ones who are putting in things like the rootkit.

The main goal in all this should be to try and make a public example of Sony so that other companies do not do the same thing, and Sony themselves will not want to try again for quite some time.

Re:What will work

[SoCalChris]

Harrass customer service. It is not as effective but if a lot of people start consuming customer service with calls, again this costs them a measureable amount of money and also makes the VP in charge of customer service very angry. You want angry people at the same level in the company as the ones who are putting in things like the rootkit.

I work for a company that writes software for call centers. Customer support calls cost an average of $3-$30 per call for a company. Lots of upset customers add up quickly.

Even better

[upside]

Don't just wait for something like this to happen, make it so. I think the Sony rootkit debacle has produced enough media coverage to get support for some countermeasures. It's time to start putting through laws along the lines of:

- Ban proactive DRM measures on content media. Permit encryption of data but ban executables on media that are supposed to be plain content.

- DRM measures, either hardware or software, on general purpose playback systems (home computers, DVD players etc) may not hinder the playback of non-DRM content.

- Create a labelling scheme, either mandatory or otherwise, for digital content that clearly tells the customer if the product
1) Is encrypted or DRM'd
2) Contains executables
3) Requires registration
4) Requires an Internet connection
5) Requires payment beyond the purchase price
6) Calls home, and what it does

Comments welcome.

Re:How to boycott? Website

[StarsAreAlsoFire]

acronyms like DRM

Digital Restrictions Managment.

Blame it on MSFT

[n6kuy]

for making it possible for Sony to do this in the first place.

How do these "CD"s play in a normal CD player, or do they?

I was pissed off at first when my SysAdmin disabled autorun on my new XP box, but now I am enlightened.

For me, it's a trust issue...

[DigitalJeremy]

...and I don't trust Sony anymore...that's for sure.

Now...with all the DRM crap etc about...why should I buy music from a big retailer such as Sony/BMG? I mean, OTHER than to support the artist(s).

I want my money to support the artist's music I buy...but not like this. I don't want to support Sony or any other recording industry giant's "protective" measures.

This is the digital age...we are all equals here. Meaning, it's relatively easy (at least in recent history) to DUPLICATE those zeros and ones on a CD (or DVD for that matter). Yet Microsoft befuddles the issue with DRM, and Sony causes worldwide loss of faith with a rootkit.

Trust? /me doesn't.

I'm not advocating piracy...I'm just saying it's far EASIER (and now...safer) to find and play that MP3 than any of the "legit" *cough cough* alternatives.

I truly would like to see a less corporate model, in which the artist gets paid more fairly, and where artist and fan have a better relationship.

Confidential, Secret, Top Secret, SAR, Intel, etc.

[AKAJack]

or blah, blah, blah.

It's been over ten years since i've been in that business, but i'd be seriously surprised if there were locally mountable devices, or even ports (USB, etc) on TS machines. We had no floppy drives and removable hard drives in our Secret machines, plus they were all tempest hardened, plus in lockable cabinets (those who know, know what i mean). We only had a few areas where we could even work on TS docs, much less create them from scratch. Having a CD drive (even read only) seems like something a security officer would have jumped on as a "duh" very early on in any project. If you needed a CD it would be mounted as a share to a server in the "vault" and you would be granted access to it for the time you needed it. No personal electrical devices were allowed in any way, shape, or form so no radios, CD players, etc.

I suppose if a contractor was lax this could all take place, someone could use the document blender to make margaritas, but in my experience there was no way to just pop in some disk or attach a device. I mean we didn't even have printers! They were locked up in the vault also and you had to sign for the number of pages you printed! This was just a SECRET rated facility (o.k., Secret with SAR, I'll give you that much). So be realistic. I could take CDs in all day long but they were only good as drink coasters.

Sony also accused of price-fixing in Britain

[paj1234]

It's an even worse day to be Sony, in the UK. Today's newspapers have headlines like "Sony accused of Internet rip-off" and "End to online bargains as Sony forces prices higher".

