President of RIAA Says Sony-BMG Did Nothing Wrong

Zellis writes "In a press conference held on Nov 18 Cary Sherman, the president of the RIAA, stated in reference to Sony BMG's "rootkit" software that "there is nothing unusual about technology being used to protect intellectual property." According to Sherman, the problem with Sony BMG's XCP DRM software was simply that "the technology they used contained a security vulnerability of which they were unaware". He goes on to praise Sony's "responsible" attitude in handling the problem, saying "how many times that software applications created the same problem? Lots. I wonder whether they've taken as aggressive steps as SonyBMG has when those vulnerabilities were discovered, or did they just post a patch on the Internet?" It seems that the latest spin is to portray the Sony rootkit as no more of an issue than a software coding error that unintentionally creates a security hole. Will they get away with it among the non-technical public?" Arguably, Sherman is right -- but I enjoy much more the fact that this whole r00tkit fiasco has set DRM back by years. Gogogo poor implementations!

Comments

Markets always trump cartels eventually

[dada21]

Sherman would be correct -- in a free market. Fortunately for us, those who rely on helping create freedom-reducing laws eventually find themselves violating their own creations.

The real dilemma for content creators was their inability to collude together on a newer standard to replace CD, and now it is too late. Wouldn't you be mad if your cartel couldn't react in time to new situations?

The simple fact that any audible signal can be recorded is important, yet the record companies still seem blind that they have a viable MP3 market because most consumers (with jobs) would rather pay $1 (with Jobs) than spend 20 minutes finding a song illegally or even bothering to rip their own CDs. I have more than a few friends who've rebought albums from iTunes that they own on CD. $10, to them, is worth the time.

Does the RIAA need to continue the "piracy is wrong" campaign? Yes! But that should be the limit. Let honest people know they're not reimbursing others for the content they pirate, and I believe you'll see people continue to pay. I believe people are generally good and moral (99% of the time even a thief acts in a good way).

Do record labels need copy protection and lawsuits? Not against consumers, not even the guy seeding a torrent to hundreds of others. They need to re-evaluate their market and see that people will pay and more people are becoming more technologically inclined so even at a lower price they can see bigger profits.

Nonetheless I don't think we need to worry about the RIAA or rootkits or whatever much longer. The new generation (10-16) of kids recording today are already using the next distribution system (PureVolume and MySpace). I know of a few young bands already making decent money selling very professional CDs by promoting their music online for free.

I'm starting to filter the RIAA news (at least mentally) since it isn't news to me. They had a great run of 70 years, and just like gaslamp lighters, their time has come.

RIP A CD, R.I.P. R.I.A.A.

Re:Markets always trump cartels eventually

[endemoniada]

You really hit the spot here. I, myself, have no problem supporting the artists by buying their albums and merchandise. I do, however, have a problem with not being able to give 1 cent to the artist, without HAVING to give $1 to the record company. THIS, ladies and gentlemen, is the theft we should all be discussing.

Re:Markets always trump cartels eventually

[Anonymous Coward]

20 minutes? I can find music for free online as fast (perhaps faster) than through iTunes. The technology on the other side has allowed very complete networks to form.

Re:Markets always trump cartels eventually

[CableModemSniper]

I have more than a few friends who've rebought albums from iTunes that they own on CD.

Come on. Ripping a CD is easier and less time consuming than buying the songs in iTMS. Stick the CD in, click a button vs. search for the artist or album in iTMS, and buy it. Plus theres no overhead with ripping the cd, atr some point you have to setup an iTMS account, your CC etc.

Re:Markets always trump cartels eventually

[Anonymous Coward]

Pretty obvious that the RIAA does not have a clue about technology, and don't even understand the ramifications of what they have done. Nor are they protecting the rights of their customers (which is going to be very few if they blunder like this again).
The scare tactic lawsuits that have been filed against users who DL a few songs on p2p is further proof of their uneducated and limited view of the the internet.

Re:Markets always trump cartels eventually

[Anonymous Coward]

"...spend 20 minutes finding a song illegally..."

You should try boadband!! It only takes about 20 seconds to find and download a song! :-)

Re:Markets always trump cartels eventually

[bigtrike]

If the music was free instead of $1 and just as convenient, most people would pick the free choice. If RIAA did nothing at all this is the situation they'd be in. Some of the early mp3 trading programs with centralized searches made it very fast and convenient. It took mere seconds to find and queue a song on Audiogalaxy, even if another user with the song was not online at the time. Some people would do the right thing, but I doubt the vast majority would.

Re:Markets always trump cartels eventually

[dada21]

I've seen 2 local bands forgo major label representation because of BAD contracts. Yet most big bands do sign bad deals.

I see a big reason for "major" labels, actually. I look at it as a co-op of bands that distribute the cost of production and marketing across hundreds of "talented" bands.

My problem is with the anti-freedom maneuvers of the labels. They corrupted radio rights, they helped destroy copyright, they subsidized the DMCA and they fostered anti-speech creations like Tipper's parental warning label and other bad ideas. I have no problem with stupid business tactics, it is when the law protects it that I'll call foul.

Re:Markets always trump cartels eventually

[rovingeyes]

I agree with mostly what you are trying to say, but let me ask you this - does the average person even know what RIAA is? I don't think so. Even some of the more technically inclined persons were asking me "what does RIAA stand for?" Now, I am not sure if that is very strange but I tend to believe that average Nascar Dad or Soccer mom don't care about RIAA let alone what Sherman thinks. In fact, most of these average Joes and Janes, I came across just know that there is a thing called virus and spyware thanks to AOL ads. Now we are throwing a lot of acronyms and technical terms like RIAA, rootkits etc. which will only confuse them. Within a month the mainstream media will forget about Sony DRM and they won't bother. RIAA will still be there in one form or other.

"Free market" is defined by the guys like RIAA, MPAA and all those lobbyists associations you or I probably haven't heard of and certainly not your average Joe six-pack. Thus my point is this - the playing field is already rigged in favor of these modern day cartels. May be its a little bit cynical view and I really am an optimistic guy, but I would be very surprised if it is not true. So my point is this - Free market ain't going to do anything to these "Cartels", unless something radically changes - like your average person worrying about these things other than things like missing an episode of Desperate Housewives.

Re:Markets always trump cartels eventually

[Dipster]

"how many times that software applications created the same problem?

The difference being that the users knowingly installed those applications and assumed the risk that comes with it.

Re:Markets always trump cartels eventually

[dunstan]

No, this is no more theft than is illegal copying. The whole conveyor belt of signing promising bands into hideously restrictive contracts with big labels is very bad, but it is not "theft".

The demise of the RIAA, as referred to in the parent article, is coming about because there is no longer any scarcity value in being able to copy and distribute recorded music. Lots of other things are happening: the public domain is now an effective reality. Public registers are now publicy available. As the printing press made scholarship available to the many, so we are now seeing the old oligopolies falling.

This is A Good Thing

Re:Markets always trump cartels eventually

[Anonymous Coward]

Does the RIAA need to continue the "piracy is wrong" campaign? Yes!

Not that it'll do any good, because they don't get it either.

There's a major anti-piracy poster campaign going on in my town right now. Apparently the reason I shouldn't pirate music and movies is that piracy funds organized crime and terrorism.

Clever guys, those terrorists, if they've figured out how to extract vast sums of money from free software like eMule and BitTorrent...

Re:Markets always trump cartels eventually

[endemoniada]

The thing is this, though... If I buy a record from , I don't want to pay for all the advertising going into . Since the record label barely put any money into releasing the unknown bands album, I'm essentially paying for the famous bands album even though I never bought it. I just find that uncomfortable.

Nowadays I only buy records and music-DVDs from artists websites, or webstores run by the musicians themselves. That way I know that _more_ of my money goes to the artist.

Re:Markets always trump cartels eventually

[dada21]

You're probably correct from a 1980 perspective but not from a 2010 one.

How many payola scandals happened over 50 years? 3 or 4? The recording cartel and the radio cartel only grew stronger. I'm firm in my belief that a rotten media cartel is to blame.

Where did all these colluding mercantilists get their power to rob from? The U.S. government, of course. We can't turn back the clock, but it looks like we won't have to.

Every media company is in shambles. Last week's Black indictment is just the beginning as investors audit failing media companies. Congress' powerful arm is dying and the next generation won't even remember it.

That is the light at the end of the tunnel. Our parents didn't know of the recording industry cartel, but supported them financially. Our kids won't know about it because the Internet was the breaking of the levee holding back our rights. Copyright is dying, new methods to earn money will appear.

When I call for the end of copyright, people say that creation would die if the artist couldn't protect their income. How much do artists today get from the cartels? Nearly 0. Thanks to copyright and those who "own" that right.

Re:Markets always trump cartels eventually

[carlos_benj]

Pretty obvious that the RIAA does not have a clue about technology, and don't even understand the ramifications of what they have done. Nor are they protecting the rights of their customers (which is going to be very few if they blunder like this again).

You're confusing Sony and RIAA. RIAA's customers are Sony and the other recording companies. RIAA is defending their customer here....

Re:Markets always trump cartels eventually

[Scruffeh]

Although I am in no way a fan of record companies or the way they work, this is a sad fact of capitalism rather than simply a problem with the record industry. It's the same if you buy dairy produce from a supermarket, clothes from most multinational companies or coffee from a coffee shop. You can pretty much be sure that the farmer or the guys in the factories are not receiving much money for what is essentially their product. At least successful artists are generally pretty much sorted financially, they are definately a lot better than people in far eastern factories who don't earn enough to eat properly.

Re:Markets always trump cartels eventually

[rolfwind]

Sherman would be correct -- in a free market. Fortunately for us, those who rely on helping create freedom-reducing laws eventually find themselves violating their own creations.

I don't see how installing a rootkit secretly has much to do in a free market or a monopoly. In either case, Sony's product went beyond the norm of what you expect a normal music CD to do - i.e. nothing - to your computer.

Re:Markets always trump cartels eventually

[kimvette]

For what it's worth, I think payola is going to die.

No, really. With the media consolidation what's to stop Sony, Capitol, etc. from buying up the radio stations? No payola necessary. The "DJ" (well. teleprompter reader really) will play the queued music from the satellite feed and announce them with a smile, or not keep his job. No payoffs required once the media consolidation process is complete.

There will still be an independent station here and there, but how much would you want to bet that the RIAA and Artist Rights Enforcement Corporation won't raise the licensing fees to air major labels' material once the consolidation of mainstream stations is complete?

Re:Markets always trump cartels eventually

[Androclese]

I'd much rather have the physical CD itself.

It all comes down to the sound quality.... something that the "iPod Generation" seems to have forgotten exists.

On top of that, what are you going to do when you lose your iPod? The CD is a hard copy of the music at the best quality you are able to get. With the CD you can rip down the MP3's to whatever quality you want to play on your laptop, etc., but you will still have that CD to play on your stereo.

If I had the choice between payign $12.00 for a CD with a few songs I might or might not like vs $1.00 a song for an MP3, I'll pick the CD every time.

...but then again, I'm old and not hip. I like to be able to hear the background noise created by John Bonham when he's playing the drums... I like to hear the humm of the tubes in the amp between riffs when SRV is playing "Little Wing". I still remember when Album's were released on those 12' discs with the grooves in them. You just can't get that with a commercial MP3.

Re:Markets always trump cartels eventually

[rizzo420]

there's a problem with the way you buy your records. do you really think that more of the money goes to the artist? is the artist really running the webstore or is the record label? think about that one...

for your parent's argument about major labels having a place... big bands do sign bad contracts all the time. why? advertising. they know they can get somewhere. think about that one. the beatles had a terrible contract, but they made more money afterwards when they did their own thing with apple records. a lot of the bigger bands today make their money through other means, not record sales. record sales means popularity, nothing more, nothing less. the more popular they are, the more poeple go to their concerts (where almost all the revenue goes to to the band). so far, the record labels haven't been able to touch concert revenue (don't you think they would've loved a chunk of the change bands like phish and the grateful dead made from touring alone?). the big label gets them advertisements, that's all (although phish and the dead became popular through word of mouth, the label just got them new fans).

Re:Markets always trump cartels eventually

[dkleinsc]

While I agree that the record company shouldn't be able to get a whole lot of my money, the following expenses need to get paid somehow:
* Artists
* Recording Engineer
* Studio space
* Any marketing outside of selling CDs at shows and such

(I'm probably leaving a few out here)
There are a lot of expenses other than just paying the musicians, and many of them have an effect on the resulting recording. In particular the recording engineering and mastering can do a lot to make a piece/song sound better.

Re:Markets always trump cartels eventually

[jadavis]

And didn't that Sony copy protection scheme violate a few copyrights itself?

Re:Markets always trump cartels eventually

[KinkoBlast]

So true... I wish I had mod points fore you.

Me thinks maybe we should focus our energy on helping those who are in a bad situation because of birht, not because they signed a nasty contract.

And for artists: Check out Magnatune, 50/50 profit split and you retain the rights to your music.

Re:Markets always trump cartels eventually

[dada21]

Yet in my research, farmers do pretty well (we have 5 independent farmers within a 15 minute d ive who net over $1M/year and they're not megacorps but family run). I've been to Asia and many "sweat shop" workers live better lives than all their neighbors combined. The Chinese poor workers save up to 60% of their earnings yet we want them to earn more?

Capitalism creates wealth, but the RIAA recording cartel is NOT capitalism. They are mercantilists -- companies using the monopoly of force of government against their competitors. Capitalism helps the poor and the buying minorities, mercantilism supports the elite.

Re:Markets always trump cartels eventually

[BrokenHalo]

Come on. Ripping a CD is easier and less time consuming than buying the songs in iTMS.

Agreed. And if you know what you're doing, you'll often get a better sounding compressed file.

An aside, though: in some countries (like here in Australia) copying any CD is still illegal, no matter what the purpose. Most of us ignore this, of course, but the law is the law, and if I must be a common criminal, then so be it. I'm certainly not going to pay twice for the same recording, except when buying extra copies of stuff I happen to like for gifts.

Re:Markets always trump cartels eventually

[kamapuaa]

I agree! And when I go to a ballgame, I want the money to go directly into the ballplayer's pockets. When I buy a beer, I want the money to go directly to the brewmeister. When I buy "A Catcher in the Rye," I want the money to go directly into J.D. Salinger's molest-a-schoolgirl fund.

What is this whole nonsense about contracts, anyway? It's all a bunch of theft!

Re:Markets always trump cartels eventually

[miller56]

Sony has a new media/digital living center that they are advertising for the Xmas holidays. From their website:

"Consolidate Your Media Library Finally, you can manage all your content - from personal photos and high-definition camcorder video, to downloaded movies and music, to recorded TV shows, to your CD and DVD collection, and more - from the comfort of your couch. With its 200-disc mega-changer, the XL1 Digital Living System(TM) boasts a whopping 1.7TB of CD and DVD disc storage that's easy to access and enjoy with the included remote control or wireless keyboard. It's the player you've been waiting for, and since it's also a PC, you're conveniently connected to the data that will let you keep track of your media and enjoy it to the fullest."

A recent review of this product in a PC World/Mag (one of those) said you could put your entire CD collection in it and set it to rip all your CDs to the hard drive automatically overnight! Except for Sony's own XCP CDs!

Re:Markets always trump cartels eventually

[j-turkey]

Free market ain't going to do anything to these "Cartels", unless something radically changes

You mean a radical change like...high quality recording equipment becoming cheaper, which will drive down the cost of studio time and thus drop the cost of album production? Another radical change that may help to flatten the marketplace is an Internet distribution model.

As far as I can tell, RIAA (and its member companies) do the following:

• Finance/oversee content production
• Finance/oversee content marketing
• Content distribution
• Fight IP violators
• Lobby for industry-favorable IP laws

Of these, the content production/marketing/distribution are the only parts of their profit chain. With studio time getting cheaper, and with home recording studios becoming a reality for the average hobbyist, RIAA's part in production is at risk. With an Internet marketplace, distribution is also at risk. Two out of three parts of RIAA's parofit chain are directly threatened. RIAA members are still able to market their product, and the indy marketplace doesn't have this down yet...especially because this is the part that takes money. RIAA/members may be able to use their marketing dollars to adapt to the new marketplace, but I (frankly) don't see these dinosaurs adapting. They have shown little adaptation to the Internet marketplace thus far.

Rather than adapting, RIAA has resisted, showing their sense of entitlement to a profit. Profits don't come from entitlement -- they come from innovation. If businesses want to sit on their laurels and watch the dollars roll in, they will be surpassed by the next guy, who is motivated to find a way in.

"Free market" is defined by the guys like RIAA, MPAA and all those lobbyists associations you or I probably haven't heard of and certainly not your average Joe six-pack.

So...they've got lobbying power. What's your point? Shouldn't businesses have the right to look after their interests (whether or not your agree with those interests)? I mean, if you can write your congressman, or have a group like the EFF or the ACLU trying to stop interests like the RIAA, why can't those groups do the same to protect what they view as their interests? I know that you never explicitly said it -- but you've implied that they shouldn't be able to do this. Is it because you think that they're wrong, or because they have more resources than you? IMO, yours is a defeatist attitude. Have you done anything to stop the RIAA's foray into legislature (like written your congress critters or donated to the EFF), or just accepted defeat and complain about it on slashdot?

Re:Markets always trump cartels eventually

[Znork]

The digital revolution has made it possible to make professional recordings for less than the price of a decent used car. Pretty much anyone who really wants to make them can make them, without a record company.

As far as marketing goes, marketing in a monopoly situation is a pure loss for the economy as a whole; you just get a marketing war over the same money, which means money that should be going elsewhere gets diverted. We dont have copyright to encourage the creation of the maximum amount of advertising.

The current situation where some record companies are wasting so much money they can barely get a profit out of platinum selling artists, when anyone able to sell a few thousand copies at the current price should be in the black, is the natural result of decades of monopoly. Once you have a monopoly there is no limit on how inefficient you can become.

Re:Markets always trump cartels eventually

[Alex P Keaton in da]

Wow- the problem isn't just that this is his opinion/view on the rootkit issue, the problem is that he is cocky or dumb enough to actually say it.
That just shows serious cockiness. I mean, sit with your employees and say dumb or evil or whatever things, but to say them in public? Stupid.

Re:Markets always trump cartels eventually

[endemoniada]

Yes, I do believe that THEY are running the webstore. Several of the bands I listen to run their own labels, and contract few, if any, other bands besides themselves. I also happen to know a few bands that follow this precise strategy. They sell lots of albums at their shows, and 100% of the money goes directly to them. No middleman, no excessive advertising (most of it is for free on the internet) and yet they almost make a living playing music.

If the RIAA are correct, how is this even possible? All RIAA wants is for artists to be dependant on record labels, so that they can cash in more money.

Think about it. If none of the money went to record labels, wouldn't the band be able to finance themselves? With the breakthrough of the internet, advertising is cheap, next to free. You can distribute music without even having to pay for the CD-materials! There is no reason we should give most of our money to record labels anymore. They're as extinct as dinosaurs, as far as I'm concerned. Couple all this with the fact that it's no longer a matter if whether people want to buy, or download. It's now a matter of whether people want to buy-and-also-get-their-computers-taken-over-withou t-having-any-knowledge-of-it, or download it.

Re:Markets always trump cartels eventually

[qmVSE*w!7e,QF(,]

I still remember when Album's were released on those 12' discs with the grooves in them.

Wow. I'm pretty old, but I have no recollection of 12 ft. discs.

Re:Markets always trump cartels eventually

[Microlith]

When I call for the end of copyright, people say that creation would die if the artist couldn't protect their income. How much do artists today get from the cartels? Nearly 0. Thanks to copyright and those who "own" that right.

When you call for the end of copyright you ignorantly assume that artists are never the ones who hold that copyright.

The problem is that those very companies that exploit copyright would be damn quick to turn around and exploit the work of others were there no copyright. Or maybe they'd just be cut off by the CD stamping companies, who'd churn out tons of copies of games, music, and movies at minimal expense to themselves but at full expense to the creators.

The simple fact is that the eliminiation of copyright wouldn't kill creation. It would, however, choke it to damn near a standstill, as the artists would be forced to work some other job and force their art to part-time hobby status.

While you may be fine with subjugating art like that, I'm sure the world is better off when people can focus on what they enjoy and have the means to do so.

Re:Markets always trump cartels eventually

[level_headed_midwest]

Hey, you guys are pretty good! Too bad the sound quality is pretty bad.

Re:Markets always trump cartels eventually

[dada21]

Yet this is a monopoly granted by license to borrow government's monopoly on force and coercion. The RIAA recording cartel wouldn't be a monopoly if they didn't know who to take care of first -- your representatives.

Re:Markets always trump cartels eventually

[Anonymous Coward]

" I've seen 2 local bands forgo major label representation because of BAD contracts. Yet most big bands do sign bad deals."

Thats simply a shame...I've seen too many bands sign bad deals as well (note: I worked in the industry for several years before deciding to go back to school). The fact of the matter is, contacts in the music industry like any other industry are supposed to represent give and take. When my university decided that some of my research was too valuable and took up their right to offer the 'standard' 50% ownership of viable IPs in return for funding my project (after deducting the cost of the office space, percentages of professors above me's salary and a dozen other deductions that would mean that I'd probably owe someone before I saw a single dime -- and the 'scholarship' they offered was included in this) -- I decided to shop the contract around and when my university balked at that, I took my first grant to a former professor now running the sponsored research program of his new school on the west coast. It was a small grant (under $50k) but it got the point across.

The next time I applied for a grant, I was given MUCH better negotiable terms by my university. Both schools are of the same size and stature, so I never had to woodshed in the 'minors' to get my way.

How does this relate to your local bands? At one point I was a signed musician. I think technically I still am and still in contact with my A&R guy who occasionally asks if I can assist on a project. When I was given the contract, I immediately went to a lawyer -- and not the one they suggested -- but not before I read everything myself and made a lot of notes. Almost all of this was common sense when reading this, and my laywer confirmed that most of my concerns were legitimate. The rest of my band signed their rights away immediately (and the label made it sound as though if I didn't sign at the same time, their contracts would be void). I wrote the songs even though I wasn't the lead man, so I had more at stake and didn't give a fuck about their concerns.

Guess what -- without a protest, most of my concerns were addressed and either ammended or stricken. As taught in High School law, contacts are about give and take and the record companies know this. If a stupid metal head or bimbo pop singer is willing to sign anything that it put in front of him or her, they deserve getting screwed on a bad contract. The labels are giving you a contract with everything they could legally hope to attain and nothing more. You should ask for everything you could legally attain and nothing more -- and then an agreement should be struck between the two. And I have no problem with anyone asking for as much as they can get because only an idiot would do so.

So your local bands forgoing major label representation -- so what? They should have hired an entertainment lawyer and had representation from management (starting off -- these should be two seperate items to make certain that no one is out solely for themselves).

Thats more than I wanted to say about the subject.

Re:Markets always trump cartels eventually

[baldass_newbie]

Wow. I'm pretty old, but I have no recollection of 12 ft. discs.

It was a REAL long time ago. Used flint instead of needles.

Re:Markets always trump cartels eventually

[OpenGLFan]

Then educate them. Predictably, large media outlets are also sitting on the story. The non-slashdot version, leaving out all the words a non-geek wouldn't know, would probably read: "Sony installed a virus on CDs that infects your computer when you try to play the CD. They did it on purpose to keep people from putting it on their MP3 players."

How much more basic can you get? But the story isn't out. Suing people for downloading music is only fair if we can prosecute Sony for attempting to hax0r everyone's computer. Do I believe it'll happen? I don't think I have that much faith left in the fairness of our system.

Re:Markets always trump cartels eventually

[budgenator]

Most farmer's are not prohibited by long-term contracts from other distribution channels. I can go to the farm, pick put a hog or beef, and it gets shipped to a packing house, a week later I pick up the meat all packaged and frozen. The farmer gets more by going arround the more commercial route, as does the packing house and I even get a good deal. With the record companies a band might sign a 3 album, exclusive contract and the label pulls the plug after the first and they're stuck owing the lable money, and two more albums that'll never get made.

Re:Markets always trump cartels eventually

[masdog]

Copyright isn't dying. The corporate media companies that use copyright as a whomping stick are. Well, maybe not dying, but afraid of their death.

The right for authors to protect their work can't die, otherwise photographers, authors, and musicians wouldn't be able to make an income off of their works.

Re:Markets always trump cartels eventually

[rizzo420]

i'm not arguing that record labels are needed, but advertising is not cheap in magazines (rolling stone for instance) or on TV/radio. unless you're a good band and can get enough grassroots advertisements (word of mouth, such as phish), you won't be known without the radio. yes, the internet helps greatly, but frankly, it's not enough to get really big.

the RIAA cashes in on record sales only (and the occasional merchandising contract). they don't get concert revenues. so once you use the RIAA for enough advertising and get good in your own right, you then get out of your contract (or whenever it's done) and record on your own and make money off of concert revenues. it's also not as easy to start your own label. nevermind the overhead costs of recording in the first place.

now i'm not a fan of the RIAA, mainly for over-charging and screwing the artists out of money they deserve. the RIAA should not be retaining rights to the music. They should only be taking in the overhead costs, plus a stipend for fronting the money in the first place. I'm, personally, a big fan of the CD and i prefer to have the actual media rather than audio files on my computer (frankly, i just like CD's and i like the packaging). i don't own an mp3 player, i don't have a use for one. i never used a walkman or discman (i had a discman with car adapter when i couldn't afford a new stereo for my car). I will have an issue if they move to 100% downloading and i have to go and burn the music to have it on CD (not to mention, for some reason, my CD player in my car won't play burned discs).

Re:Markets always trump cartels eventually

[poot_rootbeer]

The whole conveyor belt of signing promising bands into hideously restrictive contracts with big labels is very bad, but it is not "theft".

Correct. It is not theft, it is fraud.

Let's none of us pretend that the RIAA labels actually intend in good faith to pay out to the artists the amounts stipulated in their contracts. The promises their A&R flunkies make to artists about fame and fortune are lies. The contracts are unfair.

Re:Markets always trump cartels eventually

[schon]

the record companies still seem blind that they have a viable MP3 market because most consumers (with jobs) would rather pay $1 (with Jobs) than spend 20 minutes finding a song illegally or even bothering to rip their own CDs

The record cartel isn't blind - they see something that you don't: such a marketplace would open them up to competition, which would destroy their cartel.

Major record companies don't want the public to become accustomed to downloading music because it allows anyone to sell their music online. Their "piracy is bad" propaganda campaign is designed to make people equate "downloading" with "evil", so that people continue to purchase the shiny discs.

The *only* thing that record companies offer to the artists is global distribution, and they use that to screw artists out of every penny they can; the net effect of a record contract is that the record company gives the artist a loan at an effective 95% interest rate (they loan the money to the artist to make the record, then keep 95% of the sales, and take the repayment for the loan out of the artist's 5%.) What happens when the artists realize that they can get global exposure without the record labels? The end of the gravy-train.

Re:Markets always trump cartels eventually

[antiMStroll]

Not theft, a less attractive form of Indentured Servitude http://en.wikipedia.org/wiki/Indentured_servitude. At least in the traditional form the employee left free and clear of debt, too many acts end their careers still in debt to RIAA members.

Re:Markets always trump cartels eventually

[masklinn]

I've been to Asia and many "sweat shop" workers live better lives than all their neighbors combined.

Ah, the good ol' "other people have it even worse, why would you like your situation to be any better?", never ages uh?

And can be used for soo many things.

Hey, you only have AIDS while your neighbour has a cancer, you should feel lucky, now shut the fuck up

You only had bread for dinner? So what? Some people get only water, not even pure! You should feel lucky!

Stop whinning about the fact that a drunk driver hit you and you lost your leg, other people lose their lives in this kind of events, now be happy or I tear you a new one.

How the fuck does the existance of "worse" forgive "bad"?

Does the fact that Hitler killed 6 millions judes mean we should forgive the KKK for "only" killing a few hundred or thousand blacks?

Re:Markets always trump cartels eventually

[funk49]

I hate myself for saying this...defending the labels, but the reason why the labels get that $1 is they are the ones that put up the capital to develop (sic!) the artist. This includes recording, distribution, radio promotion, touring, etc. Granted that alot of the things I just mentioned get strapped back to the artist as a recoupable charges, but the label still goes out on a limb to put the cash into what they believe will make them money back.

The reason why labels are fighting the alternate distribution methods (Internet downloads, etc) is they don't have the vision to figure a way to stay in the game and see it as a huge threat. The digital model takes them of the distribution game altogether.

Re:Markets always trump cartels eventually

[AndersOSU]

Which points to a basic flaw in the labels business plans. If people aren't willing to pay for something, and there is an unlimited supply by nature it is ludicrous to try to sell it. Selling information is like selling bottled water. Sure it is possible, but you have to add value to the product, not sell something that is freely available.

Information is fundamentally different from other salable items. If I have a traditional commodity and I sell it you I no longer have that item. Even if I sell my expertise I have less time from studying your problem, and I am selling you something that isn't readily available. If I sell you information we then both posses the same information - the act of transferring the information increased the total supply of information. This might be ok for new information, but more the information is spread around the less valuable (monetarily) it is. Software is a rant unto itself, but short form - make your stuff good and cheap enough so that the genuine thing is more attractive than warez.

Copyrights make sense when they prevent another business from ripping off your work in order to turn a profit. They don't make sense when preventing copying hurts the publics access to this information. Books, journals, and magazines are likely to survive because there is value in having a hard copy. Making physical copies of a book cannot happen on the same scale as copying music, and it's not free. Publishers are also very careful about what they put on the net. Sure someone can go and do an OCR and put the full text of a book on the internet, but if nothing else eBooks have shown us that people don't like reading in front of their computer. Music labels will fail because the labels don't add anything useful anymore.

First and foremost the record labels are production companies. A record label provides three value adding services: Production, Promotion, and Distribution. Two of the three have since been rendered obsolete and devalued. Their business model is a relic, but one can hardly blame them for holding on with all their might. One can however blame the courts for propping up this corpse of business and sanctioning their draconian actions to stay alive.

The labels most viable option (in my opinion) is to restructure themselves away from the production/distribution side, and focus on what they are good at, advertising. I bet the labels can make a good bit of money even if they charge $5 per CD and allow unlimited copying. If they make a 10% of everything deal with the artist they stand to gain from putting on good shows, and getting the artists name out there. The radio companies seem all to eager to carry on their relationship with the labels, as does MTV. Sure they'll take a hit in gross profit, but that much seems inevitable anyway. Better to shrink offerings and overhead now while some kind of transition can be made, than floundering along with the status quo.

So what are the consequences? A few people will no longer be able to make a living providing no service, and music will have to stand on its merits, rather than becoming a sure hit if the record company throws enough money into it and gets the star a series on MTV. Personally, I'm ok with that.

BTW bands will still be ok, because their prime income generator - the concert - does add something consumers are willing to pay for.

Re:Markets always trump cartels eventually

[antiMStroll]

Record companies don't pay those expenses, the artists do. RIAA mambers simply loan them the money under oderous onditions then dictate how it's spent.

Re:Markets always trump cartels eventually

[IngramJames]

How much do artists today get from the cartels? Nearly 0.

Call me sceptical, but if that were the case, then nobody would earn any real money from making music. From the big cars being bought, I suspect that many artists make more than "nearly 0". A friend of a friend, who I run in to from time to time, had a top ten hit a few years back, and it still gets onto 90s compilation CDs. He bought a house with the initial return, and last time I saw him, he was still happily living off the earnings of that one record, while he messes around in a studio doing new stuff.

If there was no copyright law, he wouldn't have seen a single penny, because as soon as it got popular, nobody would have any obligation to pay him anything for distributing his music. Sure, he could have had a website from which people could pay him money to download his track. But without copyright, I could have a website that offered the track for free; and it could generate revenue through ads. Or a monthly membership free - all the music you can download for $5 per month. Bargain!

Getting rid of copyright isn't a solution; artists and consumers alike being aware that in the real world, there are sharks looking to rip you off with bad deals - now that's a solution.

Re:Markets always trump cartels eventually

[aztektum]

It would be nice if some of those artists whose cd's were infected with this crap would stick up for themselves. I saw Foo Fighters name on one list, don't tell me they couldn't get the word out. Besides it would be in their interests, to help mitigate the amount of fans who don't know better from thinking Foo Fighters support these shenanigans.

Re:Markets always trump cartels eventually

[blincoln]

The digital revolution has made it possible to make professional recordings for less than the price of a decent used car.

The tools are cheap, but the people who know how to use them properly aren't.

Being a proper recording engineer or producer is not a software package you can install on your PC.

Re:Markets always trump cartels eventually

[Alpha_Traveller]

I think it depends on how you look at it. If you don't stand up against bad business practices and bad business ideals -- attempting to get the law to protect you against it, you'll be left with raising your voice after they get the law to back the bad business practice. It's much harder to get the law turned around than one that's already passed, or already deep in congress (or through the president's cabinent) because you weren't paying attention and thought you'd speak later.

I think the consumers in regards to the media have always been behind the eight-ball on this one. If you do not stand up and say something before the next crisis, you can lose. Consumers must begin voting with thier pockets now and forming associations to lobby for their rights.

If that means something like the EFF needs to push for huge campaigns t lobby for our interests then so be it. This is a battleground and it seems we have few soldiers on the field, much to my dismay.

Re:Markets always trump cartels eventually

[Lumpy]

Problem is that it is typically based in stupidity and lies. they claim that they are protecting the artists. they are in fact not. No artist makes money on their record sales. Hell, even signed bands are breaking away and putting their stuff up for free on the net. www.steadmandband.com for example. they will be putting their entire back catalog online as downloadable non drm'd mp3 files.

They make their cash from the concerts and other aspects. They also discovered that they get more marketing doing things this way than the RIAA was willing to do for them on their dime (yes kids, the RIAA will market the hell out of you adn then present you a bill for every signel expense... in essence they give you a huge loan and then tack on gobs of extra "fees" that you take forever and 2 days to pay back.)

These companies are being insanely stupid not embracing and creating a workable business model that does not treat the consumer as the evil bastard (tm) that is hell bent on stealing everything that is not nailed down.

and the ONE model that works very well they are trying to destroy by forcing apple to raise the prices to insane levels.

Sorry, but if it was left to what the market will bear, the offices of Sony and the RIAA would be in flames right now with the executive staff hanging from the trees in the front... but the government does not allow us consumers to do that.

Re:Markets always trump cartels eventually

[funk49]

Bands get crap contracts because most musicians aren't savvy enough to be engaging in practices that involve "signing contracts". It's surprising to see how many bands will get the lamest attorney possible in order to save an almighty buck. During the signing process, labels will attempt to completely screw the bands over...it's up to the band to decide how much they want to get bent over.

One classic example. Back in the late 90's, Sony decided it was in their best interest to register domain names of it's artists if they were available in order to prevent the artists from making money on the few ways they can...merchandise. They also tried to include asanine stipulations into their contracts where they demanded portions of profits from merch sold on the website. Noone was falling for that shit but if you're a new band and you agree to that, then you get what you deserve. The two bands you know of that turned down major label contracts are idiots. All they needed was a good, knowledgable music attorney, one that knows standard signing practices.

Re:Markets always trump cartels eventually

[Blakey Rat]

When I call for the end of copyright, people say that creation would die if the artist couldn't protect their income. How much do artists today get from the cartels? Nearly 0. Thanks to copyright and those who "own" that right.

A few thoughts here.

1) Artists willingly sign away their rights to record companies. If they didn't understand the contract, well, that's their own fault. If the record companies don't offer any reasonable terms, well, too bad. But the point is that every artist being distributed my a RIAA member is doing so willingly... nothing is forced.

2) Just because one group of people abuse copyright, all copyright is bad? What about the open source movement? It relies on copyright laws to function as open source... if there were no copyright on the code, there'd be nothing preventing an open source product from being sold as closed source by a slimy company. (Heck, even with copyright law, some companies try it-- like with PearPC.)

I think you need to rethink your position a little bit. Copyright is a tool, it's neither good nor bad. It covers Joe Citizen just as well as it covers HugeComglom-O-Corp. Now, I wouldn't mind shorter terms, but removing a system that isn't broken because one party abuses it is a little short-sighted.

Re:Markets always trump cartels eventually

[arpk4n3]

Advertising is one reason for joining with a major label, but performances and word-of-mouth themselves are better advertisment; in fact, only recently have television commericals or billboards played an important role in advertising. Radio traditionally has been an artist's best medium for advertisment. Advertising, however, means nothing without distribution. Major labels distribute globally through retailers, which independent artists would have a difficult time emulating, unless they have achieved substantial success on the charts (Which is difficult, if not impossible, for indie artists due to the connections between radio--Viacom, Infinity, and Clearchannel--and the labels. Thus indie artists have to find different means of advertising as well). It's not some arcane industry secret that artists typically only make 8-15 points (cents per dollar) from album sales, and from that have to pay for studio time/musicians, managers, lawyers, tours, etc. The label handles manufacturing and distribution.

Interestingly, though, a growing number of artists, including myself, are choosing to survive as 'independent' as its profit margins are higher, and the artists themselves do not forfeit the copyrights to their songs to the labels. When you pirate music, the copyright you are breaching is not of the artist; the copyright for the recording typically is owned by their label.

More on this (and more) is discussed in a paper I wrote, available here.

Re:Markets always trump cartels eventually

[rizzo420]

i'm pissed about trey anastasio... lead man from phish. they were all about free trading of their concerts and everything, and now he's got copy-protected cd's. he should not have any copy-protection on his albums. it's very hypocritical if you ask me...

Re:Markets always trump cartels eventually

[rizzo420]

Yes, I do believe that THEY are running the webstore. Several of the bands I listen to run their own labels, and contract few, if any, other bands besides themselves. I also happen to know a few bands that follow this precise strategy. They sell lots of albums at their shows, and 100% of the money goes directly to them. No middleman, no excessive advertising (most of it is for free on the internet) and yet they almost make a living playing music.

you're talking about independent artists, i'm not. you can't buy a cd from an artist on a major label who doesn't give a good portion of that money back to the label (mainly because the label owns their webstore).

this is a comment i meant to make in my other reply.

Re:Markets always trump cartels eventually

[The MaD HaCkER]

Sometime LISTEN to metal michine music, It is an albem made to contract, 4 sides of raw noise I give you the trimph of the RIAA.

Re:Markets always trump cartels eventually

[jedidiah]

This notion that you need the equivalent of Mutt Lange is simply assinine.

It's not something the industry has always been addicted to. It got by quite well without such over-engineering in the past and can do so again. If you need a good engineer to get a decent recording out of a band, you need to fire the band rather than indulging in overpriced revlon for a pig that can't sing.

