Sony's SunnComm DRM Patch a Security Risk

Spad writes "The BBC is reporting that mere days after the EFF and Sony announced a patch to fix the vulnerability in its SunnComm DRM system, security researchers Ed Felten and Alex Halderman have discovered that the patch itself introduces yet more vulnerabilities. They have now asked users not to apply the patch and are urging Sony to recall all of the affected CDs from sale. Sony has said that approximately six million CDs using [SunnComm] MediaMax have been shipped to stores. Affected artists include Alicia Keys, Britney Spears, Black Rebel Motorcycle Club and Faithless."

Comments

Eat me, Sony.

[grub]

Sony will get to write off the bad CDs as defective at the end of the fiscal year. You or I accidentally burn something on the stove and we absorb the cost.

The publishers are just middlemen (middle-management?) scrambling to keep their distribution means relevant: cut them out like a cancer.

a) Freely download
b) Buy what you like (second hand if possible)
c) Pay to see the artists live

Re:Eat me, Sony.

[k4_pacific]

Wasn't there a Seinfeld episode to this effect? I don't remember the exact quote, but...

Jerry: George, you can't take that, it's stealing!

George: These big companies, they just write it off anyways.

Jerry: Write it off? Do you even know what that means?

George: Yeah, uh, er, no.

Re:Eat me, Sony.

[amliebsch]

No, no, no, it was Jerry and Kramer.

* Kramer: "Its a write off for them!"
o Jerry: "How is it a write off?"
* Kramer: "They just write it off. Jerry, these big companies, they write off everything."
o Jerry: "(pause) You don't even know what a write off /is/."
* Kramer: "Do You?"
o Jerry: "No, I Don't."
* Kramer: "But /they/ do..and /they're/ the ones writing it off."

Re:Eat me, Sony.

[Shakrai]

Sony will get to write off the bad CDs as defective at the end of the fiscal year. You or I accidentally burn something on the stove and we absorb the cost.

As much as I hate Sony you don't think they are absorbing the cost as well? Just because they get to "write it off" doesn't mean they magically get the money back. A write off or a charge off is just an accounting term. They will probably get to report that write off when they file their income taxes -- it will reduce the amount of taxable income they had -- but they still have to absorb the cost.

You or I can do the same thing with some expenses. You can reduce your taxable income by reporting expenses for medical care, uninsured losses, crime losses or bad debt (you loan me money and I default). Whether or not this makes sense for you (vs just taking the standard deduction) is something that only you or your accountant could figure out.

Re:Eat me, Sony.

[Jeff DeMaagd]

a) Freely download

Yeah, and but don't then turn around and complain if a company infringes on the GPL. I think that would be called hypocrisy.

b) Buy what you like (second hand if possible)

I already buy almost all of my music second hand.

c) Pay to see the artists live

That's usually stupidly expensive, I think most of the money probably goes to the property owners anyway.

Re:Eat me, Sony.

[Anonymous Coward]

You have violated copyright law by publishing the text of a comedy. We must punish you... Now - go to my room!

Re:Eat me, Sony.

[WebCrapper]

Unfortunately, Sony is such a big company, that nothing will really happen except they may claim to have lost $xxx,xxx... If you think about the company as a whole, thats nothing really. That is technically the cost of shipping & handling plus the (very) few hours of work from their programmers.

I would honestly like to see Sony taken to court for this. This is nothing but a spyware case by a large, global company who thought they could get away with it.

Re:Eat me, Sony.

[CastrTroy]

That's usually stupidly expensive, I think most of the money probably goes to the property owners anyway.

That really depends on the bands you like to see. I often go to concerts for $10 to $20. I've also seen some pretty popular artists for quite cheap. You just have to be smart about what bands you see. In my eyes, no band is worth the $80 arena ticket so you can see them from 500 ft. away. However, many bands that i may not like so much, are really fun to go and see when you can be within 50 ft. (10 ft. sometimes) of the band, and only pay $15.

Re:Eat me, Sony.

[The_Rook]

wanna bet that sony will figure out a way to charge the musicians for the recall and destruction of the "defective" discs?

Re:Eat me, Sony.

[grub]

"Writing off" doesn't make the money re-appear, that's true. It does help them with what they pay in taxes. The hypothetical ruined dinner I mentioned still comes out of our pocket from what is after tax money.

Re:Eat me, Sony.

[nra1871]

Most of the metal bands I love (Trivium, Shadows Fall, Soilwork, hell even Anthrax) cost between 15 and 20 bucks, and I just walked up to the very front, just a couple feet from the band.

Re:Eat me, Sony.

[vertinox]

As much as I hate Sony you don't think they are absorbing the cost as well? Just because they get to "write it off" doesn't mean they magically get the money back. A write off or a charge off is just an accounting term. They will probably get to report that write off when they file their income taxes -- it will reduce the amount of taxable income they had -- but they still have to absorb the cost.

IANAA (I am not an accountant) but here is the run down with that tax loophole. If you earn Earn $20. With the standard made up tax rate of say 50% you would pay $10 and only have $10 left, but because you are a corporation that is considered profit and you are taxed twice you pay another 50% of that profit.

Now you have $5 left over for your shareholders. Not much of a profit, but anyhoos...

Lets say you earn $20 but get to write off $10 due to theoretical losses. You are only now taxed on the original $20 and get $10 back, but now if your company lost $10 from a write off now you have $0 to tax for the profits.

Your company now has $10 left over for your shareholders.*

Now which one would you like to have? The $5 or $10? You see tax write offs can earn you money that you would not have had as a corporation.

*Yes all above is rather abstracted and figured are all made up and doesn't really go over tax law, but didn't I say I wasn't an accountant!

Re:Eat me, Sony.

[Ryosen]

"nothing will really happen except they may claim to have lost $xxx,xxx to piracy."

Fixed it for you.

Re:Eat me, Sony.

[Anonymous Coward]

Thanks for the laugh.

I needed that.

Re:Eat me, Sony.

[sgent]

Almost, but not quite... Companies pay taxes (at least in the US) on net income, not revenue. So extending your example of a 50% tax rate and $20 net income...

50% of $20 = $10 available to shareholders and $10 in taxes. If the company then distributes that $10 to the shareholders (sends them a check) the shareholder's have to pay taxes on the money recieved on their personal income taxes.

Ok, now assume they have a recall that costs them $5. So its $20 - $5 writeoff = $15. $15 x 50% = 7.50 in taxes, and 7.50 to distribute.

The concept of a write-off is often misunderstood. One reason that its even such an issue is in the case of small to medium business. Remember that the corporate income is taxed, and then taxed again when distrubted to shareholders. A small business can buy a MSDN subscription for $2,000. This means that it will only clost the owner approximately $1,000 in take home pay. Its not that its free, but just that it costs less to the owner than if joe blow hobbiest had bought the same subsription.*

*Note, taxes are complex, this doesn't even attempt to explain the complexities -- including common workarounds.

Re:Eat me, Sony.

[networkBoy]

[OT, Re, your sig]

Why can't /. have a +1 troll as well as a -1 troll?
-nB

Re:Eat me, Sony.

[WebCrapper]

Ok, Ok... Its the end of the day here in Germany and I'm drunk (really!) I don't claim responsibilty for anything I write today...

Re:Eat me, Sony.

[NatasRevol]

I'm too old, but not too deaf, to be 10 feet away from ANY band.

Re:Eat me, Sony.

[sunburntkamel]

objection to b)

buying second hand only covers your butt in case someone audits your music collection. (likelyhood=0). it doesn't benefit the artist, or the record company. it only benefits the used CD store and the guy who sold the CD.

replacement b)Buy what you like IN THE FIRST WEEK, or buy it from the band at the show.

Re:Eat me, Sony.

[Ryan Amos]

A few years ago Ticketmaster and Clear Channel decided that selling out concerts meant lost revenue. Their goal is to price the tickets high enough that they get about 90% occupancy. Then Clear Channel cut Ticketmaster out of the loop and started handling their own ticket sales. The end result of this is concerts that almost never sell out, but the face value on the tickets is about what you would have paid from a scalper.

Since Clear Channel typically owns the venue, puts the tour together, owns the radio stations on which the concert is promoted and sells the tickets, all the money goes to them. Their public image has become so bad recently that they have taken to promoting their concerts under the names of all the old regional promoters they bought up probably 10 years ago (I know it's Pace Concerts in the south.)

Re:Eat me, Sony.

[Anonymous Coward]

50% of $20 = $10 available to shareholders and $10 in taxes. If the company then distributes that $10 to the shareholders (sends them a check) the shareholder's have to pay taxes on the money recieved on their personal income taxes.

Take it further: when one of those shareholders spends what's left of the money with a contractor to shingle their roof, the contractor then pays tax on the money yet again. The place where he spends what's left does the same as well, until eventually every penny is back out of circulation again. Then it gets "borrowed" back into circulation from the Federal Reserve and the process starts all over again.

When are people going to wake up and see that this is the real purpose for the Federal Reserve and the Federal Income Tax?

Re:Eat me, Sony.

[Shakrai]

Almost, but not quite... Companies pay taxes (at least in the US) on net income, not revenue. So extending your example of a 50% tax rate and $20 net income...

That's part of the point I was trying to make. Thank you :) Your point about how they can purchase things cheaper then you or I is also very valid.

If the company then distributes that $10 to the shareholders (sends them a check) the shareholder's have to pay taxes on the money received on their personal income taxes.

Yep -- and why shouldn't they? If the shareholders were getting a salary instead of dividends it would still be taxed. Why shouldn't it be just because it's 'dividends' instead of 'gross pay'? (Disclaimer: You didn't state an opinion on this one way or another -- just a lot of people think this is 'double taxation' and I happen to disagree) As a question: Does a company pay tax on money they distribute to shareholders? I know if they give every employee a nice bonus they don't wind up paying a corporate income tax on that. Do they pay a corporate income tax on money earmarked for dividends?