According to The Times, "the practice of charging different prices to Internet retailers and high street stockists -- known as dual pricing -- was started by Sony and has been followed by other manufacturers." Here's the article:

http://www.timesonline.co.uk/article/0,,2-1872549, 00.html

I love it..

[bmantz65]

In order to circumvent piracy, they try to be sneaky and put this rootkit garbage on people's PC's whenever they PAY for the CD. Now they just got in a bigger mess and the result is that if you wanted to the "right" thing and buy a CD, you're at bigger risk if you wanted to download it. Hilarious.

Not just Van Zants

[whitehatlurker]

The random sampling of copy protected CDs I just did on amazon shows a large number of similar messages. The word is getting out.

I wonder if the backlash will be enough for all artists to do what the Flecktones did:
"Frustrated when he bought a copy-protected Dave Matthews release and couldn't copy it to his Apple iPod, Fleck insisted that Sony not release his new album with such restrictions"

*plink* *plink* my $0.02

[Tsiangkun]

People infected with a rootkit should be re-imbursed from Sony Music for the cost of the removal service, provided by whom ever the person chooses to use to remove the kit.

  Rootkits are designed to avoid detection, and only an idiot would trust a company destributing rootkits to provide them with software to remove the rootkit. For all I know, they just changed the cloaking mechanism, and left the machine vulnerable to attacks, still running the rootkit.

  Shouldn't Sony pay the cost of having machines backed up, wiping and formating of the drives, re-install of the OS, re-install of the software, re-configure the software, and reimbursement for the time and productivity lost in the process.

  Right now the whole thing is being treated like a childish goof up and a big oops. Sony has installed rootkits, on personal machines and corporate equipment, and they should be paying for the equipment to be restored as deemed necessary by the owner. Simply giving a link to a download that claims to remove the rootkit is entirely insufficient.

Re:PS3? No thanks, Sony; you screwed the pooch

[swillden]

I would like to point out that at Sony's size, the different divisions have little or nothing to do with each other.

Irrelevant.

Not that the people working in the other divisions, who didn't make such stupid decisions, deserve to be punished, but the way to stop companies from doing crap like this is to hit them where it will hurt the top-level decisionmakers: their stock price. To do that, you have to damage their profits, and the best way to do *that* is to decrease their revenues by not buying their stuff. If Sony's stock takes a 20% drop as a result of some decisions by the entertainment division, the C-level execs will take action, and if they don't then the board of directors will, and if *they* don't, the stockholders will. If it gets nasty enough, no one in Sony will ever again dare to do something that has even the remotest possibility of bringing that sort of shitstorm down on their heads.

Not that I believe a lot of "boycott Sony" shouting and posturing on slashdot will really affect their revenues noticeably, much less their stock price. But still, the theory is sound, even if follow-through is insufficiently widespread to make any difference.

Word of mouth ain't trivial

[loose_cannon_gamer]

Just had to jump on here for a minute... Many of the posts today are what we, the 'enraged geeks of society' should do about Sony's practices. Might I suggest one -- post on slashdot.

You laugh, but I call a recent article on Tom's Hardware into witness. The reason that the graphics card companies (nVidia, ATI) go so intensely after that performance crown is that the people who care deeply about it tend to be influencers -- I think the article claimed something like those graphics card companies can be assured of 20 mainstream target purchases due to the influence of one high-end customer.

Point being, people here care, and deeply, about the stuff Sony has been up to, and in many of these markets, *we* are the influencers.

If your company gets bad press on Slashdot, and you do technology, that's not just bad, that's very very bad, because for every post and every reader, there may well be 20 or more people who are going to stop doing business with you. And if you get repeated bad articles, over and over again, well, golly. This is only worse when there is a choice in the market, and for almost everything Sony makes, somebody else makes something like it.

How about an OS that just plays a music CD

[RichMan]

If the CD is a valid music CD and will play in a standard player,

Why is the operating system trying to run a program from the CD?

You should be able to set the OS to treat music CD's as music CD's and ignore any other content.

This is all due to MS advanced features messing the user over. Pressure should also be placed on Microsoft to treat music CDs as music CDs.