Real musicians don't need all that crap.

Re:Markets always trump cartels eventually

[jedidiah]

They don't "develop" squat.

They might dish out illegal payola to radio stations to get airplay but that's about it. Most of the time, they don't even do that. More typically, the labels are just a bunch of loan sharks and cartel brokers.

Some acts have even managed to develop their own following as well as their own master recordings. A musician needs a label as much as a fish needs a bicycle.

Re:Markets always trump cartels eventually

[Anonymous Coward]

most of their revenue, and especially PROFIT, goes to TICKETMASTER or some other BS.

Re:Markets always trump cartels eventually

[duffbeer703]

What are they farming? Are they using legal labor?

Most farmers in the US are struggling as commodity prices drop and fuel and personnel costs go up. Dairy farmers have it particularly bad in the Northeast and other densely populated areas because their farms aren't big enough to support other crops, and the growth of suburbia and the increased issues stemming from zoning and property taxes makes it even harder to survive.

Re:Markets always trump cartels eventually

[rizzo420]

i don't think that's accurate. while a portion does go to ticketmaster, ticketmaster gets more of of their revenue from the service fees and shipping fees (which are about $10 per ticket now).

Re:Markets always trump cartels eventually

[LurkerXXX]

Why is that? Can't someone allow free trading of low quality recordings from live shows while restricting it on higher-quality studio work? I don't think it's hypocritical at all. It's his decision on how he wants them destributed. It's your decision on if you buy it or not.

Re:Markets always trump cartels eventually

[Halo-]

(warning this is a bit of a rant)

Okay, I agree the label covers advertising. But what does this really mean? Unless the band already needs no introduction, they aren't getting TV or radio spots. (Let's not get into pay-for-play just yet)...

What are they getting? Posters? Unless you live in a major urban area, you're probally not going to see many of those, and even if you do they are probabally posted illegally. Besides I doubt you move many units based solely on what the album "looks like". Maybe the occasional impluse purchase, but I can't see many people buying the majority of their albums unheard.

That leaves airtime of some sort. The tradional channels are broadcast radio and cable TV. MTV and clones only play videos (or parts of them) and those are a whole 'nother expensive enterprise, which usually doesn't start until the band actually is successful. So we're back to broadcast radio. (We'll get to XM/Sirius in minute) The FM dial is pretty much a small set of genres with the same 12-24 songs in rotation around a slew of blather. Sure there are small indie stations, but those are dying off faster and faster. Probably because the labels would rather advertise the newest Britt Spears single on/to the local ClearChannel/Infinity franchise than spend the bucks to get some unknown played on a tiny little college station.

XM/Sirius is a little better, but you've still got a fairly small number of spots for a really huge number of potential songs/artists.

Where is left for the non-megastars? Pretty much concerts. Concerts get you something, but again, a narrow audience. I'm 29. I have a job, a wife, and a baby on the way. I live 30 minutes from the "hip Austin Music Scene". Even when bands I really like come to town I don't go see them. It's not something that fits into my lifestyle anymore.

Finally there is the internet. The last bands I've checked out where because someone's website said they liked them and I hunted around to find them. (Yes, usually on P2P of some sort). Once I did find them I downloaded a few tracks and looked at what else that user (the P2P one) was sharing and grabbed a handful of other stuff at random. Eventually I get around to listening to them, and delete 90% right off. Out of the remaining 10% I usually find a few tracks I like and then go out and buy the album. (This is pretty rare because I don't have the time to search and download...)

So, the way I see it, the "major labels" have two choices:

1) Not sell me anything, because I don't hear anything I like.
2) Accept the fact that P2P is a reality and produce a physical product which is inticing enough for people to bother buying it

When P2P was easy, I bought more CD's that I ever had at any other point in my life. As it got to be more of a hassle, I've bought less and less, and listen to the same old CDs again and again. I've brought close to 1000 CD's in my lifetime, but no more than 10-15 in the last two years. (And most of those were used)

"The Industry" is cutting itself out of the sweetest parts of the market (25 - 35 adults with 100K+ household income) in the hopes of locking in the 13-24 year old set.

Re:Markets always trump cartels eventually

[Anonymous Coward]

Well good for your friend, but I suspect that we probably made the bulk of his money touring and playing to large crowds. He still would have made that money if his album was good and distributed for free.

Re:Markets always trump cartels eventually

[RetroGeek]

Wow. I'm pretty old, but I have no recollection of 12 ft. discs.

You should see my collection. I have a whole barn dedicated to storing them.

AND, I managed to find a jukebox to play them. It uses industrial strength hydraulics to change the dics.

Re:Markets always trump cartels eventually

[TX297]

See, they've come up with a solution to not being able to tap concert sales... bring in ClearChannel. My dad is the production manager for a famous singer who shall be unnamed for now (he's had this job for over 20 years). He had some run-ins with his new manager a while back because, well, she doesn't know how to manage. She went and sold the entire tour to clearchannel. CC bought all the tickets upfront (for some stupid pric I can imagine) then resold them at a much higher price. This sucked because 1. I can't get comp tickets.... I'd have to buy them from CC even if I had a pass. 2. the singer loses all chances of revenue from further ticket sales. While this model would work with a smaller band that wouldn't sell a lot of tickets, it's pointless doing this with a well-established band that is almost guaranteed to sell out. As part of the contract, CC got a cut of merchandise as well. Granted, the manager wa stupid to sign a contract with those provisions, but that's what you get for dealing with clearchannel (who subsequently tried firing my dad).

Re:Markets always trump cartels eventually

[jcr]

It is not theft, it is fraud.

No, it's not even fraud. It's just a very bad deal for the musician.

Let's none of us pretend that the RIAA labels actually intend in good faith to pay out to the artists the amounts stipulated in their contracts.

Prove it in court, and you'll make a fortune on the contingency fee, counselor.

-jcr

Re:Markets always trump cartels eventually

[terrymr]

The RIAA does not represent artists ... the represent only the labels, so I'm not sure why they keep claiming they do. Not one artists organization has pointed this out though.

Re:Markets always trump cartels eventually

[rizzo420]

i prefer to buy cd's. i used p2p to download individual songs that i was interested in or to download a variety of songs from a band that i heard was good. i haven't used p2p in a while because it's gotten so crappy, and i prefer not to download a whole album from BT. but i would download a bunch of songs and if they were worth it, i'd buy the actual cd. i don't have over 1000 cd's, but i do have a few hundred. i plan to continue to buy more. i probably buy about 10 or so per year. but i have to agree, they are worried about the young people, but don't think about the people who have been listening to music for years, the actual music buffs, who buy a lot of music. instead, they put out music that just sucks and only the kids like it, but when the kids grow up, they realize how terrible it is. music that doesn't last doesn't make them a lot of money in the long run...

Re:Markets always trump cartels eventually

[Vinnie_333]

It would be nice if some of those artists ... would stick up for themselves

According to this Boing Boing link, they are. Although the article isn't very specific about Who or What they are doing.

Re:Markets always trump cartels eventually

[Fareq]

You are getting distribution as well.

That is, your album appearing on racks in all the major music stores, and possibly advertised in those stores little ad-magazines that they stick in the Sunday paper.

5 years ago, this was invaluable. You could never afford to stamp enough CDs, nor could you make enough connections to have copies of your album in stores across the country.

Now that a certain reasonable percentage of music is bought online (I've no idea the percentage, but it's not 0 anymore), phyiscal distribution isn't *as* important. Over time, it will become less and less important as the physical music stores become less important. I don't know that we'll ever completely eliminate the need for real music stores and real music CDs, but it will soon be possible to have a huge hit without having CDs in any major retailers -- there will be enough people using the online music stores, and possibly direct-order CDs, to reach critical mass. And at that point, you'll have the resources to produce CDs and acquire good placement in stores without the labels.

Re:Markets always trump cartels eventually

[NormalVisual]

All true, but as has been mentioned before, no one is forcing these bands to sign, and it sounds like in most cases they're signing without really knowing what it is they're agreeing to. I won't sign a document I don't fully understand, and if there is any confusion or I'm unclear about what something really means, the money spent having a lawyer review the document beforehand will almost certainly pay for itself. If the contract is such that it puts me at an unfair disadvantage, then I thank the other party for their time and excuse myself.

The labels definitely are taking advantage of a lot of clueless musicians, but only because the musicians let them. It's just like buying a car - you may want that car really, really badly, but you absolutely have to be willing to walk away without hesitation if you expect to get a fair deal. With the car dealer as with a recording contract, you can almost always be assured that every person you come in contact with will have the other party's interests in mind, and you'll be the only one looking out for yours.

Re:Markets always trump cartels eventually

[Anonymous Coward]

Well, if the group abusing copyright is producing 99% of the works, then yes, the copyright ought to be banned.

Re:Markets always trump cartels eventually

[IngramJames]

I suspect that we probably made the bulk of his money touring and playing to large crowds.
He still would have made that money if his album was good and distributed for free.

He didn't tour; just got lucky with one record.

And if touring is it would take to make money from something you have created, then what would you suggest a band does if they have a disabled or ill member who can't travel easily? What about musicians who are getting on in years? Extreme example: a guy gives up work for a year because he believes in his vision. Spends all his savings, and remortages the house. Gets a hit song. Then gets hit by a truck. Sorry, kids, your dad's life insurance was with his old firm. The record? Heck no, people don't pay for MUSIC! Tell you what, shove him in a coffin and we'll see if we can rig him up to mime.

If any musician want to adopt the "make money from touring" policy, they can. If it works well, it will become the most used method of its own accord; it needs no help or change in the law that could hurt others very badly.

Re:Markets always trump cartels eventually

[sandwiches]

People only follow laws as long as it's a 'hassle' not to. In other words, they'll follow laws as long as it is relatively easy to get caught. The moment it is easy for people to bypass a law such as in the internet, the law cannot be practically enforced. A law that cannot be enforced dissipates and dies, eventually.

The new generation of net users are growing up with an effectively unrestricted connection where they know they can get any song they want for free any time.

These are the same kids that will grow up to be artists and 'content creators.' These are the same that will grow up to be lawyers and law makers.

It'll be interesting to see how people will view music, videos, books, etc, in a couple of generations. I suspect that most of these type of media will be created much the same way free, open-source software is made today. Simply because you like to.

Many people are worried about what artists might do if they cannot earn as much money as they currently do if anyone can download a copy of your song/book/etc any time. I think artist will become even rarer the same way scribes became rare but people still hire professional typographers to do certain work. After all, people still make carriages, swords, and armor despite the obvious fact that very few people still use them and there's better choices.

People will only pay for material if they think it is worth it and they cannot get it cheaper elsewhere with an equal or less hassle. I would pay to go to a concert by the Three Tenors, but I wouldn't buy one of their CDs. Why? Shouldn't I be supporting artists I like? Sure. I would support them by paying, sometimes, hundred dollars to attend their performance. The problem is that artists and 'content cretaors' are used to becoming celebrities. It is expected that making it big means having a multimillion dollar house, dozens of expensive European cars, and other such luxuries. I simply don't think that a musician's performance or writer's book really deserves that much money. I think as the younger generations grow older, more people will agree with me, even if not conciously.

Will artists become rarer? I think so.
Will most artists not make it as big as the stars of the past? Probably.
Is this necessarily a problem? If you're content creator, yes.
Will this have a generally negative effect on society? I think not.

I think the overall effect will be the same as copier machine makers not being as profitable if they focused on only copiers after the advent of printers and scanners.

Re:Markets always trump cartels eventually

[Clockwork Apple]

Buying from the artists website you stand a better chance that the band will get the chunk of profit that the record store would have taken. Hey, at least you are trying to support the band in a direct manner.

C.

Re:Markets always trump cartels eventually

[dave at hostwerks]

I'd tell you that you're wrong, but you're not.

Re:Markets always trump cartels eventually

[gordo3000]

don't blame the contract because that particular artist isn't good enough to be successful.

or would you rather the A&R folks go around and try to sign people by saying "now, you aren't all that great, but we think there is a small amount of money to be made by signing you. YOu won't ever become big but that is how it goes".

you don't get people to sign on with that kind of talk. If the artist lets himself be bullshitted about the possibilities for his own music he's a fool.

Re:Markets always trump cartels eventually

[Alex P Keaton in da]

Here comes the first lawsuit...
Texas Sues Sony Under Anti-Spyware Law
http://www.breitbart.com/news/2005/11/21/D8E11IK00 .html

Re:Markets always trump cartels eventually

[AndersOSU]

Only it's very likely not his decision. Sony made it for him (and us)

Re:Markets always trump cartels eventually

[Anonymous Coward]

"When you pirate music, the copyright you are breaching is not of the artist; the copyright for the recording typically is owned by their label."

It really depends.

Even on a major, you can have the Works For Hire clause stricken and a lot of successful artists do. Also, most of the time, one does not sign away writing credits regardless -- so you are partially right: the recording may belong to label (the mechanical copyright) while the words and structure are still firmly within the artists hands. To me, this has always been the most important part of copyright...as an artist, I could give a rats ass about a specific performance in time. And yes, if someone wants to pay to record this moment in time, they should have the rights to own it (i.e., the label).

So yes, when you pirate music, you are breaching the artists copyright...and in fact screwing the artists even more (because on the points, that comes out of the performance along with those we have to pay for based on points...last time I checked, BMI/ASCAP wasn't taking shit out and redistributing it to the labels...that goes right in my pocket).

Re:Markets always trump cartels eventually

[legirons]

I think it worked.

The RIAA president said something stupid and inflamatory, and now everyone at slashdot is saying how awful the RIAA is. It's worked quite well, to take the heat off Sony (who are trying to sell things you might buy), and direct all the critisism at the RIAA (who you can hate all you like, because they're just a shadowy organisation who you'll never deal with directly)

OK, I'm sure it's more complicated than that, but don't you think they're laughing every time you tell people how evil the "RIAA" is? Everyone has completely forgotten to warn their families about buying Sony products, or Green Day albums, or any of the other people who RIAA are covering for, that are actually doing all this anti-society stuff.

Re:Markets always trump cartels eventually

[Zondar]

Of course, I submitted the news.com blurb about this to Slashdot, and it was readily rejected.

I'm sure it will be dupe posted by Zonk later today!

Re:Markets always trump cartels eventually

[cdrguru]

The problem is (a) too many people feel that paying anything is beyond their means and (b) there are plenty of people that given a low-risk opportunity to get something for nothing will do so.

What this means is that any industry that derives revenue from something that can be digitally "shared" can no longer assume they have a market. Sure, they may sell a few copies, but there are people that feel it is their moral obligation to make sure their friends aren't "taken" - so they "share". Even with the RIAA filing hundreds of lawsuits, they are only filing hundreds, not millions. Therefore the risk is so low as to not be meaningful. You aren't going to get sued.

It will be interesting to see if iTunes can be converted from a iPod sales gimmick into meaningful online music sales. And then, what happens to the folks without the high-speed Internet connections? Are they just left out, or does someone step up to sell them something?

Re:Markets always trump cartels eventually

[civilizedINTENSITY]

But for how much longer? Doesn't your arguement sound a little bit like, "maybe a car is ok for a trip from Austin to Dallas, but everybody has to have horses just to get around town, and what about all those places roads don't go to?" Magazines, TV, Radio, these are channels that were designed for one-way transmissions in an era when "broadcast" resources were considered scarce. Things have changed, and the point is that the changes have occured faster than the oligarchy could thwart. Consider that magazine ad. The RIAA loves it because there is no way to block magazine ads. Rigid, captivating distribution streams is the bedrock of their business plan. It is all about *control*.

In terms of CD vs MP3, I live in dorms at a University, so perhaps my view is youth skewed, but still: nobody sees a CD as more than a shopping bag container for getting the music from the store to where it can be ripped. Nobody carrys a CD player around campus, but there are a ton of MP3 players. I don't know anybody on my floor who listens to CDs. They literally get home and rip them to listen to them. This is the future the RIAA can't even market to...

Re:Markets always trump cartels eventually

[civilizedINTENSITY]

as an artist, I could give a rats ass about a specific performance in time

Thanks for the disclosure, now tell us who you are so we won't waste money on tickets.

Re:Markets always trump cartels eventually

[DaFallus]

Maybe if someone installed some sort of keylogging software on this guy's machine and hid it using the Sony root-kit and stole all of his banking information and decided to identity theft his ass he would be signing a different tune. Same goes for all these politicians that turn their heads when the corporations who fund them stomp on the rights of individuals and get nothing but a slap on the wrist. I have a strong feeling that they were NEVER get it until problems like this begin to directly affect them.

Re:Markets always trump cartels eventually

[Anonymous Coward]

Hee,Hee,Hee...so naive...

Tell this to Shakespeare! The most "ripped off" author in history. I'm sure he NEVER would have written his plays without copyright, ooh just a second he did now didn't he?

Tell this to Neil Diamond, who was the #1 grossing touring act of the '90s. This guy couldn't get played on mainstream radio now if he paid them! But he made more money touring than the Rolling Stones, Britney Spears, any Hip-Hop band you care to mention!

Anyway, copyright as we know it now is a relatively recent "invention", art and artists survived without it in the past, I'm sure they could do without it in the future.

Re:Markets always trump cartels eventually

[Anonymous Coward]

what is the big deal about the explicit lyric stickers?

honestl?

they tell me which cd to buy when a band makes two versions (aka i buy the nonclean version)

and bands arent forced to put out a clean version, many do that simply for their markets, or because some stores wont sell (their perogative)

Re:Markets always trump cartels eventually

[rizzo420]

i am not arguing that the RIAA is necessary. but if they weren't, why would bands go through them? think about your new up and coming bands. why do many heralded indie bands go major label? you're in college, you're young, you probably know more of these bands than i do. they sit there and bash the major labels, but i can guarantee that if given the option they will sign in a heartbeat. many have done it... modest mouse for one. i believe something corporate (who picked their name as a parody of major labels) is also on one now.

in the campus environment, mp3's are easier, i used them when i was in school. now that i have an apartment and room for my cd collection (i'm only 4 years out of college), it's easier. my computer is in a separate room (i hate the fan noise in the living room when i watch tv) and i don't have cable to run from my computer to my stereo (plus it's easier to use the remote than to have to get up to change song at my computer). so i use cd's. i bring them in my car because i can't afford a new stereo that allows me to play mp3's (plus i don't want to burn them). the mp3 collection i have (mostly pirated, i will admit) has varied sound quality (crappy to crappier to unlistenable except to get an idea of what the music is like with the occasional decent quality one). but i can take cd's in my car, i don't have to worry about any degradation of sound quality from the compression, it's just easier for me. my new car also doesn't play burned cd's really well, so there's that problem as well.

also, i'm into the music and the art of the music. an album isn't just a bunch of songs (ok, maybe in some cases it is), it's a creation. the songs are chosen for an album because there's usually some theme. can you imagine sgt pepper with other songs or in a different order? it wouldn't be the same. or how about abbey road? think about that one. so i buy cd's because i want the album. generally, the music i listen to, i like it all. there's sometimes a song or 2 that i will skip, but generally speaking, i listen to the whole thing straight through when i'm listening to a cd.

all the people i know, even those who were really into mp3 still buy cd's. it's a view that has changed in people as they get older. it might be a monetary thing for some, for others it's wanting the whole album to listen to in full, for still others, it's the rest of the art behind it... the packaging, the booklet, the liner notes. a cd for me, and a whole slew of others, is more than just a distribution method. if dvd-a or whatever is next catches on, i'll probably be converting my whole collection... i did it with cassettes at one point (although i had far fewer cassettes). but the fact remains that i will continue (as well as at least half, if not more, of the music-listening crowd) to purchase music through record stores (whether online or in person). my computer is a tool, not a stereo.

what many people don't realize is that the RIAA caters to youth only through the crappy music they put out. the majority of the people who listen to and buy music are older and are not interested in downloading their music.

Re:Markets always trump cartels eventually

[hunterx11]

What does Hitler have to do with this? If anything, you and I are more like Hitler than the sweatshops, because people's lives are improving more as a result of the sweatshops than what we do. For the record, I am against inhumane working conditions, but paying low wages isn't inhumane. After all, most people pay zero wages.

Re:Markets always trump cartels eventually

[Fordiman]

Meh, somehow, I don't think Trey knew, and is probably sensing the powderkeg of "What the Fucks" coming his way.

Meanwhile, is it just me, or is this article reporting on the biggest pack of mistruths ever heard?

Re:Markets always trump cartels eventually

[JesseMcDonald]

So what, exactly, did he do to deserve all that pay? That way you describe the situation sounds rather like winning a lottery: a huge payoff for the lucky few, minimal effort required to enter. A decent work ethic, or the common sense not throw away the future of one's family on a risky dream, would be a far better inheritance than the unearned income from someone else's lucky break. Also, the problems you attribute to touring apply equally well to any other business requiring personal appearances; why should the business of entertainment be any different?

Re:Markets always trump cartels eventually

[mr_matticus]

I agree with you entirely but do object to your tossing in of the parental warning label into the Laundry List of Bad. The label imposed no restrictions on purchasing and altered in no way one's use of the CD. It's not like the M for Mature labels where many stores ask for ID (which I don't agree with). The label is a good tool for alerting parents to the content of their child's music without having to listen to it. As long as the rules are set by the parents and not by the government, I don't see the harm in adding the label. That said, I don't agree with the entire notion of insulating children from "explicit" language in the first place, but since I'm not in the majority on that view, I fully support the label as long as it stops at just being a notification.

Re:Markets always trump cartels eventually

[Halo-]

Yes, you're absolutely correct about the distribution.

(begin probably-true assertion)

One thing to point out is that tradidionally contracts include a percentage of the total "profit" to be handed back to the label for "breakage". This was a big deal before records (the kind with analogue groves) were made out of vinyl. The old ones were quite brittle, and combined with bad streets and rough transport, losing 5-10% of the load to physical damage was to be expected.

Vinyl reduced that problem a lot, and so did improvements in shipping technology, packaging, etc...

CD's reduced the problem to virtually nil, but I believe most labels still take a cut assuming a 5-10% "breakage" rate.

(end probably-true assertion, I am 85% the above is true, and 99% sure the historical parts are, but I can't be bothered to actually Google it)

The important thing to note is that even though a problem with distribution went away, the labels still feel entitled to their old cut. They are willing to reap the benefits of technology when it suits them. (such as the dramatic drop in the cost of pressing CDs) but are unwilling to adapt their business model when it doesn't.

The whole thing falls back to "what the market will bear" and a lot of the backlash is because the labels don't like the fact the "market" is trying to tell them to get stuffed. (Of course for this to be an altruistic story, none of the content on P2P networks would be stolen, and we're not that dumb....)

Re:Markets always trump cartels eventually

[arpk4n3]

A recording, just FYI, is "a specific performance in time." Just so we're on the same page.

Re:Markets always trump cartels eventually

[blincoln]

The point is not that you need an engineer to get a "decent" sound out of a band. They're there to make the musicians sound as good as possible, because you're planning on making a recording that will be heard for many years.

Having a crappy engineer for a band is like hiring an orchestra to score your film, and then having them perform in a parking garage. It's a careless waste that makes the end result less than it could be for no good reason.

For a modern band that uses electronics, the engineer or producer can even end up being a de facto part of the band for the recording - writing percussion and musical lines, expanding on what the band performed, and so forth.

Re:Markets always trump cartels eventually

[christuckeruf]

I always thought that a good way for artists to make money without a label is to let normal internet users turn a buck on their work. This is referred to as a reseller model and it works well with other internet goods (i.e porn). People that share their music now certainly wouldn't mind making some green off of it. Just think if you could turn a fan base into a rabid marketing base.

Re:Markets always trump cartels eventually

[Anonymous Coward]

20 minutes to find a song? Get off of limewire... That's the spyware talking.

-JNY

Re:Markets always trump cartels eventually

[Halfbaked Plan]

No, it's not hypocritical. It just blows away the notion of phish as a good example of 'they can give it away for free and get by just fine.' Obviously he couldn't give it away and get by just fine. So the 'phish' case history just blew out the window.

Oh well.

Re:Markets always trump cartels eventually

[rizzo420]

actually, trey is not phish. don't confuse the 2. his new album sucks.

Re:Markets always trump cartels eventually

[Anonymous Coward]

Are you just getting that?

Thats exactly what I said and meant. You gotta get a little quicker if you want to keep up.

As an artist, I don't give a damn about specific recordings...but I respect the rights of those that paid for them to do as they will (and no, I wouldn't buy a CD with DRM on it).

My point was that I've never made any money on performances other than what I've seen up front (except for the times I've sat in as a session player). And I don't mind. I see almost all my money from the songwriting royalies (one of the reasons labels would prefer you work with material they have bought outright and own).

I love my performances, but I can always repeat those. You can't write a song twice (well, I know a few guys that can and it shows).

See what I'm saying now?

Re:Markets always trump cartels eventually

[BlueStrat]

"So...they've got lobbying power. What's your point? Shouldn't businesses have the right to look after their interests (whether or not your agree with those interests)? I mean, if you can write your congressman, or have a group like the EFF or the ACLU trying to stop interests like the RIAA, why can't those groups do the same to protect what they view as their interests? I know that you never explicitly said it -- but you've implied that they shouldn't be able to do this. Is it because you think that they're wrong, or because they have more resources than you? IMO, yours is a defeatist attitude. Have you done anything to stop the RIAA's foray into legislature (like written your congress critters or donated to the EFF), or just accepted defeat and complain about it on slashdot?"

I think one of the major problems is how corporations are treated as a living citizen when it comes to the rights they enjoy, but escape many of the consequences that accrue to a living individual for bad/illegal behaviour.

A corporation does something bad/illegal, gets caught, fires the individual employee(s) involved and perhaps pays a fine, and goes on its' merry way, the corporation still intact. An individuals' life under similar circumstances would be over, as an individual can't figuratively send just one of his replaceable hands to jail for bribing a congressman.

This reduces the decisions on corporate behaviour to a simple one of if the behaviour will profit them enough to offset the loss if caught, and the likelyhood of being caught at all.

This, along with the huge financial differences, gives corporations a powers-of-magnitude advantage over individuals when it comes to the ability to exert influence and power.

People have learned from these tactics and organized to increase their effectiveness relative to corporate lobbyists and contributions, but laws like McCain-Feingold (despite what the lawmakers *claim* it's supposed to do) are attempting to limit groups of citizens' ability to pool their resources in order to play equally with the "big boys".

Hopefully, the advantages of peer communication among individuals via the internet will give individuals enough power to change this inequitable power balance back some before the corporations and the governments/politicians they own find a way to control this too.

Just my $0.02

Strat

Re:Markets always trump cartels eventually

[dcam]

Yet in my research, farmers do pretty well (we have 5 independent farmers within a 15 minute d ive who net over $1M/year and they're not megacorps but family run)

This is in the US right? Nothing like a good subsidy...

Maybe I'm just bitter because my country does not subsidise our farmers to the same extent and I have two uncle's who own farms.

Re:Markets always trump cartels eventually

[The_Wilschon]

When I call for the end of copyright, people say that creation would die if the artist couldn't protect their income. How much do artists today get from the cartels? Nearly 0. Thanks to copyright and those who "own" that right.

It's worth noting that the actual owners of the copyright do get plenty of money. It's just the people who ought to own the copyright, but signed it away in a nasty contract who don't. As you say, the artists get next to nothing from the labels, so copyright laws certainly aren't doing any good to protect creativity as things stand.

Re:Markets always trump cartels eventually

[oddfox]

That whoosh sound was his point flying directly over your head. I suggest you re-read and notice especially where he said "How the fuck does the existance of 'worse' forgive 'bad'?"

Re:Markets always trump cartels eventually

[arpk4n3]

I do, and your reiteration of your points sounds like a trumpet in defence of the current industry stratification. With the current model, the Recording profits because of an Artist--in reality, an Artist should profit because of a Recording. The recording shouldn't precede the artist. That is, it would not be possible for a label to profit without artists to record. The labels rely and depend upon the artists. How then, does it make sense, for the labels to pay the artist minimally and as a result obtain huge profit margins through exploitation and maintain hegemonic control which would eliminate the possibility of an artist defying the paradigm and succeed without a label's intervention? It's a system of continual monopoly. I encourage you to read the precis I composed for a more detailed argument/explanation.

Re:Markets always trump cartels eventually

[Art Tatum]

You're looking at a snapshot of time in a progression. It's not just a matter of the situation being better than it is for some others--it's a matter of continual progression over time. You can't just snap your fingers and have a perfect world.

Re:Markets always trump cartels eventually

[10Ghz]

Ah, the good ol' "other people have it even worse, why would you like your situation to be any better?", never ages uh?

The "sweatshops" pay A LOT better than local companies do. I have heard that western companies pay salaries that are about triple that of what the local companies pay. To us, their salary might be crappy. But for them it humungous. We couldn't live with their salaries, but they can.

There was a case in Finland where the local Seaman's Union demanded that ships owned by Estonian companies, sailing under Estionian flag employing Estonians must pay salaries equal to Finnish seaman's salaries ("logic" being that the Estonians could undercut the Finns because their salaries are so much lower). The Estonians pointed out that if they did that, the Estonian seaman would have similar salary as the prime-minister of Estonia has. As you see, simly increasing the salaries simply does not work.

You can't just say that "We need to pay them even more! We need to increase their salaries by order of magnitude at least!". That simply doesn't work. Their salaries are improving all the time, and their standards of living are improving as well. But you can't demands that their standards of living and salaries are brought to western levels overnight. Why? Because their only competetive advantage when compared to others is cheap labor. If we were to dramatically increase their salaries, that advantage would disappear, and no western companies would invest there anymore. We would then get

a) mass-unemployment
b) piss-poor salaries from the local companies
a + b = Poverty and poor standard of living

But I guess you could then pat yourself in the back becase we wouldn't be "exploiting" them anymore? I wpould guess that the people living in those poor countries would also have few things to say to you, but they wouldn't be thanking you.

In time their salaries will increase so much that their competetive advantage of cheap labor diminishes. But by that time they can compate with higher education, improved infrastructure and the like. Along with somewhat cheaper labor. But building that education-system and infrastructure takes time. If we were to drastically improve their salaries overnight, they would lose their competetive advantage without having any other advantages (education, infrastructure etc.) taking it's place. In short: we would be ruining them.

You keep on talking about "bad" salaries. To them (you know, the actual workers?) the salary is not bad at all. In fact, it is A LOT of money! To us their salary might not be that much. But then again, things cost a lot more here than they do there. And compared to the typical salaries there, the western companies pay VERY WELL. So why aren't you whining about the local companies?

Re:Markets always trump cartels eventually

[Lord Flipper]

i am not arguing that the RIAA is necessary. but if they weren't, why would bands go through them? think about your new up and coming bands. why do many heralded indie bands go major label?

Okay, I'll bite. Let's skip the advertising budgets, the access to high-level recording environments, and distribution...just to 'level' things a bit. After all, we can use software to replicate a lot of, what used to be, hardware-only signal processors, and word-of-mouth [locally] is what happens to almost all bands starting out, and the net is there for distribution. [assuming someone 'knows' the URL, or its importance]. Fine.

So, instead, think about this: Collecting on invoices.

We have a band, let's say, and we sell 50,000 records over an area from say, southern cali, to Jax, Florida, after a year or two of tours, and signing a one-off deal with a tiny indie label.. Now what happens? Well, we need to collect the cash for those sold records [er, CDs], right? Right. But guess what?

Joe Dealer owns a little record jobber in Nowhere, Texas, and he gets a 30-60-90 day invoice for the 25 CDs he sold for us, and he gets his SonyBMG invoice that has twenty-five titles, some of whom only sold ten items, and who do you think gets paid? Sony. Why? Because Joe Dealer needs to stay on the good side with the big label, and pay for the clinkers and whatnot, if he wants to have access to their next shipment. No pay, no order. The real indie labels are 'cool', no question, but they are small because they have no cash, and as a result they have no clout.

To be honest, er, realistic, that's why you'll see smaller labels [so-called "Indies"] with big-label [i.e., RIAA] distribution deals...Selling product is one thing...but actually getting paid for it is what it's really about.

I haven't seen an 'industry standard' recording contract in at least ten years. But, when the wholesale price of LPs and cassettes [huh?!??] was around $7, bands were lucky to see 65 cents from a sale of one item. And that only happened after little things like all expenses had been recouped by the label...It's a tough business.

Re:Markets always trump cartels eventually

[Anonymous Coward]

Until you ship all your money above $1 a day over to China to help feed the poor people, you're spitting into the wind. The entire point is that the disparity between our arbitrary economic systems is so vast that we can pay them $1 a day and they live better than all their neighbors. Even in semi-third world countries where we have to pay $10 a day or something, they can buy all the food they need and probably get the best *available* medical care. There's no quick way to provide an entire "Western" standard of living to everyone in the world, it has to happen slowly simply because people and societies change slowly. You can ship all the medicine you want to third world countries, but there aren't going to be enough doctors and nurses until you get their societies to bootstrap education and produce them, and they won't make any headway against local superstition and herbal remedies without the education anyway. Basically the only way to improve society is through several generations of increasing education and industrialization. Industrialization has started, and as specialized workers are needed education will increase. History just repeats itself, that's all.

Re:Markets always trump cartels eventually

[hunterx11]

I don't think you got my point--something is better than nothing. How is something worse than nothing? Should nobody do anything at all unless they do it perfectly, lest they should be worse at what they do than others? I don't think that would be such a great world to live in.

Re:Markets always trump cartels eventually

[IngramJames]

So what, exactly, did he do to deserve all that pay?

He created a product while retailed for a price that several thousand people wanted to buy.

Who should get the money from that, if not the creator? If you're advocating that he should give it away for free, then can you explain what everyone in the world did to deserve his product for free?

the problems you attribute to touring apply equally well to any other business requiring personal appearances

If you read the parent, you will see that it was indicating that nobody who creates any music should be paid for so doing. They would have to make all their money from touring. And music (not entertainment) is different, precisely because it doesn't require personal appearances. They are optional.

Re:Markets always trump cartels eventually

[rizzo420]

so record stores don't work like the rest of the retail world where you pay for the product before you receive it (or at the time you receive it)? i own a clothing/furniture/office supply/whatever you want other than music store. i have to pay for my stock. anything i don't sell, i eat. that's a loss for me. i don't keep a huge stock if i know i can't sell it.

what you're telling me is that a record store puts in an order, gets the order, and doesn't pay for it until after they've sold, regardless of how much they have in stock. maybe that's the problem with the recording industry... make the record stores pay up front. they can determine the price based on what the market will handle (if the albums are being bought up like mad, the record store gets a nice little profit. if they don't, the record store either breaks even or takes a slight loss).

if the record companies don't like that, then they need to start opening up their own stores instead of fixing the price that record stores will sell albums at (because a record store isn't going to sell for less if no one is buying it).

Re:Markets always trump cartels eventually

[Anonymous Coward]

Not sure if I need to read the precis -- were you ever in the industry? Have you ever had to deal with any of the issues involved with the industry? Or are you just making an educated guess as to how it actually works in the industry? I have been and thus know a little more than just what is written down.

But yeah, I do support the current industry. I've worked both sides of it before getting out.

I never felt exploited as an artist...as an artist, I was more interested in getting my music out. I got paid well in advance -- and honestly, for the amount of work I did, it was a rediculous sum. It paid for my first two years back to school as well as a sizable downpayment on a home...and we really weren't that big in the scheme of things. Who are the artists that get screwed? The ones willing to sign everything away to get rich...that was never my desire -- an honest amount of pay for an honest amount of work. This whole money game is rediculous.

But what did the label pay? They paid for a set of recordings. I didn't party and I paid attention to the contracts -- did you know that if an A&R guy decides to fly out and see your show in the middle of BFE you've paid for it? Its spelt out in the contract and when he calls and says I'd like to visit next week -- he isn't asking if you have time, he's asking if you are willing to sign off on the expenses. Only someone that never read the incidentals wouldn't know this. These are where the label gets you -- and its all spelt out and at every turn the artist is given the opportunity to say no. I know my bandmates were willing to fly out to LA or New York or Miami anytime the label told them there was a party (industry event) and if they wanted, they've make the arrangements for the flight and get them nice digs in a hotel...again, you pay for this. I attended some but only if I was already in town (though the A&R guy was always adamant that you need to talk with a new hot producer or get in good with the president or try to whore yourself to a talkshow producer that will be there so that you can get on their show...but you were free to say no and hang up or click delete).

The labels give quite a bit to artists and for the actual money that goes in your pocket -- and not just the stuff that is make believe on paper -- you do end up with more than working in say technology or research -- and get to hang out with people much prettier than you are (well, actually, they are just as ugly, but they all dress a little nicer than geeks...you'd be surprised how ugly and saggy most people are in person).

Again, I never signed on to the Get Rich Quick bullshit and a lot of the things I did in the industry actually thwarted the chance that I might GRQ...but seeing the money I did even though I was burning through it was still better than I'm seeing 10 years later. And beyond the actual front money? No, I never saw anything else from the sales of CDs except from songwritting publishing. My bandmates all spent their cash and wasted it and then acted like asses demanding more...I believe our old singer was working as manager for a Tower Records on the West Coast and everytime I hear back from him, he's getting back in...all the while, I left on my own and I still get calls to do some work here or there.

It all depends on how you go into the industry. Do you expect everyone to just give you everything and you do nothing but music? This would be nice if we were talking about an artist colony where it was all idealistic -- but its not. Its a business and one needs to look at it as such. If you don't, you deserve the deal you get.

I posted other bits of my experience here:

http://yro.slashdot.org/comments.pl?sid=168923&cid =14082833

But the point is, everything is spelled out to artists. That is the working game. Those are the field rules. There is no creative accounting -- you know that X% can be returns /

Re:Markets always trump cartels eventually

[JesseMcDonald]

He created a product while retailed for a price that several thousand people wanted to buy.

Who should get the money from that, if not the creator? If you're advocating that he should give it away for free, then can you explain what everyone in the world did to deserve his product for free?

I'm not saying that he should give away his work for free. In the absence of a legally-binding agreement, no one is obligated to do anything for anyone. He's quite within his rights to keep his ideas to himself, or to sell access to them to whomever he wishes, at any price they are willing to pay.

What I'm asking is what gives him the right to forcibly prevent other people from freely copying and/or building on the products that they've purchased. That is the heart of copyrights (and patents). Copyrights (and patents) are negative priviledges, not positive ones: they take the right to use certain ideas, processes or behaviors away from everyone else, so that only those to whom the priviledges are awarded can use them freely. Copyrights are the worse of the two, since patents at least allow for non-infringing derivative works, but both copyrights and patents hold back innovation and cultural development, while simultaneously distorting the workings of the free market by tying together otherwise unrelated services: performances, recording, publication/duplication, distribution, and advertising.