Re:Eat me, Sony.

[Shakrai]

"Writing off" doesn't make the money re-appear, that's true. It does help them with what they pay in taxes. The hypothetical ruined dinner I mentioned still comes out of our pocket from what is after tax money.

True, but there are things that come out of your pocket that can be with tax free money. Medical bills, home repairs caused by uninsured losses, losses in stocks, losses due to crime, noncollectable debt, etc.

If you use a flex spending plan you can even avoid the FICA taxes (as well as income) on a whole slew of expenses. Eyeglasses, over the counter drugs, etc.

Yeah, the burned dinner wouldn't qualify though. But you could always get that money back by suing the person who sold you the stove ;)

Re:Eat me, Sony.

[budgenator]

yeah but Sony Entertainment's CEO, Andrew Lack, realy has his ass in a sling. The movies except for "Hitch" aren't even been grossing enough to cover production costs this year, and he failed to appoint a guy to run the music division when he got promoted from it, electing to run it himself. Now the Germans, the BMG part of SonyBMG, are calling for his firing, for something that nobody is sure about. The spyware/rootkit/computer invasion/GPL copyright violations are just icing on the cake, canning one of these ego-driven people hurts them worse than taking a million out of their comp package. This guy has blown a lot of hard won geek appeal for Sony which will hurt them across many divisions. They always taught us help one person and he tells two people, hurt one person and he tells ten; goodwill is easier to squander than to earn.

Re:Eat me, Sony.

[sgent]

Does a company pay tax on money they distribute to shareholders? I know if they give every employee a nice bonus they don't wind up paying a corporate income tax on that. Do they pay a corporate income tax on money earmarked for dividends?

A corporation pays tax on income. So if they have $1,000 in income, then that is taxed. Payroll/bonuses are a little different. If I pay you $100, then I will often (not always) owe the government $7.65 PLUS whatever I with-hold from your paycheck for the purpose of social security matching. So to flesh out the above, $1000-100-7.65 = 892.35. If the corporation has a 35% income tax rate, they will owe 892.35 X .35 = 312.33 in income tax, leaving an after tax profit of $580.03

Conversely, if they don't give you the $100 christmas bonus, then they will owe income taxes of $350, for a net after tax income of $650. This means paying you a $100 bonus, only cost them $69.97 in after tax profit.

Dividends and stock buybacks MUST come from after tax profit. So in the above case, the maximum divident would be $350 or $312.33 depending on the example. The company can chose not to distribute the entire amount of profit (for a variety of legitimate reasons), in which case it is added to retained earnings. It would not be subject to additional income taxation on that amount on a corporate level (assuming it sits in a bank earning no interest).

The classic double taxation comes as follows... Taking the above profit of $650, when it is distributed to an individual they also must pay taxes on that amount -- approximately the same 35%. This means that their actual in the bank amount would be $422.50 (assuming the $650 example above).

The reason this comes up in small business, is that if I'm a partnership or sole proprietor, I am only taxed once at the personal level. All profits are passed down (as well as expenses) to my personal tax form on Schedule C. So a part time consultant would have an after tax income of $650, but Accenture would have an after tax income of $422.50.

Under certain conditions, a special case of corporation called a Subchapter-S Corp, is not subjected to that "double taxation" mentioned above. This is restricted to closley held corporations (less than 100 shareholders I think), and has other restrictions.

This can get more complex, and one otherthing to keep in mind (espcially for small businesses), is that profit and cash don't line up. For instance, if I spend $2000 for a computer, I'm not allowed to expense it in the year it is purchased -- but it must be written off over 5 years. The same idea exists with invoices. If I issue an invoice for $5,000 on December 20, but am not paid, I will still owe taxes on that amount.

Re:Eat me, Sony.

[sgent]

4th paragraph should read....

Dividends and stock buybacks MUST come from after tax profit. So in the above case, the maximum divident would be $650 or $580.03 depending on the example. The company can chose not to distribute the entire amount of profit (for a variety of legitimate reasons), in which case it is added to retained earnings. It would not be subject to additional income taxation on that amount on a corporate level (assuming it sits in a bank earning no interest).

Re:Eat me, Sony.

[Alpha_Traveller]

c) Pay to see the artists live

Pay to see them live?? What, are you kidding? For the kind of money U2, Madonna, and other big groups/solos charge for tickets, I'd have to take out a loan to pay for two seats let alone four.

I only go to concerts now for small time acts. The days of goign to arenas for concerts are gone for every dollar these bastards charge for over $50 a seat.

It's a shame when Sarah McLachlan comes to town, plans to give a concern to benefit a women's shelter, twenty thousand people show up and the women's shelter only gets $30,000 out of the deal after everyone else involved gets paid.

There is just as much of a racket on the concert side as there is on the album side. I'm not even all that sure this benefits the artist all that much either.

Re:Eat me, Sony.

[Anonymous Coward]

I seem to know some people that buy music, get bored of it after a month, and sell it back to stores/on ebay. If there wasn't a good secondhand music market, don't you think sales would go down?

Of course, this indirect effect benefits the artist much less than buying their CD. But if you really want to support the artists, go to their shows and buy their merchandise.

Re:Eat me, Sony.

[the_rev_matt]

I will not take a piece of that action. Contracts in the early 90's at least routinely allowed the label to charge the artist for whatever the hell miscellaneous expenses they wanted with no explanation.

Re:Eat me, Sony.

[DM9290]

Remember that the corporate income is taxed, and then taxed again when distrubted to shareholders.

a more blatantly misleading simplification I have seldom heard.

And since when is corporate tax at 50%?

Re:Eat me, Sony.

[dogod]

When are people going to wake up and see that this is the real purpose for the Federal Reserve and the Federal Income Tax?

care to elaborate more on that?

OK.

[citizenklaw]

Foot: Meet Mouth. Mouth, meet Foot. Is it just me, or is Sony *purposely* dragging its feet on this issue??

Re:OK.

[bhtooefr]

I almost wonder whether this is Sony's attempt to go "Hah!" at the RIAA, by making DRM that sucks so badly that the populace actually knows what DRM is, and doesn't want it.

However, that's pretty unlikely, seeing as Sony's one of the Big Five that screws over the public ANYWAY...

Re:OK.

[citizenklaw]

Is either that or they are deliberatly throwing 'buggy patches' around to appease consumers, the media and investors.

'Buggy patches'!. How's that for an oxymoron?

Virii, worms and DRM ...

[VitaminB52]

are the digital infections AV software should protect your PC against.

Re:Virii, worms and DRM ...

[dr_dank]

Were Norton AV and the other anti-virus suites silent as Sony's rootkit ran wild on peoples systems? If so, their software would be in the garbage immediately if this were on one of my boxes.

Re:Virii, worms and DRM ...

[walt-sjc]

Most AV software won't protect against spyware either. That's generally a separate product. The sony code is definately malware, but it isn't considered by the AV companies to be a virus.

Considering sony's stance, IMHO the AV companies should change their position, and their customers should demand it.

Re:Virii, worms and DRM ...

[VitaminB52]

Were Norton AV and the other anti-virus suites silent as Sony's rootkit ran wild on peoples systems? If so, their software would be in the garbage immediately if this were on one of my boxes.

<PRAGMATIC>

I wouldn't do that; IMHO an incomplete protection against digital malware is better than no protection at all.

</PRAGMATIC>

Re:Virii, worms and DRM ...

[Yaa 101]

Bzzt... Wrong answer, no protection makes people stay aware, incomplete protection give people a false sense of security.

Re:Virii, worms and DRM ...

[drinkypoo]

IIRC only one antivirus program detected and removed it, everyone else was afraid to tangle with Sony. All I remember is that it wasn't Symantec. Some of them remove the rookit part but not the DRM.

Re:Virii, worms and DRM ...

[mikefe]

IIRC only one antivirus program detected and removed it, everyone else was afraid to tangle with Sony. All I remember is that it wasn't Symantec. Some of them remove the rookit part but not the DRM.

That would be F-Secure

Phew!

[Anonymous Coward]

Phew, after seeing the list of artists all I can say is if these are the artists who'll be affected I'll be secure for years to come!

Re:Phew!

[conteXXt]

funny that. My very first reaction was also "Phew"

Judging by my recent cd purchases, I'll be safe evermore.

Re:Phew!

[Iriel]

I get the joke behind the parent post, but I can actually say it with a pretty high level of seriousness.

About the most 'pop' artist I've bought a CD from was Nickelback, but they've been a disappointment since 'The Long Road' so I feel pretty safe on the CD front. Just looking at the kind of music-based podcasts I listen to will show you that most of the artists I listen to are self-sufficient. As for the few mainstream songs I do get these days, I'll pony up the dollar for a download on iTunes considering I listen to all of this on my iPod at work more than anywhere else.

Re:Phew!

[HTH NE1]

Going by my recent CD purchases, I don't need to check the list.

Re:Phew!

[BrokenHalo]

Judging by my recent cd purchases, I'll be safe evermore.

Same here. Out of curiosity, I had a bit of a prowl through my large-ish CD collection the other day, and I found only one with a Sony label after I had got about 20% of the way through, at which point I stopped.

Incidentally, that CD (John Williams: The Seville Concert) is one I was given by a relative, and I don't like it very much, so maybe it doesn't count anyway...

Re:Phew!

[Anonymous Coward]

Not to sound like a music snob, but BRMC and Faithless are hardly 'pop' or mainstream. These are artists that are fairly obscure; which means it's not just the big selling folks that are affected (infected?).

Which is why I use iTunes and Hymn.

Re:Phew!

[Anonymous Coward]

check again. Sony owns a lot of labels and I'm guessing you own a lot more sony music than you realize.

Re:Phew!