Perhaps a configuration to easily switch between
1. Play Music
2. Access any Autorun features
3. Offer option of 1 or 2

Re:How about an OS that just plays a music CD

[AFCArchvile]

One now-odious trend that was started around 1995 was the "Enhanced CD", which was a multisession music CD with a primary redbook music session, and a data session that would be recognized as a CD-ROM when inserted into multisession-capable CD-ROM drives. I'm not that versed in how Enhanced CD tells the computer to recognize the data session, but I do know that the CD-ROM drive must be multisession capable (every drive after about 1996 is capable). When you inserted the CD into a Windows 95 computer, the data session would be loaded, and whatever was scripted in AUTORUN.INF would run. I'm inclined to believe that Microsoft had a hand in this by creating autorun, as that would not only make installing software easier, but would create the impression of a hands-free multimedia experience for all the luddites. Some Enhanced CDs contained things like music videos, movie cast interviews, and so on, but much more of this was devoted to promotional advertising.

One other way to have music and data on the same disc was to have a "mixed-mode CD", which would have track 1 as the data and tracks 2-99 as music. Many PC games from 1996 onward did this, as having the CD play presented less CPU overhead than WAV/MP3/MOD music, and sounded better and more consistent from system to system than MIDI. Of course, these CDs ended up having track 1 used for data, which would sound like either silence or noise when played on a regular CD player, depending on whether the CD player would screen out the data track as noise.

When the copy protection rush started to develop, music companies used the multisession hole combined with AUTORUN.INF in Windows to present "media players" that would obscure the music track and force the user to agree to a EULA and load some proprietary player to play less-than-CD-quality tracks with a monitored player that would phone home. When combined with a non-redbook CD-audio track that had spurious errors injected, this provided the "ultimate unrippable CD". Well, throw in Linux and Mac users either getting around the autorun hole or having their systems crash due to the protection, along with consumer outrage at not being able to play the "spurious error" CDs in any multi-speed CD player, along with this new debacle, and you have a big conundrum.

Apple's OS X already has an option to show all sessions on a CD as different CD icons when a disc is loaded. Microsoft still hasn't done anything like this for Windows, nor have they considered ditching the security vulnerability that is Autorun.

If I remember correctly, Macromedia was responsible for the whole "Enhanced CD" craze.

Italian criminal probe requested

[VENONA]

It's widely published that legal actions have begun in California, New York, and Italy. The Italian situation is not just some class-action lawsuit. A complaint was filed with a criminal investigation unit last Friday.

"The complaint alleges that XCP violates a number of Italy's computer security laws by causing damage to users' systems and by acting in the same way as malicious software, according to Andrea Monti, chairman of the ALCEI-EFI. "What Sony did qualifies as a criminal offense under Italian law," he said in an e-mail interview.

Should police determine that a crime has been committed, prosecutors will be required to begin criminal proceedings against Sony, Monti said."

Sony has declined to comment.

From:
http://www.computerworld.com/securitytopics/securi ty/story/0,10801,106064,00.html?source=NLT_PM&nid= 106064

"Bad Guy" paradigm shift?

[merc]

I have noticed one aspect from all of this Sony/BMG rootkit fallout that seems to have gone unnoticed; but which I believe is a positive thing:

Up until now the RIAA trade group has been the front-man for all of the label cartels' untenable activities -- it's never been BMG, Geffen, Warner Brothers, Universal, EMI, et al, suing 12 year old girls and old ladies--noo, it's the RIAA.

Up until now whenever the consuming masses are outraged, all they have to derive their seering hatred towards is a large anonymous trade association which exists purely to absorb all of that yucky malevolent P.R.

Finally the pressure is being put on a specific corporate entity who happens to also be an RIAA member, and they will feel the wrath directly. It couldn't happen to a better company (well... okay, perhaps EMI; Bronfman is a real chode smacker).

<ConspiracyTheory>

[Tim U.]

1. MS pays the Sony DRM people to include gaping security holes.
2. MS makes sure the story on the holes breaks.
3. MS has their cronies post "boycott PS3" on Amazon, Slashdot, blogs, etc.
4. People decide to buy the XBox 360 instead of waiting for the PS3.
</ConspiracyTheory>

Re:PS3? No thanks, Sony; you screwed the pooch

[Guppy06]

"Ah yes. An AMERICAN."