If you read the parent, you will see that it was indicating that nobody who creates any music should be paid for so doing. They would have to make all their money from touring. And music (not entertainment) is different, precisely because it doesn't require personal appearances. They are optional.

It's true that music, books, and other forms of recorded ideas do not require the artist to be personally present in order for them to be enjoyed. It's also true that they are by their very nature in effectively infinite supply, because they can be copied at little or no cost. In a free market, the prices of the copies would approach their marginal cost, which is effectively zero. Effectively, anyone who already has a copy can become a local distributor, at least until the market for the recording is saturated. Original performances, however, retain their value, because they are in limited supply. The copies, on the other hand, have nothing to do with the original creator. The artists have a right to charge for their own work, but not for the work of others.

Re:Markets always trump cartels eventually

[IngramJames]

What I'm asking is what gives him the right to forcibly prevent other people from freely copying... the products that they've purchased.

If you mean they can freely copy and distribute then I disagree. By that logic, only one copy of any music CD need ever be purchased. One person buys it, and then slaps it onto eMule. Nobody else need buy it; they can get a free copy. Now if the copy is for personal use only, I'd agree that in that respect the current laws are a bit OTT. I can't count the number of CDs I've bought and then had damaged accidentaly, and it's a pain in the butt. OTOH, if I buy a sculptue and it falls down the stairs and shatters, I have to go and buy a new one.

As for "building on" the work - people are free to do that at the present time. - AFAIK. They just have to ensure they have changed the original enough. Fair play to take a short sample (or a chord sequence), enhance it and twist it around so it doesn't sound very like the original, and then use it in an innovative way. But if you wanted to (say) speed up the music by a few BPM (or just add a new bassline and keep it at the same speed) and then sell that as your own original work, it wouldn't be fair. These are the two extremes; so where should the line be drawn?

There are plenty of DJs who remix existing recordings, pay a royalty to the original artist, and everyone is happy. They use an original work, enhance it, create something which has some of the original and some of their own work, and pay a negotiated royalty which everyone is happy with. I really don't see the problem with that.

And I, for one, would not like to see any art I produce (ha! fat chance) being used on (say) a website for a Neo Nazi group. If they were free to use it as they saw fit simply because they bought a copy of it that they could listen to, they could chop it up a bit, claim it was not the exact original, and use it for their own nefarious purposes.

Also - if somebody has sat down for weeks and created a song lyric, I don't think anyone else should be able to repeat it verbatim and sell it on again whenever they want without paying for the work which has been done. If they want a lyric, they should do the work or pay for somebody else to do the work.

Sure, let them be inspired by the lyric and use that inspiration to create something new, which is their own work. But the closer it is to the original, and the more of the original they use, the less work they themselves have done - surely?

distorting the workings of the free market by tying together otherwise unrelated services: performances, recording, publication/duplication, distribution, and advertising

I don't accept that they are unrelated; they are all geared towards the production and distributiong of a specific item. I do accept that there are major cartels which are abusing the fact that these things are necessary to major artists, and bump up the prices of their products. That is wrong, but I don't think the solution is to allow anyone to become a distributor and pay no royalties to the original artist.. (forgive me if that's not what you are proposing below; that's how I read it).

Effectively, anyone who already has a copy can become a local distributor, at least until the market for the recording is saturated. Original performances, however, retain their value, because they are in limited supply. The copies, on the other hand, have nothing to do with the original creator.

In the modern world, a copy can have exactly the same quality as an original recording. If I make a recording and I can charge $5 for it, but a guy on a market stall or website can legally take an exact copy and charge $1 for it, then that removes my right to sell my work for the price I want. And if, as you say, the copying expense are effectively zero, then realistically, I cannot charge anything after the initial release, because nobody would pay it.

The artists have a right to charge for their own work, but not for the work of others.

I'm starting to think I've misinterpreted your reply; what work of others? If all they have done is copy an original, that's hardly creative work worthy of payment..

Re:Markets always trump cartels eventually

[JesseMcDonald]

Since this is becoming a rather long thread, I'm going to try to limit this to the more basic points on which we appear to disagree: (1) distribution; and (2) derivative works & control over use. I'll also try to explain my reasoning regarding my last point, "The artists have a right to charge for their own work, but not for the work of others".

(1) Distribution. You assert that artists cannot make money selling access to their music without copyright, since the price of the copy would quickly fall to zero. It is true that the artist would be unable to profit in perpetuity from any given recorded performance, because the recordings would eventually become commonplace. At first, though, there is a rather large demand for the new music. The artist can take advantage of this demand to make a reasonable amount of money right away, by holding concerts and/or limited-access performances. It would be foolish to make any high-quality recordings at this point, since that would saturate the market early on and take away the advantage. Once the initial demand has worn off, perhaps, the artist might release one or more "official" recordings, which may find their way on to an online network of some sort, but at this point the artist has already been compensated for the effort of creating the first song, and has probably already moved on to the next one.

(2) Derivative Works. There have been court cases declaring that three notes is enough similarity to constitute infringement. Other cases have declared that works the artist thought were original were actually "subconsciouly infringing" on songs the artist had heard as a child. By these definitions, it is probable that there is no longer any possibility of creating a song that doesn't infringe on someone else's copyright. If all copyrighted songs were registered, then one could check for infringement ahead of time, but even that is not longer possible, since the registration requirement no longer holds. Also, the issue of credit is a sticky one, even with copyright. Should attribution be a legal requirement? Perhaps. Some even advocate that artists have the exclusive right to control all use of their work, even use that would otherwise be permitted under "fair use". For example, various companies have tried to use EULA's to keep their customers from publishing poor reviews of their products. It is certainly possible that some group that an artist is opposed to might use the artist's work in a way opposed to the artist's beliefs. However, this works both ways. The artist is free to speak out against any group to which he/she/it is opposed.

(3) "The artists have a right to charge for their own work, but not for the work of others". The work I was referring to here was not the work of creating the song, but rather the work of distributing it. This is probably one of the most inefficient parts of the current system, since the artificial monopoly of the recording labels over the music itself gives them an additional monopoly over the distribution of the music. By now, distribution of digital content has become extremely cheap. With the Internet, sending the necessary instructions to recreate a near-perfect-fidelity copy of any song to almost anywhere in the world can be done in a matter of minutes for less than one cent in additional costs. However, the copyright system, whether right or wrong, lets the labels monopolize the means of distribution and take in huge profits for doing something that should be nearly cost-free with today's technology, at the expense of both the customers and the artists.

Re:Markets always trump cartels eventually

[IngramJames]

Thanks for clarifying :)

At first, though, there is a rather large demand for the new music
But for there to be a demand, people must have heard the music.. for that to happen it must have been distributed in a listenable format to people who are now able to pass it on for free; even if it's not the highest quality. If it generates demand for live shows - great.. unless the artist isn't in a position to perform (back to an earlier point).

Derivative Works
Good points, which I mostly agree with, but shan't go into detail due to the longevity of this thread, as you mentioned :)

"Distribution stuff"
I still think that lower (almost non-existant) distribution costs can lead to chaper, more easily available music without any change to the copyright law.

I think where we disgaree is the legality; anyone can follow you the methods propose right now if they choose to - but I wouldn't want to have it forced upon me. The cartels will have to change in time, as new artists take advantage of the new distribution mechanisms. So trying to force change quickly through repealing copyright laws in a fashion wich could have damaging effects for many people is unneccesary, IMO.

I think we shall have to agree to differ, sir :)

Re:Markets always trump cartels eventually

[JesseMcDonald]

But for there to be a demand, people must have heard the music.. for that to happen it must have been distributed in a listenable format to people who are now able to pass it on for free; even if it's not the highest quality. If it generates demand for live shows - great.. unless the artist isn't in a position to perform (back to an earlier point).

I can agree to differ on most of the points, as you suggested, but I think I must point out one or two small issues with this countpoint.

An established artist does not necessarily need to advertise the specific new music that they will be performing. The artist's past performances, along with the promise of a new song or two, would probably be enough to generate demand even if no recordings of the new songs had yet been released.

Also, I would expect that most artists with permanent disabilities of one kind or another are still perfectly capable of holding a concert, or other form of live performance, despite their disability. In fact, a disability of some kind can be a form of asset as a performer, as most people are rather enchanted with the idea of a hero who carries on despite the obstacles blocking his/he way. If they're capable of making a recording, they're probably capable of doing exactly the same thing in front of a live audience. Temporary disabilities or illnesses, on the other hand, are a risk in any line of work, though perhaps more common among performers, and would generally covered by some form of health insurance specific to performers.

Re:Markets always trump cartels eventually

[j-turkey]

Sorry for the delay in my response. I've been out of town and away from a computer.

I think one of the major problems is how corporations are treated as a living citizen when it comes to the rights they enjoy, but escape many of the consequences that accrue to a living individual for bad/illegal behaviour.

A corporation does something bad/illegal, gets caught, fires the individual employee(s) involved and perhaps pays a fine, and goes on its' merry way, the corporation still intact. An individuals' life under similar circumstances would be over, as an individual can't figuratively send just one of his replaceable hands to jail for bribing a congressman.

This reduces the decisions on corporate behaviour to a simple one of if the behaviour will profit them enough to offset the loss if caught, and the likelyhood of being caught at all.

This, along with the huge financial differences, gives corporations a powers-of-magnitude advantage over individuals when it comes to the ability to exert influence and power.

So if a business breaks a law, do you suggest closing their doors forever? This may be a bit shortsighted, since large businesses employ thousands of 'regular folks' (presumably, like you and I). Further, much of our economy is built on the backs of these large corporations. Wouldn't it be better to weed out (prosecute) the individuals who participate in the illegal activity and serve them their justice than shut the lights and harm the thousands of us regular folks employed by the corporation? Even when companies are just fined, the people who will pay the most are the 'regular' folks who work for the company (layoffs), and the consumer -- the other regular folks. The latter will be handed the bill for increased costs of doing business by way of higher prices to cover those costs. I'm sort of with you -- not really in the shutting the doors, but in less slap-on-the-wrist fining, but going after the law-breakers personally. I'll get into this later.

As far as individual rights going to corporations, I think that you should read more about corporations and try to put the anti-business propaganda aside (the 'rights' issue has been a rallying cry for the anti-business crowd for some time -- it can really be narrowed down to this part of the article). You may find yourself a little more in the center if you consider all sides of this equally. There is a reason for treating a business like a person, and there is good reason for this not going away. However, all interests may be better served by simply defining a corporation's responsibilities better. If you're not into reading all of the Wiki stuff that I've linked, the idea is that if we're going to allow many people to own a business and not make it impossible to grow beyond the status of a small business (owned by a single individual), we have to establish certains rights and responsibilities, and make them as clear as possible. This is the cornerstone of our laws which govern businesses (the aforementioned rights and responsibilities). Again, much of our economy is built on this, and Americans would certainly not enjoy our high standard of living without it. Without these rules, rights, and responsibilities, we would not have a stock market, and companies would not be able to do things like raise money for high-ticket infrastructure items -- like a telephone network, cable TV, large international data pipes, or private communications satellites. Furthermore, it is important to indemnify shareholders...for example -- if the Coca Cola corporation kills a person and you are a shareholder, you shouldn't be held criminally responsible. To take it a step further, if you hold shares in a Mutual Fund, which also owns shares in the Coca Cola corporation (maybe even unbeknownst to yo

Re:Markets always trump cartels eventually

[BlueStrat]

"Sorry for the delay in my response. I've been out of town and away from a computer."

No problem, I've been in the same position...ah, the life of a poor blues musician. :-P

To your points, please don't misunderstand. I am NOT about corporation-bashing. I've started one myself. I don't think by any means shutting down a corporation and putting people out of work is a good thing.

That being said, I do think that we need much better-written laws along the lines of Sarbane-Oxley. The shareholders (unless they are the corporate officers responsible for illegal/unethical behaviour) should not be held responsible as in your Coca-Cola example.

Corporate officers, CEOs, CFOs, etc, responsible for decision making should not be able to use the corporation to shield themselves from prosecution, however.

As far as the McCain-Feingold Act and the 527s, as you say, both political sides are in a bit of a mutually assured destruction scenario there, so I think this places grassroots type advocates without clear party leanings and/or with positions unpopular in both major parties at a disadvantage. so, yes, we are both talking apples, and mostly agree here as well.

Again, I'm sorry if I came off as an outraged anti-corporatist. I most assuredly am not. My outrage is at the suffering of individuals caused by *some* corporations' amoral behaviour, along with the politicos with their hands out who are more than willing to turn a blind eye to these problems.

It seems we are in agreement on most of the major points, and my apologies for not quoting your post as I should, but I've just returned off the road from a performance and I'm about to go hit the rack for a day or so. :)

Thanks for taking the time to reply, and I appreciate the intelligence and civility of your post. I look forward to future discussions with you here on slashdot, and will make sure I note your future posts on other topics.

Cheers!

Strat

Cary Sherman speaks truth.

[mcgroarty]

"how many times that software applications created the same problem?"

The comparison is apt and honest. I can't count how many times regular application software has done this to me. For example, the time I put Outkast's Speakerbox CD into my drive, and I found a buggy version of Firefox had installed and masqueraded as a system DLL. Or the time I was listening to William 0rbit's Strange Cargo, all the while the CD was secretly installing an unpatched IIS server and updating the kernel to keep the install from showing. Boy, that sucks every time. :(

Clearly the analogy as apt, and we need a more progresive, less bigoted view: Just because it's a shrouded rootkit doesn't mean it's a security hazard.

Re:Cary Sherman speaks truth.

[theJML]

You know, this whole Sony rootkit wouldn't be so bad if it was Cool software. I'd love to throw in a CD I just bought, only to be prompted to install a free version of 3D Studio Max, or the latest version of Adobe Studio.

Re:Cary Sherman speaks truth.

[Anonymous Coward]

Saying that 'because software you choose to install may lead to security leaks make it okay that software that installs itself without warning opens up security leaks' is like saying 'because sleeping with someone you choose to may give you herpies then it is okay that someone who rapes you gives you herpies'.

Re:Cary Sherman speaks truth.

[jfengel]

The rootkit does give you a warning, in the form of a badly-written and probably meaningless EULA. I'm sure not defending the action, but it wasn't rape. It's saying "yes" to a charming asshole.

Re:Cary Sherman speaks truth.

[karmatic]

The issue being that if you close it without saying yes, it still installs the rootkit anyway.

Re:Cary Sherman speaks truth.

[WarezApzz]

Clearly you are in danger of being biased.
The analogy is little more than a immature "He did it first" tactic. The truth is: Should your actions be honorable then there should be no reason to hide such actions. He also stated how Sony was aggressively trying to correct any problems. FLAW: Correct the problem?!?! Not bloody likely! Sony is trying to CYOA. Class action law suits have already sprung up against Sony, and now they scurry like cockroaches in order to lessen damage already done.

Clearly the music industry and the software industry should take the obvious lesson to be learned here: I may not have been guilty of 'stealing' music/software before, but after seeing your underhanded actions I will definitely have no moral issues about doing so now.

Re:Cary Sherman speaks truth.

[Anonymous Coward]

uuhh... no way! never! installing a rootkit when the CD is inserted into the computer is an unauthorized change to the computer. the fact that a flaw in the way windows is typically set up makes it easy to slip this trick past a consumer is no excuse!

the problem is not that the rootkit is flawed. the problem is that it is a change made to the system through subterfuge. think of another case, like Webhancer....you probably recognized the name when you discovered something wasn't right with your computer because you saw it in the click through agreement, but it was not obvious what this program would do to your system (intercept your TCP/IP stack, thereby screwing up your computer).

It isn't even the case that if the rootkits were "flawless" that the problem would go away. if you say that you are running "Windows XP SP2", then that is what you are supposed to be running when you close all the other programs down. That's what all other programs expect...not "Windows XP SP2 with a webhancer'ed TCP stack and a sony rooted filesystem". If Sony gets away with this, then keystroke loggers are fine too as long as there was a lengthy EULA that mentioned it in the trojan horse's installer program. But you know if we managed to get the head of Sony to install such a keystroke logger that he would complain loudly about his private information being sent off to the gang that got it packed in with the trojan horse.

All I can say to them is:

If you want to go after piracy, then continue pursuing people that are actually violating the law. If the cost/benefit of CDs isn't working out, then you are just going to have to try to peddle us a format that puts the cost of copying above the cost of purchase. The recording industry survived casette tapes and even had a long period in which people didn't copy CDs at all. If you can't create something people will buy, then you just aren't trying.

People are buying $500 mp3 player and buying music for them at $1 per song (all without the costs of physical stores to you) and getting a $1500 computer based largely on how well it works with the player. They buy t-shirts for more than $20 on a regular basis. And you call these people cheap! The record industry needs to wake up and start thinking about how they can profit from getting a slice of airtime on cell charges, a slice of the expensive mp3 players and the peripheral items that surround them. The new strategy of corporate and political propaganda disguised as music will never sell well, but selling products branded with the music seems acceptable to most people.

I get the impression that they are resigned to creating and pushing submissive nobodies in order to get a quick ROI before they push out another one, and throw artists that don't do what they are told into the memory hole. ("What? You DON'T want to drink Coca Cola in your music videos?!?! You don't like reality TV?!??!") People don't respect the products enough to buy them at their asking price.

Re:Cary Sherman speaks truth.

[Anonymous Coward]

The difference is that when you buy music, you expect only what you just bought, nothing hidden. How would you feel if, while buying gasoline at your local station, it secretly installed software that limited top speed, or lowered your fuel mileage, or required the use of only that brand of gasoline in order to run in the future. You don't expect it, you don't want it, you can't escape it. That is not informed consent.

Re:Cary Sherman speaks truth.

[fastpathguru]

Since when does an honest bug require close interaction with virus software companies to hide it?

fpg

Re:Cary Sherman speaks truth.

[Anonymous Coward]

there is no i in herpies

Re:Cary Sherman speaks truth.

[jfengel]

Missed that part. Yeah, that's rape.

In Other News...

[Anonymous Coward]

Satan says Hitler did nothing wring!

Re:In Other News...

[GFunk83]

...and by bringing Hitler into the argument you've automatically lost.

Re:In Other News...

[Anonymous Coward]

What are you, some kind of nazi?

Re:In Other News...

[cocoamix]

Hm. That might xplain why Karl Rove still has his job. :)

Re:In Other News...

[moxley]

Hitler. Halocaust. (I've just fucked us all).

Re:In Other News...

[log0]

What argument? Who was the parent arguing with?

So he metioned Hitler. Big deal. If he said Saddam instead would his point be more valid?

Oh really!

[nemaispuke]

I wonder if Cary would be saying that if the RIAA was named in several lawsuits and was facing the the bad press Sony is currently getting?

Re:Oh really!

[Fx.Dr]

Furthermore, do you think he's even aware of the potential lawsuits following Sony's violation of the GPL in place on the public code used in the rootkit they've distributed?

Commercial rootkit?

[GGardner]

The most surprising thing to me about this whole affair is that there are companies selling rootkits. Which makes me wonder -- who else is buying them? Who knew this was a legal commercial enterprise? Can we get a list of their other customers?

Re:Commercial rootkit?

[Patrik_AKA_RedX]

Can we get a list of their other customers?

Anyone knows a comparing study on the quality of brick walls? This revolution is going to need a very strong wall...

Re:Commercial rootkit?

[Anonymous Coward]

I put Snort sigs in place for the Sony traffic http://www.bleedingsnort.org/ and got hits from the following company

I have loaded the Sony DRM sigs but have gotten hits from other products. I am wondering if this is a false alert or another company using this root kit for DRM

000 : 50 4F 53 54 20 68 74 74 70 3A 2F 2F 77 77 77 2E POST http://www./
010 : 70 68 6F 74 6F 73 68 6F 77 2E 6E 65 74 2F 4D 50 photoshow.net/MP
020 : 53 4E 41 70 70 53 65 72 76 65 72 2F 73 65 72 76 SNAppServer/serv
030 : 69 63 65 73 2F 6C 6F 67 67 69 6E 67 20 48 54 54 ices/logging HTT
040 : 50 2F 31 2E 30 0D 0A 41 63 63 65 70 74 3A 20 61 P/1.0..Accept: a
050 : 70 70 6C 69 63 61 74 69 6F 6E 2F 2A 2C 20 61 75 pplication/*, au
060 : 64 69 6F 2F 2A 2C 20 69 6D 61 67 65 2F 2A 2C 20 dio/*, image/*,
070 : 6D 65 73 73 61 67 65 2F 2A 2C 20 6D 6F 64 65 6C message/*, model
080 : 2F 2A 2C 20 6D 75 6C 74 69 70 61 72 74 2F 2A 2C /*, multipart/*,
090 : 20 74 65 78 74 2F 2A 2C 20 76 69 64 65 6F 2F 2A text/*, video/*
0a0 : 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 ..Content-Type:
0b0 : 74 65 78 74 2F 70 6C 61 69 6E 0D 0A 55 73 65 72 text/plain..User
0c0 : 2D 41 67 65 6E 74 3A 20 53 65 63 75 72 65 4E 65 -Agent: SecureNe
0d0 : 74 20 58 74 72 61 0D 0A 48 6F 73 74 3A 20 77 77 t Xtra..Host: ww
0e0 : 77 2E 70 68 6F 74 6F 73 68 6F 77 2E 6E 65 74 0D w.photoshow.net.
0f0 : 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A .Content-Length:
100 : 20 31 36 33 0D 0A 50 72 6F 78 79 2D 43 6F 6E 6E 163..Proxy-Conn
110 : 65 63 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 ection: Keep-Ali
120 : 76 65 0D 0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 ve..Pragma: no-c
130 : 61 63 68 65 0D 0A 0D 0A 3C 3F 78 6D 6C 20 76 65 ache..........
190 : 3C 69 6E 73 74 61 6C 6C 49 64 3E 35 66 37 35 30 5f750
1a0 : 34 66 36 33 61 66 38 37 38 35 61 39 32 63 36 33 4f63af8785a92c63
1b0 : 63 62 64 38 30 61 38 66 63 63 66 3C 2F 69 6E 73 cbd80a8fccf
1d0 : 3C 2F 73 65 72 76 69 63 65 3E 0D 0D 0A ...

Re:Commercial rootkit?

[MindStalker]

From what I understand is that Sony built this rootkit themselfes though they did steal GPL code on the way.

Re:Commercial rootkit?

[Anonymous Coward]

> From what I understand

not really all that much, as it turns out, huh?

You may have not heard, but a company called First 4 Internet actually developed and licensed this "DRM Solution" to Sony

http://www.eweek.com/article2/0,1895,1887181,00.as p

Dan Kaminsky, an independent security researcher, discovered evidence that so-called "rootkit" style stealth programs developed by U.K. firm First 4 Internet Ltd. and used by Sony while conducting an audit of the DNS (Domain Name System) infrastructure.

This has been all over /. for the last couple weeks. Are you really that stupid to ignorantly post something contrary to what has been very public knowledge for some time now, or are you just a stupid troll?

Re:Commercial rootkit?

[Fishstick]

not quite...

http://www.xcp-aurora.com/press_article.aspx?art=f eb_05_art3

NEW YORK (Billboard) - It looks like music retailers will soon be getting their wish: At least one major is getting aggressive with copy-protected CDs.

Sony BMG Music Entertainment is stepping up the rollout of what it calls content-enhanced and copy-protected CDs, according to company executives. It began with the Chieftains' "Live From Dublin" album, released Feb. 22. Upcoming albums that will receive the treatment are from Kasabian (March 8) and Susie Suh (March 29).

Sony BMG expects that by year's end a substantial number of its U.S. releases will employ either Sunncomm's newly enhanced MediaMax or First4Internet's XCP to address piracy concerns. No matter which technology a CD uses, it will include such extras as photo galleries, enhanced liner notes and links to other features.

First4Internet's XCP - the true meaning of audio security

XCP copy control technology is aimed at protecting the rights of Content Owners from the unauthorised and illegal copying of digital music and film on CD, DVD and on the Internet.

First4Internet is the one who apparently used GPL code without permission or attribution. Sony didn't build the rootkit on their own or directly steal GPL code (though they did distribute it, knowingly or otherwise).

Re:Commercial rootkit?

[KitesWorld]

Likely a false alert. The Rootkit itself doesn't communicate on the internet - the Music player (which is a seperate program, even 'tho it's installed at the same time), however, does.
Given that the two are installed at the same time, you can be fairly sure that any traffic from the player itself is indicative of the rootkit. Hits from other software, on the other hand, don't mean a damned thing.

Well, except that that other software uses the 'net for something. >_>

Re:Commercial rootkit?

[antiMStroll]

What surprised me was Norton and Symantec were aware of it but chose to treat it as a 'good' root kit on its customers behalf and without their express knowledge. I'll never buy their product.

Re:Commercial rootkit?

[sploxx]

The most surprising thing to me about this whole affair is that there are companies selling rootkits.

Rootkit, rootkit, rootkit. No one understands that. At least here in germany, calling it a "Trojaner" gives people something to which they can relate to (as this is really a trojan).

I do find it very interesting that noone in the media is calling this a trojan, only a 'rootkit that (accidentally) enables trojans to get into the PC'. I'm normally no conspiracy theorist, but I wonder if the spin is intentional or just because no journalist has a clue.

Thank goodness for Konqueror

[filesiteguy]

I was wondering when - after I bought a recent album - Konqueror opens up instead of Amarok. I thought, WTF? Then I realized I had a Sony CD. I'd be pissed if I were a Windows user - or worse, a sysadmin - and this thing got installed on my desktop.

Re:Thank goodness for Konqueror

[forkazoo]

Well, I'm a sys-admin at a company with a few hundred desktops. AFAICT, there isn't any way to scan my whole network for the rootkit, and the only sure fire, safe way to remove it is to reimage the machines that have it. Thankfully, it does phone home, so we have started looking through firewall logs for anything trying to get to the phone-home website. Still, a major PITA.

Re:Thank goodness for Konqueror

[Zocalo]

There is also another way which might be easier depending on your setup. As you say, the root kitphones home, and that means it has to perform a DNS lookup of the domain. In order to see which, if any, of your hosts have the Sony rootkit installed you could also enable query logging on your DNS server and see which hosts are doing that. Better still, you could also create a dummy zonefile for the zone and redirect the requests to /dev/null while you are at it - I've got a whole list of zones (mostly banner ad companies) /dev/nulled this way, and best of all they can all use the same zone file with BIND. Create an entries in named.conf like this:

zone "spammers.com" in { type master; file "devnull.master"; };
zone "phishers.net" in { type master; file "devnull.master"; };

Then create a zonefile "devnull.master" with records like this:

* IN A 127.0.0.1
@ IN MX 5 127.0.0.1

and none of your users will see any web traffic or be able to "unsubscribe" from them ever again...

Re:Thank goodness for Konqueror

[TheRaven64]

I hope your company sends Sony an invoice for all of the time you spend fixing this problem at your standard charge-out rate (not your salary rate).

Re:Thank goodness for Konqueror

[TubeSteak]

You forgot one

zone "slashdot.org" in { type master; file "devnull.master"; };

Re:Thank goodness for Konqueror

[TCM]

Uhh, this is a very, very ugly way to do things. You twist the semantics of the global namespace and potentially redirect all traffic to those domains to 127.0.0.1.

What if your users are developers running a local httpd?

If you want to block HTTP traffic, use an HTTP proxy. The proper way to implement ACLs is to return a code that indicates "denied", not return false information as if it were real. This only leads to headaches later, when noone thinks about this "solution" anymore and tries to debug a real problem.

In one way, this solution is slightly better than the stupid hosts-file-mangling you see everywhere because it's centralised. OTOH, it's just as stupid as that because it's like driving a screw with a hammer.

There is one case where fiddling in BIND is appropriate. This is cases like omniture.com. They smuggle data through DNS by requesting weird hostnames like [long encoded string].omniture.com. I saw this when browsing through ebay one day. In this case, you have to block on the DNS level, but not by falsifying the information.

I checked out which nameservers are authoritative for omniture.com. Then I checked which networks they belong to. Those networks I put in a blackhole clause in named.conf. So whenever I request something in omniture.com , at least I get a "server failed" which hints me to BIND, should I forget one day that I blocked them.

Re:Thank goodness for Konqueror

[kawika]

It is not hard to detect the Sony/XCP rootkit using a simple script. Even in its cloaked state, several telltale signs peek through. For example, it only hides keys that start with $sys$ and Windows requires a few keys where that string is not at the start of the key. One of these is LEGACY_$sys$drmserver. See the CA writeup for details on the keys and where to find them.

Re:Thank goodness for Konqueror

[Anonymous Coward]

That is kind of hard to do in KDE. Fortunately KDE does not support AutoRun (running code), only AutoPlay (launching a web browser or media player).

Re:Thank goodness for Konqueror

[jtrott]

All you need to do to find the sony-bmg rootkit is to create a new blank file somewhere on the hard drive, rename it to $sys$filename, then see if you can still see it.
If the file has vanished, you have the sony-bmg rootkit. If the file is still there, delete it and move on to the next machine.

Re:Thank goodness for Konqueror

[Grand High Wonko]

Yet another reason why you should never give the normal user install rights on your network.

Re:Thank goodness for Konqueror

[petermgreen]

can't you just put something in your login scripts that creates a file with the magic identifier in its name and messages you with the pcs details if the file it just created isn't in a directory listing?

Does this surprise you?

[SlashAmpersand]

I'm sure they'd love the DMCA to include permission for them to place rootkits with impunity. Because we all know that DRM is FAR more important than protecting all the data on my hard drive. I'm sure he's perfectly willing to put his money where his mouth is and run the Sony rootkit on his personal and business computers...

Re:Does this surprise you?

[2old2rockNroll]

I'd say don't give them any ideas, but I'm sure their lawyers have already sent the proposed legislation to a few cooperative members of Congress.

They did nothing wrong

[JBlaze03]

Never mind that their software contained copyrighted code

Re:They did nothing wrong

[RPoet]

... and that their CD's contained copyrighted music.

Re:They did nothing wrong

[mrchaotica]

Why, of course it did! It contained code copyrighted by First4Internet (or whatever it's called), for one thing. That's not the problem, though, because that code was licensed.

To be accurate, what you need to be complaining about is "that their software contained copyrighted code which they did not have legal permission to distribute."

Re:They did nothing wrong

[JBlaze03]

You are correct. I was complaining about the code they included that was not their own. Sorry for overestimating your ability to understand that.

Re:They did nothing wrong

[sabernet]

I didn't know Jon Johanson and the LAME designers worked for First4Internet?

idjit

Re:They did nothing wrong

[mrchaotica]

Oh, it's not an issue of me understanding it; it's an issue of being scrupulously accurate so that our opponents (i.e. the RIAA and their shills) can't twist our words and use them against us. Making blanket statements like you did confuses the issue, and plays right into their hands.

For example, the major strategy in their campaign against P2P is to convince everyone that sharing any copyrighted work is illegal, and that there's no such thing as Free Software, public domain media, or the Creative Commons. They want to make us forget about the legal uses of the programs so that they can make the programs themselves illegal.

I corrected you because I didn't want you to accidentally help them. See, there's a method to my madness! ; )

Re:They did nothing wrong

[mrchaotica]

Well, gee, and I didn't know Jon Johanson and the LAME designers made the rootkit part! I never said all the code was copyrighted by First4Internet, you know!

Now who's the idjit?

They're innocent! (But who is 'they'..?)

[endemoniada]

So... If I shoot someone for stealing, I'm just being responsible, and I can also claim I had no knowledge of Smith & Wesson makings things that really kill people? "B-but judge, I thought they'd just get scared from the sound, and run away...? *sob*"

Mmmmmmm

[jlechem]

Foot Sandwich

Responsible?

[bugbeak]

So...waiting days after this rootkit was shown to the wild before actually taking action is considered responsible? Let's give FEMA an award for speed and responsibility!

Re:Responsible?

[chunews]

"RIAA, you're doing a heck of a job!"

Re:Responsible?

[Anonymous Coward]

...and a week of bad press on Slashdot...

Nobody gives a shit about bad press on Slashdot. With the great "editing" and important stories like "BOO HOO I'M NO LONGER CMDRTACO ON WOW" it's no wonder.

Re:Responsible?

[mrchaotica]

Piracy is bad, but so is getting rooted...

Copyright infringement may be bad, but getting rooted is orders of magnitude worse, because it opens your computer to other crackers and malware. Given the hundreds of thousands of computers that are affected, this even has implications for National Security -- terrorists could launch one Hell of a DoS (or otherwise) attack with that many zombie machines!

No, what Sony has done is much worse than copyright infringment; it's very nearly terrorism!

Re:Responsible?

[Loonacy]

I completely agree.
FEMA was slower when an idiot was in charge, so we should be glad it's slightly less inept now that a bumbling moron is in charge!

Re:Responsible?

[Rude Turnip]

"It took a California lawsuit, the EFF, and a week of bad press on Slashdot for them to pull this.."

That, and a royal bitch-out by a small, obscure federal bureau called...oh, what's its name? Ah, yes...The Department of Homeland Security!

Re:Responsible?

[strider44]

As an Australian I don't mind being rooted one bit.

Re:Responsible?

[ve3oat]

If I were a hacker (which I am not, though some days I might like to be), I would hack the RIAA website so that every few minutes any page there would flash the question on a viewer's screen "So how does it feeeeel?" I'm sure there are other, more worthwhile attacks too. But I'm not a hacker.

Hmmm

[the computer guy nex]

This is like a M$ shareholder saying there is nothing wrong with their business practices.

Fantasyland!

[Anonymous Coward]

the fact that this whole r00tkit fiasco has set DRM back by years.

Hey Hemos! What color is the sky on your planet? Think about it for a minute. Do you truly believe that this minor incident with Sony-BMG will have any significant effect, even with Sony let alone any other label? I guarantee you that Sony_BMG is already scrambling to get the "latest generation" DRMed CDs on the shelves before Christmas. You must live in Fantasyland.

Spinning faster that a DRMed CD...

[Anonymous Coward]

Wow, look at the dirty laundry being spun today! Notice no mention of stealing others IP to try to lock down your own.

I agree :-)

[Anonymous Coward]

Yes, HOW MANY times have I put a CD in my WIntel workstation and had software secretly installed on it? Must be at least a hundred...no, a thousand? ...no, a million? ...no
Oh yeah, I forgot.... It HAS NEVER happened before this

That's why we must stop it NOW.

Re:I agree :-)

[RandoX]

How do you know? That's why they call it "secretly installed".

Re:I agree :-)

[Anonymous Coward]

Actually, I know that it's secretly happened 6 times to your machine. Not that *you'll* ever find it. C'est l'vie.

Big Surprise?[ - Radio now]

[saskboy]

"President of RIAA Says Sony-BMG Did Nothing Wrong"

In other news, cows give milk.

Anyone interested in local radio coverage of this story, CJME.com is about to do a show on the Sony rootkit, you can listen live at 10:05AM CST, and again in the evening for a rebroadcast. Sorry, no podcast is made.

Re:Big Surprise?[ - Radio now]

[leuk_he]

Well if you did follow the story, and came any futher than "sony=rookit=evil"then you would notice that most antivirus creators did conclude the same. THe only thing they do remove is the rootkit(=hide the drivers), not the DRM software. So President of RIAA does follow a common opinion.

Re:Big Surprise?[ - Radio now]

[incabulos]

Sony were knowingly distributing viruses and code in violation of its license - a practice known as copyright infringement by most people.

Both of these acts are criminal, and will result in a police raid, arrests, seizures of equipment, and so on if the group involved is a person. Corporations are apparently too sacred and important to be hindered by such laws.

But why not take a cue from the RIAA - arguably the most visible and outspoken copyright police in existance. The next time you get harrassed by law enforcement ( or the RIAA themselves ) for infringing copyright simply say that you have done nothing wrong. The RIAA says the copyright infringment of Sony is 'nothing wrong', so it must be true!

Who installs software from an audio cd?

[simetra]

That's my question during all this. Why don't people just rip the tracks to mp3 and be done with it? Does everyone have auto-play on for audio cds? If so, don't they kind of deserve whatever they get?

Re:Who installs software from an audio cd?

[Halo1]

I've read the installer of the software on the audio cd autostarts under Windows, and that even if you answer "no" to the question whether you want to install that software, it still installs something (though not as much as when you tell it to proceed).

Re:Who installs software from an audio cd?

[CosmeticLobotamy]

Why don't people just rip the tracks to mp3 and be done with it?

Because you need to put the CD in the computer first.

Does everyone have auto-play on for audio cds?

No, but they do have auto-run on for everything, because turning it off requires editing the registry, which 99.97% of Windows users don't even know exists.

Re:Who installs software from an audio cd?

[Jearil]

The problem is, Windows by default has auto-run enabled upon CD insertion. Most people won't go through the hassle of turning this off (it's not even in a very obvious place to turn it off..) So yeah.. someone might want to rip it to MP3.. but as soon as you insert the disk it auto-runs the rootkit which then hides itself and disables your ability to rip the files (what it was meant to do).

So to answer your base question... Yes. (most) everyone does have auto-run enabled for all CD's (these discs Sony put out have both an audio and data track.. so the line between audio and data CD is a bit blurred) because it is the default; which most people do not change.

Re:Who installs software from an audio cd?

[SirTalon42]

Its not the auto playing of the audio side that is the problem, its the data section of the cd being auto-ran that install the software. Windows defaults to auto-running whatever software the cd says should be auto-ran. How many people actually know how to disable the autorun?

Re:Who installs software from an audio cd?

[everphilski]

The problem is, Windows by default has auto-run enabled upon CD insertion. Most people won't go through the hassle of turning this off (it's not even in a very obvious place to turn it off..)

Windows XP: Go to My Computer. Right click on your CD-ROM drive. Click Properties. Click the "Auto Play tab. Click "Prompt me each time to choose and action" or "Take no action". Done. How much easier or logical can it get?

-everphilski-

Re:Who installs software from an audio cd?

[BushCheney08]

Who installs software from an audio CD? Anyone who runs Windows and hasn't specifically disabled autorun for the optical drive. It's not like it prompts you to install it. In other words, simply putting the disk into a drive on ~98% (I'm guessing here) of the Windows machines out there will result in the rootkit being installed.

Re:Who installs software from an audio cd?

[Prospero's Grue]

Does everyone have auto-play on for audio cds? If so, don't they kind of deserve whatever they get?