[budgenator]

That was probably the underlying stratagy, DRM some obscure artists, wait and see what happens and slowly move toward more popular groups. When the shit hits the fan they can play dumb and say why all of the excitement now we've been doing this for years and nobody cared. This way they've turned an intrusion into an easement, to stop it people will have to argue against the status quo. If anything they were more surprised by how quick the out-cry occured and how mainstream it extended, I guess that taking a page out of Microsoft's playbook like embrace and extend just doesn't work for anyone else.

Re:Phew!

[BrokenHalo]

No. I checked, and apparently I don't.

Nice

[ruiner13]

I wonder how this will play out if a minor buys one of the broken CDs, puts it in their parents computer and it gets taken over. As (at least in the US) minors cannot agree to contracts, I'm thinking the EULA cannot legally be agreed to by them. Since their EULA installs the rootkit on yes or no answers, this turns out to be illegal on so many levels. So much for buying Sony ever again, they make decent TVs, it is a shame that one of their divisions has to make such a bad image for the whole company.

Re:Nice

[fdiskne1]

This particular bug gets installed even if you decline the EULA. Sony and Sunncomm, what a wonderful combination. Remember, this is the same company that tried suing someone for putting on their web site "Hold the shift key down while inserting a copy protected CD to prevent the DRM software from being installed."

Just shaking my head at their idiocy and getting ready to watch the fireworks, assuming anything actually happens because of this mess.

Re:Nice

[Ooblek]

Can anyone tell me how to find this DRM stuff on my CDs? All I can see is a bunch of .mp3 files....does this mean I've been infected?

Re:Nice

[Kjella]

I don't think that matters. A porn site doesn't get convicted if a minor got in by using daddy's credit card. They have in "good faith" believed that an adult has agreed to the EULA. What should bite their ass is secretly installing software even if you decline. That alone should be a lesser crime. Installing system-level patches to change the way the system works should be a felony hacking charge. That is what any other hacker would get if he secretly installed a rootkit with his apparently legitimate software.

Re:Nice

[xtracto]

just a quesiton, do you know what happened to the princeton guy? was he sued? do you have any other references with stories follow up?

Re:Nice

[cortana]

Holding down the Shift key stopped AutoRun and prevented the software from being installed. Halderman wrote about the software, and the "infamous Shift key attack," in an academic paper and posted it online. Within 24 hours, SunnComm was threatening a $10 million lawsuit, and vowing to refer Halderman to authorities for allegedly committing a felony under the controversial Digital Millennium Copyright Act, or DMCA.

By the next day, the company had backed down in the face of public outrage. Looking back, Halderman says, "The whole experience was a whirlwind.... The response was way bigger than (anything I'd) expected."

Source: Wired News: Music Man Cracks DRM Schemes, 7th December 2005.

Re:Nice

[Anonymous Coward]

Just remember... all this bad publicity for Sony is being exploited by Intel/Microsoft/Sun and Apple. Intel just made it's big announcement about Le Grande, the Trusted Computing chipset... and spun it as a way to stop things like this happening. This, of course, is a total lie.

Re:Nice

[NatasRevol]

You're obviously missing a clear difference.

CD's are purposely marketed and sold to minors.
Porn isn't.

So the GP has a valid point. Can Sony get sued for trying to force/enforce an illegal contract?

Re:Nice

[budgenator]

Not the same thing at all, it's much more reasonable that Dad, secures his CC from unauthorised use as a matter of routine. I'd also argue that it is reasonable for kids to have access to music CD and to play them in the computer while doing homework. I'm not sure that this crapware is any different than what a hacker would be doing; seems a company with sony's resources should know exactly what they are installing on a hapless user's computers. If there are security "vulnerablities" in the crapware, is it an accident or is it a backdoor? I just don't see the crapware as being different than any other trojan building a bot net; definately jail time.

The music gene pool is self correcting

[lohphat]

Given the titles affected, consumers had it coming.

Re:The music gene pool is self correcting

[autocracy]

What the hell is wrong with Faithless?

I'm rather suprised Faithless is signed to Sony, but *shrug.*

PS -- God is a DJ :)

Re:The music gene pool is self correcting

[Anonymous Coward]

Except for BRMC - excellent rock & roll - damned shame they're with Sony.

Re:The music gene pool is self correcting

[91degrees]

Indeed. If only the rest of the world could have perfect taste.

Re:The music gene pool is self correcting

[boingo82]

What's interesting to me is that Sony is only claiming about 20 CDs were affected, but I personally have purchased at least one that contains SunComm MediaMax, yet is not on their list. (Foo Fighters) I have seen other lists online showing over 50 affected CDs. The Foo Fighters alone released 4 titles that Sony put Media Max on. Anyone else notice how Sony only claims the shittiest, lowest-selling titles have the software at first? The first discs that admittedly had XCP were Celine Dion and a bunch of other crap that's most popular with people who are computer-illiterate. They're avoiding mentioning the infection of the discs that sold the most, especially those sold to people who actually understand the word "rootkit".

Oh goodness! More to investigate and recall.

[saskboy]

I even went to the bother of giving the EFF, Sony, and "independent 3rd pary verification" the benefit of the doubt that they wouldn't frick things up AGAIN after their XCP DRM patch hole. Now I have to update my blog to say the MediaMax patch is hosed.

http://www.independentbands.com/cd/switchfoot/noth ingissound.html
Some interesting info was brought to my attention today by http://www.glynhotz.com/ the lawyer in Ontario suing Sony over XCP for consumers in Canada. EMI issued a recall on a DRM infected CD, on October 6, shortly after Sony was notified of the rootkit in their XCP CDs.

Any one care to investigate this further?

http://www.boycottsony.us/

Re:Oh goodness! More to investigate and recall.

[budgenator]

As I understand it Canadian law sets up a tax on recordable media, to compensate lables for copying, and that file sharing is mostly legal in Canada. From those premises, isn't distributing DRMed CDs inside Canada at best "bad form" and at worst tax fraud? I guess somewhere in the middle might be consumer fraud, a Canadian has paid for the right to distribute, but the company failed to provide an unencumbered distributable media. Of course I'm just a dumb yank wondering about Canadian law so the whole thought might be whacked.

Re:Oh goodness! More to investigate and recall.

[saskboy]

There is a levy collected on recordable music CDs [don't ask me how the data CDs are different?]. This does go to the music industry somehow, and goes to artists deemed rich enough to deserve more money. But common sense anyway tells me that it's still free choice of the music distributors to put DRM on their CDs as long as they don't break people's computers without warning them sufficiently [which of course doesn't happen]. People don't have to buy crappy DRM infected CDs, but as it stands they aren't aware of the fact that they are being screwed. When they find out in bigger numbers, expect the poop to hit the rotating blades.

Bitten by the patch?

[ReformedExCon]

So you could be hit once by the original flaw. Then you could be hit one more time by the flaw in the patch?

Someone should write a song about that.

Re:Bitten by the patch?

[Arhat]

Someone should write a song about that.

Oops, I Did It Again?

Re:Bitten by the patch?

[Caste11an]

I've heard this one:

She got the mine
But I got the shaft....

Re:Bitten by the patch?

[k4_pacific]

You can call it:
DRMed if you do, DRMed if you don't

Re:Bitten by the patch?

[ellijacket]

I bought a cd the other day
then I placed it in my cd tray
My songs started playing to my delight
Then I danced away through the night
Never suspecting the sinister plan
That was put in place by the music man

My computer began to sneer and snort
Viruses were streaming through the ports
No matter what, I could not see
The viruses were hidden from me
I never suspected the sinister plan
That was put in place by the music man

I patched the bug and felt ok
My computer would live another day
but then my box fell to it's knees
no more bits could it process for me
I never suspected the sinister plan
Now I'll never buy from the music man.

Re:Bitten by the patch?

[rhendershot]

I was gonna mod, but I bet others do. Instead I wanted to say this is so DRMed funny I nearly pee'd myself!

Re:Bitten by the patch?

[jmcneill]

Instead I wanted to say this is so DRMed funny I nearly pee'd myself!

Of course, you mean .. this is so DRMed funny I nearly HDCP'd myself!.

Re:Bitten by the patch?

[rhendershot]

>>this is so DRMed funny I nearly HDCP'd myself!.
LOL

No, I don't have a license for HDCP implementation. I tried to download one but then my computer started talking japanese and asking me to insert memory card and controller in port for mod:GTA_II. I dunno.

I was able to bring SCMS online in time to prevent p'ing anyway so all is good. ;)

Good bye Sony.

[LWATCDR]

I think that Sony is going to have some MAJOR issues. This DRM stuff my not mean a lot to the average music user but it could really hurt the PS3. The 360 is already out and it isn't bad. The Revolution is actually seems to be getting more interest than the PS3 from the press now.
I for one am not going to buy any CDs from Sony anytime soon. If I do I will rip them on my Linux box and burn clean copies to use.

Re:Good bye Sony.

[hal2814]

It's easy to boycott a system that hasn't come out yet (or doesn't have a launch lineup or even a finalized hardware setup yet). I imagine this ill-will towards Sony won't carry over to their PS3 console. For one thing, a lot of people do not equate Sony's media content divisions with their hardware divisions. Another thing, this is happening a year before the PS3 comes out. Are people going to hold a grudge for that long? I doubt it. Memories are generally shot.

Re:Good bye Sony.

[rpozz]

The effect on the PS3 sales will unfortunately be minimal. Not only do the vast, vast majority of people not know or understand what they have done wrong, but after a few pretty screenshots or videos of the PS3, there'll be no doubt that people will conveniently forgive Sony for this crap. Remember all the /.ers overlooking the MPAAs actions when LOTR came out?

For this to make any long-term difference whatsoever, an enormous boycott would be needed.

Re:Good bye Sony.

[Anonymous Coward]

LOTR was filmed in New Zealand instead of the US though, so it has at least 25% forgiveness built in ;)

Re:Good bye Sony.

[maxwell demon]

Memories are generally shot.