Somebody from Texas does something you don't like. Abroad, everything from Texas or New York or even Saipan is only labelled "made in the USA." Additionally, federal taxes collected from businesses in New York still benefit those folks in Texas.

Now, would you like to go even further out of your way in the course of your boycott to make sure that you only penalize those businesses from Texas, or do you want to make sure that everybody in the US, regardless of what state they're in, is penalized for allowing Texas to do what it does and helping them to do it?

Just because there are times when you should ask whether the scalpel or the chainsaw is the best tool to use doesn't mean the chainsaw is always the wrong choice.

I'm off the Sony sauce

[CharimanMeow]

I've had a Vaio for years and loved it. I may be a rare breed in this regard. Because of my experiance with this computer, I've bought a lot of other Sony products. No more. They lost me. The next laptop I get will not be a Sony, the same goes for cameras, music, etc. Man, it seemed like they were just beginnnig to get their act together...then this.

Re:PS3? No thanks, Sony; you screwed the pooch

[aztektum]

Last I checked the PS3 is going to ship with Blu-Ray which is filled with its own DRM restrictions, so essentially his "broad generalization" is fairly accurate IMO.

So who's really breaking the law here?

[C0D3X]

So isn't Microsoft violating the law by removing the Sony copy protection software, even though it's buggy and poses a security threat? Even though their intentions are good?

Should it be a violation of law to circumvent such copy protection schemes, even though they are harmful to the user?
It's still copy protection software, and they're still removing it.

Of course I don't think Sony would take Microsoft to court over this since they put themselves in such a bad position -- it would make them look twice as bad.

I think we finally found the missing link:

1. Sell a CD with copy protection / spyware or virus in one program
2. Antivirus will remove the program, circumventing the copyright measure and therefore breaking the law
3. Sue the antivirus maker for the huge loss of billions of dollars (per second) and the awful personal damages from such a terrible disaster.
4. PROFIT!!!

We Need to Start a Programmers Guild

[slarrg]

As a programmer, I have felt for quite some time that we need to have a "Programmers Guild" similar to the guilds of Medieval times. In the guilds of yore, the professionals of a craft actively monitored the products of other craftsmen and would punish/train/certify those who performed the craft badly. It has always bothered me that the most inept programmers continue to find work in our industry. Sadly, the only people in the industry who seem capable of evaluating a programmer's ability is other good programmers. The people responsible for this crappy code should simply not be allowed to work as programmers ever again. Instead these people will have a resume that proudly proclaims, "Worked to create high quality software with millions of users for Sony," and the managers they interview with will be quite impressed and put them in charge of more programming projects. For the sake of our craft, we desperately need to create a software programmers' guild.

Nice?

[Snaller]

So if I first hit you with a hammer - and then *stop*, I'm nice?

Re:artists properly compensated?

[Em Adespoton]

It's called a Cartel. Just like the diamond merchants do everything they can to restrict the injection of "other" diamonds into the marketplace, RIAA companies restrict the airplay and venues available to new artists. This means that in most cases, if you want to make a living off of your music, you have to sign with an RIAA member, in order to get the startup financing, airplay, and venues that are generally required to become popular. Most artists eventually give up and sign, even if they don't like the conditions of the contract.

However, with the advent of internet-based human networking (IM, blogs, etc.), this is starting to change. You still can't get the old airplay and venues, but it is now affordable to distribute your music over the internet, using word of mouth to increase demand. Similarly, you might not be able to book the good venues, but with blogs etc., people can find the alternative venues that don't get ad-time in newspapers, on the radio, or on TV.

So in summary, artists often are victims, but with the new technologies of the last 10 years, more and more artists are able to emancipate themselves and survive.

Why Microsoft will do this

[Dragoonmac]

3 words
HD-DVD vs. Blue-Ray

Why else would Microsoft violate copyright law when they're already in Anti-trust hot water? Because it makes them look like friggen Angels when compared to Sony. With people boycotting sony product, and two different data formats pending, HD-DVD, from the company that doesn't put a rootkit on your PC is going to be a much more appealing bet.