What? "Well, come on judge. She was playing a CD...she was obviously looking to have a rootkit installed on her system."

What kind of elitist nonsense is this? Lots of people auto-play CDs. I autoplay CDs despite the fact I have ripped them, and know my way around the box. (Obviously I have to be more careful, now.)

Yes, ultimately the victims of these DRM-schemes are going to be the average schmucks, but that doesn't mean that being at the average level of sophistication means that you're so dumb that you brought it on yourself.

Re:Who installs software from an audio cd?

[91degrees]

No, but they do have auto-run on for everything, because turning it off requires editing the registry, which 99.97% of Windows users don't even know exists.

Under XP, right click on the CD-ROM drive and select properties, then autoplay. This allows you to disable autoplay of CDs. I don't know whether people know this, but a lot more will know this than about the registry.

Re:Who installs software from an audio cd?

[syrinx]

No, but they do have auto-run on for everything, because turning it off requires editing the registry,

Er, I suppose if you're really into doing things the over-complicated way, you probably *could* edit the registry to turn it off, but it's blatantly false to claim that it "requires" it. I've been turning auto-run off since Windows 95 and never once had to edit the registry to do so.

I wish there was a "-1, Stupid" or "-1, Completely Untrue" mod.

Re:Who installs software from an audio cd?

[Anonymous Coward]

"Does everyone have auto-play on for audio cds? If so, don't they kind of deserve whatever they get?"

No, they don't deserve whatever they get for using a feature of their operating system. The operative word is "Audio" not data which could have an executable file on it. Any software that installs anything on a users computer without permission is wrong, any company that distributes software like that is equally wrong, and should be liable for any cosequences of that act.

Re:Who installs software from an audio cd?

[Anonymous Coward]

AutoPlay and AutoRun are two different "features." In order to disable AutoRun you have to edit HKLM\SYSTEM\CurrentControlSet\Services\Cdrom\AutoR un [via]

Re:Who installs software from an audio cd?

[Prospero's Grue]

How much easier or logical can it get?

Yeah! See how easy it is when you're given the step-by-step procedure? I don't know what's wrong with these people.

Re:Who installs software from an audio cd?

[Loonacy]

While i'm not entirely sure what exactly the Sony CD's do, I'm fairly certain that a Windows PC doesn't treat it as an audio CD. When you put it in, it autoruns an EXE, so merely disabling automatic audio CD playing won't stop this from occuring.

Re:Who installs software from an audio cd?

[arkanes]

I can't say specifically if the Sony rootkit does that (but it probably does), however there absolutely are DRM kits(although sadly I can't provide a citation as the info is on my laptop) that do run(via auto-install) as soon as the disc is inserted. If you accept the EULA, the software is actually "installed" per se, if you don't it's just loaded into memory but not installed on the PC and not configured to auto-start - a reboot will clear it. However, the fact that the software does that, to my mind, throws many of the claims as to the legality of such software heavily into doubt - when you rely on an EULA for your legal justification, running before the EULA is accepted seems very questionable.

Re:Who installs software from an audio cd?

[Rude Turnip]

"How much easier or logical can it get?"

Those steps are neither easy nor logical. You're giving wayyyyyyyyyyy too much credit to the average computer user. Most people will not even make the assumption that they have a choice in disabling any of that stuff. It scares the hell out to me to see the amazement of friends and co-workers when I show them how to do things that the average Slashdot reader takes for granted as easy.

The easiest and most logical thing that can be done is NOTHING WHATSOEVER. Most people seem to forget that "do nothing" should always be the first option. If you're putting a music CD in your CDROM drive to listen to music, you'll know that you need to launch your music player.

Re:Who installs software from an audio cd?

[Loonacy]

Well, there's editing the registry, or installing something like TweakUI. Those are really the only ways to disable autorun. You CAN disable autoplay in the CDROM properties dialog, but that's not the same thing.
In order to disable autorun, "editing of the windows registry is necessary."

Re:Who installs software from an audio cd?

[Prophet of Nixon]

There is a key in the registry that stops non-system processes from accessing the index of available drives. I can never remember the key, but I know it defeats programs that scan for cd emulators, and I'm wondering if it might play some role in preventing these kinds of attacks too.

Re:Who installs software from an audio cd?

[BrokenHalo]

I wish there was a "-1, Stupid" or "-1, Completely Untrue" mod.

Heh... I more often tend to find myself wanting a "-1 wtf is this guy on about?" mod.

Re:Who installs software from an audio cd?

[bhtooefr]

Umm... that's really short-sighted.

Not everyone knows to go digging in Group Policy (gpedit.msc, FWIW), go to Administrative Templates>System under Computer Configuration, and enable "Disable autoplay".

Re:Who installs software from an audio cd?

[91degrees]

Hmm. Seems I got autorun and autoplay mixed up.

Re:Who installs software from an audio cd?

[Kjella]

a) It's not obvious to most people
b) It inconvieniences most people, because nearly all of the CDs do what they want them to do when inserted.

In short, music CDs are being a PITA, and the only way to get rid of it is to make launching any application from CD a hassle. This is very typical for people that use physical CDs instead of Deamon tools for games and the like. I don't like it on music CDs in general even with plain software, I don't think I have to tell you about a CD that installs rootkits instead of software and does so without asking. The users don't know how to to it, but more importantly they shouldn't have to do it!

Wrong illegal and unethical

[secondsun]

Sony may not have done anything patently illegal. The EULA does inform the end user that they are making modifications to their system. However this fact is (reportedly) buried in the EULA and there is not any install notification. The fact the program goes so far to hide itself that it reprograms part of the windows core system (and does not implement proper checking which can lead ot deliberate crashing) is definantly unethical.

Re:Wrong illegal and unethical

[voice_of_all_reason]

The EULA does inform the end user that they are making modifications to their system. However this fact is (reportedly) buried in the EULA and there is not any install notification.

Well, there you go. In this country, you have to be up front about EULAs. You can't just call it 1103sys.ini.txt and say it's the user's fault for not reading every file in the CD.

A great example I read before on slashdot was about a storeowner who hid a sign behind the counter that said "Anyone who enters my store, I get to punch in the nose." He can't hit you, then say that it was your responsibility to fully examine the store before walking in.

Re:Wrong illegal and unethical

[multriha]

The parts of the software are installed and activated before the EULA is even displayed to the user.

Re:Wrong illegal and unethical

[_LORAX_]

I can confirm that at least one disk "Chris Botti" the rotkit installed WITH NO EULA. That IS patently illegal in any handbook.

Re:Wrong illegal and unethical

[KitesWorld]

Wrong kit mate.
You're thinking of MediaMax - which is outright illegal here in the UK (Computers Misuse Act, Section 1). MM installs and runs components designed to limit access to the CD before showing the EULA. Declining the EULA doesn't remove them, either.
The F4I cd's are a 'little' nicer about it - they don't install the rootkit 'til after you've clicked through. Still a pain in the fricking arse tho.

Re:Wrong illegal and unethical

[Digital Vomit]

That IS patently illegal in any handbook.

I hope the guy who owns the patent on that sues Sony into oblivion.

Re:Wrong illegal and unethical

[ObsessiveMathsFreak]

Sony may not have done anything patently illegal. The EULA does inform the end user that they are making modifications to their system.

Pffftt! The EULA said a lot of things. A LOT of things. It has about a snowballs chance in a Google data server container of standing up for more than ten minutes in court. EULAs in shrinkwrap software is one thing. EULAs in shrinkwrapped music CDs is quite another.

Oh, I'll expect Sony to puff up like a blowfish, indignantly declaring that because you clicked yes they in effect have complete dominion over your entire PC and everything on it, as well as most of your actions for the rest of your life if most EULAs are obeyed to the letter.

Whatever. I'll expect the judges to frown once they learn that Sony is the vector for one of the worlds biggest computer virus infections, and that they're seeking to justify it using the most dubious type of legal agreement since the oral contract. With any luck EULAs will be universally declared null an void and people can go back to actually buying and owning goods.

Re:Wrong illegal and unethical

[Anonymous Coward]

As many as pointed out, Sony distributed other people's copyright software illegally (*).
Even if they have done nothing criminal, they can still be sued for damages in a civil court
for what their root kits has cost and for removal as the end users are not informed about
the root kit installation.

I would love to see they being sued for $150,000 a piece for copyright violation of the software
and $10,000 each for damage to the customers.

Note: They violated the license terms of a few pieces of software.

Re:Wrong illegal and unethical

[Anonymous Coward]

That's just it - a CD isn't supposed to come with an EULA. Licence agreements are for licenced products, not for music CDs. When you buy a CD, you own that CD and can use it any way you please within your fair use rights. You can make as many copies as you want as long as you don't distribute them. You can lend them to others, you can play them at private parties, etc.
It doesn't matter what the EULA said - music isn't the same as software. You aren't buying a licence to listen to the music.

Re:Wrong illegal and unethical

[Zordak]

I wouldn't expect EULAs to be declared generally invalid. More likely, they will be treated like any other form contract when and if they are tested in court. Which is why nobody wants to test them in court. Courts recognize the necessity of form contracts as a matter of public policy. They're necessary for doing business in a mass consumption economy. But the court also recognizes that NOBODY READS THEM. So courts will generally only enforce those parts of a form contract that a reasonably prudent consumer would expect. Anything that wouldn't be expected will generally have to be prominently displayed and separately agreed to. Which means if Sony wants you to agree to let them root your computer, they probably have to tell you expressly that they intend to do so and have a big button that says, "Yes, install subversive spyware" before a judge would charge the consumer with having agreed. In which case, Sony is almost certainly in violation of laws that they and their buddies flagrantly purchased.

Re:Wrong illegal and unethical

[N1AK]

Now that is something, I mean how much more blatantly illegal can something be than without your permission (or even hidden warning) installing something that modifies your computer. I KNOW that is a crime under UK law (infact wasn't that the one they did the security consultant who was checking the charity website for).

Also as you have not read (and then by dodgy implication agreed with) the EULA you havent agreed to the clause saying you can only hold Sony for $5 of damages.

I may be missing something, but thats breaking the law, damaging your computer and not having any limited responsibility. How can sony not get shafted for this?

Re:Wrong illegal and unethical

[Anonymous Coward]

patently - adj. "Very", as in: that is patently absurd. Synonyms: literally, incredibly, totally.

Re:Wrong illegal and unethical

[ucblockhead]

A EULA isn't a "get out of jail free" card. Just because it asserts that Sony gains certain rights doesn't mean it has any legal force! For instance, they could bury in the EULA "Clicking 'yes' gives Sony the right to conduct snap physical inspections of the user's PC". They'd still be in a shitload of trouble for trespassing if they actually did!

Re:Wrong illegal and unethical

[SilverspurG]

patently - adj. "Very", as in: that is patently absurd. Synonyms: literally, incredibly, totally

It's an adverb just like all the others you've cited. As an adverb it should be formed from the adjective--meaning it should be "patentedly". Merriam-Webster, however, supports the lazy "patently" formed from the noun or verb "patent". If you look at all adverbs, though, they're nearly always formed from the adjective.

It makes me cringe every time I see it. "patently"... -ly on the end of a noun form.

You don't grin sheeply (from the noun). You grin sheepishly (from the adjective). You don't speak forcely (from the noun). You speak forcefully (from the adjective). You shouldn't do something that's patently illegal (from the noun). That should be patentedly absurd (from the adjective).

And no, I don't really care. I've been wanting to write this grammar rant for years. :)

Re:Wrong illegal and unethical

[Anonymous Coward]

ZOOOOOOOOOOOOOM!!!!!

Re:Wrong illegal and unethical

[Anonymous Coward]

But your rant is patent nonsense!

patent adj. 1. easily recognizble; obvious : she was smiling with patent insincerity

Re:Wrong illegal and unethical

[SilverspurG]

I guess that depends whether or not you recognize that many nouns are made into adjectives by adding -ed. If you look up patented you will see that it is also the adjective form of the noun patent.

As per my original rant I consider the adjective form "patent" to be lazy. It's a result of most people not being able to easily pronounce the phonetic sound "-a-ten-ted" choosing instead to quit after "-a-tent". Many people have problems with the staccato inflection.

In the case of patent vs. patented as the adjective it stands to reason that "patented" is preferable as it follows the general method of forming the adjective by adding -ed or -ish to the noun. Refusing to recognize the typical transformations of words is trollish behavior. You may have a patent on being a troll but few people will follow your patented behavior. You may argue that your behavior is best described as patent tomfoolery but that would be patentedly out of line with the established conventions of forming an adjective from the noun and a case of patented laziness.

My original rant still stands.

Re:Wrong illegal and unethical

[SilverspurG]

Actually, considering the etymology of patent, it stands to reason that patent was used as an adjective before it came into use as a noun. That etymology would then justify the adverb patently and would further mean that the adjective form patented is a late-comer to the language. So that does make my rant patent nonsense.

But since you didn't address this from an etymological point of view I still win the point even though my rant is debunked.

Anyone surprised?

[blindcoder]

Actually, I'm only surprised it took the RIAA so long to stand in line with Sony on this publicly.

Re:Anyone surprised?

[Anonymous Coward]

Yeah, that surprised me. I'd expect everyone outside of Sony would want to stand as far as possible from this flaming pile of shit. I guess RIAA likes the smell, or maybe somebody lied to this guy to try to take them down. I don't know, it's just mind boggling cluelessness all around.

Even more surprising is that comment at the end "Arguably, Sherman is right". No, no he isn't. There should be nothing to argue, he is wrong.

"There is nothing unusual about technology being used to protect intellectual property."

Nothing unusual if you're writing a virus or other malware.

"You can't simply make an extra copy of a Microsoft operating system, or virtually any other commercially-released software program for that matter."

You can, actually. Legal issues aside (*cough*backup copy for archival purposes*cough*), those CDs do not castrate your machine to prevent you from copying them. This is like having a book that breaks your thumbs so you can't hold a pen.

"The problem with the SonyBMG situation is that the technology they used contained a security vulnerability of which they were unaware."

The main function of the code was a security vulnerability. How can you not be aware of that? This isn't an honest mistake, it's negligence at the least.

"How many times that software applications created the same problem?"

Software that wasn't trying to steal your credit card numbers or turn your machine into a DoS bot? Not that many.

The only bits you could possibly argue as correct are the parts where he's not addressing the actual issue. (ok, he never addressed the actual issue, but the parts where he strays the most)

Re:Anyone surprised?

[hackstraw]

Actually, I'm only surprised it took the RIAA so long to stand in line with Sony on this publicly.

They only did it _after_ Sony "voluntarily" pulled the tainted product from the shelves after a worldwide public outcry and lawsuits.

RIAA is basically a (poorly implemented) publicity front end for the major record labels. I see their timing as appropriate, but still ineffective to us that are still pissed off.

Re:Anyone surprised?

[fermion]

Which is why my reply has been consistant. It is simply too dangerous to buy a music CD. There is simply no way of knowing wht is hidden in the CD. This is different from software where copy is controlled through serial numbers or defects on the disk. The alternative, is, of course, to buy through a music service. The code still has security risks, but ther is less of a risk of an amatuer doing funny things to the OS. Of course the labels now want more money from the online music services. This means that where a just released CD might cost $12 online, the tracks, with no physical media, no book, and lower quality, might cost more. The cd can't safely be played on the computer, the legal download is too expensive, so one is left with the illigal arena.

or just buy from idependent artist and small labels who don't hate the customers.

Re:Anyone surprised?

[iabervon]

I'm surprised that they're now backing Sony's original position, after Sony abandoned it. Sony now seems to think that what they did was really bad; bad enough that they're not trying to fix the reported flaws, but giving up on protecting this particular music at all for now. I'd expect the RIAA to say nothing about this, like they usually do when record companies get in trouble.

Hmmmm......

[8127972]

"the technology they used contained a security vulnerability of which they were unaware"

Which is why you beta test stuff BEFORE you release it. Otherwise, you risk getting yourself in these situations. Just ask Microsoft.

Re:Hmmmm......

[BushCheney08]

Otherwise, you risk getting yourself in these situations. Just ask Microsoft.

I called up the Microsoft support line to ask. They told me they've never had any problems with faulty software or security vulnerabilities and that I should contact my hardware manufacturer.

nothing to wring here....move along

[digitaldc]

It's true, he never did his own laundry.

This post 0wn3d by s0nY

[mcgroarty]

This post 0wn3d by sOny - Greets go out to Mitsubishi, Toyota... thanks to Toshiba for t3h maths. Secret message to Cary of RIAA: LOL can't believe u said it, now I owe you $5

Giving Consumers What They Want??

[Chaotic Spyder]

This is awfully interesting... From TFA
University of Southern Mississippi, The Student Printz: History seems to show that anything done to stop files sharing will only create new methods and technologies to get around their controls. In light of that, should the middlemen (RIAA, et al) be thinking about ways to bring consumers what they want -- which they'll mostly end up getting in any case -- instead of futilely struggling to keep their finger in the dike, which ultimately only causes further public unhappiness with them?

Cary Sherman: History also shows that no matter what is done to stop bank robberies or shoplifting, some people will always find a way around those techniques. Does that mean we should simply give up and allow people to take what they should be paying for? Record companies ARE trying to give consumers what they want. Think of how music was available just a couple of years ago and how it's available now. You can buy an individual track, at any time of the day or night, and get it instantly on line. You can subscribe to services with a million-and-a-half tunes to choose from that you can listen to whenever you want, for an all-you-can-eat monthly fee.

Hrmmm Did he ever stop to think that if "Record companies ARE trying to give consumers what they want." Then the ratio of Illegal music downloads to Bank Robberies might be a little more consistent with what he is implying? Companies need to realize that copy protection isn't a trade off. It's a limitation. And it's a limitation that most people don't want to bother with.

Re:Giving Consumers What They Want??

[Entropius]

What I would like:

I would like to be able to go download a recording of , and would like at least 80% of the money I pay for it to go to the composer and the performers. They, after all, did the hard work.

I would like this recording to be available as a plain old 192kbps mp3 or 160kbps ogg, or a FLAC encode, at my choice.

Is that really so hard to ask?

Re:Giving Consumers What They Want??

[xtracto]

Then what you like is www.allofmp3.com + mail your favorite band $10 for each record you download (make sure you write a note telling them what you did and why).

After thinking for a while, my conclusion is that that is a fair way to back your artist. You may write them and tell them to give you a PayPal account to make them a deposit.

Why allofmp3 instead of p2p? because in allofmp3 you can download the music in several (mp3, ogg, flac, ape, mpc, wav, mp4... etc) codecs.

Re:Giving Consumers What They Want??

[Anonymous Coward]

Is that really so hard to ask?

Yes because we, the RIAA, would like to charge you for every copy of that recording. You may make as many copies you like, however, if your choice is 192kbps mp3 then there is a 30% surcharge for that particular format. As for 160kbps ogg, the surcharge is 75% because that seems to be a format enjoyed by whiney slashdotters.

Please feel free to play the recording as many times as you like on any device, however, we are imposing of charge of $0.45, per play on top of the copy charge.

The composer and performer will continue to get their meager share. Let's be honest here, the composer and performer no longer matter. Our marketing is what drives album sales. That said, our marketing department will continue to get 5% of the budget and the rest of the 96% will go to profits. Yes, that's 101%. That extra 1% of revenue comes from unknown artists paying us money to record their albums.

Re:Giving Consumers What They Want??

[Anonymous Coward]

Is that really so hard to ask?

Well, since you did the asking, you should know.

(I think you meant, Is that really so much to ask? ...)

More and more invasive

[Chayak]

I agree with simple copy protection meant to keep Joe User from just sending files over the web but it's impossible to stop him from lending his CD to a buddy to be ripped. This will never hurt the pirates as they'll just find a way around it and continue what they do. The RIAA is hurting the legit users more than pirates who could care less.

RIAA Hates its Customers

[Doc Ruby]

"Nothing unusual" != "nothing wrong". Sherman's response that Sony's crimes against its customers aren't unusual makes it worse. He defends the crimes by saying they're standard practice. He should get frogmarched to prison after a RICO case shows he conspires with the media cartel to commit these crimes, and to cover for them.

Re:RIAA Hates its Customers

[Anonymous Coward]

RICO requires force or the threat of force (as in, leg breaking, gun to head, etc.). Threatening to sue doesn't match, unfortunately.

Re:RIAA Hates its Customers

[Mr. Underbridge]

"Nothing unusual" != "nothing wrong". Sherman's response that Sony's crimes against its customers aren't unusual makes it worse. He defends the crimes by saying they're standard practice. He should get frogmarched to prison after a RICO case shows he conspires with the media cartel to commit these crimes, and to cover for them.

I believe he was stating that this is nothing unusual for the software industry, not specifically the music industry. He's saying that many companies use copyright protection, and that this software will sometimes result in system instabilities. Additionally, regular software might contain security bugs as well.

Of course, this is true. It's also true, however, that such practices happen to be far more common in the music industry than other purveyors of software.

Re:RIAA Hates its Customers

[Doc Ruby]

Does RICO require threats of violence, or can threats of business damage by the cartel also qualify?

Re:RIAA Hates its Customers

[Iriel]

What seriously unnerves me about the RIAA's statement is that they say there's nothing unusual about this case, refering to DRM. If they think that rootkit DRM CD's (are|should be) commonplace, I'm really reconsidering backing up my new CD purchases in fear of what may come.

Re:RIAA Hates its Customers

[MindStalker]

RICO requires extortion.. The legal definition of extortion is.

The term "extortion" means the obtaining of property from another, with his consent, induced by wrongful use of actual or threatened force, violence, or fear, or under color of official right.

So any threatening of something fearful will do, as well as pretending to be an official, (ie pretending to be a police officer or court official of some sort). I believe that in some of their early legal threats they crossed that line as well from what I recall.

Re:RIAA Hates its Customers

[mrchaotica]

More to the point, it's also true that generally speaking, most companies don't root your computer in the name of "copyright protection!!" This guy is lying -- rooting people's computers is (relatively) unusual, and is completely inexcusable!

Re:RIAA Hates its Customers

[Doctor_Jest]

It's good that these things get put on the public record. Sherman's response reflects another in a long list of reasons why the RIAA and its affiliate labels are just a few short lawsuits away from being as relevant as the wagon in today's society. Sure, some other nefarious organization will come up behind them and be much, much worse, but these dinosaurs are languishing in their own tarpits from their own ignorance. They did this to themselves. They can't blame piracy for their own stupidity.

The fact that this made the evening news is not a good thing for Sony, DRM, or the RIAA. People are aware of this, and this has set back unfettered "we're going to blow up your computer if you infringe" DRM by years (if not completely... but that's wishful thinking...)

The great unwashed know that Sony is out to break their computers. The genie's out of the bottle and raping cheerleaders. All we have to do is sit back and watch them try to spin their way out of it. At the very least, it's going to be funny. :)

Re:RIAA Hates its Customers

[hackstraw]

Eh, the customers are people like Sony, and which ever other recording labels are left.

The RIAA does not sell CDs, they don't have a "product", and you and I are definitely not their customers.

They are akin to the "Got Milk!" campaign people. People like the "Got Milk!" people much better for some reason.

Re:RIAA Hates its Customers

[Doc Ruby]

The RIAA is the industry trade organization for those labels. Sony's customers are therefore "the customers" in the industry they represent. All the RIAA's money and power derives directly from us, their customers. The American Dairy Association's customers are American milk drinkers, just as the American Medical Association's patients are American patients.

In Other News

[Anonymous Coward]

A popular news site known as Slashdot was crashed today by hoardes of users posting anger-deranged rants about the RIAA simultaneously...

If...

[RAMMS EIN]

If Sony clearly indicated that they were installing a rootkit on the users' systems, than I think indeed they did nothing wrong. It's their product, after all, so if they want to include a rootkit, that's fine. The only reason I say they need to indicate the presence of the rootkit is that it is the kind of software that you would normally expect not to be included (in good faith).

However, I doubt that Sony would have clearly indicated the presence of the rootkit. How do you even begin to clearly indicate the presence of something that most people don't even understand? I haven't been following the case, though, so I can't say anything more about it.

Re:If...

[Anonymous Coward]

If Sony clearly indicated that they were installing a rootkit on the users' systems, than I think indeed they did nothing wrong. It's their product, after all, so if they want to include a rootkit, that's fine.

So, how far will you go? How severe does a crime have to be before it's not fine for a corporation to commit it on a whim?

"If Sony clearly indicated that anyone they caught copying their music would be forced to watch their daughters being raped in front of them, and then fed into an industrial mincing machine with their whole extended family, then I think indeed they did nothing wrong. It's their product, after all, so if they want to rape and murder anyone who infringes their copyright, that's fine."

Fuck that. You may think that copyright holders should be made into a new aristocracy, with the right to force us peasants to accept any terms they deign to decree, but I don't. I think it should be a crime to ask people to consent to have their fundamental rights taken away... like their right not to have their property fucked with.

that's a joke

[Anonymous Coward]

Hi,

a rootkit is a rootkit others will go to jail for such crap.

CU
9000h

Consider the source.

[lukateake]

What the hell is the RIAA going to say anyway?! They're playing for the same team which is out to f*ck individuals such as you and me. Just more of the same from the well-heeled, government-sponsored oligopoly.

Bah! And don't even get me started on the oil companies or Microsoft. ;-)

Where are these Lots?

[Anonymous Coward]

Can somebody please point to me a list of all thise supposed software that has basicly removed all security from a machine? I can't think of a single legit program out there that when installed, hides stuff on your computer and allows viruses to use this same technology to hide themselves on the machine. When removed, kills hardware drivers in your computer and leaves your computer wide open for just about any type of computer attack.

I think they are off by claiming that LOTS of software has done stuff like this in the past but Sony is the first to do so and then turn around and try to fix it. I seem to think Sony is in a class of their own when it comes to a sideeffect of software being installed like this.

I have a vision...

[skandalfo]

I'll put a rootkit in every home!

How can he praise them?

[ZiakII]

He goes on to praise Sony's "responsible" attitude in handling the problem?

They are responsible for putting it in there, and the next line after that makes me laugh even harder.

how many times that software applications created the same problem

Other then virusus/trojans....let me think none?

It's a freaking rain storm!

[ThatGeek]

We've sold off industry, education and science. Looks like our business leaders are now selling their soul. Sure they've done bad things in the past, but their actions are now so blatant. They don't even try to hide what they do any more; they just "pee on our legs and tell us that it's raining".

At what point can we say that business has gone to far? When PR boys start trying to convince us that it's ok for them to install stuff to spy on us? I'm waiting for the brain implants and mandatory goggles to "protect their intellectual privacy rights".

Yuck.

Re:It's a freaking rain storm!

[Anonymous Coward]

"they just "pee on our legs and tell us that it's raining"."

Hands ThatGeek:-

Tinfoil hat, waterproof trousers, de-oderant and rose tinted goggles.

AKA Geek kit.

Hell I want one of these kits as well, forget the RIAA, be handy for long MMORPG sessions, esp the pants.

Re:It's a freaking rain storm!

[RAMMS EIN]

``At what point can we say that business has gone to far?''

At any point you like. Go and make noise. Tell everybody about it. Write to the papers, school magazines, billboards at work, anything. Boycott the companies that offend you, and ask others to do the same. Set up and promote alternatives.

Remember: if it upsets you, it will upset others. The more people you inform about it, the more people will be upset. The more people are upset, the more people will be looking for alternatives. And before you know it, there will be a viable market for these alternatives.

An old Saying

[Puhase]

Will they get away with it among the non-technical public?

Anyone ever lost betting on the ignorance of the general public?

Deleted from original transcript

[Billosaur]

University of Berlin Tecnological College: Herr Führer, vhat do you say to zese Fascist dogs who proclaim zere rights are being infringed?

Führer Sherman: We believe in the right of the individual to listen to music the way they want, as long as that way is our way! Eventually we will have the music-listening public marching to a single tune, our tune, and a great day will come when we will bring all nations under our heel!

University of Berlin Tecnological College: Sieg Heil! Sieg Heil!

Where's Neville Chamberlin when you need him?

In other news...

[HesAnIndieRocker]

Powersauce bars are great!

punish RIAA

[Anonymous Coward]

Every time they say something like this, steal a song. Everytime they Do The Right Thing (tm), buy a song.
An I am such a sissy that I post this AC

Vote with your $$$

[Anonymous Coward]

I personally boycott Sony due to their business practices in both the music and computer industry. Luckily we aren't completly at the whim of Sony.

I've been using Windows since windows 95. Currently on XP, as it has the best driver support for my laptop, linux otherwise if all hardware is supported.

Once mactel laptops come out I will boycott microsoft as well!! Boom headshot!

For once

[Anonymous Coward]

The RIAA is right -- Sony got way more criticism than they deserved (but for understandable reasons).

Not Unusual...

[Chabil Ha']

"...there is nothing unusual about technology being used to protect intellectual property..."

There is also nothing unusual about technology being used to 'steal' it and share it on a P2P network, either.

Re:Not Unusual...

[carlos_benj]

There is also nothing unusual about technology being used to 'steal' it and share it on a P2P network, either.

There goes their appeals to consumers based on having the moral high ground, eh?

I Wonder..

[GmAz]

I wonder if the RIAA would be happy to have Sony's rootkit on all their computers? Perhaps the RIAA computer systems should be used as test beds to make sure future Rootkits are secure or is it "Sure, its a good thing, just don't put it on my computer".

Unaware?

[ect5150]

the technology they used contained a security vulnerability of which they were unaware

i don't have one of the discs with the rootkit on it, but I remember the consumers not being aware that the program was installed.

By that logic, I should be able to install a key-tracking program on this guy's PC.

Re:Unaware?

[lzandman]

I assume the next step is suing the software house that produced the DRM for them.

Yeah, I think First4Internet can just as well stop their business. Sony will let them bleed (pay) big time and nobody trusts their copy-protection garbage anymore... Bye bye :-)

Re:Unaware?

[mrchaotica]

No, no, no -- what they were unaware of was that people would be able to detect the rootkit!

Re:Unaware?

[whoever57]

If you want to really scan for virus and trojans on a crtical PC, you map the administrative shares C$ D$ etc to another PC, and run the virus scanner on that machine. You surely can't think that can you? If you are accessing the shares remotely, you need the kernel on the compromised machine to tell you what files exist. If the kernel doesn't list the files, do you think it will make them available over the share? The only way to be sure is to boot from CD or another, known good, hard disk.

Re:Unaware?

[chris_eineke]

Those of us involved with IT security know this attack vector all too well. If you want to really scan for virus and trojans on a crtical PC, you map the administrative shares C$ D$ etc to another PC, and run the virus scanner on that machine.

That way you know for certain that you haven't been rooted, a kit can only hide from the PC it is hidden on, not another machine.

So what stops the rootkit from hooking itself into the filesystem/-sharing layer and faking its non-existance?

Re:Unaware?

[NexusTw1n]

It's a good point, but I've never seen it happen. All rootkits I've seen are visible over a share.

Rootkits are revealed on the network via firewall logs, and I've always tracked them down via this method. I suppose there may be kits that I may not be seeing, but they don't appear to be phoning home.

Remember that you can hide a file from the API, but you can't hide from NTFS itself otherwise you risk getting overwritten.

It's entirely possible that administrative shares get their file list from the disk volume itself and translate the information when it arrives using the clean kernel rather than the potentially infected API on the remote machine.

I'd be interested to know if anyone knows for certain if this is the case?

Re:Unaware?

[NexusTw1n]

You can't hook into the filesystem and hide. If you do, you run the risk of being overwritten. The filesystem HAS to know what is on the disk and where.

All you can do is trick everything above the filesystem layer that you aren't really there. The question I've asked someone else who has raised this, is how the administrative share works on Windows.
Does the admin share operate at a lower level than standard "user" shares, and hook straight into the file system?

If it uses the API on the remote machine in any way, then my method is clearly flawed.

Re:Unaware?

[pipingguy]

No, no, no -- what they were unaware of was that people would be able to detect the rootkit!

Modded as funny, but it's true.

The sense of entitlement displayed by some companies is astounding.

Re:Unaware?

[Anonymous Coward]

I tell you for a fact that this is *not* how windows file shares work.

There is code which runs on the server end of the file share which receives messages from the client end of the file share and creates, opens, read, writes, etc files.

Re:Unaware?

[samj]

Those of us involved with IT security [know] a kit can only hide from the PC it is hidden on, not another machine.

This is utter BS. Those os us involved with IT security tend to understand an issue intimately before we offer our advice on it, especially publicly. Scanning 'remotely' (over the network or by booting a trusted OS) can be more secure, but not for the reason you cite.

Re:Unaware?

[steve_l]

I didnt know about remotely visible shares finding rootkits. I would be surprised if that was the case, but I will take your word for it.

One way i do know that people are looking at is just doing an enum of the HDD+registry on the box, then booting it off a trusted CD and repeating the process. then you diff the files. anything that isnt found on the local enum that crops up on the trusted CD enum is hiding from you: voila, one rootkit.

Re:Unaware?

[RAMMS EIN]

``Those of us involved with IT security know this attack vector all too well. If you want to really scan for virus and trojans on a crtical PC, you map the administrative shares C$ D$ etc to another PC, and run the virus scanner on that machine.''

Hmm, sounds rather weak to me. What if the other machine has been compromised, too? I think it better to boot the PC off a read-only medium, then run the scan from there. Saves you from having an extra PC, too.

If you're really paranoid, you can have it both ways: have a dedicated computer that boots off read-only media run a scan against the possibly compromised system (it protects against malware flashing your BIOS...). Don't forget to replace the aluminium case by one made of tin...

Re:Unaware?

[GIL_Dude]

Sorry, but that isn't 100% correct. The USER MODE rootkits can be found in the manner you mentioned - mapping a drive to the C$ from another machine.

However, the redirector still has to use the Kernel so a kernel mode rootkit will NOT be found by your method. In fact, the SONY rookit will not be found by that method.
To find kernel mode rootkits, you need full offline scanning - booting to WinPE or Knoppix or something. If the OS is booted and you are just remoting it, the kernel mode one will still lie to you.

Re:Unaware?

[GIL_Dude]

No, that isn't the case. Again, you are finding the user mode rootkits that way. They are only hiding from ntdll.dll (and hence Explorer.exe doesn't show them, cmd.exe doesn't show them). The redirector is running as system, so the user mode ones can't hide from that. This is why you can see them over remote mounted disks (C$,etc.).

However, if you read up on the kernel mode ones (some of the talks Mark Russinovich has given -like at Tech Ed this year), you'll see that these touch the kernel itself and the redirector will not expose them (so C$, etc. won't work).
It's just a matter of different architectures and different methods of "rooting" a machine.

Re:Unaware?

[Anonymous Coward]

i don't have one of the discs with the rootkit on it

Which reminds me to ask.. how do I say this.. where could one get a copy of the rootkit code without any _more_ malware attached to it?

Re:Unaware?

[Anonymous Coward]

> All rootkits I've seen are visible over a share.

Really? You haven't seen the ones that aren't visible?

Re:Unaware?

[samj]

More BS: why don't you quit while you're ahead. Why the fsck would administrative shares be handled any differently? The only difference is they are created automatically and end with a '$' - most clients just don't enumerate them - this doesn't mean they behave any differently than 'normal' shares.

Re:Unaware?

[NexusTw1n]

"Scanning 'remotely' (over the network or by booting a trusted OS) can be more secure, but not for the reason you cite."

The reason I cite is that by using a trusted Kernel, either via a trusted machine, or read only OS, you can be reasonably sure you are getting the real picture from the filesystem.

Stating I'm wrong for claiming this without explaining why and backing up your statement, was a pretty pointless waste of a post don't you think?

Re:Unaware?

[Torne]

You can't hook into the filesystem and hide. If you do, you run the risk of being overwritten. The filesystem HAS to know what is on the disk and where.
Yes, you can hook into the filesystem and hide, without being overwritten. Lots of methods:
1) You can mark your blocks as used in the free bitmap but not link to them, and hope the user doesn't run chkdsk (which will 'fix' this problem).
2) You can have the filesystem itself skip over your directory entry when the generic FS layer asks.
3) You can have the filesystem claim the disk is smaller than it is, and use the blocks at the end to store data.
4) etc

Not hard at all. You don't neccecarily even need to do that much - you may not care about being overwritten. If you stick yourself near the end of a huge chunk of free disk space, it may be months or years before that space gets allocated, and if the only reason you're there is to use the machine as a spam zombie or something, then it may not even be worth protecting yourself from being overwritten when that day comes, as hey, just infect the machine again, or rely on the fact that there are plenty more. Even if you do let the FS know about your existence, that doesn't mean it has to report that fact to the generic FS layer when it asks. Disk space allocation is an FS-specific issue and the layers above don't give a damn about it.

All you can do is trick everything above the filesystem layer that you aren't really there. The question I've asked someone else who has raised this, is how the administrative share works on Windows.
Does the admin share operate at a lower level than standard "user" shares, and hook straight into the file system?
Nope, it's not special at all. Shares ending with a $ cannot be enumerated remotely, and the 'admin' shares cannot be deleted or have their permissions changed via the user interface (though they can still be blown away by tweaking the registry a bit and hoping the Server service doesn't put them back), but are otherwise identical to normal shares. If your rootkit is lying to the OS at the filesystem or kernel level, it will be invisible through these too.

If it uses the API on the remote machine in any way, then my method is clearly flawed.
There is no (non-terrifying) way to access the contents of a filesystem of a running Windows instance other than via its filesystem API. Windows will not let you open the disk for raw access while it is mounted (for obvious reasons). You can bypass this by installing a custom device driver but it's easier to just boot BartPE ;)

Usermode rootkits cannot do most of these things, and may well be visible over network shares (due to the difference in user account used to access the disk), but any rootkit which is allowed to run as administrator can install itself into kernel memory quite trivially and do all kinds of amusing things. Techniques exist to make the presence of malicious kernel memory modifications effectively invisible (see the last issue of Phrack for one discussion) and there is absolutely no dependable way to scan for them without shutting the machine down and booting into a known-clean, ideally-read-only operating system instance.

Re:Unaware?

[Lost Found]

If that's true, that would be really retarded. Surely Windows must have a kernel layer at least *something* like any modern UNIX's VFS - that is, a common interface to disparate filesystems on disparate block devices.

Re:Unaware?

[renehollan]

Remember that you can hide a file from the API, but you can't hide from NTFS itself otherwise you risk getting overwritten.

Even if you take it's sectors out of the free space?

Yes, "the math" won't add up if you do that, but that's a real subtle thing to check.

Besides, the right thing to do is to show them in the free space, but allocate them last (i.e., never in practice). (I scare myself sometimes).