Oh damn, I guess I'll have to watch out for the guy with the gun! :-)

Sony/BMG, A Division of Al-Qaida

[swschrad]

congratulations, oh bearded one, for your infiltration of computers in the western world. and congratulations for keeping your sizeable stock holdings in Sony and Bertlesmann secret for so long.

there is no other plausible explaination for the number of times Sony/BMG has shot itself in the nuts over copy protection that cannot do what they want it to do. it MUST be a plot against humanity by the AntiChrist. no other logic works out.

Re:Sony/BMG, A Division of Al-Qaida

[Asklepius M.D.]

Sooooo we're scared shitless that some fundamentalist camel-jockey is gonna hack our system, leading to all sorts of restrictive legislation, but if a mega-corporation does it in the holy name of DRM it's a non-issue? Let's make it fair - let's invade Japan....they're harboring cyber-terrorists!

This could be a good thing:

[Donniedarkness]

I think that after Sony loses EVEN MORE money because of this, they may be a little conservative in the future. I still urge everyone to not buy any Sony products (I just talked my parents out of buying a $1300 Sony Camcorder, a $200 Sony car stereo system, and a Sony HDTV that has a price that I don't know). We need to show these guys that WE WILL NOT TOLERATE this sort of shit. These guys are doing whatever they can to make as much money as they can. Let's kick them where it hurts.

Re:This could be a good thing:

[dmcooper]

Hear Hear. Turned down the Sony camcorder option myself for a Panasonic.

Re:This could be a good thing:

[Anonymous Coward]

Dear SONY,

It's you, not me, and this just isn't working out. Music is not software, and Music CDs should not require me
downloading patches to keep myself secure from your music media discs. I left you alone in my house,
and you left the doors wide open. When I came home I found out you had installed cameras in all the rooms
of my house to monitor my activity. I can't live with someone who can't respect my privacy.

It's over between us, and I'm telling all my friends what you did.

Re:This could be a good thing:

[Anonymous Coward]

We need to show these guys that WE WILL NOT TOLERATE this sort of shit.

Go back thru the annals of /. You will find many preaching about "If Sony supports the DMCA, we need to stop buying Sony". "If Sony supports ...." is a common theme. Yet, when the new gizmo comes out from Sony, or Sony Pictures releases a new movie - Bam! Front page on /.

"We" tolerate it just fine it seems.

Re:This could be a good thing:

[drinkypoo]

No, no, no! We have to buy more Sony! Someday you will take your Sony to the Sony to buy more Sony! And then it will all be full of illegal DRM software and we can all sue them and live happily ever after.

Re:This could be a good thing:

[Milican]

Hmm... yes, yes... Then we need to unleash the Tobacco Lawyers on them and sue them into oblivion and then shit away all the money. Heck, if Johnny Cochran was around we could use the Chewbacca Defense.

JOhn

great way to keep kids away from britney...

[passingNotes.com]

honestly, some of the artists excluding a handful of top 40 sellers are unusual compilations from pre-90's stars (neil diamond for example) and while i genuinely hope to see sony make ammends with consumers, there has been soooo much mixed information coming from so many sources that i honestly do not believe any typical sony cd purchaser a) understands what happened or what they should do, b) understands if that if he did undertstand, he was wrong and should rethink what he did (reapply patch, etc) or c) understand that the second revision to his understanding was wrong, and so should not have downloaded to begin with (the patch) or should just get the tunes elsewhere...how can they possibly hope for a clean fix even with a recall? the cd's are in the market, on hard drives and players already and communicating this to everybody as if it's on par with a tylenol scare is a bit absurd - privacy is paramount, but this is being presented as a deathknell to sony's consumer relationship building efforts...no amount of press or instructions or expert opinions with constantly revised advisories will help, they will only confuse - there is a need for just ONE clear and definitive statement from SONY itself, ideally a full page ad in major dailies, and this in turn should list all artists/CD's effected, and should ask for readers to tell friends. you think most neil diamon fans and britney junkies are getting the slashdot rss feed? right...

Re:great way to keep kids away from britney...

[Anonymous Coward]

I honestly do not believe any typical sony cd purchaser

1. understands what happened or what they should do,
2. understands if that if he did undertstand, he was wrong and should
3. understand that the second revision to his understanding was wrong, and so should not have downloaded to begin with (the patch) or should just get the tunes elsewhere...

I work in an IT company. We develop software for the masses. Yet two of my colleagues did not know the term "rootkit" or have heard about the Sony goof-up. These were not office clerks or marketing people. They were 30-ish and both had developer background.

That served as a reality check for me. This case has hardly been touched by the mainstream media.

What's worse, now scores of naive users will try out rootkit detectors with no understanding of using them properly. False alarms will ensue, like claims of Firefox running 10 rootkits. Yeah, right! There will be lots of noise in the blogs, and little mention in the mainstream media. Joe Public will not be enlightened by this.

Re:great way to keep kids away from britney...

[CyricZ]

Why do you expect the mainstream media to provide decent coverage of this? They won't publish anything negative about a company as big as Sony, especially if Sony buys advertisements from them.

The problem is not with the mainstream media failing to report on this sort of an issue, for whatever reason. The problem is that the public in general is dumb enough to only get their news from the mainstream media.

So instead of complaining about how the mainstream media isn't reporting, do something beneficial. Inform people about this issue, and suggest that they avoid all Sony products, for instance. Print up notices and post them around. Get the word out yourself, rather than relying on some large, corporate newspaper to television news proram to do it for you.

Why was the EFF involved in this?

[Sanity]

Why did the EFF get involved in the announcement or endorsement of this patch? The EFF is a legal organization, not a technical organisation. Now, instead of the egg landing squarely on Sony's face, where it deserves to be, the EFF is embarrassed too.

The EFF should have pointed out the vulnerabilities to Sony and left it at that, there was no need for the EFF to lend its name to Sony's fix for the problem.

Re:Why was the EFF involved in this?

[openfrog]

I see a good reason for the EFF to get involved. Sony was succeding in keeping the two DRM issues separate, at least on the legal and larger public side (developers are (were?) seen as a negligible entity. The Agreement for the patch was for the EFF a way to get Sony to recognise the reality of the larger problem. I don't know if the EFF knew already what would follow, but I would not be surprised. Good move EFF!

--
Think!

Re:Why was the EFF involved in this?

[Sanity]

Good move EFF!

Yeah, the EFF hurts their credibility by unnecessarily associating themselves with an insecure patch - and that is a good move? This must be according to some definition of "good" i'm not familiar with.

Re:Why was the EFF involved in this?

[sgent]

The EFF had a lawsuit against sony outstanding regarding this technology (they sued for BOTH this and the XMP technology). This was part of Sony's attempt to mitagate damages from the lawsuit. Lawyers who care about their clients will often try to settle as much as possible rather than dragging it out for 10 years -- where no one is helped.

Re:Why was the EFF involved in this?

[openfrog]

The EFF did not release the insecure patch. Sony did. What the EFF did was to allow Sony some time to release it:

In accordance with standard information security practices, EFF and iSEC delayed public disclosure of the details of the exploit to provide SunnComm the opportunity to develop an update.

IMHO: I admit that I don't know all the implications of the EFF move, probably no one does at this time. However, I would be prudent before blaming them. If Sony begins to listen to intelligent people instead of DRM vendors, it might not be a bad thing. In the end, their commercial interests might prevail, but at that time, the EFF will have earned a public recognition that can be used to access and mobilise public opinion.

SONY ES UNA MIERDAD

[xavsec]

YO TE DIGO AHORRA QUE YO ESTOY CAGAO. MI ESPANOL ES BIEN MALO, PERO POR ALGUN RASON ESTOY ESCRIBIENDO EN ESTE LENGUAJE. ALLUDA ME POR FAVOR! eerr. sorry, not sure where that came from. anyway, Sony has most likely alienated their artists, their customers, and the fanatics over at the RIAA. I don't care though, I have had explosive diarrhea all morning -- and I must say, the addition of Sony malware on my system is not making things any better.

Oh what a tangled web we weave...

[digitaldc]

...when Sony CDs we do receive.

Now if people can be sued for unlawful downloading, do people have the right to sue for unlawful malware?

I think I will go on over to Microsoft.com and find some information about 'Sony rootkit'
Here are my results:

Results for:
all the words: sony rootkit; category: Support & Troubleshooting; site: All of Microsoft.com;

Support & Troubleshooting

no results were found in this category.

Re:Oh what a tangled web we weave...

[nytes]

It's interesting that people keep talking about Sony being sued over installing malware, and how much it's going to cost them (most likely a wrist slap and a $5 coupon for your next purchase of Sony products).

I see a bigger, and far more ironic potential here if Sony violated copyright by distributing 6 million CD's with open source software on them.

Hey, Sony, remember those laws you paid for a couple of years ago - the ones that provide (IIRC) $10K fines per violation? Well it looks like we've got about 6 million violations here.

We are definitely gonna git yo' sitcha-ation under control!

Sony is out of touch

[gasmonso]

They're constantly pushing for technologies that people don't want and hopefully is going to hurt Sony. First there was the memory stick, now destructive DRM and the possibility of locking down PS3 games to one device. If lawsuits don't correct this (and they most likely won't), it's up to the consumer to correct the issue with their wallet.

gasmonso http://religiousfreaks.com/

Re:Sony is out of touch

[Anonymous Coward]

Don't forget ATRAC.

Re:Sony is out of touch

[delirium28]

Agreed. Personally I was looking forward to the PS3 and the Revolution. Granted that the gaming division of Sony has nothing to do with the Music label side, I still plan on punishing all of Sony because of this recent mess with their CDs. The big N will be getting my support from now on in terms of the console wars! And as for music, you still can't beat http://www.allofmp3.com/

original article from Felten and Halderman

[edfelten]

The original explanation of this, from Ed Felten and Alex Halderman, is at http://www.freedom-to-tinker.com/?p=942

Big surprise

[mrRay720]

Did anyone really think that Sony were going to stop doing evil things? They don't see themselves as having any financial benefit from truly removing the damage they do to their consumers' computers. They have their reasons for wanting this crap of there in the first place, and a bit of bad publicity they think will blow over soon enough just isn't going to make those reasons go away.