REPORT THE CRIME

[spoonist]

I know I'm jumping in WAY late in this conversation, but if just a few people see this and respond, it'll do some good.

Go to the following sites and complain:

Department of Homeland Security - Select "Security Threats"

US Secret Service - They do computer fraud cases.

FBI

That's because one (or maybe more)of them is lying

[Sycraft-fu]

I'm sure there are people who post on Slashdot who really have worked in facilities doing classified work. Hell the guy who sits across from me at work was cleard TS/SCI when he was in teh Ariforce years ago, and one of our student employees actually has active secret clearence for his internship.

However, for every person on here who legitmately knwos what they are talking about, you have someone who's just making shit up. They want to appear "in the know" and believe they really know how it is, because they heard a story somewhere or something like that. However in the retelling, they pretend like it was them, because of course it makes them seem to be more knowledgable on the topic.

I've had lots of people tell me how things work in regards to secret data, however most of the people doing the telling, I know for a fact have never worked in such a facility. So what they are saying may be based entirely on fiction.

As always, take what you hear on Slashdot with a grain of salt.

Don't expect a DMCA case

[AngryNick]

Sony will choose to ignore this violation of their DMCA rights. What's funny is that, assuming M$ offers the removal tool to all Windows users (as opposed to secretly whacking the rootkit with the next SP), then the users will be in violation of the Sony EULA...the same EULA that says you must delete the licensed materials from your computer if you declare bankruptcy or fail to install updates to the rootkit(see Article 9, paragraphs 2 and 3).

New sig:
--
Days since my last Sony purchase: 602

Re:Don't expect a DMCA case

[Al Dimond]

IANAL but I'm betting the EULA would be struck down as unenforceable. Of couse, that would only happen if Sony tried to enforce it, and Sony seems to be in full retreat mode over this whole fiasco right now.

This is simply the Sony Business model

[seabreezemm]

This type of tactic that was used with this virus ware is nothing new for Sony. It wasn't a simple mistake or an accident or simple bad judgment. Sony has a long history of this type of strong arm tactics in almost every branch of the company. Another example in particular is the SOE entertainment branch that runs Everquest and Everquest 2. Throughout the game of Everquest Sony placed spyware on machines in a form that captured user specifics about their computers, connections, and names, credit card information and other personal data. When confronted about this collection of information on the Everquest players they quickly turned tail and ran into the legal jungle of vague response and said it was needed to properly manage the game environment and accounts. This of course was complete garbage. It was a campaign to collect, sell and profit from this data. To this day that data collection continues according to the very EULA they force you to agree too in order to play any of the games they now operate. Not only did Sony collect data and lie about its purpose but they also actively engaged tactics to force players into huge fees to simply be able to allow the players to be able to sell the very software they had already purchased. This is just one of more then 20 easy to find examples of Sony's business model that exploits abuses and damages the public's security, welfare and privacy.

Re:This is not a rootkit.

[VENONA]

You are correct. It is not a rootkit. But not for the reason you stated. If it makes you feel any better, icydog and bluGill didn't get it right, either. The term is from Unix, and I'm a Unix/Linux security guy, so I'm going to stay in that context: what rootkit really means.

Say you've just rooted a system. In order, you want to 1) hide your presence, and 2) make sure you have a way back in if 1) fails.

To hide your presence, you do things like clean log files, and install Trojaned versions of various system tools, such as the 'ps' process lister and the 'ls' file lister. Maybe you don't stop with Trojans. Maybe you load kernel modules, and hook system calls. That isn't a requirement for a rootkit, though. It's a technique. Nor is it a requirement to include a replication mechanism, which would tend to give you away. This isn't a worm, it's a means of hiding yourself and maintaining access.

What you do on the system is then up to you. Maybe you're attempting to compromise other systems, but that's not a requirement, either. Maybe you only wanted this machine because it has huge disk capacity or something. Maybe you don't want it for anything at the moment, and are just checking it's resources and their usage patterns, to determine how you might best employ it in future, without revealing yourself.