Re:Unaware?

[ucblockhead]

The particulars really don't matter. When you are using a share, you are relying on softare on the share giving you correct information. There are many places it could be attacked, at low levels and high. If you can't infect the filesystem itself, you can infect the network sharing software.

Re:Unaware?

[samj]

The reason I cite is that by using a trusted Kernel, either via a trusted machine, or read only OS, you can be reasonably sure you are getting the real picture from the filesystem.

No you can't. Whether you access the filesystem locally or over the network doesn't matter when this type of root kit is involved - the same APIs are used in both cases. Presumably a user mode root kit works by hooking the APIs in the process's address space (caller) rather than the kernel (callee), which is possibly how you were confused - in that case the kernel and server service are not affected so yes, shares (any share, not just administrative shares) would work, but then again so would another uninfected account on the same machine.

Stating I'm wrong for claiming this without explaining why and backing up your statement, was a pretty pointless waste of a post don't you think?

Viruses which interfere with local virus scanners but which do not interfere with APIs can be detected remotely.

And what is the point in setting me as a foe? You declared yourself an authority on the subject, made a false statement in public about an issue that you did not fully understand and were called on it. Hopefully you've learnt something and will think twice before making potentially dangerous assertions in the future.

Sauce for the Gander

[Nom du Keyboard]

Cary Sherman, the president of the RIAA, stated in reference to Sony BMG's "rootkit" software that "there is nothing unusual about technology being used to protect intellectual property.

I truly, deeply, and sincerely hope all his personal computer systems are rooted by all the DRM flavors out their simultaneously. Then he can live with what he claims is not a problem at all for the rest of us.

Re:Sauce for the Gander

[carlos_benj]

I truly, deeply, and sincerely hope all his personal computer systems are rooted by all the DRM flavors out their simultaneously. Then he can live with what he claims is not a problem at all for the rest of us.

I doubt Cary uses a computer. Somebody else actually uses the computer and the wind-up PR/Spokesperson gets handed paper summaries to read.

There is a difference

[Daytona955i]

There is a difference between a software bug that allows an attacker to take over your computer and deliberately installing a backdoor to allow anyone who knows how to take over your computer.

And what about this...

[m4g02]

I don't see how this has anything to do with technology being used to protect intellectual property.

The RIAA is behaving just like Microsoft did with SCO, taking advantage of the situation and feeding FUD supporting stupidity.

No wonder everyone hates the RIAA.

I salute you...

[LordMaxxon]

... with a single digit!

Pretty consistent

[Aceticon]

These are the same guys that believe that lobbying to create laws to protect intelectual property (DCMA) is a good thing.

One can hardly expect them to consider the technology arena as holy and untouchable.

Basically they only care about the bottom line - they'll do whatever it takes as long as they don't loose money by doing it it.

Re:Pretty consistent

[Hawke666]

"...don't loose money by doing it."

And hopefully tight money.

Unaware?

[NexusTw1n]

"the technology they used contained a security vulnerability of which they were unaware".

I assume the next step is suing the software house that produced the DRM for them. Because they, at the very least, should have known they were implementing a standard root kit with all the risks that entails.

Those of us involved with IT security know this attack vector all too well. If you want to really scan for virus and trojans on a crtical PC, you map the administrative shares C$ D$ etc to another PC, and run the virus scanner on that machine.

That way you know for certain that you haven't been rooted, a kit can only hide from the PC it is hidden on, not another machine.

I see rootkits all the time, the main entry is through backup software exploits rather than O/S holes. (Or autorunning CDs). You will regularly see script kiddies taking advantage of a root kit placed there by other hackers.

So anyone who works in IT, especially someone who works in root kit creation, cannot claim that they were unaware of potential security problems.

It was incredibly irresponsible and pleading ignorance is no excuse.

Responsible?

[tetrahedrassface]

It took a California lawsuit, the EFF, and a week of bad press on Slashdot for them to pull this..
This is "responsible"?
I tend to agree with a lot of other posters on here that if it were an individual they would be in jail right now.....
How the heck is it responsible?
I really like the part where Sherman says the record industry is really a lot more giving when it comes to allowing the copying of data... :)
The responsible thing would have never put the rootkit on the disks to begin with.......
Piracy is bad, but so is getting rooted...
Where is the middle ground? Id like to find it and sit there.
Jeez.....

RIAA in a different world.

[u-235-sentinel]

"How many burns are you allowed of a movie? None. How many of a videogame? None. You get the idea. Even the CDs with content protection allow consumers to burn 3 copies or so for personal use. The idea is not to inhibit personal use, but to allow personal use but discourage (not prevent, you can never prevent) copying well beyond personal use."

Actualy it was my understanding the Supreme Court put this issue to rest about 8 years ago. We are entitled to one (1) archival copy of our media. I'm not aware of this having changed in the last few years. I guess I shouldn't be surprised they are saying this. It's a different world they live in.

Why?

[RAMMS EIN]

Why does the president of the RIAA feel compelled to make an ass out of himself? The RIAA is doing some stuff I can perfectly understand, up to suing teenagers and their parents, because the RIAA believe these teenagers to be involved in copyright infringement.

However, stepping up to defend one company's abuses, and stabbing at software projects that "merely put a patch online" just makes him lose credibility. Now, the RIAA is rapidly going from the desperate copyright guard dog to the evil money grabbing oppressor that many people already view them as.

Hey, maybe Sherman is actually on the people's side? Trying to kill the RIAA from the inside?

Tape defeats Sony DRM

[davidwr]

Last time it was a felt-tip pen, this time it's gaffer tape. I bet a pen will work just as well.

To quote Gartner in one the playfuls.com link:
"After more than five years of trying, the recording industry has not yet demonstrated a workable DRM scheme for music CDs. Gartner believes that it will never achieve this goal as long as CDs must be playable by stand-alone CD players."

Let's call this one the disable-the-data-track-hole.

We Need a Change!

[TheZorch]

I totally agree with dada21. The time has come for the RIAA.

They are obsolete and are trying desperately to stay in control in an age where technology has outpaced them. Its either time for them to disband completely or change with the times. If they continue on their current course something similar or worse than the Sony/BMG Rootkit fiasco is destined to occur, and it may spell the end of the RIAA right then and their.

Or, iTunes and Napster could just put them out of business and artists and bands will publish their own music online or via their own privately owned studios. The Internet gives all of that freedom, but the RIAA just doen't get it yet and probably never will. Its sad really.

Set back?

[Zocalo]

How can DRM be set back when it's never got off the ground in the first place? As far as I am aware there is yet to be a single form of DRM that has even come close to forcing the use of recording of the output signal(s) in order to make a copy of a digital media file. Even Gartner is apparently now saying that DRM is a waste of time and predicting that the studios will abandon the idea in favour of enforced DRM controls in the hardware. Personally, I doubt that is going to work out any better given the totally ineffective DVD region coding scheme, but there does seem to be a sharp increase in lobbying going on, so maybe Gartner is on the right track.

Re:Set back?

[Walkiry]

> How can DRM be set back when it's never got off the ground in the first place?

It's been set back in the propaganda arena. All of the sudden there's a hefty amount of press about "DRM" being associated with "evil" or just "bad," after years trying to fudge it as a simple thing that is good for the artists and good for the users (remember "Trusted Computing"?). I say it's a good thing, and the funniest one is that it took way less effort that a deliberate campaign to achieve the same, it's always easier when your opposition does a massive screwup.

Also,

[Prince Vegeta SSJ4]

Birds with similiar plummage are rumored to travel in like groups.

Too Late, Sony

[Anonymous Coward]

It's too late for Sony. I will never buy any product from them again! That those profits to the bank.

Arguably right? WTF ever

[div_2n]

Arguably, Sherman is right

No, he and the others want to pretend that Fair Use doesn't exist. I pray for the day when they all get smacked royally for violating our rights.

Re:Arguably right? WTF ever

[n6kuy]

Apparently, Sherman didn't consult with Mr. Peabody...

Re:Arguably right? WTF ever

[Scrameustache]

No, he and the others want to pretend that Fair Use doesn't exist.

He reminds me of a little kid crying "It's not faiiiiiir" when denied something.

"But I WANT to charge them everytime they hear it! AND to force them to hear it! It's not fair that they won't let me!"

Re:Arguably right? WTF ever

[mrchaotica]

Screw Fair Use; this goes waaaaay beyond that! He wants to pretend that private property doesn't exist, and that his Fascist organization has the right to do whatever the fuck it wants!

This is the kind of dangerous reasoning that led to World War II!

Re:Arguably right? WTF ever

[div_2n]

I like your sig. Are those yours or someone else's words? If yours, may I use them at will?

Re:Arguably right? WTF ever

[mrchaotica]

The particular phrase is mine, but it was inspired by somebody else's Slashdot post from not too long ago. Unfortunately, I can't tell you who inspired it, because I can't find the post. All I know is that it was attached to one of the articles about Sony's rootkit, and that my reply to it said something to the effect of "Oooh, I like that: 'DRM manages access in the same way that jail manages freedom' [i.e. paraphrasing him]"

But yeah, if you want to use the quote, go ahead.

All Hail the Empire!!!

[vertaxis]

"there is nothing unusual about technology being used to protect intellectual property."

That's Darth Sherman to you.

Jedi Mind Conspiracy

[$nyper]

Who died and gave the RIAA supreme Legislative and Judicial control in this country. Sometimes I think this group just has a serious pair that someone needs to walk up and slam a bat between

MY GOD, they are using the Jedi mind trick on us! "This is not the Sony exploit you are looking for... it can go on about it's business of destabalizing your system's security. Move along now... Move along"

I see says the blind man as he picks up his hammer

[TinBromide]

and saw... "Its all coming back to me" as he wizzes into the wind. Yes, software has vulnerabilities, some create vulnerabilities, but most of the time you voluntarily and knowingly install this software onto your system, or it rides along with software that you downloaded because you didn't feel like buying an equivalent piece of software in the store. Norton anti-virus also picks up some of these ride-along software now. When i buy a piece of software from a store from a reputedly good software maker, i do so with the understanding that the piece of software i install is listed on the front of the box. Sony's problem is that they pulled some bs that you would expect from some seedy company hoking your privacy for an mp3 encoder or something. If i buy quicktime full version, i expect to only have quicktime and only quicktime install on my system. If i play a music cd, i expect there to be music and only music on that cd. Sony did wrong, while they may not be legally punished for it, they violated the unwritten contracts between paying customers and software companies. (Yes, when you buy a sony bmg music cd, you're buying a piece of software that plays music, you can pop a mechwarrior 3 cd into a cd player and listen to the in game soundtrack, so software can have music tracks too). This unwritten agreement is that if i pay for your software, you'll keep your protection schemes from messing with my computer and it will only kick in when i use your program. If you fire up a game with safedisk vX on it, the cd copy protection only kicks in at that time, not before, and not after you close the game. If you fire up photoshop cs2, the keyvalidation happens once during install and it only checks that your key remains valid according to the hardware specs of your system. The only memory resident program is a gamma loader which doesn't break anything if you shut it down/keep it off. Yes sony screwed up, yes they should be rebuked, and yes, this is the predictable responce to the RIAA's more and more vigilante style tactics. Some day i can see them riding into town and tarring and feathering people who fileshare.

Got...

[Prince Vegeta SSJ4]

CJME.com is about to do a show on the Sony rootkit

Got Milk...er Root, ummmm

Defeated by scotch tape!

[rAiNsT0rm]

My favorite part of it all is that it was stated by the Gartner group that the entire "protection scheme" can be defeated with a small piece of scotch tape placed on the outer track. Yay, low tech hacks for poorly implemented DRM... I mean come on.

Plus the fact that there was stolen open source code, I think adds up to the fact that Sony "did something wrong." Who the fuck made the RIAA so powerful? I mean seriously, they've positioned themselves as the be all end all... and for some reason we let them become so powerful a force. I think work needs to be done to clip their wings to keep them from becoming even more far reaching and powerful... EEF? Anyone? Buehler?

Re:Defeated by scotch tape!

[quantum bit]

That's because CD audio has no DRM whatsoever built in to the format. In order to be compatible with the millions of CD players already in people's homes and vehicles, any "protection" add-on must depend only on the user being dumb enough to let it install.

DRM is very impressive.

[91degrees]

The record companies spend a lot of money in producing a protection mechanism that costs a lot of money, prevents some users from playing the discs, and ends up causing severely bad PR for them... And the real beauty is - their DRM doesn't work!

Sure, it may prevent some people from ripping songs from the CD, but anyone who wants to will manage to do get a copy. They'll find software that will do what they want, or if they're completely stuck, they'll just download it from someone who has managed. Professional pirates will be able to make a copy anyway (with or without DRM). Several applications will work in Windows. A lot of the people with the technical ability to know how to rip a CD will turn off autoplay anyway.

I wonder if Sony, or any of the music cartel have actually done any research at all on how effective their technology is at its purpose? Or rather how effective their technology is at increasing sales, which is, after all, what they actually want.

Re:DRM is very impressive.

[biglig2]

As Cory Dotcorow has pointed out, DRM can't work. It's mathematically impossible.
You can express it in cryptographic terms like so:
Alice wants to send a message (her new single) to Bob, her customer.
Alice wants to ensure that her message cannot be read by Oscar, a "pirate".
OK, this sounds do-able, until you realise that Oscar isn't called Oscar. He's called Bob, too. Alice has no way of telling the difference between a "pirate" and a customer. She can't treat Bob differently depending on whther he is a "pirate" or a customer because she can't tell!

Re:DRM is very impressive.

[91degrees]

There's the solution...

Sell an "honest customer" version and an "evil pirate" version. Then simply rely on people's honesty to select the right version.

RIAA Support != Customer Satisfaction

[Cyphertube]

Just because the RIAA comes out and makes the argument that they have been more responsible than some others in handling this, doesn't mean I'm suddenly all warm and fuzzy about Sony.

I have railed and fussed about Microsoft for year, but this mishandling of DRM, going against codified law in the US regarding 'fair use', their foot-dragging on Blu-Ray, and their desire to totally dominate my home entertainment, makes them far worse than Microsoft in my eyes, and I'm not a big fan of the MS lifestyle.

What the RIAA and the record companies don't get is that the more CHOICE we have, the less we're likely put up with the bull from anyone. Most people put up with software errors because they don't know they have options. They are not willing to put up with music creating software errors, because they can always buy music elsewhere.

As for me, I have a great Sony Discman I bought years ago. That's probably the last Sony product I will buy unless they really learn to change their minds. Sony has become a dishonourable company.

Granted, of course, if the RIAA came out supporting Linux, I'd be tempted to switch to BSD, too.

Re:RIAA Support != Customer Satisfaction

[BVis]

What the RIAA and the record companies don't get is that the more CHOICE we have, the less we're likely put up with the bull from anyone.

That's kind of the point. The RIAA's mission statement includes the maintenance of a monopoly over the distribution of recorded music. Anything that seriously threatens this monopoly is to be eliminated by any means necessary. This is what is meant by "they didn't do anything wrong". In the RIAA's eyes, anything that is done to prevent those nasty pirating hacker people from distributing their God-given content is completely justified.

Most people put up with software errors because they don't know they have options.

If you're talking about Windows, most people don't have options; the decision has already been made for them by either their business or the retailers they buy their computers from. If you're talking about recorded music, name one place you can buy music that wasn't distributed by the major labels. If you have to think about it for more than 15 seconds, then it's too much work for Joe Sixpack. (Leaving aside the point that J.S. couldn't even conceive of what you're talking about without hours of explanation, and even then you most likely won't be able to convince him that it's a bad thing.)

They are not willing to put up with music creating software errors, because they can always buy music elsewhere.

Again, name one place. For many in America the only way to feasibly purchase recorded music is Wal-Mart. Wal-Mart won't go to the time and effort to sign hugely anticompetitive deals with any independent labels (nor would any other major retailer), and those labels couldn't produce the quantities they would need anyway. Not to mention that nobody that shops there would buy the stuff. Sure, in theory, they could buy music through iTunes, but how much of America is that technically sophisticated? (It's trivially simple to you and me, but way beyond a lot of people.)

Re:RIAA Support != Customer Satisfaction

[Cyphertube]

Oh, I recognise that the RIAA wants to have a monopoly. However, they're failing to really engage in that.

The evidence of this is Sony/BMG going off half-cocked and implementing DRM without everyone doing it. Granted, if they all went and violated 'fair use' then we'd easily be able to bring them up on RICO charges.

When I talk about choices for the average user, if it's between crap artist A and crap artist B, they'll choose crap artist B if it doesn't have DRM that's been covered by the news. Most people won't know for most DRM, but this is a big publicity stunt that really blew up.

At any rate, a monopoly like Microsoft's tends to only get you slapped with Sherman... What the RIAA is trying to do, should they succeed, can get them slapped with RICO.

I think the MPAA and RIAA should really make it clear to everyone and get together to form the Music And Film Industry Association - MAFIA.

Re:RIAA Support != Customer Satisfaction

[BVis]

The evidence of this is Sony/BMG going off half-cocked and implementing DRM without everyone doing it.

Point. But that just makes it a disorganized monopoly, which IMHO will be much harder to prove and/or remedy.

When I talk about choices for the average user, if it's between crap artist A and crap artist B, they'll choose crap artist B if it doesn't have DRM that's been covered by the news.

I disagree. You have more faith in the American sheeple than I have. IMHO even if they've seen the publicity around this Sony episode, that won't stop them from buying what they've been told to buy through various media, because either 1) they won't make the connection, or 2) they take the "oh I don't have anything that anyone would want to steal" approach I've seen towards viruses/spyware. That being said, it is true that this publicity may make other labels more hesitant to use these kinds of tactics, or at least ask their third party developers, "Hey, what's that rootthingy that I heard about? Sony got in trouble for that and it cost them money."

Ultimately that's the only thing that will deter the other labels from doing what Sony did-if it costs them millions of dollars through lost sales, recall/replacement expenses, and class-action settlements. Not because it's illegal or unethical, but if it's bad for business.

11th Commandment

[Tryfen]

The only thing they did wrong was breaking the 11th commandment.

Thou shall not get caught!

Logic

[Experiment 626]

Given that:

1) The Sony rootkit contains pirated open source code, and

2) The RIAA finds nothing wrong about the Sony rootkit

It follows that RIAA does not consider the piracy of copyrighted material wrong... Well, I'm off to go copy a few CDs, with the cartel's blessing this time.

Re:Logic

[gmurray]

A new entry for the redefinition dictionary:

Piracy:
The act of doing anything that may harm the profit margins of any company that owes its livelihood to bloating the prices of the intellectual property it distrubutes and meddles with, including, but not limited to, refusing to buy the content.

Re:Logic

[Gibsnag]

No, no, no... Copyright only applies for good right wing corporations. Not those damn liberal code monkies.

Re:Logic

[Esion Modnar]

It follows that RIAA does not consider the piracy of copyrighted material wrong

Said the RIAA Big Daddy in his stained boxers and wife-beater undershirt, and gruff 10-pack-a-day cigarette voice, "Do as I say, not as I do. (And get off my damn lawn!)"

Re:Logic

[shark72]

"Given that:"

Unfortunately you (and lots of other readers who didn't follow the link) were trolled by yet another misleading Slashdot headline. Cary Sherman very clearly called it a "mistake" earlier in the satement that was quoted in the summary. In other words, it wasn't the case that the moderator missed that part -- he successfully fooled you. Here's the complete quote:

The problem with the SonyBMG situation is that the technology they used contained a security vulnerability of which they were unaware. They have apologized for their mistake, ceased manufacture of CDs with that technology,and pulled CDs with that technology from store shelves. Seems very responsible to me. How many times that software applications created the same problem? Lots. I wonder whether they've taken as aggressive steps as SonyBMG has when those vulnerabilities were discovered, or did they just post a patch on the Internet?

C'mon, mods -- the record companies are evil enough on their own; no need to pull these sorts of tricks.

The problem isn't the defect

[Digital_Quartz]

"how many times that software applications created the same problem?"

How many times have software applications that were installed on my machine without my knowledge created the same problem? How many times have software applications that were impossible to uninstall from my system created the same problem?

The only instance I can think of are other root kits and spyware, and I do my best to keep my system free of those criminal pieces of software as well.

The problem with Sony BMG's software is not the defect, it's the underhanded way it is delivered to a computer to begin with. Sony BMG has no right to install software on my computer without my knowledge. When inserting a music CD into my computer, there is no expectation that software will be installed. Sony's software SHOULD pop up a big "I'm about to install this software on your machine" dialog, with a big "OK" and "CANCEL" button, like other comercial software from respectable companies.

Future of grocery shopping

[endemoniada]

Welcome to Walmart!

We appreciate you as a customer, and want to do anything to make your shopping experince the very best!

However, because of a recent wave of shoplifting, everyone buying a product will have to shoot themselves in the foot with this here shotgun.

Thank you for your patience!

ps. If you shoplift, we'll prosecute your 14yo daughter, and fine her $250.000. Thank you!

Attempting to make Broken CD's the standard

[asv108]

As a music lover, I am still forced to purchase CD's in order to get a high quality sound in an uncrippled format. My usual routine is to rip the CD in to FLAC as soon as it arrives and keep the CD has a hard backup copy. When the industry initially pushed copy protected CD's, it seemed that the target market was pop and rap consumers, so it never really affected the music I cared to purchase. Now, I'm starting to see indie, jamband, and jazz CD's with copy protection.

Sure, most of the schemes do not affect ripping on my platform(Linux), but I am unwilling to support a distribution method that unfairly restricts basic fair use. So whenever I see a CD that I would like to purchase but its copy protected, I make sure to give it a 1-start review on amazon stating the reasons why I wont purchase it. Its quite simple, if enough people refuse to buy copy protected content and make it publicly known, the industry will be forced to release real CD's.

Re:Attempting to make Broken CD's the standard

[glesga_kiss]

Just download the lossless copies, for example the Ape format. It's really a turnup for the books when the illegal stuff is actually safer than the legitimate stuff. Sony's shareholders should be tearing the board apart for their complete incompitence in getting us to this point.

No regedit required at all...

[everphilski]

No, but they do have auto-run on for everything, because turning it off requires editing the registry

FALSE

(Windows XP) Go to My Computer. Right click the CD-ROM drive, hit properties. Click the AutoPlay tab, and select "Take no action" or if you prefer "Prompt me each time to choose an action" to get a nice pop-up window asking what you want to do. No regedit required at all.

-everphilski-

Re:No regedit required at all...

[Kitsuneymg]

start -> run...
gpedit.msc
Computer Configuration -> Administrator Templates -> System -> Turn off Autoplay
Set this to enabled.

You'll never have to worry about any user autoplaying anything.

Complicated, but my family managed just fine with the above instructions.

Also, if it is a regestry tweak, drop it into a .reg file and tell your friends/family to double click it and hit yes. Then tell them only to do this for things they know are from you.

Re:No regedit required at all...

[NatasRevol]

Your sig seems so...appropriate...for your comment and the parent.

Maybe it's just me.

Re:No regedit required at all...

[Anonymous Coward]

You can only turn off autoplay from the properties tab. The autoplay feature in windows is used for playing content on a media cd (ie cd audio or pictures). This is entirely seperate from autoplay which allows the cd to run arbitrary code on your computer. There maybe be a way to turn off autorun without using regedit, but that is not it.

Re:No regedit required at all...

[CosmeticLobotamy]

That'll work in XP Pro, but not in XP Home (at least from what I can tell). Of course, maybe I'm the only person alive that ever encounters XP Home. Google seems to think it's rare.

Re:No regedit required at all...

[kibbylow]

This is exactly the setting that I have on my XP box. I usually get the pop-up for CDs and DVDs, however some of the recent DVDs somehow circumvent this setting. I put the Star Wars EP3 disc in and it automatically plays.

Re:No regedit required at all...

[Tran]

because auto-run is still enabled. Auto-play is not the same as auto-run

Re:No regedit required at all...

[kawika]

everphilski, have you actually checked that with the Sony CDs? Because it doesn't work.

The settings on the AutoPlay tab are for "Autoplay V2" which determines the action based on the content of the CD (mp3 files, image files, etc.). The Sony CDs use "Autoplay V1" which only requires a file named Autorun.exe in the root of the drive. Even if you turn off all the features on the Autoplay tab, it will not disable Autoplay V1.

There are several ways to disable the V1 variety, if you don't want to manually RegEdit just download TweakUI and you can turn it off that way. If you prefer the registry method, Google for DriveTypeAutoRun to disable them on a per-drive letter basis or services cdrom autorun to turn it off for all CD/DVD drives.

Re:No regedit required at all...

[towsonu2003]

regedit is required. XP will pop up stuff to ask you whether you want autoplay after you do changes...

Re:No regedit required at all...

[djflipstarx]

Can't you just hold the right shift button as you insert the CD to prevent the V1 Autoplay? I'm pretty sure I've done it when I wanted to browse a software CD without having the autorun pop up.

Re:No regedit required at all...

[Anonymous Coward]

And if you turn off Autoplay completely, then iTunes won't be able to use your CD drives.

Thanks alot Microsoft, and fuck you very much Apple.

Re:No regedit required at all...

[AFCArchvile]

Yes, and through the Windows Registry, you can disable autoplay on the CD-ROM drives. I forget what the address to this is, but you can disable it with Microsoft's very own PowerToys, as well as a number of other third-party utilities.

I personally always disable autoplay; it's an avenue for malware, and anybody can open the AUTORUN.INF file on the root directory of the CD and see what program would have been started, and then make a decision on whether that program is appropriate to be executed.

nonsense

[Anonymous Coward]

so basically i can write a virus, infect millions of PCs and just claim that I am protecting my IP?

i just have to make up some makeshift software or music or anything i can electronically ditribute and circumvent any anti virus law?

wow

What is being sold here

[Nom du Keyboard]

saying "how many times that software applications created the same problem? Lots.

Just what is being sold here? Music, with a 3,000 word EULA -- or software? I think what has been created is an entirely new category of product.

And I, for one, feel this new product is being sold under deceptive marketing practices that have it masquerading as be a product it's not. It pretends to be a regular music CD, with only fine print informing you otherwise. This deserves full investigation by all regulatory authorities with appropriate punishments doled out. In addition. these CDs should be sold in an entirely different section of any store from regular music discs.

Re:What is being sold here

[Kjella]

And I, for one, feel this new product is being sold under deceptive marketing practices that have it masquerading as be a product it's not. It pretends to be a regular music CD, with only fine print informing you otherwise.

No no no, it's an enhanced CD, that is doubleplusgood!

For the non-technical:

[SLot]

"Hey, I know we were found in your house in the middle of the night after breaking in a window, but we've cleaned up the mess and put in a new pane of glass. Aren't we responsible"?

Now, if only the non-technical people could see this....

Re:For the non-technical:

[Frogbeater]

Yes! Correct.
Please Mod up Absoluts reply.

They didn't fix the broken window, the only way to fix the problem is to rebuild the whole house.

How can they ever establish a remedy for this outrageously irresponsible act. Their rootkit is comprimising military bases and on corperate systems. How much will it cost to remove? How many systems will never be cleaned?

This is much more than "scaring off DRM in the future." This is irresponsible and should lead to more than a class action suit.

Re:For the non-technical:

[Anonymous Coward]

No, it's more like this:

I bought a chair from Sony. They come to my house to do the installation, which requires removing a giant area of my floor and installing a steel plate in my floor's place. The chair then gets bolted to the steel plate.

During my possession of the chair, a Sony lawyer remains in my house to ensure I don't make unauthorized uses or copies of the chair. The lawyer also occupies many other chairs and prevents my use of them.

When I ask Sony to remove the chair, they drive their back hoe through my front door, rip out the chair, and partially replace my floor. They leave the giant hole in the front of my house for all to use.

A week later, they offer free wallpaper for the new wall I might install someday.

How was that responsible?

For future reference, modifying the Windows kernel is not "normal operation" and I will attack software that does this with the same ferocity as that back hoe did to my hypothetical wall!

Re:For the non-technical:

[Pollardito]

you forgot the part about "it's ok because windows break all the time"

Re:For the non-technical:

[ClamIAm]

Relevant quote

Another reason to run BSD/Linux

[putko]

Cary is right. This stuff was out there, working (in a broken, insecure) way for about 2 years. Windows has been out there, working (in an somewhat insecure way) for longer. The same for sshd and a bunch of other programs.

Where were the security experts who help to protect the millions of windows machines?

Well, at first I was figuring they somehow were asleep at the switch, but then I thought -- OK, if they run OpenBSD, OSX or Linux, perhaps they just didn't notice that there was a giant rootkit running on their machine.

If I was a security researcher who runs windows on my desktop, I'd be thinking, "back to the drawing boards."

And I guess this is a good reason to run some freaky os like Zeta -- the rootkit just isn't going to work, unless you are running some sort of emulation software to emulate a PC.

Remarks on Sherman's closing remarks

[digitaldc]

"And for generations, students have spent their hard-earned dollars on the music they love in the local college record store. How many of those stores are left now? Makes you realize just what the impact of illegal downloading can be, and why we've taken the actions we have."

First of all, hard-earned is questionable. I know plenty of college students who never worked before or during college, so maybe he should quantify the statement by adding 'parents' hard-earned money. Also, it would be about one generation that has even dealt with this issue, not 'generations' as if file-sharing was something people did back in the Bronze Age.
Second of all, I highly doubt these college 'record' stores closed because of illegal filesharing, more likely they closed due to big-box retailers offering CDs at highly-discounted rates, thereby making money by overall volume of sales, not individual purchases.
Third of all, it doesn't make me realize anything, except that the music industry are hypocrites for having settle a lawsuit for price-fixing/gouging in 2002 and then claim they are losing money now. Was that price-gouged projected earnings, or actual earnings they are losing? This only leads me to believe that the music recording industry is a very greed-driven industry and they probably don't really care about the low-volume 'college record stores' anyway.
Read more here: http://www.usatoday.com/life/music/news/2002-09-30 -cd-settlement_x.htm

Re:Remarks on Sherman's closing remarks

[mborland]

And for those that are too young to remember, blank audio cassettes were probably one of the largest expenses for students back in the 80s and early 90s. Most people had shelves of copied albums and mix tapes.

MP3s (etc.) just add a different medium for the same music sharing impulse.

Re:Remarks on Sherman's closing remarks

[digitaldc]

But since you can use a computer (as opposed to a tape to tape deck) it is infinitessimally more egregious! Off with their heads I say!

Re:Remarks on Sherman's closing remarks

[poot_rootbeer]

Also, it would be about one generation that has even dealt with this issue, not 'generations' as if file-sharing was something people did back in the Bronze Age.

Home duplication of records has been around for about 30 years -- it's just that for the first 20, the medium used was typically audiocassettes.

That's more than one generation.

Re:Remarks on Sherman's closing remarks

[BumBiscuit]

Second of all, I highly doubt these college 'record' stores closed because of illegal filesharing, more likely they closed due to big-box retailers offering CDs at highly-discounted rates, thereby making money by overall volume of sales, not individual purchases.

That, and the ability to locate previously obscure music cheaply and easily via Internet retailers.

In my recollection, most people went to the local college record store only begrudgingly. It meant braving the overwhelming reek of patchoulli incense and the disdaining sneer of the musical-elitist prick behind the counter when you plopped your import Morrissey single down in front of him. Not to mentioning the bowel-emptyingly awful sounds of kittens being garrotted with guitar strings that were invariably being played at jet engine levels over the store's tinny speakers.

If I could have simply jumped onto Amazon and ordered a copy of whatever off-kilter disc I was looking for, I would never have set foot in one of these dingy holes again. To say that file sharing somehow killed local college record stores is absurd; they killed themselves by being awful and obnoxious and in no way superior to the alternative means that sprung up in their wake. Good riddance to the bastards.

-- Bum

Re:Remarks on Sherman's closing remarks

[theLOUDroom]

as if file-sharing was something people did back in the Bronze Age.

Actually it was.

If you could get your hands on a book, by all means, go ahead and copy it. There was no such thing as copyright back then.

People seem to forget that copyright is an arbitrary legal construction. There's nothing fundamentally necessary about telling people what they can't do behind closed doors in their own home. Many would argue that this is antitheical to a "free" society.

He should know better

[thsths]

Sherman says:

> You can't simply make an extra copy of a Microsoft operating system, or virtually any other commercially-released software program for that matter.

which is really interesting. Last time I checked it was trivial to make a copy of the Windows XP installation CD. Heck, you can even download a trial version.

Activation is of course a different matter. It is new with XP, and it is a major pain in the ***. But I guess for an OS it is acceptable, especially if you also receive free security updates. Registering every single CD before playing would be fun, hm?

Re:He should know better

[quantum bit]

Activation is of course a different matter. It is new with XP, and it is a major pain in the ***. But I guess for an OS it is acceptable, especially if you also receive free security updates. Registering every single CD before playing would be fun, hm?

No, it's not acceptable for an OS, and we shouldn't put up with it. For a single application maybe, but if your OS suddenly decides that it thinks you're a pirate and shuts down, it renders YOUR property (your computer) useless.

Some of my friends and family have purchased computers that came with legal copies of XP Profressional, but if they must use Windows I encourage them to wipe it out and install Win2k. The last thing they want is to have to call Microsoft to get permission to use THEIR computer again just because they added some hardware.

CD's? We talkin' about CD's??

[mainphrame]

You would think that the music business would learn by now, but apparently they are pretty slow learners. They are using an old fashioned antiquated system of delivering their product that has no means of protection built in. To take a line from Alan Iverson "CD's??, we talkin' about CDs?" Who the h*ll still wants music on purchased CD's. Hey Music Men please try and keep up. CD's are dead. How may people still listen to a CD they bought? Maybe some but most people use a portable music player like the ipods. Or if they do use a cd then its one that they created with a playlist of the songs they most like to hear. The music industry is so scared of all the different ways that people like to listen to their music because they have not found a way to give us this flexibility themselves. Their answer? Try to make us stay in their little box that they can control. Pathetic, unimaginative, and just plan old dumb that is the biggest problem with the music industry. Hey Record Labels, you're loosing business because you are stupid and lazy not because people are ripping you off. Give your consumers the music they want how they want it and they will pay for it. Make them come up with their own ways of getting the music in the format they want and you'll feel threatened. Get creative on distribution not on restriction and you'll have a much more loyal customer base.

By the RIAA logic. . .

[kimvette]

By the RIAA logic, folks who engage in file sharing are also doing nothing wrong. After all, they are not distributing for a fee, no physical property is stolen, and many users are unaware that most artists only receive a very, very tiny percentage of each CD or tape sale (usually $.30 or less per unit). So, because the average Joe is REALLY hurting the average artist with each MP3 download, but doing so UNKNOWINGLY, due to his misguided idea that the artist is getting $11 out of each $17 CD sold, then of course the average Joe is innocent of wrongdoing.

Hey if that kind of logic (feigned ignorance) works for the RIAA, it ought to work for file sharers as well.

This is why unless a REALLY compelling release comes out (e.g., Pink Floyd, Weird Al) I don't buy RIAA material - not even from so-called "independent" labes which are really just shell companies owned by RIAA labels. Heck, I haven't even bought Roger Waters' "Ca Ira" because it is a Sony/BMG release in the states. Instead, I am looking for an overseas source for it - legit or otherwise, and I emailed Sony as such.

Justification still stupid

[Bullfish]

Sony has been saying they did nothing wrong all along so it's not a surprise to hear the RIAA chime in. So others do it too, does that mean a burglar should get off because others have broken into your home? Protect their content, they are entitled to that, but not at the expense of our data.

This is another of the RIAA's great stabs at PR by pouring gasoline on a fire.

Makes you wonder of any of their people went to business school.

Sony did nothing wrong?

[Vampyre_Macavity]

*coughbullshitcough*

Unauthorized installation of software.

Deliberate introduction of software that creates security vulnerabilities.

Unauthorized alterations to system function (namely, disabling the CD drive) if the DRM software is removed.

Is it any wonder that their CDs are now banned from most workplace computers, have been criticized as 'a threat to Homeland Security' by the DHS, and are facing multiple class actuion lawsuits?

I'd say Sherman has his head up his ass if he considers this the result of Sony "not doing anything wrong".

Re:Sony did nothing wrong?

[Anonymous Coward]

But when will they make these things ILLEGAL ? With regard to the root kits, Sony has legally done nothing wrong.

Re:Sony did nothing wrong?

[Vampyre_Macavity]

Unauthorized software installation, deliberate indroduction of software designed to create security vulnerabilities and unauthorized modification of computer function are already considered acts of cybercrime or acts that enable cybercriminals (such as identity thieves, phishers, spammers, industrial spies, and virus writers to name just a few - there are at least two known virus variants that exploit the rootkit).

Sony has also committed acts of vandalism (they're causing damage to the computer system by disabling the CD drive of any computer where the user deletes their rootkit DRM without the owner's permission, hence vandalism), and the US Department of Homeland Security has said the DRM rootkit poses a clear and present threat to homeland security.

Now THAT'S a headline I'd like to see: "Sony-BMG Executives Detained On Terrorism Charges".

SonySuit.com - Strike back in Small Claims Court

[marklyon]

What Sony did wasn't responsible, it was, in fact, a crime in many areas. Call and report it to your local police department.

On the civil side, you don't have to wait for the class action lawsuits against Sony BMG Music Entertainment and First 4 Internet to wind their way through the courts -- you can sue on your own in Small Claims Court. For a useful guide to get you started, visit SonySuit.com.

New Year's Resolution

[JustNiz]

The RIAA's total arrogance is a blatant slap in the face for consumers.
We all need to unite and vote with our wallets because they've made it obvious that the ONLY thing they respect is the almighty dollar. They certainly don't respect OUR rights.

Please everyone, make a New Year's Resolution to NEVER buy another Sony CD.

RIAA is a TERRORIST ORGANIZATION!

[mrchaotica]

By attempting to take over computers with their rootkit, the anti-American, Fascist Sony leadership has committed electronic terrorism against the United States! Therefore, all members of their organization (Al-RIAA) should go directly to Guantanamo Bay, do not pass court, do not collect any more royalties!

(Okay, so I'm only half-serious -- but hey! It could happen, given that we've done it to others for less!)

That's a big "if"

[kebes]

However, I doubt that Sony would have clearly indicated the presence of the rootkit.

No "doubt" is needed. We know what they did. They created a piece of hidden software that would automatically break into users computer's, and install unauthorized software. At no point did a user even have a chance to read a EULA or to understand the implications of what was being installed, since the entire process was being hidden. This sounds suspiciously similar to "computer hacking" ... which I think is not especially legal.