There will be an updated patch eventually that actually does a half decent job of removing the worst of the security holes - they'll have to if they don't want a blanket removal of all their spyware from AV companies as a security measure. Not even a giant of Sony's stature can last too long being seen actively attacking and damaging all of their customers.

Then, after the news outlets have had their fill of the story, 6 months or so down the line they won't be wanting to run the same thing over again. Sony will then be free to come out with the next wave of evil but slightly less dangerous malware. That's how it goes. The next round will be a bit less dangerous, a LOT more secretive, but with the same anti-consumer schemes.

That's my opinion, anyway.

PS3 Tooooo

[Anonymous Coward]

PS3 is rumored to be a security risk. While Xbox 360 burns your house down. PS3 sends e-mails out to burglars as to which time you are not at home and how to get in and where you hide your key!

Recall won't be so effective...

[FellowConspirator]

The damage is most likely done to those who are susceptible.

Anyway, the patch is a non-issue for Americans who are prohibitted by law from downloading or applying it. The patch issue only effects people in countries where it is not illegal to modify/remove/circumvent DRM software. In the States the solution is much simpler: just format the disk and reinstall the OS.

Re:Recall won't be so effective...

[Lifewish]

If I recall correctly, there's some debate about whether the formatting process itself constitutes a circumvention measure. Ah, what a wonderful world we live in.

Re:Recall won't be so effective...

[shking]

I doubt that the patch creates people in countries where it's legal to circumvent DRM (Effects them); on the other hand: it may Affect the people who are already living there!

conspiracy teory

[nazsco]

1. sony claims it needed the DRM crap to prevent pirates
2. sum up the recall of the cds and drm development into "loses due to pirates"
3. lots of news: "p2p makes music company loose money!"
4. ?
5. PROFIT!

Re:conspiracy teory

[Spy der Mann]

1. Buy defective SONY CD for 2 cents.
2. Paint it and add a nice suction cup for cars
3. ???
4. Profit!! :D

Re:conspiracy teory

[Darth Maul]

Please, learn how to use and spell "lose" properly. You got it wrong twice in one post.

"losses due to pirates" and "...music company lose money!".

It's not that hard!

Re:conspiracy teory

[eradicateur]

I believe the missing step is "lobby for legislation"

Re:conspiracy teory

[nazsco]

> It's not that hard!

actualy it is when you are a dislexic, hear and read more then write english (2.o language) and post at work so you don't proof read much...

This is a good thing, in the long run

[Eagle5596]

In the long run all of this trouble is a good thing. Sony is galvanizing people against DRM. In the future companies may find people simply don't buy any products with DRM because they are afraid there will be security holes. All in all this is probably a good thing for consumers in the long run as it will keep DRM off of CD's.

Re:This is a good thing, in the long run

[Chaffar]

"In the long run all of this trouble is a good thing. Sony is galvanizing people against DRM."

I disagree. Even though in theory this should happen, I feel that anyone who understood the nature and purpose of DRM was already against it in every way. I don't think that this fiasco attracted anyone's attention except of those who are already pretty much against DRM. This isn't really a M$ Vs. Linux Vs. Mac debate, where each party has its own arguments. I think that even the people who are against piracy kinda see how pointless these types of measures are, especially those that harm the innocent (i.e. the thing about not being able to copy more than 3 times screwing over iPod users?).

Re:This is a good thing, in the long run

[croddy]

That's rather like claiming human casualities are a good thing, in the long run, because they galvanize people against wars.

I would say that it's fortunate that Sony is being hit with so much pressure and bad publicity, but I'd have a hard time seeing how it's a good thing that Sony is distributing malicious software with the sole purpose of depriving paying customers of their fair use rights.

Re:This is a good thing, in the long run

[rhendershot]

Those non-tech types who *do* hear about this will see the confusing stories, contradictory information, misleading statements and I think they'll just chalk it up to "those hackers copying music deserve what they get". Sadly, I don't think even a small portion will realize that this affects them in any way. They will probably conclude that the entire hoopla could have been prevented by STRONGER DRM, not lesser. :(

Re:This is a good thing, in the long run

[WhiteWolf666]

Come on now,

There's a difference between sacrifices human lives and between some people's systems being compromised.

Constant drought conditions in Las Vegas encouraged Nevada to push forward Xenogardening regulations (gardening without grass). I'm sure more than a few dried, brown lawns encourages this.

This was quite a lot better, than, say, people dying of thirst in the front yards to encourage water conservation.

Re:This is a good thing, in the long run

[micron]

I really don't think this will matter. As Sony's own CEO put it, the average person does not know what a root kit is.

Joe Sixpack doesn't know what this is, nor does he care. His daughter just wants her Brittany Spears.

He never listed to a bunch of geeks anyway.

Re:This is a good thing, in the long run

[Fancia]

You're mistaken on what the iPod DRM is, actually. It's not that it prevents copying more than three times, but that it prevents the song from being used on more than five (it used to be three, but Apple increased the limit) computers. You can deauthorize a computer if the file is copied to a new computer and you don't want to play it anymore on the previous one.

Re:This is a good thing, in the long run

[Chaffar]

Actually what I was referring to was the Sony Rootkit limiter which doesn't let you copy from the CD more than 3 times, whatever the use. So if you are the type that frequently puts songs on your iPod, removes them, and puts them back, you're in big trouble. This is especially true for those with the dinky iPods where space matters.

To be honest I don't know if the Sony ro0tkit limits the number of copies you can run from the CD to the track or to the CD itself. In other words, am I limited to 3 copies of each track from the CD, or to 3 copy-sessions off the CD, even if I took only track 1 the first time, track 2 the second, and track 3 the third? In both cases it's pretty fscked up of Sony...

Re:This is a good thing, in the long run

[croddy]

I wasn't saying anything about the level of harm. I was drawing a comparison between the reasoning in each claim. Come on. Read it again.

attempt to stop ripping

[johann8384]

Sony will release a statement saying the security holes were put there intentionally to discourage ripping of the cds. This would prevent them from being shared as easily.

Illegal

[DeanFox]

"Sony BMG said the MediaMax copy protection system, which is supposed to stop people making illegal copies of CDs, has been used on 50 titles sold in North America."

Why do the keep emphasizing, "making illegal copies" when it is not illegal? I have the right to make as many copies as I want. What I cannot do is make un-authorized copies (fair use IS authorized) or distribute those copies.

Who the f**k cares?

[Anonymous Coward]

Ok. Look at the song titles. Do you really think that anyone buying those titles will even hear about the problem let alone understand what it means? So they shove the cd into their (parentt's) computer and blammo... music and possibly videos or nifty extras are spit out.

They don't care. They got what they want. They probably won't notice a difference. And you whining about it here on a geeky nerd site (yes I am one of those too so I can say it) will not make a whit of difference. Sony will still make money. People will still blissfully buy the music or steal it and listen to it. Computers will still be compromised and run slower and hackers everywhere will be reading those emails from gramma while laughing maniacally.

Poop on a stick. Give it up!

--Russ

Man Bites Dog

[headkase]

Boycott's are ineffective and Sony's proven they're too incompetent to even clean up after themselves. I'd like to see some lawyers sick themselves on Sony... Let's see a class action settlement of ~$100 for each user to get a professional to remove the security hole the software introduces. They just don't seem to understand anything but dollars so at least the lawyers would be using the right stick.

Re:Man Bites Dog

[tomstdenis]

sony this sony that sony this that and sony that this, sony sony sony, sony who sony what sony how and sony why? ...

IGNORE THEM.

Don't protest, don't argue, don't boycott, don't fight.

Just ignore them. I couldn't name you five popular Sony labeled bands or groups. Stop thinking about it.

Are people really that compelled to buy every piece of music they come into?

Tom

Affected artists ...

[Throtex]

Affected artists include Alicia Keys, Britney Spears, Black Rebel Motorcycle Club and Faithless.

What does that have to do with a story about DRM? We already know they're affected.

Re:Bitten by the patch? Lyrics

[amcdiarmid]

Hit by the flaw, Bitten by the patch.
Lyrics by me.

I got hit by the flaw, and bitten by the patch
A computer rebuild, a 'driver with a ratchet
It's hit me, it'll be hitting you
How much did you pay for that Sony Doo-Doo?

I Put a music CD in my CD-Drive
Hit "I Accept" to some DRM jive
Now I'm here, waiting for the other shoe
and to make it worse, the music sucked too

Hit by the flaw, bitten by the patch
That company just said bend-over biatch
Bitten by the patch, hit by the flaw
hold on to your hat, 'cause that ain't all

Picked it up this morning from the TV news
Sony got another system that you don't want to use
As if the first one was'nt bad enough, with your computer flubed up
They got a second system that's also bad enough

Hit by the flaw, bitten by the patch
some big CEO needs to take it up the ass

"That's enough now, I'm Tired" - Oppourtunites never knock - The Clash - version where the kid sings it.

Re:Larry, Cruly, and Moe

[MyNameIsEarl]

I agree with the Cruly part. :)

Article Title Should Read

[Anonymous Coward]

"Sony is a Security Risk"

Don't sit HERE whining, TELL THEM

[NVP_Radical_Dreamer]

Why sit here whining about it? Tell them how you feel, I did. Im sure a couple emails wont make a differnce, but with the combined effort of the /. community they will listen. Especially when you tell them like I did, that their bottom line will suffer since you now refuse to purchase ANY of their products again. http://www.sonymusic.com/about/faq.html

Re:Don't sit HERE whining, TELL THEM

[CyricZ]

Sony will probably collect your name, email address and whatever other information they can obtain about you. And then they'll pass it on to the RIAA, and you'll be listed as a pirate. And to threaten Sony's bottom line! Why, that's pure terrorism!