Specific attack tools, etc., are not part of the definition, though you definitely have a means of hiding them. Or pretty much anything else. You have a way back in if the original security vulnerability is patched.

You are now the worst nightmare of many sysadmins of business and government installations (hosts + network). Many of these guys would actually much rather you did launch a worm or something. Then you're findable.

It gets much deeper than this (it's a career in itself)--but the two requirements are those above. Sony's DRM software didn't provide a way back in. It was a screwup of epic proportions, and the first piece of mallware (Backdoor.IRC.Synd.A) known to be leveraging it was found in a spam message on the 9th.

But that's an IRC backdoor, meaning the system will most likely become part of a Botnet. Again, easier to find. And, again, that remote access component is not part of Sony's DRM screwup.

I one or another /. post about this, someone recommended double-quoting rootkit. He or she was dead-on.

Publicly Acknowledge the Wrong and Fire the Exec

[Seraphnote]

Have they publicly acknowledged they did wrong?
Have they fired the executive who approved this idiocy?

Sony will need to do this if they ever want my business, my family's business, or my employer's business again. And this includes EVERYTHING SONY.

Why should a corporation who does this to their customers, have customers?

The more important question

[Nkwe]

While everyone is whining (rightly so) about what Sony has done, why is there not obvious and loud whining about what Microsoft has done? How come by simply inserting a disk into a CDROM drive, Windows will read the disk and automatically execute code as a privileged user? The Sony DRM stuff is evil and hooks into and hides at the kernel level. It is more evil that kernel level drivers are automatically installed by Windows by the mere insertion of media with no user interaction or confirmation. There is no excuse for this.

DMCA anyone?

[cryogenix]

I'm all for MS removing the rootkit, but doesn't Sony now have grounds to go after anyone that makes a tool to remove this under the DMCA? I suppose they could waive rights to it or such... I'm kind of hoping they do so that DMCA proponents can watch in horror as the worst of all possibilities come to fruition. Perhaps we can then look at getting rid of that legislative piece of trash.

Dear Sony

[Honkytonkwomen]

Dear Sony,

Please leave the DRM on the Ricky Martin and Celine Dion CDs. If you could make the DRM stronger so that they can't be played on ANY device, that would be even better.

Sincerely,

Everyone

This is Typical Sony

[SuperFuse2]

Sony has a habit of wanting to control everything. Betamax, Memory Sticks (manufactured exclusively by and for Sony), UMD, blue ray, the PSP, even the new PS3 will have the ability to control all of your media on the machine. The only thing they have learned over the years is that for new technologies to catch on, you do need the support of the other big dogs. What Sony recently learned is that they are going too far in their attempts to "control" their consumers.

Site with more than 20 infected titles

[MiliusXP]

I don't know if this site is serious, but they claim to have a list with more than 20 infected title. Here the link : http://www.idiotabroad.com/2005/11/cds-affected-by -the-sony-bmg-spyware/

apply black hat laws to sony?

[romerom]

Why shoudln't the same rules applied to black hat hackers who compromise and exploit the security of systems be applied towards sony executives? They should really make an example out of these guys so that other corporations and even spyware makers won't attempt anything like this EVER AGAIN.

Re:apply black hat laws to sony?

[GnarlyNome]

Do you honestly think that the same laws will be applied to Sony in the same way that the law would apply to you
Five dollars says that *no* sony executive will spend any time in jail

Re:FBI? NSA? Homeland Security? BullSh***

[Kaenneth]

I worked in a county office as a sysadmin, and while I didn't have detailed schematics for stealth bombers, I handled payroll/personnel data for jail guards, judges, prosecutors... I brought in my own music CD player even though I could have polayed them my machines CD-Rom, because I believed in keeping personal things out of government equipment. Now, thinking of other departments... Bus Schedules, you could phone in an listen to recorded bus schedules, something that messes with audio could hose that. The county hospital, people have died from bugs in radiology software, as well as patient records. Court records, crime Victim/witness information. Computer controlled sewage equipment...