If Sony clearly indicated that they were installing a rootkit on the users' systems, than I think indeed they did nothing wrong.

No, if Sony had not installed rootkits on people's computers, then they would have done nothing wrong. Alas, they installed rootkits on computers, without consent. Furthermore, I'm not convinced that explaining in the EULA "we're going to install a rootkit" would even be legal. The company installing a rootkit should still be liable for damages due to negligence, and users can also (very legitimately) claim that they didn't fully understand how bad/vulnerable a rootkit is.

Frankly, the fact that Sony recalled the CDs and is offering free replacements is fine... but the class-action lawsuit against Sony should be continued. Why? Well the average user (who knows nothing about computers) won't know how to check their machine or remove the rootkit, etc. They will have to hire someone more knowledgeable to do so. So really anyone who bought a Sony CD recently should be given enough money to cover the cost of a computer technician checking their machine. Sony should compensate the end-users at least to that extent, in order to actually undo what they've done.

The comparison to other software is absurd. When I download and run some piece of software, I know I'm taking risks that the software might be buggy. When I play a music CD, I take the risk that the CD might not sound great. However, if a company willfully installs vulnerable software on my computer without my consent, that's not the same as a "bug" or "accidental vulnerability" ... anymore than purposefully hiding a virus in a piece of software is a "bug" or "accidental vulnerability." In both cases, (CD with rootkit or software with malicious virus) the person distributing the damaging product should be held liable.

Non-techies don't know

[ribblem]

I've talked to some of my friends who would are not part of the /. crowd. None of them had any idea that Sony cds have a security flaw that can affect their computers. One of them actually had the rootkit on their computer from when they put their CD into iTunes.

So while Mr. Sherman may praise Sony for doing such a much more than software companies I think Sony needs to do even more. A higher percentage of people using software expect to need to download updates for their computer than percentage of people using CDs. Then there is the whole debate going on in court of whether Sony distributed illegal software...

Bank Account analogy

[Lord Bilbo]

Loading software that can aid others in hiding nefarious programs (I know, just 1 small part of what the rootkit accomplishes) is sort of like...

I wanted to protect the money I deposited in my bank account by breaking in and taking my money from the bank's safe.

In both cases, there are side effects that should be frowned upon by law enforcement agencies.

Breaking/damaging the computer that the root kit is loaded on and weakening the security of the internet vs. damaging the safe and building in which the money is stored in.

Um...

[Anonymous Coward]

Bank Robbers get something you can't pay for, money itself.
Most shoplifters steal stuff for one of three reasons: A) because they're too embarassed/unable to buy it (pr0n, Prep H), B) because they're sociopaths and enjoy it/are compelled to do it, or C) because they plan on making money reselling it.

Only A) might apply in the case of downloaders. Very few shoplifters steal stuff because they have an culturally different notion of property than that of the owner.

Now, if he'd used burglary in the Third World, that analogy may have made sense.

"If we're rich European businessmen, in some SE Asian country to oversee our sweatshop operations, the impoverished masses are going to think that they have some right to the wads of cash we make off of their labor. Does that mean we should simply give up and allow people to take it?"

See, that analogy would fly.

Real fallout might be MS and Anti-virus Cos

[ScrewTivo]

It has already been reported that the anti-virus companys helped create the rootkit. The anti-virus companys were paid to protect their customer from these things. Can you ever trust them again? Is it worth paying them an annual fee when all they are doing is keeping out people that do not pay them off! MS may become the biggest loser as governments realize the Windows OS has this bigger then Everest hole in it. As they wake up they may realize they need another solution and FAST! Governments deal in billions of dollars, surely they have the expertise to review the code of FOSS to determine if there are back doors. So when you are protecting the keys to the kingdom who do you choose?

Re:Real fallout might be MS and Anti-virus Cos

[Tankko]

t has already been reported that the anti-virus companys helped create the rootkit.

Can you please provide a link for this statement? I've seen accusations they they were complacent, but none that says they helped create it.

If you're going to make statements like that, please be better than the people we are fighting and provide evidence.

Thanks.

Sackbeatings

[yakhan451]

"Oh Kent, I'd be lying if I said my men weren't committing crimes."

"Touche"

Need a new distribution method

[xMilkmanDanx]

I was thinking about this the other day, we need a DJ P2P network. Where radio can play and rate any music on it. Music should have a tag pointing to the band's website where CDs / merchandise can be sold directly benefitting the band.

Cost of entry for a new band would be minimal, just upload your song(s) and convince a DJ to check it out and rate it. Which isn't that hard, most of them are pretty sick of hearing the same old crap 15 times a day. This already happens with tapes but tapes aren't easy to distribute, whereas with this, distribution is automatic (as long as the DJ liked it and others check out the particular DJ's new song list).

Re:Need a new distribution method

[dada21]

Let me start by saying that I hate "market" democracies. DJ radio is the worst form of democracy as it tries to create one group of listeners without thinking about the many subgroups.

MySpace does a MUCH better job. You can see what your friends are listening to, and try it yourself. Rather than buy an album that's nationally loved by 2 dozen promoters, you can buy an album that 2 dozen of your friends love and you're more likely to actually like it.

Mass marketing will be replaced by viral mini-markets. A talented local band can do very w ll in th ir local 2-3 state area.

I'd rather see 500 local bands make $100,000 a year than 5 bands making $10M. $100,000 a year is great money for a part time, easily doable if copyright was gone. 6 shows a year to 500 fans (10% of your fan base) and 5000 albums sold.

Yet radio and mass broadcast marketing (protected by coercive copyright) was our only option due to the radio cartels. Podcasts and MySpace are finally taking own the national promotion scene.

Re:Need a new distribution method

[Total_Wimp]

Not to dis your general point, but do you realize that a four member band making $100,000 per year only brings home $25,000 per member?

I don't mean to imply that these guys should have some sort of right to be rich, but I would hope the good bands could at least make a living.

TW

Re:Need a new distribution method

[Fulcrum of Evil]

do you realize that a four member band making $100,000 per year only brings home $25,000 per member?

I believe his point was that most bands have day jobs, or should. How would you like to make an extra $25k doing what you enjoy? Lots of jobs pay around $40-$50k for relatively defined work (little overtime). Adding 50% to your take home has a certain appeal.

Re:Need a new distribution method

[Total_Wimp]

I believe his point was that most bands have day jobs, or should.

The part I disagree with is the "or should."

Think about your proffession. Do you spend 40 hours a week at work? 60 hours? More? It takes time and effort to do what you do well. I work in IT and I'm challenged every day. New technologies come out, I need to think of creative ways to use old ones, I need to make both kinds easy to use. I'm sure that whatever proffesion you're in has difficult challenges that must be addressed on a daily basis.

The question is, do you really believe that artists don't face difficult challenges as well? It takes many, many years to refine the vocal cords to the point that you can sing proffesional opera. Advanced photography is as difficult as IT. You will not be able to recreate the statue of David on weekends. And yes, rock and roll is often about far more than "maybe get a blister on your little finger, maybe get a blister on your thumb."

Think what you want about the quality of Britney Spear's music, but when she puts on a show she goes all out. The girl practices dancing and showmanship on a daily basis. The fact that our society cares enough about her art that she can do that full time says something good about us. The fact that your brother in law can play some great gigs on the weekend shouldn't take away from that.

TW

Re:Need a new distribution method

[Fulcrum of Evil]

It takes many, many years to refine the vocal cords to the point that you can sing proffesional opera.

Do most people that sing opera have day jobs? Are most actors working a job to pay the bills?

nd yes, rock and roll is often about far more than "maybe get a blister on your little finger, maybe get a blister on your thumb."

Sure is, but it's art - most people can't make a living at it, and there's lots of room for amateur artists.

Think what you want about the quality of Britney Spear's music, but when she puts on a show she goes all out.

How many groups perform at the level of Britney? In terms of size of production, not many. Statistically, people at her level are rouding error.

The fact that your brother in law can play some great gigs on the weekend shouldn't take away from that.

That's because the brother in law is part of 'most'.

Re:Need a new distribution method

[PunkOfLinux]

I know how hard it is to play music. Granted, I play the trombone, but it's still the same - i've been playing for 4 years, and i'm still far from professional quality. Of course, some people have a gift for music - like my girfriend, who plays 21 intruments. Seriously.

I'm just glad RIAA is revealing their true colors

[theStorminMormon]

There has been a lot of backlash from the Sony blunder, and I think the backlash will continue because there's a relatively low speed of propogation from the techies to the non-techies, but it's there. I tell people all the time about the Sony rootkit who have no idea what a rootkit is - let alone that Sony had put one out. Without fail they are interested in learning the basics of a rootkit (allows programs to hide on your computer by corrupting the OS) and without fail they are angered by what Sony did.

So now to have the RIAA come out and say "me too!". Nothing could be better. There's a lot of anger coming Sony's way, and I'm glad to have the RIAA volunteer for their fair share. First community-minded thing they've ever done.

-stormin

Does anyone know if XCP effectively runs in Wine?

[NRAdude]

Does XCP (DRM) run on Wine?

I'm not willing to buy that Celine Dione record just to get a hold of the DRM software on it. Another thought worth noting, is how the DRM software loads; is it a viral, embedded application in the Compact Disc music format, to quietly run the moment a Microsoft Win API media player interprets the music format of the Compact Disc, or is it executed with an "AUTORUN" file and referenced as a file itself? Thanks everybody.

I just thought of something

[cy_a253]

Arguably, Sherman is right -- but I enjoy much more the fact that this whole r00tkit fiasco has set DRM back by years. Gogogo poor implementations!

What if the unnamed programmer who coded this rootkit made it unsafe "on purpose", in order to convince the public that DRM mesures are unsafe and dangerous? It's really unlikely, but if it were to be true, man that guy was really brilliant, no?

Re:I just thought of something

[marklyon]

Nope, wasn't an accident. Ceri Coburn of First4Internet really is that incompetent. He only got as far as he did because people are a bit too helpful.

Nothing wrong huh?

[Anonymous Coward]

There are millions of songs downloaded from the internet for free on a daily basis. It happens all the time! It's not unusual, so must be there's nothing wrong with it. I'll go back to being a scurvy pirate now. Yarg.

All well and good...

[tekiegreg]

However I'd like to see the RIAA's feedback on the (at least alleged) LGPL violation by Sony in this. Would the RIAA (MPAA, BSA, etc.) encourage companies to practice what they preach? As posted previously on Slashdot there was a potential LGPL violation. My suspicion would be that the RIAA takes a "no comment" stance, hehehe....

RIAA and their PR

[sinco]

The thing that intrigues me is the RIAA has the nerve to support this action when Sony clearly suggested (not in a press release but in recalls) they made a mistake. This shows the RIAA does not care about their PR. It seems to me the RIAA views us as consumers who will buy their product at any cost, regardless of how they treat us. Like suggested before, they have a monopoly at hand. I'm hoping in the future that some of the consumers can conform to suggest reasonable methods of distribution and rights to combat the RIAA's evil actions. If not I think the RIAA will keep on pushing for complete control over digital distribution and rights.

It's MY computer...NOT theirs!

[Danathar]

I'm sick and tired of the MPAA/RIAA saying they can do ANYTHING they want with DRM! It's MY computer, NOT theirs. They MAY NOT do stuff to my system without my consent!

Yea right...

[LWATCDR]

"" According to Sherman, the problem with Sony BMG's XCP DRM software was simply that "the technology they used contained a security vulnerability of which they were unaware". He goes on to praise Sony's "responsible" attitude in handling the problem, saying "how many times that software applications created the same problem?".
The difference is that an application give the end user some benefit. This one limits the end users ability to control their own computer. Also an application can only make your system vulnerable while it is running. This root kit gets installed as a service I believe so it is running all the time.
Finally an Application can be uninsulated.
Nope Sony screwed up and we are made as hell. I am not going to buy any CDs from Sony for a while and if I feel the need too I will ripe them on my Linux box first and make new clean CDs ASAP.

Move along.. nothing to see here..

[drunkennewfiemidget]

In other news, Satan says murder is fun!

In Summary:

[llbbl]

Sherman: "Sony, good job on the root-kit idea, too bad you got caught"
Sherman: "Oh yea and ... /cry /moan oooh we are all so pooor plz stop downloading or we sue u!"

Re:Tape defeats Sony DRM - What World Needs

[Nom du Keyboard]

Last time it was a felt-tip pen, this time it's gaffer tape. I bet a pen will work just as well.

What the PC world needs is a CD driver that comes up and says:

Multi-session disc inserted.
2 sessions detected.
Select session to use (cr for newest): __

Comment removed

[account_deleted]

Comment removed based on user account deletion

FoxTrot tries to educate the Public

[Jaxim]

Did you all see today's FoxTrot? It appears that existence of Sony's rootkit is becoming more and more mainstream.
http://news.yahoo.com/news?tmpl=story&u=/uclickcom ics/20051121/cx_ft_uc/ft20051121

software installs WITHOUT EULA agreement

[Danathar]

The thing thats REALLY bad is that the software installs on your system (disabled) even if you DON'T say "yes" to the EULA.

I'm really hoping that lawsuits brought up with this stuff brings the whole "I can put anything I want into an EULA and it's binding" mantra we hear from certain software and content providers.

No, Sherman is not right

[Dr. Blue]

To pass this off as a bug "of which they were unaware" is horribly inaccurate.

The software hides itself -- by design, not as a bug.

The software makes itself difficult to remove -- by design, not as a bug.

The software places itself in fundamental system areas, like accessing the CD, compromising those areas -- by design, not as a bug.

No, the problem isn't a bug. The problem is a company thinking they have the right to get into places on my system that they have no business being, and then hiding to make it difficult to clean.

A common component of all anti-spyware legislation and attempts that I'm aware of is that everything has to include a reasonable and effective uninstall procedure, that clears out the software. Sony didn't have this -- again by design.

Re:No, Sherman is not right

[TubeSteak]

You obviously didn't get the memo

The dangerous factor was a "rootkit," a feature cloaking the files on users' computers that reported back to Sony BMG about how music was played and transferred

Rootkit = feature
(from this article

Re:No, Sherman is not right

[Darius Jedburgh]

Note also that the software installs itself surreptitiously without you even being aware that software is being installed.

SONY did do something wrong.

[Decius6i5]

The problem with the SonyBMG situation is that the technology they used contained a security vulnerability of which they were unaware.

No, the problem with the SonyBMG situation is that they installed "technology" without the user's consent. How can the user consent in the fine print of an EULA to installing software which is specifically designed to hide itself and to be impossible to uninstall? Obviously, if there was any credibility to the claim that the user consented to installing the software there would be absolutely no reason to hide it! The idea that you can simultaneously get me to consent to something AND keep me from knowing about it is so insane that it would be comical if so many people weren't seriously suggesting that its true.

Furthermore, the "vulnerability" in this program that SONY was "unaware of" is not a typical software bug that developers might be reasonably unaware of. This software is specifically designed to hide any file starting with the $sys$ prefix! The idea that the creators of this software are "unaware" of something they specifically designed this program to do is almost as insane as the fallacy above.

Whats worse, the uninstaller is designed to break security too! If you are putting a remotely accessible ActiveX control on a machine, which has a function called "ExecuteCode," you're allowing any web page to "ExecuteCode" on that machine. This isn't a vulnerability, its a bad design, and the design is so obviously bad that it is impossible to be sympathetic.

If you are savvy enough about computers to be designing DRM software in the first place then obviously you would know that these things are problems!

Evil Pirates! Putting honest people out of work !

[Chaffar]

"And for generations, students have spent their hard-earned dollars on the music they love in the local college record store. How many of those stores are left now? Makes you realize just what the impact of illegal downloading can be, and why we've taken the actions we have."

Causal fallacy.

It's not like he doesn't know it, but why bother building proper arguments when you can get away with absolute b*llshit and still be quoted as a respectable source? I couldn't finish reading the whole article, and to compare file-sharers to bank robbers and shoplifters was just insulting.

Cary Sherman: Obviously, anyone who has stopped downloading (or uploading) illegally will not get sued.

Thank you, Cary Sherman, for your infinite compassion towards us petty thieves, we are not worthy of such.

SCO says, HEY! LOOK AT ME! pleeeease?!!!

[Thud457]

Sony insider: DRM is discredited at Sony

A high-placed source at Sony BMG has emailed me with some interesting information about the ongoing rootkit DRM fiasco. My source says,

Some of the top Sony BMG artists who had XCP placed on their CDs are complaining directly to the label heads, furious that it will hurt their relationship to their fans and their sales as they go into the massively important Christmas season. Add that to rising number of anti-DRM voices within in the company who have been against DRM as only hurting "the people that are doing the right thing and buying our music." This all means that some of the label heads are finally starting to believe that DRM is just bad for business.

Now they are starting to stand up to the corporate leaders who are pushing DRM as the solution to their sliding revenue, particularly Thomas Hesse who notoriously said "Most people don't even know what a rootkit is, so why should they care about it?"

At least of the label heads has threatened never to allow another CD to go out with DRM again.

Re:SCO says, HEY! LOOK AT ME! pleeeease?!!!

[budgenator]

Yeah just before christmas, just a couple weeks before Xbox 360 launch; Sony is such a big company that the left hand doesn't know the right hand even exists, SonyBMG seems to forgotten that a big chunk o'change comes from movies, games and gaming hardware, computers and even high and mid level consumer electronics, and pro grade equipment. This puts such an impact on their corporate reputation, it's going to ripple outward a long ways. Six-pack joe might not know what a root-kit is, but the geeks that buy their high-margin stuff does, hard-core gamers does, and a lot of music-fanatics do.

Re:SCO says, HEY! LOOK AT ME! pleeeease?!!!

[OpenGLFan]

Well, yeah -- this is a "get out of contract free" card for artists. If you believe that this software violates laws, and you're an artist whose picture is all over this CD, you'd definitely have a reasonable argument in refusing to work with the label in the future because the label installed illegal software on your work. If a company used my picture to try to promote knowingly defective, say, toothbrushes that would break off and jab you in the gums, then I'd certainly have the right to refuse to do the other two commercials I'd signed with, on the grounds that I didn't know about the last offense, but I'd be knowingly culpable the next time around.

Re:SCO says, HEY! LOOK AT ME! pleeeease?!!!

[Anonymous Coward]

"At least of the label heads has threatened never to allow another CD to go out with DRM again."

Which ones? Really, which? Who will have the guts to say that, and when? The holiday sales season has commenced. Who will do it versus risking potentially lower sales with the status quo?

The first label to stand up and not only SAY that, but put the policy into effect, will be the one from which I won't feel either ripped off (for buying a "copy protected" disc with my "fair use" rights technically eviscerated) or feel that I am contributing to the problem by financing this beast whenever I buy an audio CD from a major label.

I bought a Nora Jones disc for my spouse at Christmas last year. I felt bad when A) I didn't notice the "copy protected" label, and B) it did not work on our older CD/DVD player. Bottom line: I won't be buying any more "copy protected" Nora Jones discs for Christmas this year -- the risk of disc failure is too much of a hassle -- even though my wife liked the music. I'll find something else without the "copy protection". Sorry, Nora. It isn't you, it's your label's fault.

And, important note for any music execs or artists listening out there: I made this decision based on my experience with copy protection before the XCP fiasco began.

So, imagine my attitude now.

Re:SCO says, HEY! LOOK AT ME! pleeeease?!!!

[uqbar]

This *is* hurting artists, particularly developing ones. There have been at about 20 CD's this year that I've put back in the rack because I was pissed over the SunnComm's attempts to install crap on my work machine (which is against company security policy for reasons which now are obvious to all). I have money, but Sony has chosen to reject the business of honest consumers that don't want to screw up their machines.

Until Sony completely disavows all DRM, I'll buy CD's from other labels with a preference for indy labels, even if it pains me to pass on artists I like (most recently Go! Team, and Kate Bush).

And my next video game console with be the one with the funny new controller...

Re:SCO says, HEY! LOOK AT ME! pleeeease?!!!

[Anonymous Coward]

EMI Music released Kate Bush for the world except USA *WITHOUT* Copy Control. Sony/BMG released Kate Bush in the USA *WITHOUT* Copy Control. Maybe Kate had some influence in this?

Re:SCO says, HEY! LOOK AT ME! pleeeease?!!!

[uqbar]

I'd like to think so - with Ms. Bush's power she should be able to make certain demands, and I was fairly bitter when I went to buy the CD only to learn that it was Sony.

The again what's Outkast's excuse? What about Pharell?

"Gogogo poor implementations!"?

[OneIsNotPrime]

I believe you mean "Gogo Gadget poor implementations."

Yet another reason to go to Digg.com; correct Inspector Gadget quotes.

Just kidding.

Analogy

[99BottlesOfBeerInMyF]

In explaining this case to a friend I came up with an analogy that I think does a good job of expressing the issues. Imagine, if you will, that you purchased a new coffee mug that came with a warmer that could be plugged into either a wall socket or a USB port and would keep your coffee warm while you worked. Now imagine the company that sold the coffee mag+warmers was run by a very paranoid person who feared that people might copy his patented coffee mug warmer and illegally sell knock offs. So, in addition to drawing power from the USB, if it was plugged into a computer the coffee mug warmer would silently install a back door on your computer, search your hard drive for schematics that looked similar to those of the coffee mug, and connected to the internet an uploaded your personal information to a server run by the coffee mug company. Further imagine that the software used techniques to hide from the user and the OS and conceal this fact. Now, just to add some spice, image that the software was found to both have a serious security vulnerability and to contain code that was infringing upon someone else's copyright.

Sony is selling discs intentionally designed to trick users into thinking they are CDs, when in fact they are not CDs, they are devices that act like CDs enough so that the user does not notice that they are something else, while silently trying to hack that user's computer. Hopefully, the individuals involved will face criminal charges for their actions.

Other apps create the same problem.

[DieByWire]

Seems very responsible to me. How many times that software applications created the same problem? Lots.

He's right. But those applications are usually called 'viruses,' 'trojans,' or 'worms,' and their authors face jail time when they're caught.

Richard M Nixon said it first ...

[rewinn]

"... when the president does it, that means that it is not illegal."

The RIAA - Now More Than Ever!

Oh boy do I disagree

[digitalgimpus]

Maybe it's just a coincidence, but I just blogged earlier this morning that they should be compensating users financially for the trouble they have caused. And/or face some criminal liability.

Seems like the only way to rid yourself of their blunder is to wipe and reinstall windows. IMHO users should be compensated for that.

There's absolutely no way that Sony didn't realize the risks associated with using a rootkit. It's been covered here before (among many other places, typically regarding spyware). So we can safely say they knew what risk existed.

They were just hoping everyone was to dumb to realize what they were doing.

Am I bias or just looking to attack Sony? No, definately not. I didn't get this garbage, heck I'm not even a real music fan, so the whole thing is a null as far as I'm concerned. To be honest, I like Sony hardware. So I'm not a anti-sony jerk taking advantage.

I just know I hate reformatting my computer because windows got screwed up, and I know what I'm doing and can do it quickly. There's quite a few people out there with this garbage installed on their computer... and some don't even realize what's going on.

Come on Sony... open up your wallets and compensate them for your blunder. You knew what you were doing was wrong. You did it anyway. Now compensate. If it were up to me, your execs would be in jail for a year or two for hacking, since that's effectively what you did.

I really don't want Sony to get off free here. Just think about what the next one is going to try and get away with. Just wait until version 2.0 includes a keylogger to ensure you don't transcribe the lyrics.

Come on Feds... don't back down.

Re:Oh boy do I disagree

[Ekevu]

Wee!!! Yeah!!! Go you!!! Sony sucks!!! Ohhh! Free Sony PSP? I want some!

Re:Oh boy do I disagree

[EvilStein]

I totally agree with you. Problem is, watch the lawyers file the class action lawsuit. Lawyers will make millions, and users will get nothing more than a $5 coupon for their next Sony BMG purchase.
It's royally sucks, but sadly, it seems to be the reality.

Security vulnerability

[inverselimit]

The purpose of DRM is to prevent the customer's computer from functioning properly, and obeying the commands of the computer owner. Thus DRM is inevitably a security violation. Or in the words the RIAA might use, DRM is theft--of the computing resources of another person.

Sony become Script Kiddies

[galdrin]

So as long as Sony apologised then everything is ok? So when we catch the next hacker that installs a rootkit, we can let them go secure in the knowledge that they have apologised!

MOD PARENT UP

[Anonymous Coward]

I've not heard a more truthful analogy in ages.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sherman is dead wrong

[Anonymous Coward]

With its rootkit Sony is clearly in violation of existing law and someone in Sherman's position should know that. If it was not Sony but some teenager he would be sitting in jail now.

Copyright infringement not stealing. Rootkit *IS*.

[Spy der Mann]

Dear RIAA:

Your rootkit has stolen my:

- Computer safety. Imagine you suddenly find your door locks disappeared and everyone could enter.
- Electricity. Your rootkit consumes CPU usage I *never* agreed on giving you.
- bandwidth. Because of your rootkit, I can't allocate 100% of my communication channels for my teleconferences.
- sleep. I don't know if I'll be called by the FBI because some hacker used your rootkit to commit illegal acts using my computer.

In other words, you're stealing my MONEY, you **tards!

Sincerely,
disappointed customer.

Yeah, the problem is the LIES

[mrchaotica]

Let alone the fact that calling it a "defect" is a blatant lie, because the thing everyone's complaining about is what the rootkit was designed to do! No, the only thing "defective" (from their perspective) about their rootkit was that they got caught

The management Sony-BMG and the RIAA are all a bunch of criminals, who have committed crimes far worse than any copyright infringers could ever could. They shouldn't be holding press conferences; they should be in prison!

So, its official.

[Belial6]

So, the official stance of the RIAA is that they have the right to infect peoples computers with rootkits.

Re:Yea right...Ditto!

[Nom du Keyboard]

"According to Sherman, the problem with Sony BMG's XCP DRM software was simply that "the technology they used contained a security vulnerability of which they were unaware".

And the software only phones home in order to download a service pack to fix the vulnerabilities discovered after release. This is all for your protection, Winslow.

LOL!

[Anonymous Coward]

Great comment! The loophole, though, is that they said "nothing unusual," not "nothing wrong."

In other words, they know it's wrong, but think it's standard practice. Kinda like we know it's wrong to download music we haven't bought, but it's standard practice.

Re:LOL!

[hcg50a]

He said Sony made a mistake:

The problem with the SonyBMG situation is that the technology they used contained a security vulnerability of which they were unaware. They have apologized for their mistake, ceased manufacture of CDs with that technology,and pulled CDs with that technology from store shelves.

The title of the article is completely bogus and misleading.

Re:LOL!

[wes33]

You are being obtuse. The difference is that a "mistake" is not a "wrong action". So to say that is a mistake *is* to say that is not wrong. Suppose I trip by mistake and knock you down. I didn't do anything wrong (you can still be compensated of course). Suppose I willfully decide to fake a fall so that I can knock you over. That is not a mistake, and it is wrong.

Re:LOL!

[RAMMS EIN]

``Kinda like we know it's wrong to download music we haven't bought''

It's not like you can buy the music, anyway. You can only ever license it. The RIAA keeps it.

Re:LOL!

[$nyper]

No no your honor... downloading 3000 mp3's for free was not wrong... it was just a mistake!

Re:LOL!

[Anonymous Coward]

Hi - This license the music thing wrt CDs. Has this ever been challanged in court?

Back to the point:

[BrokenHalo]

I wholeheartedly agree that artists in many cases get shafted.

However, that is not really the issue which Sony is attempting to defend. Sony is attempting to defend an action which essentially transfers ownership of _your_ computer to itself. And it is that which prompted the legal slap, and rightly so, for what it's worth.

The fact that Sony seems to be unable to learn that lesson is another issue, and apparently one's only recourse seems to be to boycott their recordings. In my case, that seems incredibly easy to do, since I own a vanishingly small number of them.

The state of Texas apparently disagrees

[Zygote-IC-]

Just got a press release in our newsroom that the Texas Attorney General Greg Abbott is suing Sony BMG.

Full release can be found at http://www.oag.state.tx.us/oagnews/

Don't mess with Texas.

Re:The state of Texas apparently disagrees

[scharkalvin]

"Because of alleged violations of the Consumer Protection Against Computer Spyware Act of 2005, the Attorney General is seeking civil penalties of $100,000 for each violation of the law, attorneys' fees and investigative costs."

Let's see, how many copies of the CD did they sell, multiply by $100,000. Wow, I'd
sure sell Sony stock short if they get it!

Re:The state of Texas apparently disagrees

[Jarnis]

Mmmm...

"Because of alleged violations of the Consumer Protection Against Computer Spyware Act of 2005, the Attorney General is seeking civil penalties of $100,000 for each violation of the law, attorneys' fees and investigative costs."

Too bad this probably only relates to the crimes done in Texas.

100k$ per installed CD, 2M+ CD's sold... that would be a *serious* chunk of change even for a megacorp like Sony.

Even if this is limited to texas, it could still be tens of thousands of CDs, 100k$/CD...

Ouch? :)

Re:The state of Texas apparently disagrees

[ObsessiveMathsFreak]

Don't mess with Texas.

Or we will sue your company and toss the proceeds into state coffers. How noble. I wonder how much of the money will simply go to paying off the legal teams rather than compensating the users whos computers have been violated.

Re:The state of Texas apparently disagrees

[KitesWorld]

Doesn't matter. The whole point of a Criminal prosection (which is basically what this is) is that it punishes the 'guilty party'. People see that punishment, realise they don't want to be on the recieving end of that punishment, and dont break that law.

That's pretty much how criminal justice has worked since, well, ever. Shoot the scapegoat, watch the rats scurry.

Re:The state of Texas apparently disagrees

[samj]

If the users want to be compensated they can take on Sony themselves or by starting/joining a class action. The law in question is designed to prevent this type of shenanigans, and like most other punitive penalties will end up serving some purpose other than compensating victims. If it makes companies think twice before distributing spyware then we all benefit. It's similar to expecting drink driving fines to be distributed amongst victims - there are various forms of (state and private) insurance to deal with this and the money is arguably better spent tackling the problem through more police, education, etc.

If you are considering taking this further the following response to a web enquiry may prove useful:

<snip what="full name, which was not provided with the enquiry!?!">,

Thank you for contacting Sony Online Support.

As your email states that may seek financial and/or legal action against Sony BMG, Sony support policy prevents us from further communication via email. Please address any such requests to our corporate offices:

Sony BMG Music
550 Madison Ave, 24th Floor
New York, NY 10022-3211

Thank You,

Your Sony Email Response Team
CC2S

<snip>
Message : Where should customers send invoices for costs associated with rebuilding machines infected by your software?

Re:The state of Texas apparently disagrees

[Kythe]

Let's see, how many copies of the CD did they sell, multiply by $100,000.

Comes to roughly $200 billion.

I wonder if the RIAA will help them out with that. I sure wouldn't be unhappy if that drained the kitty for suing consumers instead.

Best new vector since MS Look Out! errr Outlook...

[Thud457]

"Congratulations! You have been selected to win this free Celine Dion CD!"

Crap. I guess that ploy would only work if I sent people a CD of something they'd actually want to play.

Here's a little more info...

[ndtechnologies]

Just to touch on the subject of the RIAA and the true theft that occurs...

If you do the research you will find out that a band's first contract (and sometimes their ONLY contract) is NOT designed to give them any say. Remember Hootie and the Blowfish? Their debut album (Cracked Rear View) grossed over 12 million copies. Do you know how many of those 12 million their label gave away to record clubs like BMG or Columbia House (you know the buy 1 get 12 free deals)? 4 million. That is 4 million albums that they will NOT get paid for, and guess what else? It was written into their contract and they had NO say about it. This hasn't happened to them only either. This type of clause is in 98% of new band contracts. The same thing goes for promotional discs sent to record stations. The bands pay for those (and everything else including, studio time, music videos, producer's fees, mixing fees, mastering fees) out of the advance they receive from the label, but they don't get paid for the promotional copies. They have to eat the cost, and hope they can make it up somewhere else, like touring or merchandising. Furthermore, remember that the band doesn't begin to make ANY money until every dime of their advance from the record label is paid back.

The ONLY way that you begin to have any say in your contract negotiations is if you have 2 or 3 really successful albums. Only then can you begin to negotiate your contracts. Do you think a band like Green Day was able to get a really great contract when they first signed up? NO, they didn't. However, after 10+ years and more than a few platinum albums, they now have negotiating power, but most labels aren't looking that far in to the future. As far as they are concerned, most artists have a shelf life of about 3-4 years and then they are old news (just look at Britney, Christina, and Creed if you want some examples).

Remember Record Labels are nothing more than banks. They will stand there with the money and the contract, waiting to see which of the new artists will wade through the river of crap and emerge from the crap with a pen, just waiting to sign. If you don't want to sign the contract, they aren't going to beg you because they know there are others that are willing to do it, if you don't.

If Sony were the average virus writer...

[Nom du Keyboard]

...the FBI would have raided them and seized all their computers by now -- even if a court case is yet to be filed and any day in court is months to years away, if ever.

Hey, FBI, there's still time.

Music CDs are Data STORAGE

[Anonymous Coward]

Music CD's were not intended to contain computer progams. Does your CD player execute windows programs? So how is this the same as a software vendor installing software onto your computer? Music is not Software and there is no implicit agreement that programs will be added to your PC when you play a redbook music cd.

That is the inherent problem with their argument. Its apples to oranges. Games install copy protection, but a game is designed to run on the PC.

This is very much like buying a book, a medium which stores the written word and is replayed by your eyes and brain, and the pages are laced with an invisible substance that is absorbed into your skin and prevents you from repeating the story. A computer is an extension of your brain, and illegally installing protection software and hiding it very much like illegally drugging someone to force them to do your bidding.

Comment removed

[account_deleted]

Comment removed based on user account deletion

In other news..

[Anonymous Coward]

the President of the US claims that he did NOT lie to the world, manipulate intelligence on WMD to sucker Congress into authorizing the use of force, send US soldiers to die in a country with no plan for winning the peace (let alone a plan to bring them home), appoint the man who penned the policy condoning torture Attorney General, or reveal the identity of an undercover CIA officer as political payback against Ambassador Wilson for revealing the truth. Nor are the Vice President's ties to Halliburton in any way related to the excessive contracts granted and paid for services not performed.
Nor did a member of his party call (which, with a few, notable exceptions seems to lack them) a decorated combat veteran a coward on the floor of the House last week. Nor did they try to label Max Cleland (a decorated, disabled combat veteran) unpatriotic for questioning the administration's policies.
And I believe him. Time to check under my pillow: the Tooth Fairy may have left me a dollar.

Sherman is wrong.

[alw53]

Using technology to protect copyright is one thing, however Sony's software installed itself without asking, did not uninstall cleanly, and violated copyrights itself. Unauthorized access to a computer is a violation of US federal statutes, as is copyright violation. And if Sony knew that the rootkit broke Microsoft's pitiful
security model, or if they failed to exercise due diligence in this matter, they could be civilly liable under implied warantees of merchantibility. An example of an implied warantee would be if you bought gasoline from a station that ruined your car engine.

As long as the RIAA isn't infected...

[Guey_X]

Well, I don't really think that the ILoveYou virus was any serious because I WASN'T INFECTED. I wonder what would the RIAA say if their computers were breached because of the rootkit. Just imagine the irony of downloading songs directly from the RIAA because they were infected with a rootkit virus... Sweet...

Tijuana Tattoo

[ZekeSMZ]

After the Sony Rootkit incident, I'd sooner get a tattoo from Tijuana roadside vendor (using a "refurbished" needle) than buy music on a CD.

RIAA Radar

[Anonymous Coward]

Just avoid RIAA related cd's using http://www.magnetbox.com/riaa/

That's it

[aurifex]

Can someone please throw a bomb through this guy's window? We don't need people like him wasting precious air and living space on this planet.

Patch on the internet?

[pdschmid]

He has a point...Traditionally software isn't pulled off the shelves when a security flaw is found in it. Imagine Windows being pulled off the shelf once a month... Nevermind...I forgot that people bought music from Sony and not software ;) And his comment about the patch on the internet? Sony would look MUCH better by now, if they actually had posted a real patch for this problem aka as a clean uninstaller!

RIAA Hates its Retailers Too.

[twitter]

Yeah, what a bunch of morons. This is a typical response of an entrenched cartel. "We've done nothing wrong, you are a bunch of theives. We're going to do it some more, fuck off."

That this is turning off music buyers is a growing story. It also points to their envisioned future.

If they want to be selling music they need to get their act together. Both Sony and EMI's stupid DRM fail to work with the leading portable music player, the IPod. Get it yet? Even if this shit had "worked" and not actually hosed the user's system, it would still be a "broken" CD because it does not do what customers want it to - transfer to a portable music player.

I suppose they can grunt and say, "What's the problem? Jus go use deh Itunes or WMP." Well, well, well where does that leave brick and mortar retailers? Out of luck, that's where. Nothing new there. Given their policy of RIAA only or no RIAA at all and other crappy anti-competitive practices of old, they have always hated retailers because they have an inherent loyalty to the actual music fan.

Oh yeah, they hate their artists too and I would not buy stock in any of them. That means they hate everyone.

Re:RIAA Hates its Retailers Too.

[Doc Ruby]

Just listen to the crap music they protect with their industry. They hate music. They're subhuman.

Two measures?

[Anonymous Coward]

So downloading a CD-rip, lending a CD from a friend or even making a backup of a CD *you own* is "wrong", "illegal", "unethical" and "might destroy the world as we know it"... But installing a whole *vector* for spyware, virus, trojans, keyloggers is just "bussiness as usual"... I mean, come on!! The software itself is a really really bad thing, but what it makes possible is, in my opinion, even worse! One can do *anything* (even cheat in online games!) is one exploits the huge backdoor that the Sony components install on a PC! And, from the RIAA's point of view, this is all right.

Ok RIAA, you just confirmed the idea that you have of your customers: a stupid mass of people with money to spend, and that can be cheated, tricked, lied to, and fed with reashes and repacks and "new versions" of things they already own. On the other hand, the "stupid mass" can be sued, terrorized and bullied if they start to drift from the path that *you* think it's right... Afterall, "people don't even know what a rootkit is, why should they care?".

This things really make me angry because this sort of behaviour torward the *customers* should get the attention of the government and the companie(s) responsible for such actions should have a really heavy punishment (yes, punishment). Imagine if the food industry started to quietly insert some sort of "tag" into the food so that when we eat something that we grown in our backyard, we get awfully sick...

By the way, I would like to see legally how does it compare a copyright violation (for example ripping a CD or using P2P) with some other crimes... My guess is that copying a bunch of stupid CDs is getting too much importante in the eyes of the law...