Re:Don't sit HERE whining, TELL THEM

[Viol8]

Pah , you think they'll listen?? The only thing they'll listen to is the
sound of their share price falling when people stop buying.

Re:Don't sit HERE whining, TELL THEM

[entirety]

Where is Sony Music located, and how can I get in touch?

The corporate headquarters for Sony Music Entertainment Inc. is located in New York City:

Sony Music Entertainment Inc.
550 Madison Ave
New York, NY 10022-3211
sonymusiconline@sonymusic.com

Re:Web 2.0

[meringuoid]

sites are able to leverage Web 2.0 technologies

Please don't use the word 'leverage' again unless you can estimate a value in newton metres. It makes you sound like a PHB.

Rephrasing into sensible English,

sites are able to use Web 2.0 technologies

Re:Bitten by the patch? Lyrics

[93,000]

. . . and to make it worse, the music sucked too

Something about that line struck me terribly funny. Bravo.

I hope you're not mad that I reprinted it without permission.

I can't get no sleep

[Anonymous Coward]

I've been trying to uninstall all these Sony rootkits and security holes!

$sys$fnord

finally now i can use p2p again

[nazsco]

and when sony sues me (thu RIAA), i just load one of those handy cds with digital-rootkit-management and claim that someone else (probably at sony) was hijacking my computer and putting all those mp3, that i've never heard about before, there.

What people need to do

[DrugCheese]

is to start voting agaisnt companies that screw over their market like this. Don't buy Sony. I've always found Sony to be in a favorable light, but this is just one huge bad call. Unless they recall all the CDs and replace them with clean CDs they will not fix this in my eyes.

Oh no! Don't write about us on your blog!

[Anonymous Coward]

As a Sony executive, I am very concerned about your decision to write about this matter on your blog. As you may or may not already know, the self-important ramblings of an individual's personal web log are the strongest force for change yet seen by man. This is even despite the fact that writing about something on the Internet barely breaks the barrier of showing concern about the subject, as it takes very little effort. Nevertheless, we are "shaking in our boots" about your blog and sincerely hope you will reconsider your decision to write about us.

I know!

[Ruff_ilb]

Lets fix it with a rootkit!

What's this "mere days"?

[Robotech_Master]

It was discovered, and remarked upon, and even posted in comments to the original Slashdot article about the patch, on the same day.

Contradictory tactics against file-sharing?

[ilovegeorgebush]

Well to me, all this excessive DRM tactics seem to be having an adverse effect on what companies like Sony are actually trying to achieve. In all honesty, what is your average file-sharing fanatic gonna think and do when they read of rootkits and vulnerabilities in CDs they might want to buy?

I'll tell you.

"Im not buying cds if they're gonna risk the integrity of my PC" and download more songs from their favourite Peer-to-peer network; that's what they'll think and do, respectively.


Law suit anyone?

Re:Contradictory tactics against file-sharing?

[99BottlesOfBeerInMyF]

Well to me, all this excessive DRM tactics seem to be having an adverse effect on what companies like Sony are actually trying to achieve. In all honesty, what is your average file-sharing fanatic gonna think and do when they read of rootkits and vulnerabilities in CDs they might want to buy?

Or maybe you just don't understand what they are trying to do. This has nothing to do with people who download or pirate music. It does nothing to stop them. The intention of DRM is to stop regular people who obey the laws and don't download songs from P2P from being able to migrate their music to other devices and formats without paying. This is just making sure the CD debacle does not happen all over again. Sony was one of many companies who were pissed off that users could rip CDs and load that music onto mp3 players. They felt they should be paid again when users wanted to switch from CD players to mp3 players, just as they were paid again when users switched from tapes to CDs. DRM is an attempt to make sure they are paid multiple times for the same thing. So if downloading is an alternative, you're already outside their demographic.

Re:Contradictory tactics against file-sharing?

[ilovegeorgebush]

Fair enough.

And where are these people going to go once they realise:
a.) There are other alternatives to CDs and that the music they listen to can be obtained and put on a device without the need for CDs
b.) Read of rootkits in the media, being uneducated assuming this is virii or some other form of computer-related crime

Probably to p2p networks. Or, just not buy CDs again. Either way, its still adverse.

Anyone have one?

[ruiner13]

I am actually curious if anyone has any of these infected CDs if there is anything on the CD case or the liner notes that make any mention of the possibility that software will be installed on a computer if used on a PC, or if they even have the compact disc logo anywhere on it. Can anyone confirm? P.S., I would NOT advise putting it in your computer to see if there is anything on the CD, unless of course you happen to be running some other OS besides Windows or Mac (as I think some sort of kernel mod can be installed by some of these CDs, though it it more difficult to get it installed than on windows).

Re:Oh no! Don't write about us on your blog!

[saskboy]

Well, considering my blog was singled out by Glyn Hotz as the force that got him on the air in Saskatoon and Regina this week, broadcasting his news of a Canadian class action lawsuit to a potential 700,000 people in Saskatchewan, I'd have to say it's not completely gone unnoticed by consumers here anyway.

Not that I'm getting all self-important mind you, but you just shouldn't completely discount the possibility that a blog is backed with action behind the scenes by opening up communication between motivated individuals.

Re:Web 2.0

[Gleng]

Now there's a paradigm with some synergy!

What a good product might look like

[Ant2]

What if you could purchase an Audio CD that:

- could play in all CD players, including PCs and car stereos?
- had an extra track with non-DRM MP3s, OGG, and WMA files?
- included cover art in JPG and PNG format?
- included the full lyrics in TXT format?
- was free from DRM and other executables?
- (oh, and actually had songs you liked)

Would you buy this? I would.

Re:What a good product might look like

[Anonymous Coward]

Woud you still want it if it had two or three fewer tracks to make room for all that extra stuff?

Re:What a good product might look like

[meringuoid]

- had an extra track with non-DRM MP3s, OGG, and WMA files?

If they're non-DRM, just let people rip their own. It's unnecessary to waste the space. Anyway, whenever I open up a music CD in Konqueror, I already see a directory full of MP3s, a directory full of OGGs, and a directory full of FLACs, which I can copy stuff out of just fine...

Then how do we get rid of this thing?

[Darthmalt]

Friend of mine bought the switchfoot cd and put it in her computer. I've tried using all the so called patches and microsoft's anti spyware all of which failed to remove it. I've gotten to the point where now I can see the files but they're write protected. If I bypass the write protection and delete them will it screw up the laptop?

CURSE YOU SONY!!! and your sudden but inevitable betrayal.

Re:Then how do we get rid of this thing?

[BCW2]

Simple, It's called format & re-install. I hope everyone that has to use this solution will then send a copy of the bills to Sony. When they don't respond or laugh at you then take it to small claims court. A few million little suits like this will make something happen.

I charge $75 - $85 to F&R and driver it up.

Re:Then how do we get rid of this thing?

[Darthmalt]

I'm charging dinner :) Welcome to the life of a college student.

Re:Then how do we get rid of this thing?

[BCW2]

Been there, done that. I'm talking about the ones that come into the white box store I tech at.

When I was in college the first time, I did tune ups and carburetor overhauls for a case of beer.

Sony, there's something i want you to have

[Spy der Mann]

Sony: Aw, it's so beautiful - wait a minute, isn't this..
Suncomm (smiling evilishly): yes, it is.
Sony: But I thought it had a rootkit and you dropped it into the dumpster.
Suncomm: Well baby, I went down and patched it for ya.
Sony: Aww, you shouldn't have...

OOPS, I DID IT AGAIN!

legit CDs are no longer a safe option

[mkcmkc]

Actually, it occurs to me that due to Sony's (et al) actions, buying legit CDs is no longer a safe or reasonable thing to do. So I'd strike (b) from your list, and just stick with downloads (open formats only, for safety) and watching acts live.

In Soviet Russia

[Kroc]

In Soviet Russia, the DRM protects you!

Well there is some proof of this

[SmallFurryCreature]

DRM crippled CD's have with us for a number of years now. Granted the actual music company that tries it changes but it seems clear none of them have simply accepted that DRM is only damaging them.

They keep hoping that this time the consumers will be ready for it. Someday, they will be right.

Re:Oh no! Don't write about us on your blog!

[BVis]

You might want to kill -HUP your sarcasm detection daemon, it appears to be non-responsive.

More Sony "Silliness"

[fdiskne1]

Check out this story on Wired about Sony's latest guerilla marketing ploy. Sony has hired graffitti artists to paint buildings in New York, Chicago, Atlanta, Philadelphia, Los Angeles and Miami with graffitti showing people playing with the PSP. NOt everyone is happy with this. I know if they painted MY building (assuming I had one), I'd be suing them.

Re:More Sony "Silliness"

[nuggz]

Read your own freaking article.

Unlike IBM, however, Sony says it's paying businesses and building owners for the right to graffiti their walls.

DRM-infection valid defense for RIAA lawsuits?

[waynemr]

I wonder if having one's computer infected by one of the SONY DRM installs and then compromised by hackers, who then used your system to share music files, would offer a valid defense against RIAA lawsuits?

Well I guess I'm safe!

[JasonBee]

>>Affected artists include Alicia Keys, Britney Spears, >>Black Rebel Motorcycle Club and Faithless.

Looks like Sony's trying to suggest that their customers develop their tastes in music.

I wonder if their classical music label had the same problems ;)

Revolt

[PacketScan]

I see a MASSIVE revolt coming againts the RIAA and there conspiraters. They are Hap hazardly deploying drm and they can't even fix the problems they create.. DRM should be banned as it's turning our nations computers into a tool the enemy can easily exploit and use againts us..
This is a National security issue now!

Curious...