And yeah, yeah, I know that legally "copying is theft", "it's the same as stealling a car" and all that, but let me remind you that freedom of speech and associaton was a crime in many countries too (usually during ditatorships) and that even if something is legally a crime, well, it doesn't make that automatically "right" or "aceptable". Laws are made by human beings wich are (gasp!) prone to errors, corruption and weakesses, as any other human being. If the law says something and we don't agree, maybe it's time to *change the law*, or at least voice our opinions.

Re:Two measures?

[Travelsonic]

And yeah, yeah, I know that legally "copying is theft", "it's the same as stealling a car" and all that, b

Actually, legally, copying is not theft (if it goes against the wishes of the copyright holder/is not public domain, it's copyright infringement), and it being worse than stealing a car is a moral opinion, despie what the RIAA wants you to think. Maybe it is worse in terms of penalties, but whether it is worse in any other way is an opinion at best and can not be forced onto others unless they are able to believe it too.

WTF?

[stinky wizzleteats]

how many times that software applications created the same problem?

Yeah, that shareware side scroller I wrote - it accidentally installs a rootkit, violates the DMCA and copyright, and breaks your CDROM drive. Ooops.

The ultimate would be..

[milobloom-ab]

..for someone to bring a lawsuit against Sony under the DMCA for circumventing Windows security or something. Surely the DMCA is ambiguously worded enough to allow for this? :)

No Christmas For Sony

[Error27]

I don't plan on buying _any_ Sony products until after Christmas.

Sony doesn't care about what people think only about if people buy their products. If we don't make a measurable dent on the pocket book for a couple weeks then they'll just go back to installing spyware on all their CDs.

I hope a lot of other people decide to do the same thing.

They Knew What They Were Doing...

[hipster_doofus]

I think Sony obviously knew that what they were doing was wrong, otherwise they wouldn't have gone to such lengths to hide it. If you have to hide something from your customers, chances are it's at least unethical, if not illegal.

Do markets *always* trump cartels?

[NickFortune]

Regarding your subject line - do you have any historical examples of this, or is it more like an article of faith? That's not a dig; this is something I'd like to be true. However, experience tells me that those times when I want to believe something are the times when I most need to check to facts.

I suppose the problem is going to be that all cartels fall in time, and in every case the role played by the market is going to be open to debate.

Anyway, I'm curious as to whether you cite any examples.

Re:Do markets *always* trump cartels?

[dada21]

No, you're right. I'll have to track down some of the sources (I post from my PDA phone so I don't keep access to all my research here). I'll try to look up some old articles I wrote about Standard Oil, American car companies, and various other cartels over the years and e-mail it to you later.

In my research, the only cartels that took decades to break were the ones that held real power over the elected officials. As time goes on and as citizens keep putting faith in voting, these powers will only get worse -- yet the Internet opens so many holes in the cartels that I am hoping we'll see some tumble quick before they even see the end.

Re:Do markets *always* trump cartels?

[James_Duncan8181]

Counter example: DeBeers - still over 90% of the world diamond market and holding sufficient diamond stockpiles to keep the price *way* over true market value. They have replaced governments, were an unapologetic supporter of the South African apartheid-era regime, and still continue to buy conflict diamonds to maintain their hold on the market. Over 100 years and still counting.

I don't think that's right...

[kenthorvath]

Arguably, Sherman is right -- but I enjoy much more the fact that this whole r00tkit fiasco has set DRM back by years. Gogogo poor implementations!

First let's take a look at the claim that Sony was merely trying to add a layer of protection to their IP by using XCP and weren't aware of the potential security flaws.

For starters, if they just wanted to encrypt their data or have a program running in the background that prevented the user from opening a certain application, this is all possible with XCP. In fact, the only reason to use XCP is to bypass the built-in security measures that your computer should have immutably enabled and functioning. That is, they wanted their DRM software to be in a position of ultimate control over your computer. Ordinary security features prevented this, so they install XCP to hijack your computer, to bypass security - and not only that, but they provide that control to any program that prefixes its name with $sys$. That is, XCP is a security flaw by its very nature and it was licensed with just this functionality in mind. There is no other reason to use it, but to circumvent security measures.

Now I'd like to address the seemingly prevalent belief that people are up in arms against this software primarily because it may allow a virus or other undesirable program unfettered access to you system.

People are used to security flaws within windows. They happen all the time and MS releases patches. They are not well loved for it, but for the most part, people continue to use windows and tolerate the seemingly ubiquitous lack of security. Why then, would they make an exception for Sony's case? I believe the answer lies not in the DRM itself, but in Sony's arrogant and anti-consumer attitude that they're right to control their "property" usurps the consumer's right to control the functionality of his or her computer.

One statement that whoever-it-was in this interview made in defense of Sony was that DVD's have been DRMed forever. You can't rip them to disk, you can't copy them, you can't even play them in non-licensed players. CDs, on the other hand, (as manufactured by Sony) are designed not to prevent you from playing them, or copying them, or presumably using them as you see fit, but rather to prevent you from copying in excess and giving too much of Sony's IP away without their consent. The problem with this logic is that for one thing, nobody is giving the movie companies kudos for locking down their DVDs. That I can't legally rip my copy of Spaceballs to my iPod video isn't a fact that gains MGM much love. And secondly, CDs were never designed to be crippled in the first place. When I buy a CD, I expect it to behave like a CD. Sony wants to change the way CDs behave - and the only notice they give you about it is an enigmatic little "CP" icon and the words "content protected". Content protection sounds good to me - does that mean that my CDs will scratch less, or that if I lose the CD, the content will continue to be made available to me, because I paid for the content? I thought not.

Lastly, I'd like to take issue with the notion that the Sony fiasco has set DRM back for years. I don't think it has. In the official release, Sony has only recalled the discs with XCP and has all but promised that future CDs will be released with some form of DRM. As long as the methodology doesn't usurp the functionality of the computer or provide in any egregious way a security risk, Sony will continue to distribute crippled CDs. That is, after all, the reason for the fiasco in the first place. It wasn't the DRM that got them in hot water, it was the way they went about achieving it. There are still many CDs out there with the "CP" logo that Sony hasn't recalled. Santana's newest CD comes to mind.

This is the way that the future is going to go. DRM has more than a foot in the door, it nearly has a whole leg. The Sony fiasco must serve as a wake-up-call for us, or we risk losing the public domain forever. (DRM + DMCA = unlimited copyright terms) We mu

Re:I don't think that's right...

[KitesWorld]

It's quite possible that this has set DRM back several years - at least with regards to CD's themselves. It's not possible to prevent CD's from playing back or bieng copied in a PC without installing additional software - that's part of what makes a CD what it is. The legal actions now taking place *should* only be the tip of the iceberg.

Now that people have seen the potential for software based DRM to cause damage to their machines, people are going to be wary about it. People are already boycotting cd's that have copy-protections because those cd's won't work with their Ipods, for instance, and thats only going to spread further as a result of the mainstream press picking up on this.
And when people in general think something is 'bad', politicians always sieze on it. Don't be too suprised if you start seing attempts to push through legislation that limits the rights of content-publishers with regards to what they can get away with.

Heck, Australia has already made rulings against DRM - they've rejected a lawsuit filed by Sony against mod-chips, on the basis that people have bought their software legally (although overseas) and as such should be able to use that software. Without restriction.

More FUD.

[RobinTucker]

More FUD. The shame of it is that most non-technical users don't have a clue what the problem is in the first place. I tried to get a couple of non-techie friends to boycott Sony over this but had trouble explaining exactly why (I gave up in the end). I think Sony know this and one of their Executives more or less admitted it quite recently. "We can do whatever we like, as long as our users don't understand whatever it is we are doing". As with some others above, I like Sony hardware but won't be buying any in the near future because of this. Anyway I haven't bought a music CD since the RIAA started taking children to court for file sharing. I'm not completely anti-corporate, it's just that I've started to get this very nasty feeling I'm being exploited somehow whenever I hand over money to one of these companies. Market Branding is all about the "customer feel-good factor" but what these guys are doing is completely destroying their brands. I don't feel that way about buying video games and movie DVD's at the moment - (although Valve are doing their best to put me off video games with Steam and the MIAA are feeding up their lawyers for the big push). The whole thing leaves a very bad taste in my mouth and I'm giving these people less of my money because of it. It isn't good business. It's going to break at some point I'm sure of it. I can feel the pressure building.

Leave it for the courts

[phorm]

As an international entity, I'm hoping that Sony will have to bend over to the courts in at least a few countries. Anyone who expected the RIAA to accept blame raise their hands? How about we let a judge decide instead.

Not surprising

[Anonymous Coward]

Ethics is such a foreign concept to them.

Best way to take revenge on RIAA

[freedom_india]

The best revenge for RIAA? Pirate the infected Sony songs, make sure the class-action suits target RIAA for supporting "unauthorized, forced" entry, aiding and abetment to crime and finally piracy for allowing users confidential data to sent to unauthorized people.

But then, being americans, we would probably settle for a $150 discount coupon on a new VIAO.

Nothing wrong.

[Liam Slider]

So RIAA sees nothing wrong with Sony's violation of copyright law so long as it's to protect their big corporate property...no surprise there, not like RIAA hasn't encouraged violations of other areas of copyright law in order to benefit themselves. And RIAA evidentally sees nothing wrong with introducing software to people's computers without their permission, that does undisclosed things, and cannot be removed without breaking the machine. Nope, nothing wrong with screwing over other people's property to make a buck.... No surprise there either though, they've constantly been encouraging that very thing for quite some time.

Is it no wonder that so many people think that RIAA is evil?

There's all the difference in the world.

[GaryW]

Sherman is wrong. There's an enormous difference between a security hole in DRM software and standard software: normally, any software I install on my machine is running with my permission and knowledge, performing a function that I chose and doing it for my benefit. Sony were trying to get their code onto end users' computers without those users understanding exactly what is was doing, and naturally the software functioned entirely for the benefit of Sony and not the users.

Richard Stallman clearly explained the problem and explained all the issues that Sherman doesn't want us to think about in an essay called Can you trust your computer?. If Stallman had the marketing clout of the RIAA's members and vice versa, I suspect we wouldn't be in this situation today.

Flaw in logic

[ndunnuck]

As for praising Sony for their "responsible" efforts to fix the problem, I have two things to say:

1) They're being "responsible" because they're being "sued."

2) Regardless of the myriad cybercrimes under which SonyBMG is currently being sued, usually when companies install software that circumvents a customer's expected right to a freedom of choice, they get punished by the government under anti-trust law. See Microsoft.

There's nothing about this issue that's either legal, moral, or intelligent.

Re:Big Surprise?[ - Radio done]

[saskboy]

Tim from http://www.boycottsony.us/ was the guest on the radio program, and he did a fine job of convincing the radio host John Gormley how bad this DRM infection is. If all technical people were as gifted verbally as Tim is, then we'd see a lot fewer problems from companies trying to exploit consumer ignorance.

The rebroadcast is tonight CST at www.ckom.com

Texas AG says otherwise, files suit

[RichMan]

http://www.kwtx.com/home/headlines/1996172.html

Texas is suing Sony BMG Music Entertainment, alleging the company illegally installed spyware on millions of music CDs that Attorney General Greg Abbott says can make computers "vulnerable to computer viruses and other forms of attack."

Abbott said the spyware installs files onto the computers on which the CDs are played.

Would they actually admit they did something wrong

[kmartshopper]

$sys$nothing_to_see_here

Illegal downloads not responsible

[j-turkey]

From TFA:

"And for generations, students have spent their hard-earned dollars on the music they love in the local college record store. How many of those stores are left now? Makes you realize just what the impact of illegal downloading can be, and why we've taken the actions we have."

What a load of horse crap. Local record stores were going the way of the dinosaur long before illegal downloads. The Best Buys of the world, which subsidized below-cost album sales in order to attract buyers to their higher-margin electronic gear are what drove the local record store out of the market. The situation was made worse by cheap albums being sold via mail-order online distributors. (Made cheap by the high volume of the online retailers).

I don't know how much money the record stores and IP owners lost on online piracy. The truth is that nobody really knows. Record companies exaggerate one way, and the free-everything people exaggerate the other way. However, it seems pretty reasonable to assume that with college kid dollars going into online music stores and forced buy-ins to the university music repository, the dollars will not flow into local record stores.

Besides, the recording industry could care less about the mom and pop record stores. Those guys sold in crappy volume compared to the larger chains. Further, the local stores sold indy music, and any profits from that never touched the coffers of the RIAA member companies.

Sherman/RIAA have to know that they're bullshitting. I mean, these are shrewd businesspeople. I can see right through the bullshit -- and I'm just some dork posting on Slashdot. This stuff is really simple -- do they think that this will pass muster with most of the American public? We're not that dumb, are we?

Re:SonySuit.com - Strike back in Small Claims Cour

[BenJeremy]

I would think that you could claim damages, including recovering whatever extensive costs were required to restore your system, if a bit of malicious software caused damage to your system.

What is my data worth?

I think getting a honey pot set up, with Sony's Rootkit, and some old SQL non-transferable licenses set up on it might do nicely for 5 or 6 thousand in actual damages, to begin with. Add in my own time to restore the system to working order (another couple of thousand) and punitive (Triple damages?).

Multiply that times, let's say, 10% of the slashdotters out there, all filing suits in every state and district of the US... a million individual lawsuits, with recognizable evidence of criminal negligence, damages, and likely a ton of defaults on the order of billions in judgements, might actually sink RIAA, as the other big labels realize how foolhardy all of this DRM crap really is.

Boycott DRMd content / support artists who trust U

[ozzee]

Just goes to you that the RIAA and all affiliated with it do not deserve your attention.

It's your time, your attention. Place your valuable time in artists who trust you and don't treat you like criminals.

We should start creating a list of idie labels that practice a more acceptable license - like this one from Candyrat Records.

They have 60 seconds of each track available to preview the music (again no DRM).

Plug - take a listen - It's real music - not some mass market crap pushed down your throat.

Nothing unusual?

[icydog]

"there is nothing unusual about technology being used to protect intellectual property."

Hey, did the RIAA just tell us that many music publishers commonly pirate open-source code into rootkits and place them on their CDs as common practice?

Re:Nothing unusual?

[Bassman59]

"many music publishers commonly pirate open-source code into rootkits and place them on their CDs as common practice?"

Welcome to the Department of Redundancy Department.

MOD ABUSE ALERT

[Anonymous Coward]

The parent was modded down for NO REASON. This post was ON TOPIC and some shameful moderator came in and CENSORED THE POST. How can people get away with this sort of shameful acts of cowardly censorship?

no no

[Run4yourlives]

However, because of a recent wave of shoplifting, everyone buying a product will have to have their bags checked.

They already do this, and it's equally illegal.

Re:no no

[jpetts]

It's not illegal if you consent to it. The only place that has any sort of right to do this is Costco, since the membership agreement you sign explicitly allows examination.

Re:no no

[Coniptor]

Where do they do that? I have never had my bag searched in a store.
Were someone to stop me to search my bag presuming I have not bought anything it's now time for them to play the shopping bag equivalent of 52 card pick up. If I JUST bought something and I'm on my way out the door and I'm stopped. Whoever they are will be informed that they can eat shit and die. I will then proceed to my vehicle and would also back over or run over anyone standing in my way. I would definetly love to back over or run over any label shill.

Simple Solution: Boycott

[ursuspacificus]

Joe A. Consumer has clearly been lulled into a nice, foggy trance. We need to mobilize. Lawsuits are fine and everything, but if you really want to put the pinch on them, STOP GIVING THEM MONEY. They can fend off lawsuits till the cows come home. What they can't make you do is purchase something against your will. The "Holiday Shopping Season" is upon us. Let's show them what we're made of.

Step 1) Boycott Sony. All things Sony. Sony Pictures, Columbia/Tristar, Sony/BMG Music, Sony Electronics, AIWA Electonics, Sony Ericsson cell phones. Give 'em a month to cool their heels and think about this.

Step 1a) Boycott RIAA. All things RIAA. Buy no CDs or Concert Videos. Don't listen to music on the radio. Listen to the stuff you already own legally. Give them a month to cool their heels and think about this.

Step 2) Listen for the change in attitude.

Step 3) Repeat as necessary.

There's no need to engage in piracy, litigation, rioting or any other behavior with collateral expense. Simply don't buy anything from them. .... or... shut up and take it in the baloon knot with a, "Thank you, may I have another."

If that's what Sony believes....

[Anonymous Coward]

If that's what Sony believes, then they show a remarkable disregard for their customers, a remarkable level of greed, and a totally unbelievable ignorance of the way in which people use music.
Just another reason not to buy retail music.

DVD Jon's code in the rootkit?

[ManuelKelly]

I have seen a couple of reports that the rootkit included code written by DVD Jon having to do with iTunes security.

I cannot verify this, I have not seen to root kit.

I would really like it to be true. Sony steals others intellectual property in an attempt to protect music they distribute, and the RIAA says they have done nothing wrong.

I really hope that some can validate this story.

hmmm...

[thegreathoe]

i'm jsut waiting for the riaa to come up with a way to sue people that hear a song on the radio or off of a friends cd. to me audio memory is the same thing as havin a backup on my pc.... only on the pc i can remember things a lil better :-p and i wonder what sony is trying to give the riaa for them to give these kinda statements... perhaps all the lists of the rootkitted cds?

How many times?

[Anonymous Coward]

"How many times that software applications created the same problem? Lots."

Yeah. Applications like spyware and adware, which are ILLEGAL in many jurisdictions, will soon be (draft laws), or should be. Then there are viruses and worms. Perhaps the head of the RIAA would like to name some of those many other applications, and stand side-by-side with them to defend their shared principles?

It's like saying that because it is common for people's car windows to get broken during robberies, it is okay that Sony broke a window for reasons other than robbery, provided they replace the window.

It just ain't so.

Also, if the car is generally screwed up from that point on, without the owner even being aware why, and it takes a trip to the mechanic and an engine transplant (system reinstall) to truly fix that "error", you can bet that people would be damn angry.

It was irresponsible from the start. The main problem is caused by a *feature* of the software, not a bug. While it is true that it was incompetantly implemented, the fact remains that the software was largely doing what it had been designed to do -- screwing around with the low-level system software relating to the CD-ROM driver. Even though extricating the software was harder than intended because of the bug, it is no excuse for messing with a user's system to this degree, and making it that vulnerable to abuse or error, especially for users that PAID FOR THE PRODUCT!!

Other audio "copy protection" schemes are only slightly better in degree. They are still rife with compatibility and quality problems thanks to the intentional corruption of the Red Book CD standard, and dealing with that is costing both the hardware and software manufacturers loads of money.

A simple message needs to sink in: once customers understand what these discs are, and what liberties may be taken with their computers, customers do not want these fake, non-Red Book, potentially "infectious" CDs. Once the RIAA's clients lose the customers' trust, they will be in far deeper trouble than what is caused by pirates that will circumvent all these tricks anyway.

This just in

[AnalogDiehard]

Burglar uses stolen hammer to break a glass window on a private home and steal valuables, gets caught on amatuer video, suffers a week of bad press, then his lawyer defends him saying he did nothing wrong.

New BBC article on the fiasco...

[KitesWorld]

http://news.bbc.co.uk/1/hi/technology/4456970.stm

About 2 hours old now. And yup, It even touches on the rootkits own copyright infringments.
Estimates the damage caused to SONY's bottom line in the tens of millions for this one incident, not counting the pending legal action taking place in Cali, NY, and now Texas.

Re:New BBC article on the fiasco...

[djmurdoch]

That article was written by Michael Geist of the University of Ottawa, who always has interesting things to say about IP law. See his website for more.

the need for DRM

[tomcres]

It kills me how the industry blames their own customers for piracy and decreased revenues and forces these kinds of protection schemes on them. We are paying them. What incentive is there for us to just give away copies of something we spent our own hard-earned money on? If we, as customers, want to make copies, it's probably for a legitimate reason, like making a backup for your kids who are prone to break stuff, or ripping it to a computer to use on a portable MP3 player.

The real piracy problem is with people mass-producing illegitimage copies of CDs and DVDs and passing them off as genuine. It's the discs that end up for sale at the corner of Nevins St and Flatbush Ave that are really hurting them, not the paying customers. Instead of directing all this energy and money towards DRM, lawsuits against filesharers, and Sony's defense, maybe they should focus more on helping the police crack down on illegal production and warehousing of ripoff CDs/DVDs and lobby the government to do something more aggressive about China.

Sherman blatantly wrong

[sunderland56]

From the interview:

Cary Sherman: There is nothing unusual about technology being used to protect intellectual property. You can't simply make an extra copy of a Microsoft operating system, or virtually any other commercially-released software program for that matter.

Since when can't you copy a Windows CD?? Or most other commercial software programs?

Now if that isn't

[madkow]

The pot calling the kettle white.

Use a proxy

[steve_l]

If you have a decent proxy you can block the site there and redir people to a page that says "call IT. we know who you are"

It's MY Computer, DAMN IT!

[renehollan]

If you want to put software on my computer, you'd better disclose what it does.

If it causes harm intentionally, then you are guilty of fraud and destruction of property, and should be subject to criminal as well as possible civil penalties.

If it causes harm unintentionally, you should still be subject to civil penalties.

There is no excuse for software that causes harm unless I clearly waived my rights to redress and that harm was unintentional.

While this may be reasonable if the software is free (as in either speech or freedom), it is not reasonable if the purpose of the software is to protect someone else's property interests.

The bottom line, is that such untrusted, unvetted code, should only be deployed to dedicated machines where the harm is not likely to be wide-spread (i.e single purpose devices), and particularly where the harm will affect those who would naturally benefit from what the software should do: if a firmware upgrade is sent to my cable box by my cable company, and it kills the box so that I get a refund on not being able to view content, this is likely reasonable. But it should certainly not kill a general purpose computer. If anything, that is an argument for dedicated devices who's sole purpose is the decryption and display of encrypted content.

Parent has a good point

[typical]

However, that is not really the issue which Sony is attempting to defend. Sony is attempting to defend an action which essentially transfers ownership of _your_ computer to itself. And it is that which prompted the legal slap, and rightly so, for what it's worth.

It's easy to lose sight of what the issue is here -- the parent post is very much right.

It doesn't matter whether you like the RIAA, the artists, or whether you use MP3s.

The issue at hand is very simple.

Sony dumps some very low-level software on your system that alters the way the system works in some unexpected ways. The vector that this software is arriving in is not expected -- many sysadmins on corporate networks, for example, allow audio CDs (to help prevent copyright violation from people bringing in MP3s).

Sony has essentially done something to the system that the user does not expect.

This is a very classic case of going behind the user's back to do something that he is not going to want to have happen. The same thing happens with a lot of other software out there, true, but having a Gator or Bonzi Buddy from *Sony* instead of a random shady startup is a little different -- that says that this is an attempt to legitimize doing anything to a user's computer that a software vendor can get away with.

The counterclaim made by Sony when someone pointed out that they were doing something nasty surreptitiously was that "most users don't know what a rootkit even is". Yes, that may well be true. However, the problem is that something is being done to my system at a low level -- I don't know how my car works, but I trust my mechanic not to break it. When I stick an audio CD in a CD drive, I expect it to play music, not to modify the function of my kernel. The fact that the typical user does not have the knowledge necessary to understand how he is being screwed over and what to do to repair the problem is absolutely no defense against this.

Furthermore, they claimed that this was perfectly acceptable, and appear to be ready to do it again. The question is not minor -- this is the first time that I'm aware of that a mass-market company is attempting to do nasty stuff to computer users, and taking advantage of the fact that few users are able to identify what software is causing problems and what might be a bad idea to do to their system. Fortunately, there are a few technically knowledgeable and competent people out there (like the well-respected gentleman at Sysinternals) who are able to bring this up. If Sony can get away with this, it's a green light to any *other* company that sees a perceived advantage in somehow modifying your computer system to do so via any means necessary. Today, Windows boxes are the only ones affected, but what about tomorrow, when Linux and Mac OS boxes are hurt?

If Sony is not slapped down *hard* legally for this action, the floodgates of adware and spyware from major companies will have been opened.

I'm rooting very, very hard for the ambulance-chasers on this one, and it has nothing to do with the fact that this involves DRM. Software is something that Joe Average has to deal with on a daily basis, and his ignorance about how his system works or how to fix damage done to it should not be something that it's okay for every company in the world to exploit.

Sony is *not* going to listen to anything other than legal suits on this one -- if they were going to listen to common ethics, they would have done so by now.

Re:Parent has a good point

[Pieroxy]

I translated your post in French there : http://france.palmdrive.net/

Let me know if that is any kind of problem, I'll remove it right away.

Re:Parent has a good point

[DustyShadow]

If Sony can get away with this...

They already lost with me and I'm sure it is the same with many of their other customers. I started thinking about how many Sony products that I own and by just looking around the room, I can see that I've given them a good chunk of my hard earned cash. Those days are over. I'm done buying their products. If they think this won't hurt their other sectors, they are lying to themselves. Sony is destroying themselves in more ways than one. It's ashame because they used to be a great company.

Re:Parent has a good point

[quarkscat]

This response from the RIAA is hardly surprising. Instead of seeing new ways of marketing and distributing the media/content that they control for fun-and-profit(TM), the RIAA (and the MPAA) sees digital format media as an overwhelming threat to their livihood. Since money talks, and more money talks louder, the DMCA was passed (in no small part) in order to strip the right of "fair use" from their customers.

Both the RIAA and the MPAA need to be taught a lesson by consumers -- the only lesson that they can understand: boycott! As SONY is a leading member of both of these organizations, they make the ideal target for consumers to boycott. SONY's DRM "rootkit" is the ideal "line in the sand" issue to organize such a boycott around. Since SONY is in the media hardware and media content business, this company has broad enough consumer exposure to justify a boycott of ALL SONY PRODUCTS.

This boycott should continue IMHO until the more draconian measures of the DMCA are removed or ammended, legislation be passed to make corporations criminally liable for spyware and DRM that abuse computer security, and that consumers' right of "fair use" be restored.

Re:Parent has a good point

[Toloran]

Both the RIAA and the MPAA need to be taught a lesson by consumers -- the only lesson that they can understand: boycott! As SONY is a leading member of both of these organizations, they make the ideal target for consumers to boycott. SONY's DRM "rootkit" is the ideal "line in the sand" issue to organize such a boycott around. Since SONY is in the media hardware and media content business, this company has broad enough consumer exposure to justify a boycott of ALL SONY PRODUCTS.

This boycott should continue IMHO until the more draconian measures of the DMCA are removed or ammended, legislation be passed to make corporations criminally liable for spyware and DRM that abuse computer security, and that consumers' right of "fair use" be restored.

Yes, the infamious boycott. The classic anti-big-business technique.

Sadly, however, they just don't work anymore. For a boycott to work it has to seriously affect the company being boycotted (either directly thorugh sales or indirectly through bad press). However, in todays modern society it is difficult to do it effectively. The reason these companies keep doing this is because they can't see the negative effect of it. If a 10,000 people don't buy their product, the most they'll think is that it is a normal slump in profits. And even if they do notice it, they'll just write it off and wait for the boycotters to give up. Most people don't have the constitution to keep one up for any prolonged period of time. So if you you really want a boycott to work you have to get far more people to join it. Doing this isn't easy because most people just accept whatever they are spoon fed by the TV (fewer people read the newspaper and watch the TV news so even that isn't as effective as it once was).

The only way to get these companies to stop what they are doing is by making them lose money. Simply making them make less money isn't enough, they have to see the reciept to know they've lost it. The only way to do this is by both civil and crimial legal actions. Sony has to have an example made of them. Levy far higher penalties against them then would normally be given. The music industry has to be scared so that they won't even think of doing it again. Thats my thoughts anyway. *steps off the soapbox*

Re:Parent has a good point

[typical]

No, I'm honored. Thank you.

DRM doomed?

[mgessner]

This article on Yahoo! says DRM is doomed. FTA: "The fact that so-called digital rights management might always be a doomed experiment became painfully clear with the fiasco that erupted after Sony BMG Music Entertainment added a technology known as XCP to more than 50 popular CDs."

Let's hope. I always thought this was stupid. I bought the CD. The concept of fair use says I should be able to listen to it when, where and how I want. Fussing about people trading music just goes to show how badly the music industry knows it's wrong and that it's been screwing artists since the beginning. They're not treating their artists nor their customers well.

Re:DRM doomed?

[Bushido Hacks]

Horray! DRM should be doomed! Lets encourage it's doom by singing the Doom Song! http://www.siberkat.com/requests/r6-doomsong2.wav

Re:DRM doomed?

[glesga_kiss]

It's Digital Restrictions Management. Please encourage the use of this correct term and use their double-speak against them.

Re:DRM doomed?

[mgessner]

That does seem to be more appropriate than Digital Rights Management, doesn't it, given that there are very few rights involved...

Re:DRM doomed?

[glesga_kiss]

Exactly. It doesn't, and can't ever give you any more rights than an regular media file. Them (ab)using the word "rights" is double-plus ungood!

Another phrase that's getting popular is "infected with DRM". It's another good re-name to something that the public will understand.

Everyone else is doing it

[ronjeremysjohnson]

Using Sharmans logic its fine to download music, everyone else is doing it too!

No, no, no, you've got it all wrong!

[RAMMS EIN]

``It follows that RIAA does not consider the piracy of copyrighted material wrong... Well, I'm off to go copy a few CDs, with the cartel's blessing this time.''

No, no, no, you've got it all wrong!

It's not about breaching copyright.

It's about who harms who. Small folk harming the large corporations? BAD! Large corporations harming the small folk? Standard practice!

I want to see the evidence!!!!!!

[Anonymous Coward]

I demand that President Sherman present credible evidence to support his claim of Weapons of Mass Duplication!!!!!!!!!!!

Good Idea, Bad Idea

[RoffleTheWaffle]

Let's play a game of 'Good Idea, Bad Idea'.

---

Good idea: Implimenting a copy protection scheme.

Bad idea: Implimenting a copy protection scheme without analyzing it first.

---

Good idea: Monitoring your customers' reactions in order to quickly and intuitively react to any problems they encounter with your product.

Bad idea: Monitoring your customers' reactions in order to quickly and intuitively react to any problems they encounter with your product, and then sweeping the problems under the rug.

---

Good idea: Asking for help from third parties to save time and money in developing your product.

Bad idea: Asking for help from total idiots to save time and money in developing your product.

---

Good idea: Informing your customers that your product could modify the content of their PCs - their personal property - and how.

Bad idea: Not informing your customers that your product could modify the content of their PCs - their personal property - and how, and then denying it in spite of conclusive proof that says otherwise.

---

Good idea: Dealing with rogue business affiliates strictly, or severing ties in response to a mess like this.

Bad idea: Praising rogue business affiliates for creating a mess like this.

---

It looks like the RIAA is just full of good ideas. Honestly, these aren't the kind of people who I wish to do business with. This just goes to show how slackassedly the RIAA deals with business partners when they cause a massive breach of ethics and customer trust by failing to properly analyze a poorly constructed third-party copy protection scheme they implimented, and then sluggishly respond to the fiasco by posting ineffective third-party patches without actually attempting to reach customers or willingly going public about the issue.

Folks, Sony obviously doesn't care whether or not their products damage your property, and neither does First 4 Internet. F4I is guilty for making this bastard of a CPS, and Sony is just as guilty for distributing it without even looking at it, and then barely even trying to help fix the problems it causes. It doesn't matter what this talking head from the RIAA says. This isn't just a programming error, this is a royal fuckup of unimaginable magnitude - a prime example of an absolute lack of good business sense and business ethics. One would hope that F4I and Sony will get what they have coming for this, but something tells me Sony will likely load off the blame onto F4I and get out of this unscathed... Business as usual.

However, I can safely say that this turn of events will not curb my habit of buying music second hand, and I certainly know whose products to avoid now. I'd hate to see if there was a safety recall involving one of Sony's products. That'd probably go something like this.

"Upon analyzing this product, we have determined that it poses a great danger to the consumer - an obvious and highly dangerous flaw in its design-"

"Sony has done nothing wrong here! It's just a design error. Mistakes happen, sir."

"... I don't know where you come from, but here in America, we don't like it when portable CD players explode unintentionally-"

*obnoxious snoring*

"ARE YOU LISTENING TO ME, YOU JERK-OFF?!"

"Huh?"

Well... that and...

[Eric Damron]

"According to Sherman, the problem with Sony BMG's XCP DRM software was simply that "the technology they used contained a security vulnerability of which they were unaware"."

Well, that and it probably violates multiple state laws... What's that saying? Ignorance of the law thing...

President of RIAA Says Sony-BMG Did Nothing Wrong

[animale]

Except for violating the license for LAME and DVD-Jon's work? Will developers of both of these products sue Sony blind for stealing (and then trying the public's patience with this PR agency directed campaign to clean up their image?) If Johansen gets a big settlement would it cripple DRM permanently? Will the lawsuits include pressure from governments, who now realize they could leak secrets just because their secretary listened to a music CD at work? And that's only the accidental espionage...

As disturbing as everything about this case is, the scarier part is how Marc stumbled across this rootkit. Are there enough genius-level diagnosticians amoung us to find the dozens of rootkits that are better crafted than this F4I junk? Rootkits used by governments to spy on each other, AND US? Who was it that called the internet the greatest boon to covert intelligence gathering since the submarine cables in the North Atlantic?

Mr Russinovich, PLEASE open a trade craft school to teach the best and brightest how to detect and code for removal of these threats. Corporations and governments will pay for their security experts to learn, professors will seek the knowledge to teach others, and AV companies will pay to send programmers to learn how to code removal tools for a lucrative new market, Ignore pleas by our overlords at MS and the Fed. Hopefully the designers of removal tools will not bow to pressure from the lazy spook types, who won't be able to sit back and snoop PCs for much longer before being found out.

Comment removed

[account_deleted]

Comment removed based on user account deletion

The RIAA mindset

[typical]

The simple fact that any audible signal can be recorded is important, yet the record companies still seem blind that they have a viable MP3 market because most consumers (with jobs) would rather pay $1 (with Jobs) than spend 20 minutes finding a song illegally or even bothering to rip their own CDs. I have more than a few friends who've rebought albums from iTunes that they own on CD. $10, to them, is worth the time.

It comes down to this.

The record companies have identified that control of artists are slipping away from them.

There are hordes of little nasty DRM companies that will promise the moon to get a fat contract from someone like Sony. People like the earlier company that tried corrupting the error-correcting information sufficiently to keep audio CDs from working properly in a computer. When you pair a technically inept, worried, rich company with a nasty little DRM company who promises a way out, the rich company's executives will make some pretty fucking stupid decisions.

I worked with one of Phillips' researchers who was working on watermarking and other approaches to DRM. I mentioned that a particular approach that took a huge amount of mathematical work to avoid being stripped out by MP3 seemed unlikely to last for very long, even without someone cracking the system deliberately, because psychoacoustic models are constantly getting better. He looked at me, sighed, and said, very honestly, "Yes, you can't really do DRM on an audio CD as a permanent solution -- but there are research dollars there, so that's what we work on."

Currently, if a single person can rip a CD, the audio will hit P2P. And there are so many technically ept people out there that the question of whether or not someone can rip a CD isn't even an issue -- the answer is just yes.

All these solutions are aimed at trying to prevent ripping. That's a lost cause. You can't do that. It's just too easy to rip audio at least once.

The record companies' (merely perceived or not) problem is the people *downloading* music, not the people ripping their own CDs to iPod or similar (unless they're *really* trying to sell the audio twice over -- once in digital format and once on a CD). The problem is that those people downloading music are also the people completely unaffected by attempts to eliminate ripping -- someone, somewhere, will *always* manage to rip audio. The only people getting shafted by these schemes are the legitimate customers, the ones who are trying to listen to audio on an iPod or their computer or so forth.

Any real solution (which may or may not be feasible, but it's a starting point) needs to do something in which physical modifications to a *player* are necessary in order to play the audio, or something along these lines -- anything that requires work on the part of each infringer, not on the part of a single person somewhere on the Internet, because that's a lost cause. The RIAA is pissing off a lot of people and blowing money on solutions that could *never* work in the long term, not even a little, and they're blowing any opportunity that they might have of making a workable DRM system, or of exploring ways to survive in a new world in which DRM doesn't *exist* and copying is easy.

The degree to which the RIAA member companies have been sold snake oil by security companies is amazing. You gotta feel for them.

Paying the bands

[SeanDuggan]

I do, however, have a problem with not being able to give 1 cent to the artist, without HAVING to give $1 to the record company.
Sure and you can. Many of these bands have an address for fan mail. Send them a few bucks. What are they going to do, send it back?

Quick Summary

[serutan]

Summary of the article: "Somebody in the record business said something."

Record company execs live in their own imaginary world, where music exists only because they're here to own it and sell copies of it. Expecting them to say anything sensible in a PR statement is like asking your dog to explain the Federal Reserve system.

shame

[towsonu2003]

shame on these people... Sony cracks people's computers -> RIAA issues comment saying it loves that. What's next? will RIAA sue F-Prot for copyright infringement bc. they say in their site that Sony rootkit is malicious?

this is getting more ridiculous everyday

will joe gonna be afraid to buy legal copies because they crack computers?

Riaa copy protection

[mclennanb]

What is so laughable is that the recording industry had an alnost fool proof copy protection scheme. They (the industry) broke it in the intrest of profitablity. It was called a vinyl record.

How about the included GPL code?

[RenHoek]

echo "America - It's not fascism when /we/ do it!" | sed s/America/Sony/ | sed "s/fascism/copyright infringement/"

Re:How about the included GPL code?

[Anonymous Coward]

Agreed but what can we do about it. The system would just laugh in our face and say you gave the source away for free what do you expect... Plus who would have the right to do something about it.?!? I hope some gets them for this. they deserve to pay big time!

Criminal Charges

[Odiche]

I find it highly highly diappointing that no charges have been filed for this instance.

I don't really expect them to be read, but I fired off emails to my senator, representative, and DA. Using their online forms obviously.

Why the senator and rep? Because at this level it is probably a political decision whether to go foward or ignore SonyBMG.

Da*n I wish I had that sort of clout.

What I think is at stake here, from a personal viewpoint, is the question, Are corporations liable under the law, to obey it. And if they are not, why are still legal to form them.

Secondly if they are free to ignore the law, why should the rest of the populace follow the law. SonyBMG violated it on both the technical side, as well as the spirit of the law. I can understand that if a technicality is broken, but the spirit of the law is maintained, that at the end of the day it can be justified. Or if any part of the law is unconstitutional, would be another exception.