[GmAz]

By recalling the CDs and sending out new ones without the DRM, does this remove the DRM from the machine or just leave it there. Or does the new CD remove the DRM when you play it? Same for the Sony Rootkit. By recalling the CDs, it sounds like they stopped the spread but didn't remove the auctual DRM software. If this has been answered before, I am sorry.

Yes, mainstream media are not much good...

[Anonymous Coward]

Get the word out yourself, rather than relying on some large, corporate newspaper to television news program to do it for you.

(I'm the GP poster) I certainly don't expect mainstream media to inform and educate the public on such matters. However, I expect Sony be sued for hefty amounts.

I am involved with EFN, a Norwegian sister organisation of the EFF. When big businesses pull stunts like this, the EFNs get more ammunition to discredit DRM in general. Some politicians actually get really annoyed by this kind of audacity shown by large companies. Then their IT advisor tells them that with Windows Vista, this audacious behaviour will be a"feature" in every PC, and protected under the New and Improved Copyright legislation. All of a sudden, they are less keen on ratifying that law proposal. Delays ensue, and ammendments are made...

Fight fire with fire...

[dada21]

Paraphrasing and modifying the previous article:

According to a Slashdot user, the Music Listeners' Association is stepping up to launch the next phase in the consumer industry's battle against government-protected music. The MLA is demanding jail time for the maintainers of CDs offering undocumented rootkits and worms. The MLA President has stated that refusing CDs and imposing boycotts is not enough, stating that by 'throw [ing]in some jail time I think we'll be a little more effective' in its crusade."

Re:Fight fire with fire...

[Lucky_Norseman]

That actually sounds like a very good idea.

An organisation like that might be just what is needed to get some more balance into the system.

Re:Oh no! Don't write about us on your blog!

[saskboy]

Excuse me? The AC's sarcasm was that blogs have some effect, implying they don't. I was demonstrating that they DO, because the in case of mine, I know it's influenced the course of events here because Glyn Hotz on my province's news radio station thanks in part to my emailing them, is evidence of that.

So let me get this right...

[Anonymous Coward]

x installed rootkit
x virus was written to use rootkit
x lied about it sending info
x licensing was illegal
x contained stolen copyrighted code
x created patch that contained vulnerability
x patch collected info from machine

x another drm contained vulnerability
x created patch with vulnerability

9 strikes. Did I leave anything out?

Re:So let me get this right...

[colinmc151]

Anonymous Coward on Friday December 09, @11:50AM (#14220562)
x installed rootkit
x virus was written to use rootkit
x lied about it sending info
x licensing was illegal
x contained stolen copyrighted code
x created patch that contained vulnerability
x patch collected info from machine
x another drm contained vulnerability
x created patch with vulnerability
9 strikes. Did I leave anything out?

Regretably, yes

x patent infringement

So up to 10 strikes ... I have normally loved Sony hardware, back from the days when I had two Beta VCRs, but this stunt has been unforgivable...

Re:So let me get this right...

[Anonymous Coward]

What exactly was the patent infringement? I guess I missed that one..
Oh, and I thought of one more - trying to remove the rootkit caused the cd/dvd drives to stop working and/or a BSOD.
so that brings us to 11. daaaang.

Re:Bitten by the patch? Lyrics

[saskboy]

More importantly though, what DRM are these lyrics protected by, or did you release it under Creative Commons?

Re:Web 2.0

[Anonymous Coward]

that whooshing sound was the joke going right over your head.

Re:Oh no! Don't write about us on your blog!

[BVis]

I was referring to the sarcasm of the AC impersonating a Sony exec.

they already do charge the artists!

[feepcreature]

Isn't there still the 10% or so deduction from sales, before royalties are calculated, for breakages? A legacy from the days of shellac and vinyl, I believe. They could use that... (see http://www.scoremusicmagazine.com/scorerocks/bborg 3.html) Or they could slap on another charge, and make even more money.

Once again, no forced recalls...

[WolfZombie]

They can force a recall on Rockstar's Grand Theft Auto - San Andreas because of a nudity code, even though it is a mature rated game and causes no security risk. Yet they won't force a recall on Sony for potential security risks created by software on their cds. Maybe if Sony pissed off and shocked the Christian population like Rockstar did, they will have some reprocussions.

The whole music industry is just pissing me off now a days. Everyone in it wants to make a bazillion dollars and are willing to step on anyone they can to do it.

It was a PhD student, no less

[norminator]

Remember, this is the same company that tried suing someone for putting on their web site "Hold the shift key down while inserting a copy protected CD to prevent the DRM software from being installed."

And don't forget, it wasn't just some random guy that got sued, it was a Princeton PhD student who was doing research based on this. They didn't start to backpedal until they realized how bad it looks to sue someone doing academic research, especially when the "shift key" conclusion is such an obvious hole in their product.

What jerks. Of course they and Sony feel free to sue people who do things that hurt them, but carry on selling products that are secretly damaging their own users' computers, then releasing patches that damage them more. Here's a case where I'd love to see what goes around comes around, but I'm guessing they won't be hurt too badly by it... unfortunately.

Be a software pirate....

[caffeinatedOnline]

just hold down the shift key!!

.05 per cd then

[Anonymous Coward]

jeez, split some hairs already. Sony isn't going to lose 15$ per cd OK?

Re:Oh no! Don't write about us on your blog!

[saskboy]

I didn't know what took priority, the sarcasm as a Sony exec, or the Sarcasm-point itself. We may never know as the author remained hidden and won't likely return to explain what they meant.

Re:Web 2.0

[ValuJet]

lol. if I had modpoints I'd mod you up funny.

Judge, I bought the CDs

[WhiteWolf666]

But instead of putting them in the computer, I downloaded the songs from limewire.

I've heard too much about vulnerabilities and the like regarding these CDs. I bought the CDs, left them in the wrapper, and downloaded the music online. What's wrong with that?

Recall Sony MediaMax CDs

[wehup]

Sony needs to recall every last one of the Mediamax CDs and do a better job on the recall than they did on XCP. XCP CDs were still being sold at my local Walmart this week. They were supposedly recalled a month ago.

Upgrades

[16K Ram Pack]

There's also the question of upgrades. Now, there is no upgrade. Where CD gave a difference in quality, there's nothing to add to it now. The last thing would have been to have made it smaller, but that's been solved by the iPod.

People will upgrade if they perceive something better. And for most people, CD is good enough, and it always will be.

Re:Upgrades

[99BottlesOfBeerInMyF]

People will upgrade if they perceive something better. And for most people, CD is good enough, and it always will be.

Missing features: lyrics, accompanying video, available anywhere there is a network, more channels of sound, artist commentary, extra unreleased, songs... need I go on?

Re:Upgrades

[16K Ram Pack]

For most people, 2 channels is plenty. Especially as a lot of music is in-car and on headphones. There are multi-channel formats (some DVDs of operas use various surround options). It's limited in how many people want it.

Videos, commentary, unreleased songs can easily be done with enhanced CD.

Re:Upgrades

[99BottlesOfBeerInMyF]

Videos, commentary, unreleased songs can easily be done with enhanced CD.

It's not about what can be done with the existing format, its about what is not there now, but can be added to a new format to entice people to move to that format. You can add deleted scenes and extra commentary to the end of a VCR (and a small portion of them had that) but it was used to convince people to buy a DVD version of a movie they already owned. If nothing else there is always the fact that CDs become scratched and die and these companies have particular content locked down, so they can just refuse to release anything in the old format, once they get a good number of people to switch. People have said the current format was all they would ever need for every format; records, reel-to-reel, 8-track, and cassette before getting to CDs. They were wrong then and you're wrong now.

Re:Upgrades

[16K Ram Pack]

They were wrong then and you're wrong now.

Let's forget what people did in the past and focus on WHY I believe it's reached it's peak.

In every one of those cases, they were superceded by something that offered something more to people. Reel-to-reel was never a format for sold music. 8-track gave people convenience over records (they could play them in cars). Compact cassette shrunk things further. CD gave people higher quality, and didn't have the problems of records.

My point is that we have reached a stage where the sound quality is good enough for people, and size of format is irrelevant. Sound quality is good enough because attempts to create a more advanced format have gone nowhere. Other than audiophile shops, you'll struggle to find DVD-A and SACD, and that's not because they've just come out - no-one wants them.

If the music companies were so powerful at replacing consumers options, they'd have tried to bring in the better protected SACD and stop producing CDs. As for size, that's irrelevant.

Make it the size of a postage stamp - it doesn't matter because where size matters - portable music - it is all going iPod, which can just be transferred.

Re:Oh no! Don't write about us on your blog!

[Braino420]

I am interested in joining your newsletter

Actual settlement: $10MM for lawyers, $0 for us.

[Anonymous Coward]

Class action lawsuit, yeah, that'll show em.

The lawyers will end up with a bag of cash, and the consumers will get a "buy 3 Neil Diamond CD's, get one Free!!!" coupon - IF - they spend the time to fill out pages and pages of forms. And even better - they lose the right to sue unless they fill out pages and pages of forms.

End result - Lawyers happy, Sony happy, consumers get the shaft.

Damn

[JebusIsLord]

I DO have one of those discs too... thought i was immune due to taste, but Black Rebel Motorcycle Club hauls ass!

There's got to be something wrong with the world..

[PhotoBoy]

... when buying legitimate "CDs" from shops is more likely to get your machine 0wned than just downloading MP3s from Kazaa...

Re:Web 2.0

[Scarblac]

Please don't use the word 'leverage' again unless you can estimate a value in newton metres. It makes you sound like a PHB.

A bit like "Web 2.0", "enabled", "Podcast", "advent"... but unlike terms like "AJAX" and "Ruby on Rails", which make you look like a web programmer buying into the hype of the day.

The sibling is right, it was probably meant as a joke.