Cause if SonyBMG gets away with this, I see no reason why I cannot purchase a nuke, technically, or at least a really large cannabis farm. Providing I incorporate first.

Plus is doesn't work

[Anonymous Coward]

Autoplay is different than Autorun.

Nice try, although what you suggest won't protect you against a Sony CD.

In the interest of accuracy...

[chaeberle]

... the president of RIAA did not say that Sony did nothing WRONG. He said that the idea of protecting content wasn't unusual. He made, as far as I can tell, no moral judgements on Sony's actions. In other words, like a typical corpropolitico, he said nothing.

Re:In the interest of accuracy...

[briancarnell]

In fact his point is completely taken out of context. Sherman is not saying this is a good thing. Rather he's saying that other programs have caused similar problems, and that he doubts those companies have taken action as quickly as Sony has.

That's a debatable point, but nowhere does he say he approves of what Sony did. In fact he makes it clear that he thinks Sony made a mistake,

"They have apologized for their mistake, ceased manufacture of CDs with that technology,and pulled CDs with that technology from store shelves. Seems very responsible to me."

Re:In the interest of accuracy...

[DaveCBio]

My issue with what he says is that somehow Sony didn't know about the vulnerability. I find that very hard to believe.

Re:In the interest of accuracy...

[Ph33r th3 g(O)at]

"They have apologized for their mistake, ceased manufacture of CDs with that technology,and pulled CDs with that technology from store shelves. Seems very responsible to me."

Sure they did, after they were exposed in the national media. Their first response, though, was to deny they had made any mistake. Only the bright spotlight of media embarrassment induced them to do the "right thing." And that was too little, too late. I hope the Texas Attorney General shakes them down for millions and the other 49 states pile on. This could be like the tobacco settlement!

I have one simple question:

[Anonymous Coward]

I'm thinking of the "homeless hacker" who almost went to prison for showing the NYT that their systems weren't secure, of Kevin Mitnik, of a bunch of other people who have been threatened with or gone to prison for "accessing a protected computer system."

Governments world-wide have these laws.

Why are no Sony executives incarcerated yet? Do they own all of the world's governments?

(MRC="handout")

Lawsuit needed to wake up the non technical

[gwait]

I disagree with some of the sentiment posted here that "This sets back DRM several years". Nothing short of a class action suit against Sony will convince the public that it's a bad thing for anyone to put software on your own computer without asking, especially one that snoops on you and leaves you even more vunerable to attack.

Who needs to worry about RFID tags when your own home PC watches your every move and reports it to
big corporations! Hell, the FBI could do exactly the same thing as Sony and get it put into law that every PC must have ratware installed! The ISP's would rather this than spend the serious money required to monitor your actions at the local network feed!

Don't forget the songwriters

[gosand]

a lot of the bigger bands today make their money through other means, not record sales. record sales means popularity, nothing more, nothing less.

Well, it can mean royalties. And it depends on if you are talking about musicians, performers, or writers. Songwriters get money when their songs do well. Think of the song Torn performed by Natalie Imbruglia. It was a cover song made to fit popular radio. But the original band that did it didn't complain, because they were getting songwriting royalties. (BTW, the original song, of which there are several versions, is much better IMO)

Re:Don't forget the songwriters

[rizzo420]

very true... but the RIAA usually has more rights to that than the songwriter... and the band has to pay royalties when they perform a cover (or release a live album that contains said cover).

Re:Don't forget the songwriters

[PateraSilk]

From what I can recall, the original band (Ednaswap) got screwed five ways from Sunday and didn't see a dime from "Torn". And believe me, they did complain.

Sherman is NOT right

[weg]

"how many times that software applications created the same problem?"

Arguably, Sherman is right --

No, he's not.. because I know of these other applications running on my PC (either because I installed them myself, or they came preloaded), so I'm able to update them. Furthermore, these applications (or operating systems), even if they are sometimes buggy, fulfill a purpose for me. Users who listen to a Sony CD on their PC and thus unintendedly install the rootkit a) don't know that it's there and therefore will not patch it, and b) don't take any advantage of this rootkit.

Texas has just filed suit...

[artifex2004]

I submitted an article, but then edited it. In case the latter fails to see light of day:

In the first enforcement of Texas' new spyware law, the Consumer Protection Against Computer Spyware Act of 2005, Attorney General Greg Abbott filed suit against Sony for having "surreptitiously installed the spyware on millions of compact music discs (CDs) that consumers inserted into their computers when they play the CDs, which can compromise the systems." The suit is seeking US$100,000 per violation. A PDF of lawsuit is available here.

Where does your major label $1 go

[pdq332]

I think it may have been true at one time, but with today's digital technology, the cost of production and distribution is practically zero. I can cut an album out of my closet with a few hundred in used mixing and recording equipment, make the mp3s available for download, and even burn my own CDs at 24X and drop them off at local record stores or sell them online. For a few thousand in direct one-time costs, I could even upgrade my equipment and do a "professional" job. The major labels exist for one reason only: marketing and promotion. Once people figure this out and start competing with low cost online marketing and distribution systems, the major labels should pass into history. Really, it never ceases to amaze me that the companies that comprise the RIAA get away with suing 12 year olds and old ladies and breaking into home computers with nary a spot on their public reputations. By the way, this is how every dollar is spent by the coop of bands in the RIAA: $0.02 Bleach treatments for Michael Jackson $0.03 Special wardrobe for Superbowl halftime performances $0.05 Bribing congress to pass the DMCA $0.05 Web sites and fan clubs for $0.10 New boobs for (former) teen superstars $0.10 Filing lawsuits against children and old ladies $0.15 Pancake makeup for Madonna $0.15 Sending Rocco out to break the legs of a few DJs $0.15 Renting WETA rendering farm for digital reprocessing of Ashlee Simpson performances $0.25 Recalling millions of CDs infected with malicious Sony/BMG malware -$0.05 Artists share of what they owe the record company on your revenue

William Vanderbilt

[enjahova]

Seems like we are going back to the time of Robber Barons (hah, p2p filesharers aren't the only robbers) with William Vanderbilt's famous quote: "The public be damned!"

I am going to have a really dumb question

[Jason Terlecki]

What is the validity of a EULA if it was accepted by someone who cannot enter legal contracts, such as a 6 year old kid who pops in one of these SONY CD into a computer? Surely a 6 year old kid cannot be expected to understand a 3,000 word EULA but can understand the word ACCEPT and click on it.

er...

[Kythe]

I guess they'd be liable for the copies sold in Texas alone. I was figuring for all 2.1 million CD's :)

Even so, I would imagine we're talking more than 10,000 CD's (over a billion dollars).

But...

[Kythe]

...that's just a guess.

theft?

[SEAL]

I do, however, have a problem with not being able to give 1 cent to the artist, without HAVING to give $1 to the record company. THIS, ladies and gentlemen, is the theft we should all be discussing.

No one forced the artist in question to sign a contract with a big label. If the artist wants to keep all sales proceeds to himself, then he should do his own marketing. If he wants to put out a record under an indy label, then he's free to do that. If he wants to sign with a big label to get the fame and distribution channels, then he should be well aware of the large cut the label is going to take.

Does anyone else feel...

[Anonymous Coward]

...that as things presently stand, the system is so corrupt, useless, and broken and favours corporations so heavily over individuals that at some point in the not so distant future, our only possible recourse might be to take matters into our own hands with some violence?

I'm no advocator of violence, being a left-wing tree hugging socialist, but there are rare times and places when it is indicated, and I can see those perhaps coming. The legal system has failed the people when it comes to business, and we are entirely impotent in the courts and will have to rely on alternative means to achieve success.

(Posted A/C for obvious reasons.)

I can't think of any though...

[tkrotchko]

"He's saying that many companies use copyright protection, and that this software will sometimes result in system instabilities."

Software companies? Like what? Virtually all protection these days is a serial validated with a web lookup.

Can anybody think of copy protection on software that basically takes over the machine?

Re:I can't think of any though...

[Mr. Underbridge]

Can anybody think of copy protection on software that basically takes over the machine?

All copy protection, by definition, prevents you from doing something involving your machine and their product that you might otherwise wish to do. Is what Sony did a tad dangerous? Yes. Is it unheard of? No. Other methods of copy protection trick your CD drive into not being able to copy a protected disc. Many games manufacturers use this method. Sony just took a *really* bad approach to doing it. But it's not that different from what's been done for years.

Really, Sony would have been better served to just sell out F4I and claim innocence. If you don't consider the things they said since the rootkit fiasco, it wouldn't have been that bad for them. It's their reaction since it happened that's more worrying.

Re:I can't think of any though...

[tkrotchko]

"Sony would have been better served to just sell out F4I and claim innocence"

Maybe F4I kept good records ;-)

Can't you see that the end justifies the means?

[Psyqlone]

1. The RIAA and MPAA are NOT ARTISTIC ASSOCIATIONS!

This merits repeating. The RIAA and MPAA are NOT ARTISTIC ASSOCIATIONS!

Come to think of it, neither is Sony.

Admittedly, they are "industry" organizations, but this also implies that they represent industry interests, which are not always the same as artists' interests. In both cases, you've got lawyers and legal staffers, who serve the interests of distribution companies, financiers, studios, you get the idea.

2. The RIAA and MPAA exist in large measure to perpetuate and protect obsolete business models. It's partially driven (obscured?) by goals of being able to exact revenue from each viewing, each session, each "show". In their minds, this was the way it's supposed to work. I'd like to think they're bright enough to realize they can't keep doing business in quite the same way, but they can't even see which way they are going. It isn't only the technology they don't understand, but those "suits" don't understand the nature of offering the sort of entertainment that makes audiences want to see more, but not necessarily more of the same.

Maybe they're beginning to see that they can't keep fooling all of the people all of the time. Maybe they realize that they can't stay in business by suing their customers and hitting them up every time they try to fairly use something they already have a receipt for. Maybe they're beginning to get the hint that taking a buck for every nickel the artist gets is kindasorta wrong. Maybe their consciences are actually beginning to bother them.

Maybe that was too many "maybe's" for one post.

3. ...lest we forget, the entertainment industry moved to California first to dodge their creditors in the east, secondly to avoid paying tax debts, but also to avoid paying royalties to Thomas Edison. Edison and company invented the production and post-production equipment on which the American film and sound recording industries modified to their own specifications.

Of course the less polite version alleges that they ripped off Edison outright. ...can't be as morally reprehensible as copyright infringement, right?

Sony was unaware?

[DaveCBio]

Maybe some at Sony were, but you can't tell me that the dev that made the software and the legal department didn't know what was going on. There is no way to spin installing a rootkit and making it a good thing. Which is why they are back pedalling. It's not about, "Oops, we made a mistake, sorry." It's about, "Oh shit, we got caught."

Re:Sony was unaware?

[javaxman]

ou can't tell me that the dev that made the software and the legal department didn't know what was going on.

I'm sure the dev that made the software knew what was going on, but he didn't work for Sony. He worked for First4Internet. So some scumbag marketing guy sold some scumbag music-division head at Sony this magic software that keeps people from copying CDs. Nobody involved in the sale cared if somebody got their machine rooted when they put a CD in it, WTF are you putting a music CD in a computer for anyway, in their opinion...

I'm not excusing Sony here. They're dumbasses, to be *charitable*. Still, it is plausable in this case that the Sony Music boss scumbag was just clueless enough that he didn't call over to Sony Computer and have someone with half a brain check out this third-party product. He's not going to know what a rootkit is and the First4 salesjerk sure as hell isn't going to mention it if he does know.

I mean, the guy who signed the contract with First4 and put the order in to have the discs pressed is a music industry hack, is he going to ask for someone else's opinion? Not bloody likely.

And before you ask Dave, no, I'm not a Sony fanboy, I despise their music strategy and their DRM policies are almost as bad as Microsoft and Intel together...

Re:Sony was unaware?

[Zellis]

In a way, the idea that Sony didn't know what the software actually did makes things worse. I mean, if Sony and the RIAA genuinely can't tell when malware gets shipped on their own product, how can the consumer trust any of their products?

Caveat emptor, indeed.

Re:Sony was unaware?

[DaveCBio]

I still haven't seen any statement from Sony that would lead me to believe they were entirely ignorant and if they were that's still an issue. There are checks and balances in companies and I doubt this can be laid on the shoulders of one person acting as a lone wolf.

Re:Sony was unaware?

[javaxman]

still haven't seen any statement from Sony that would lead me to believe they were entirely ignorant and if they were that's still an issue.

Well, they have made statements that they were just using third-party software and didn't really *care* or think the consumers would *care* what the software did... and I guess that's sort of the point, if they knew or not, they didn't care...

I'm not saying it was one person acting as a lone wolf... I said it was one person in charge, as it always is, giving general marching orders like "get some sort of strong DRM on our CDs, people are copying them like crazy!" and not wanting, in typical pointy-haired-boss fashion, to be bothered with the details.

I do think it's *possible* that, since we're talking about the music division here, nobody really understood what First4's software actually *did*... I don't think they cared to know. No idea if that's what really happened, and either way, there is *definitely* still an issue here. Apparently, since they're offering to replace the discs, they now are aware of that. All of those lawsuits and all of that bad press probably helped drive the message home.

Re:Sony was unaware?

[javaxman]

the idea that Sony didn't know what the software actually did makes things worse.

More to the point, they *could* have known, and *should* have known, but the fact seems to be that they just don't *care*.

I mean, if users don't know what rootkits are, why should Sony care if their DRM uses one? That's their opinion, really!

They're interested in cutting down on copying of CDs using computers. First4Internet had a package that would do it. Done deal. How much did Sony Music poke under the hood of the copy-protection package they bought? Probably releasing it on such a limited number of discs was their idea of "testing" it.

Maybe a good thing for the long run

[porkThreeWays]

Yes, they did a very wrong/illegal thing. However, it can be argued that the whole rootkit fiasco will be good for the consumer. The public is highly aware of this issue. They have also heard the word DRM a few times. Now everytime DRM is mentioned the consumer will say "I don't want your virus on my computer". So yes, it was a bad thing. But in the long run I think Sony's damaged the word DRM so badly that we will benefit from this accidental education of the average consumer. They've done something in one stupid move that we've been trying to for years!

Re:Maybe a good thing for the long run

[mgessner]

Hmmm, maybe my comment was misinterpreted.

I think it's wonderful what happened: Sony got greedy, Sony did something incredibly stupid, Sony got busted, Sony's getting sued, Sony's music consumers that were abused will get compensated. All in all, I think Sony's going to be left with a very, very black eye and people will be wary of buying anything from Sony.

I think it's brought to the consumers' attention that the RIAA members are Very Bad People, who only want to steal money from artists and build profits on the backs of those artists that rival the recent oil companies' profits from their illegal activities.

All that having been said: does anyone think that this MIGHT HAVE BEEN intentional? Think of it this way: Now, anyone who buys a Sony CD will think, "Hmm, well, it's safe to play in my CD player, just not on my computer. That isn't such a bad thing anyway, so I'll go ahead and buy it anyway." Who buys CD's just so they can rip the tracks to they can go distribute them on some p2p network?

no.

[artifex2004]

I think getting a honey pot set up, with Sony's Rootkit, and some old SQL non-transferable licenses set up on it might do nicely for 5 or 6 thousand in actual damages, to begin with. Add in my own time to restore the system to working order (another couple of thousand) and punitive (Triple damages?).

Once you start deliberately infecting your machines, it's your fault, not Sony's. That's like saying you're going to spill hot coffee in your lap so you can sue McDonalds. You'd be lying if you told the court Sony was installing something without your knowledge, and that you didn't know it would be hard to remove.

Shame on the RIAA...

[Guru84]

I wonder if the President of the RIAA bought any of the music CD's Sony loaded down with that crapware? Yeah right. It's funny how he's accepting it, because it just makes the RIAA look even worse. Even Sony went back and made a fix for it, so they acknowledge that it wasn't right. President of RIAA = Idiot

Apples to Oranges... content != software.

[atlasdropperofworlds]

"how many times that software applications created the same problem? Lots. I wonder whether they've taken as aggressive steps as SonyBMG has when those vulnerabilities were discovered, or did they just post a patch on the Internet?"

Who amoung the general public equates a CD full of music to software? I'm thinking no-one. So when a music CD acts like software and starts changing the functioning of your PC, it gets you by surprise. People don't expect CDs to be software, so of course it's a big deal when not only do they act as software, but they create serious security problems... People already expect this of software, but not of content.

But...

[popo]

...This isn't software.

Nothing else needs to be said.

Had Douglas Adams ever met the likes Cary Sherman?

[trudyscousin]

In Chapter 4 of So Long, And Thanks For All The Fish," Douglas Adams described Ford Prefect's predicament in a bar in the lower side of Han Dold City when the barman wouldn't accept his American Express card:

"He glanced around at the motley collection of thugs, pimps, and record company executives that skulked on the edges of the dim pools of light with which the dark shadows of the bar's inner recesses were pitted. They were all very deliberately looiing in any direction but his, carefully picking up the threads of their former conversations about murders, drug rings, and music publishing deals. They knew what would happen now and didn't want to watch in case it put them off their drinks."

And later...

"He had, after all, been in the bar all day, he had been drinking a lot of stuff with bubbles in it, and he had bought an awful lot of rounds for all the pimps, thugs, and record executives who suddenly couldn't remember who he was."

Okay, the "music publishing deals" part wasn't exactly accurate, but this stuff was published in 1985. One would be tempted to say it was awfully prescient of Adams, but then again, maybe not.

Re:Evil Pirates! Putting honest people out of work

[Anonymous Coward]

This is off-topic, but what the hell . . .

Causal fallacy.

It's not like he doesn't know it, but why bother building proper arguments when you can get away with absolute b*llshit and still be quoted as a respectable source?

The reason the children at Sony can get away with bullshit like this is because most people don't know what a causal fallacy - or any logical fallacy - is. Debate, civics, and basic logic are not taught in most of today's schools, so most people have little idea when they are being feed ill-formed arguments (or if what they are fed is an argument at all).

This is profoundly dangerous when the people talking are politicians, not just some corporate monkey. Then again, the CEO-as-politician seems to becoming more popular nowadays . . .

EFF Files Class Action Lawsuit Against Sony BMG

[Anonymous Coward]

EFF Files Class Action Lawsuit Against Sony BMG. Sony BMG is also facing at least six other class action lawsuits nationwide and an action by the Texas Attorney General.

I'm going to write a virus...ehm, sorry, "DRM kit"

[Elixon]

If I do write virus that I call "DRM kit" that will spread without your knowledge and install without your knowledge onto your computer and the only purpose of this virus will be to hide itself and search your disk for unauthorized copies of my application I created... is it OK? Will I do something against the law? I'm going to protect my property! Just this and nothing else! RIAA will backup me! And if I make some "programming error" that will allow my DRM kit to act as a trojan horse.. ups! Errors happen...

No, not your local police...

[Anonymous Coward]

They don't have jurisdiction.

Contact your local FBI field office:

http://www.cybercrime.gov/reporting.htm
http://www.fbi.gov/contact/fo/fo.htm

You should also file complaints with your state's
attorney general and with the Federal Trade Commission,
and perhaps with other agencies that I'm forgetting
about at the moment.

Judas

[Anonymous Coward]

Like the devil telling judas that he did not do anything wrong...

Rootkit

[advb89]

Well then, I sure know there's a hole in the President of the RIAA that i'd like to stick a few MB's up right about now...

Open letter to record company execs ...

[Empty Yo]

To whom it may concern,

I am concerned for your mental health as I have been tracking the growing battle between the RIAA and its member companies and the nefarious 'downloaders' they seek to curb. I envision countless stressful budget meetings, security meetings and reactionary meetings whenever a new DRM method is cracked or discovered like Sony's. The legal budget alone to push record company friendly legislation through in every country you operate in, the necessary 'bribes' to get this to pass, along with the legal funds necessary to enforce these laws and punish offenders must be considerable.

Have you ever thought that perhaps all this money the battle is costing you is ... too much? Would the money you lose by 'giving in' be offset by the great sum of money you are spending to curb a worldwide phenomenon that shows no signs of stopping? Perhaps instead of fighing downloaders, you should recruit them. Find out from them exactly what they would like to see with their downloads (security, high bit rate, different bands, etc.) and then get in the game yourselves. Charge $5 a song, but give the downloader lifetime rights to copy, backup and re-use the contents of the file to his or her heart's content in exchange for this price. Let them choose the bitrate and file type of their download to maximize their possible usage. I know that you miss the days where we bought seven copies of the cassette because they wore out long before our love of the music wore out, but those days are gone and never to return.

You'll make more than a download at iTunes, would embrace a new technology that you should have embraced a long time ago, would save on that giant legal budget and get the rest you most certainly need and deserve. What price is peace of mind?

Sincerely,

Empty Yo

SACD / DVDA format strategy in lieu of legal now?

[bpevansncsu]

but I enjoy much more the fact that this whole r00tkit fiasco has set DRM back by years. Perhaps this blow will get SACD or DVD-A back on track. I'm hoping one of the two formats will gain more support and am more than willing to buy content in that format. SACDs sound so much better than MP3s or CDs. Sony et. al. need to fight from the value-add perspective and not the legal-assault front.

Which is safer?

[Anonymous Coward]

Which is safer?

(1) Buying a legitimate music CD and inserting it into my computer, or,

(2) Downloading the same music in MP3 format from eMule, knowing that each file has 50 different sources, all with the same security signature?

The answer to that question has been irrefutably decided this month.

This is a significant turning point in the history of music distribution.

Public Domain/Radio

[Namronorman]

This is why, ladies and gentlemen, I listen to public radio. I do not buy CDs from any label that is under the RIAA, and if I do buy a CD it's for a physical copy of something that is in Public Domain.

Only listening to PD stuff doesn't stop me from being afraid of a large corporation like this though, they're bullies and it's apparent that they'll sue anyone, guilty or not. I honestly don't think I could list a single band that is on the top 40, let alone very many current (as in new) bands!

In other news...

[prisoner-of-enigma]

Satan defended his practice of evil, scientists discovered water is wet, and Generalissimo Francisco Franco is still dead.

I mean, seriously, this guy is the head of the RIAA. What did you expect him to say? That covertly installing malware on your PC such that it will bring more dollars to his pocket is a bad thing? These guys are the enemy. They think nothing of engaging in hypocritical behavior so long as it's "good" (for them) behavior.

But then again, hypocritical behavior is not something the RIAA has a monopoly on. After all, just find any Linux vs. Anything-but-Linux flame war on /. and you'll find loads of hypocrisy from both sides.

Intent

[Sheepdot]

A few posters have somewhat addressed the issue in previous Slashdot threads, but no one has really hit it yet. When determining who is at fault and maliciousness of an action, intent is always considered. Not the intent to violate the law, but the intent to do the action that violated the law.

For example, if you walk in to a gas station and grab a 25 cent pack of gum and pay for gas and walk out, you can be held liable for stealing that pack of gum. Not because your intent was to break the law, you obviously intended to do that, but because your intent was to take the pack of gum.

A toddler in the same gas station picking things out of mommy's purse and putting them on the shelves and taking gum off the shelf and putting it in mommy's purse, cannot be held liable for stealing, because they don't even have a concept of taking something that is owned by someone else.

Sony here intended to have their rootkit phone home. They intended for it to hide itself. These are very serious allegations, but none of them are incorrect. Sony might not have wanted to violate Texas spyware law, but it seems clear they did intend to have a piece of spyware that attempted to hide itself and phone home.

That's a huge problem. Sony may very well end up being a martyr for DRM in such a way that no future RIAA member company will even attempt something along these lines for years to come.

This is a CRIMINAL case

[tacokill]

All of it. That's what Attorney General's do. Remember, this is a CRIMINAL prosecution. Not a civil prosecution. Anytime you read "Attorney General" of anything, that's a criminal prosecution.

And to the non-US'ers of us, in US courts, there are two types of cases - civil and criminal. Criminal cases can (usually) only be brought by an agent of the government (Atty General, Inspector General, etc). They usually involve fines and/or jail time. Civil cases are cases that are fought between two private parties where the govt is a non-party and you can't go to jail. You can only be penalized financially or through other non-jail means (attend counseling, etc).

In other words: Divorce = civil. Killing your wife = criminal.

PROVE to Sony/RIAAhat they did something bad.

[Anonymous Coward]

1. Find computer at Sony or RIAA with Sony root kit. You know they eat their own dog food.
2. Hack computer. Randomly remove data, make computer useless.

If they think what they did was not a problem, then directly show them how bad it is to have a machine hacked. They live by the sword, let them die by the sword.

Multi-session CD's

[SeaFox]

Multi-session disc inserted.
2 sessions detected.
Select session to use (cr for newest): __

Wait, doesn't the audio session have to occur first on a multisession cd (because a regular CD player expects it to be there)?

So if we hit 'Enter' to pick the default (newest) session, we'll be picking the data session with the rootkit!

And in other news...

[outofcoffee]

White House says Enron 'Did Nothing Wrong' Shock. Please..

And to think I use to be worried...

[kjots]

Cary Sherman, meet Rope. Rope, Cary Sherman. I'll leave you two to get acquainted.

Translation

[k00110]

According to Sherman, the problem with Sony BMG's XCP DRM software was simply that "the technology they used contained a security vulnerability of which they were unaware".

So basicely, Sherman says that Sony is incompetent.

Microsoft, Internet Explorer, ActiveX

[argent]

"how many times that software applications created the same problem? Lots. I wonder whether they've taken as aggressive steps as SonyBMG has when those vulnerabilities were discovered, or did they just post a patch on the Internet?"

Not only has Microsoft implemented a far worse design, they went up against the DoJ to keep that design in place, and have not only refused to actually back out the design flaw (having a mechanism whereby a document can execute unsandboxed code based only on information available to the ActiveX control that renders the document), but have made an allegedly safer version the core of a new API (.NET).

To quote John Brunner, "There is no difference, both are evil".

Arguably, Sherman is wrong.

[Anonymous Coward]

Creating a security bug, by mistake is not the same as introducing a security fault by design, thats the differnce between neglignce and criminal intent.
companies that do that, are called "criminal enterprises"

what sherman is saying is false.
the dude is an asshole, seriously, at least give an intelligent reply.

Re: H-O-N-E-Y P-O-T. Capiche?

[BenJeremy]

I didn't say infect your own PC.

Simply listen to the rootkit'd CD, leave your PC exposed to the wild world wide web. That's the idea of a "honey pot".

You aren't actually infecting your own system.

I will admit, it is akin to taking that hot cup of coffee and moving about in a crowd, I suppose.

No, Sherman is wrong...

[rdean400]

The issue is not that the CD installs software. The issue is that the CD doesn't inform the consumer of its actions and give them the chance to eject the CD. Sony should be fine with it if I'd rather not play the CD on my computer at all than have it install software.

On the other hand, is the CD able to install the software if auto-play is disabled?

Promotion?

[tepples]

most consumers (with jobs)

Problem is that unemployment of American people with a four-year university degree is going up as jobs are outsourced to rapidly developing countries with a much lower cost of living. How can I become a consumer (with job) if even minimum-wage shops consider me overqualified?

Nonetheless I don't think we need to worry about the RIAA or rootkits or whatever much longer. The new generation (10-16) of kids recording today are already using the next distribution system (PureVolume and MySpace).

So what's the next promotion system? A lot of these 10-16 year olds are forced to listen to major label music on commercial FM radio on the bus ride to and from school.

Sonny Bono owns you

[tepples]

the public domain is now an effective reality.

Say what? RIAA executives, MPAA executives, and other followers of Sonny Bono would beg to differ.

I'm confused, that's only 2 blind mice

[swschrad]

there has to be a third totally clueless idiot to follow the other two spiralling down the black hole to obscurity.

Sony/BMG is proven totally hopeless, particularly when somebody demonstrated that a little hunk of electrical tape on the CD's outer tracks will kill the entire bogus session-2 rootkit PC-munger altogether, and allow the CD to play like it was a real CD-DA.

RIAA thinks they're wits, and they're half right.

Notice we haven't heard from any of the usual suspects in Congress yet, the bought-and-paid-for brigade. DHS for once pointed in the right direction when they implied that Sony/BMG is the terrorist. The entire rest of the free world plus those souls who can blog undetected has called the incomptents out to the alley.

So on the pattern of 3 makes a crowd, there's still one more village idiot that needs to fall in front of a Eyewitness Action News Home Team Leader satellite truck and be recorded as too dumb to breathe in this rape of the legitimate users.

Will it be DoJ not charging Sony/BMG with computer terrorism in court? Will it be our Fearless Leaders looking to crawl in bed with another corrupt and unpopular business giant? Or will Metallica and Lars come screaming out of obscurity yet again to prove once and for all that head-banging is not healthy?

I'm waiting.......

Oh.

[artifex2004]

Well, I don't expect the Sony rootkit to infect you from another system. So if you just listen to the CD, but don't let it install, what exactly are you waiting for the honeypot to catch, that you can blame on Sony?

(I meant that you deliberately installing the rootkit = deliberately infecting yourself :) )

What public domain of sound recordings?

[tepples]

the major strategy in their campaign against P2P is to convince everyone that sharing any copyrighted work is illegal, and that there's no such thing as Free Software, public domain media, or the Creative Commons.

No sound recordings have entered the public domain through expiration of exclusive rights in the United States. The State of New York and several other States recognize perpetual copyright-like privileges in sound recordings, and federal law will not pre-empt these privileges until the year 2067. The only "public domain" in sound recordings is an affirmative abandonment of exclusive rights by each work's copyright owner.

"Nothing Wrong" ???

[sfm]

If Sony did nothing wrong, then why are at least 2 lawsuits being filed against them ???

Of course RIAA supports Sony's root kit

[nurb432]

Remember they were behind the insane concept spewed by that senator a while back where they wanted the right to remotely destroy your PC, at their whim..

Having a rooted PC everywhere pretty much would give it to them.

Installing lawyers at the company doorstep

[Anonymous Coward]

If the RIAA comes limping to Sony's defense at this late stage of the fiasco, I doubt that it's merely lip-service to assuage Sony's tidal-wave of bad press these days. Not when this comes on the heels of the attorneys general of California and now Texas who have come calling about this issue.

Sony's rootkit is indefensible, period. The less-than-rapid response and holier-than-thou attitude when it became a public issue is going to need a little more than a sales job by the RIAA to rehabilitate Sony. Legally, the writing is on the walls for those guys, and there isn't much cover at this point.

RIAA is spinning for Sony

[gone.fishing]

Lets call this what it is - spin by an agency that is well known for its ability to spin just about anything. Think of how many of their cash-cows (err, artists) have stepped in various drug abuse problems, affairs and other tawdery sex acts. Somehow the RIAA actually manages to get them taken care of.

Sony, and the programmers that wrote the root kit should have known they were wrong. If they didn't, then they must have missed more than one or two ethics classes along the way. Of course, their argument would be that piracy too is unethical (at that point I'd ask how two wrongs make a right).

Sony spends a lot of money on the RIAA and since even the worst criminals of them all deserve representation and someone in their corner, I guess that the RIAA is stepping up to the plate for their client. This is one thing that I can say is right in this whole story, the RIAA should be solidly in their client's corner. Unfortunately, their ethics are showing a little more than a slight tarnish.

In the long run, all of this is going to hurt the major labels in their battle for DRM but only a little. The next time around, they will have learned a lesson or two and the next effort will be a bit more proper and ethical but still just as hard to live with.

Fight back

[Anonymous Coward]

You could always put in your software RIAA specific clauses allowing free access to their computers if they use your software...

The counter-spin in one easy sentence

[Zellis]

Sony's DRM software didn't "contain" a security vulnerability, it was the security vulnerability.

President of RIAA Says Sony-BMG: should be FRIED

[Anonymous Coward]

This pice of walkin shit that doesn't deserve the breath he breathes
should be FRIED in an Electric Chair for his admitted Nazi linkages.

There, I've said it, the Chair of Sony is a Nazi, and a Gay Fag to boot.

The buffet is about ready .... eat hardy.

Toodles!

The explicit reason Trusted Computing is bad

[Anonymous Coward]

While everyone is commenting on how horrible Sony is for doing this, I haven't seen a whole lot of posts about how trusted computing would impact the picture. So far, Microsoft is only cleaning out the rootkit because it's common knowledge. Under a trusted computing model, Microsoft would have *signed the code as trusted* and you probably wouldn't be able to remove it, much less pull it up in a debugger. Microsoft doesn't trust you, or your friends, or anyone you personally know. Microsoft trusts Sony and the RIAA, and they're the ones they're trying to win over to their own DRM schemes. I'm sure they'll be friendly to other companies in the process, just to get DRM accepted everywhere before pulling a 180 and mandating only their distribution method. After all, once DRM is in place in a trusted computer, nothing stops Microsoft from simply turning off the other brands and forcing the use of windows media. After all, they control the trust relationships.

Copyrights? What about the GPL

[Sleeping Kirby]

Strange, I don't see RIAA complaining about how Sony broke the agreement for the GPL... On the up side, if we all really screw over RIAA's computers and say it's for copyright protection, it's okay. Hackers, you've been given your mission. XD

President of RIAA

[Hanasoni]

Is a fuking moron

Suing RIAA

[Anonymous Coward]

If Sony is found guilty in the class action suit, will it open up a venue to sue RIAA and Cary Sherman, the president of the RIAA for harbouring criminals and criminal activity?

Sony share holders may disagree...

[jerunamuck]

I was undecided over a Sony or Sharp plasma TV. Then Sony fcuked up my system and cost me a day's productivity. I now have a new 42" Aquis hanging on my wall. Nope, I can't see Sony did anything wrong but then again, I'm not a share holder!

PS: I'd like to sue Sony for lost productivity but my employer won't sign a deposition. Anybody know of a class action suit in the making?

Go to the police!

[Arend]

"Agreed but what can we do about it."

You can go to the police and report the evidence you have regarding an alleged crime. The police should then go and investigate the evidence and, in case enough evidence is found, justice should have it's cause and a judge should decide wether or not to punish the offender. That should be possible in all countries that signed the TRIPs agreement, including the US and the UK (see below). Article 61 states:

http://www.wto.org/english/tratop_e/trips_e/t_agm4 _e.htm

-+-

SECTION 5: CRIMINAL PROCEDURES

Article 61

Members shall provide for criminal procedures and penalties to be applied at least in cases of wilful trademark counterfeiting or copyright piracy on a commercial scale. Remedies available shall include imprisonment and/or monetary fines sufficient to provide a deterrent, consistently with the level of penalties applied for crimes of a corresponding gravity. In appropriate cases, remedies available shall also include the seizure, forfeiture and destruction of the infringing goods and of any materials and implements the predominant use of which has been in the commission of the offence. Members may provide for criminal
procedures and penalties to be applied in other cases of infringement of intellectual property rights, in particular where they are committed wilfully and on a commercial scale.

-+-

It seems that at least the UK and the US have implemented this in their laws, so I think one could go to the police over this in both the UK and the US:

====
UK
====

http://www.theregister.co.uk/2003/10/07/prison_for _using_kazaa_surely/

-:-

But from 31st October, the new regime introduces a new threat for P2P fans: prison. "There's no suggestion that this is what the new law is intended to catch, and it's not something that the European Directive demands; but the wording could be interpreted this way," says Robertson.

The relevant provision states:

"A person who infringes copyright in a work by communicating the work to the public -

(a) in the course of a business, or

(b) otherwise than in the course of a business to such an extent as to affect prejudicially the owner of the copyright,

commits an offence if he knows or has reason to believe that, by doing so, he is infringing copyright in that work."

Robertson said: "It could be interpreted under these new Regulations that you are now committing a criminal offence when you use KaZaA or other P2P services. You may not be acting in the course of a business; but by making a music file available for download for any other users of your chosen P2P network, you are communicating the work - potentially at least - to millions, i.e. to an extent that the music industry could say is prejudicing its rights."

-:-

Judging on this, in the UK -- the base of first4internet -- one can also be sent to prison over copyright infringement.

Some more or less relevant case law:
http://www.legalday.co.uk/lexnex/simkins03/simkins q403/simkins141003.htm

"PPL applied for an order to commit Mr Tierney for contempt of court in respect of his failure to comply with the court order. It had reportedly made seven previous applications of this nature against Mr Tierney.

PPL succeeded in its application. Mr Tierney had been warned of the consequences of further breaches of the court order only six months previously. The court imposed a term of imprisonment of 35 days. In order that the sentence had the effect of ensuring future compliance, the court suspended the sentence for 40 months."

====
US
====

Disgusting

[paladin151]

I find Sherman's comments outrageous. I cannot see myself ethically justified in supporting an industry that encourages the erosion of consumer's personal freedoms and uses corrupt business practises to maintain control of an art form. The empire has outlived its purpose, namely to get music to the people. That is the purpose regardless of the motivations of the people in it.

Re:Markets always trump cartels eventually (O/T)

[oddfox]

"When I give food to the poor, they call me a saint. When I ask why the poor have no food, they call me a communist." -- Dom Helda Camara.

Sure the people working in those sweatshops (By the way, I advise everyone I know to avoid labels that I know have repeatedly used sweatshops, and I don't purchase any of their goods, ever, nor wear them. Nike is a prime example) are making money and are thus able to put some food on the table, but the problem is that these people are first off being paid jack squat, compared to residents in nations that are further developed, and second off the workplace environments are more often than not to the point where they'd be shut down permanently in, again, many nations that are further developed. And if you believe that these jobs are actually helping the country progress in a positive nature, I've a bridge to sell you. All they do is keep the status quo, no more.

These people are being exploited and that's the whole point.

Re:Markets always trump cartels eventually (O/T)

[hunterx11]

I was actually going to point out that they aren't being paid the same wages as more developed countries. Because they don't live in more developed countries. It would be great if the countries were more developed, but driving away business isn't going to increase living standards at all. It would also be nice if companies paid significantly more than market wages, but if you force them to pay the same wages as they would in a developed nation, they simply wouldn't hire workers in developing nations at all. Just having some food is pretty terrible, but it's better than having no food or resorting to prostitution.

The problem with Godwin's "Law"...

[Money for Nothin']

is that it hides the atrocities committed by Hitler's regime.

That's why Godwin's "Law" is both stupid and dangerous.

In Depth Rootkit Article

[mvea]

While the /. community is an exception, it seems to me that most people just don't understand what exactly rootkits do. At best, they're given cursory nods in the news [now] as just another form of malware. The media asks why can't our anti-virus software just detect them? OmniNerd has an article about how rootkits work that is technical enough for /. but without the reliance on source code found so often on Phrack resources, which our non-tech brethren can't understand.
URL: http://www.omninerd.com/2005/11/22/articles/43