Sony destroyed our trust in the brand! Avoid Sony

[Anonymous Coward]

I agree that the only reasonable action i\is to buy nothing from Sony for the next 6 months or 1 year. The old Sony was a Japanese company. The philosophy in Japan is that
"The Customer is King". Having worked on a large project which sold to a major Japanese company I can tell you that this is no joke. As the supplier we had to perform miracles to meet the very high standards required. We did it! It is the high expectations that Japanese companies had that made Japanese such good
products. The provided the customer with excellent value for money - you got more than you paid for! However the current Sony messup is due IMHO to a US management view that you can lie to the customer and treat him/her as a sucker to be duped of his money.

The Sony brand was expensive - because you knew you could trust it! Now that trust has been destroyed. The PC is your electronic home - a virus is a
an electronic house invasion. Unfortunately Sony is now one who damages
the locks on your house and make it unlivable and leaves it open to attack!

The internet allows the customer to be king. Companies learn by experience.
You can tell Sony you notice by not buying any Sony product. Sony do not yet realise what a disaster they have on their hands. Only when their sales drop
will you the consumer have their attention. Yes I think that the PS3 sales may also be effected by their stupidity. Microsoft may benifit

The simple message is that Sony is not to trusted. Even it they say that they
will fix it - they have demonstrated that they don't have the ability to
know it they have created a good fix or not. The reason for a price difference between brands is that the customer trusts that the product will work and do not harm.

Sony blew it. Until they they change the upper management and replace them with Japanese who understand that the Customer is King I see no reason to trust them.

Mr Sony built a fine company - but he is dead and values have been lost.

Samsung is now the brand to watch. They, a Koren company, have in the last 10 years produced better and better products.

Perhaps it would be good to look for the smaller companies that are producing
great new products. The internet could let the best grow very fast.
This would be good for society.

How about it? Post the great products you buy from little firms.

"Remote Attestation" and content access monopolies

[NZheretic]

Don't just go after Sony. The REAL THREAT comes from the operating vendors themselves.

ALL third party and more importantly operating system based DRM puts the user at greater risk. If the DRM code itself is not exploited then there are always new vulnerabilities being discovered in the media players and browsers used to play and display encoded content.

August 02, 2005 "Remote Attestation" and content access monopolies

Remote Attestation" and content access monopolies

The Trusted Platform Module provides the hardware functionality for digital rights software to provide effective remote attestation and digital key withholding.

Both Microsoft and Apple have plans for media-digital-content-viewers that, at the request of a digital content provider, will not allow the user to view or access specific digital content if the operating system has been modified in certain ways.

Because, for the foreseeable future, it is impossible for the digital rights management software to detect if an individual modification to a particular subsystem is hostile to the goals of the demanded digital rights, all software and subsystems relating to the operating system with storage and input to display will have to be digitally signed by Microsoft or Apple before it can be accepted by the DRM subsystem. Microsoft and Apple are effectively locking the user out from changing parts of the operating environment.

Because it is possible for hackers to read digital keys used to encrypt content direct from the computer's memory, the operating system has to be built with the ability to lock the user from being able to access pages of memory used by the mediaplayer and digital rights management system.

OS based Digital Right Management systems are based on the principle of locking the owner of the computer out of the ability to access sections of memory and disk space used by the DRM mediaplayer systems.

Locking the owner out of parts of the computer has become a major security issue.

Microsoft's Mediaplayer, Active-X ( still used with some DRM ), Real's realplayer, Adobe's PDF viewers, Apple's Quicktime and even Microsoft's and Sun's Java JVMs, have in the past had remotely exploitable vulnerabilities.

OS based DRM combined with TPM based encryption along with enviable future vulnerability holes in media access offers the malware/virus/worm creator the ability to hide a virus from any antivirus tool or live forensic analysis. Existing stealth viruses already have ability to hide the modifications it has made to files, going undetected by antivirus programs. DRM encryption offers the ability for the malware to store content, and without the keys to decode the content, keep it hidden from any forensic analysis.

Crackers and hackers always find ways to exploit the code to access or share protected content. There is not a DRM system that has not been cracked within months of widespread release. The focus on the code use d in such systems also comes to the attention of malware/virus creators. The same holes discovered by those who just want to freely access content may possibly also be abused by those wanting to crack into your computer. Similar holes in other types media viewers, the webbrowser and email programs, are increasingly being used for criminal gain by phishers and spyware makers.

Some vendors reportedly have in the past purposely left backdoors in the source code to allow access by US intelligence agencies. This has not only become a major issue for other countries who fear spying, since discovered backdoors quickly become the criminal's frontdoor i

Rebels... heh

[Anonymous Coward]

Gotta love that a band called "Black Rebel Motorcycle Club" is selling their music on DRM protected discs via a major record label like Sony. Yeah, that's rebellion for you! Way to stick it to the man...

Shopping season

[msbsod]

It is shopping season, and I bought a VCR/DVD combo. When I checked the list of available products on the market the first thing I did is to remove all Sony products from the list. Big company can do whatever they want because people buy their products. The customers' money is also used to lobby against the interests of customers. And the customers' money will be used to fight off all legal implications because of the Sony rootkit debacle. Personally I will never again spend a cent for any Sony product. IMHO this is the only way to deal with DRM, rootkits, spyware...

My views on Sony

[MaTriXxx1]

Im pissed at Sony, not just the music department... Granted they are seperate entities, but they all stem from Sony... so when 1 department screws up, they are all affected. the reverse is true isnt it? example 'JohnDFoes Television' department makes a GREAT TV, consumers notice, and are more likely to buy from 'JohnDFoes Audio' department. Now, onto the rant. Sony didnt just screw up, they had sheer arrogance in the whole matter, and still does. They believe that because you buy a cd, they own any equipment that cd can be used in. Thats bull. When I buy a cd, im buying 30 to 60 minutes worth of audio entertainment, that can be re-enjoyed anytime anywhere. Im not buying something to listen to on my cd player, which i can then buy to listen to on my computer, and then buy another copy to play at work, and another copy for the car. Further, CD's are horrible at reliability. I dont think I own a single cd (out of hundreds) that is still 100% perfect and scratch free. When you buy a cd, you should have the right to digitally store it, wether on your ipod or computer, cause that cd wont last. I have atleast 30 gigs of mp3's all ripped from cds I own, so that I can put them in a big playlist at work, If i bought Sony cds, I couldnt play them in winamp, nor my cars mp3 player. Also, Sony has further pushed the issue by punishing their paying customers. think about it, you buy a cd, you cant transfer it to an ipod, or a myriad of other portable mp3 players. But if you 'steal' that cd from www.thepiratebay.com your music can be transfered to anything you want, and you can digitally store it for use anytime you want. So think about that... Pay for an inferior product (legally)that will likely destroy your computer, or get a superior product for free (illegally).... the choice is ours. My reason for not pirating songs, is the time involved downloading, dont get me wrong... my friends send me songs occasionally, but if i like that song, and its not produced by sony, i will go buy the cd, if it is from sony, I will email the band stating that I would like to buy music from them, but not through sony. woah long rant... last thing i swear.... 20 dollars for an 8 cent cd???? who is the criminal in that one?

Missing option?

[lasindi]

The publishers are just middlemen (middle-management?) scrambling to keep their distribution means relevant: cut them out like a cancer.

a) Freely download
b) Buy what you like (second hand if possible)
c) Pay to see the artists live

Instead of undermining copyright law by choosing (a), you might want to try the alternative you left out:

d) Ignore them

I'm there, too, man

[swschrad]

you know, their clock radios don't even have backup batteries on the clocks! I'm politely but firmly telling folks who ask that Sony has a lot to prove all of a sudden, besides mostly me-too products, and they're off my list until they reanimate all the dead behind them.

Exactly...

[Cl1mh4224rd]

Why do the keep emphasizing, "making illegal copies" when it is not illegal?

Isn't it obvious? They can't tell the difference between legal and illegal activities.

1) They literally have no way of knowing if you're making a backup copy, making a copy for your friend, or your friend is making a copy of your CD for himself. How can they can say this sort of crap is meant to stop "illegal copies", when they have no fucking clue if the copy being made is actually illegal?

2) Their actions in attempting to prevent copying (period) have shown that they don't have even a tenuous grasp on what is legal or illegal.

In my mind, Sony BMG has lost all credibility when speaking on legality.

Re:Oh no! Don't write about us on your blog!

[Anonymous Coward]

don't be so sure, saskboy. i was saying that a single person's blog does not make a different. hell cmdrtaco started this blogsite (if you don't think slashdot isn't taco's unilateral wet blogdream, then you need to hang yourself now) and look at all the comments that people post (sometimes making valid points) that gets ignored. why? because our voice doesn't matter anymore. the american population is a vast void of propoganda.

hell, why isn't there a widely-known boycott against sony? i'm pretty sure, the american population would have done this back in the 70s. why isn't there a LARGE pickett protest happening outside of every Sony office? why hasn't every person that bought a DRM'd cd sued sony (i personally am pissed that I don't own one of these cds, or I'd be suing sony to the tune of a few thousand dollars to get my computer 'fixed').

seriously, america sucks and its getting worse.. which is so evident from this case. if you think your single blog changes anything, you're damn wrong.. look out your window.

Re:Oh no! Don't write about us on your blog!

[saskboy]

I might not be able to change society, especially with my current limited readership, but I can affect individuals. And saving a dozen people from buying Sony crap is better than doing nothing and whining about it later. I've also influenced mass media in SK to publicize the Sony Boycott, so it's not like it can't be done. In the range of "influencial bloggers" in SK, I'm hardly in the top 100 as far as I know.

Re:Oh no! Don't write about us on your blog!

[saskboy]

I'm not sure if you're being sarcastic, trying to reference the "I'd like to subscribe to your newsletter" Homer/Bart clip or not :-)

If you're serious, I have my blog linked as my home page, and for now you just have to old-fashoned bookmark it but it will have an RSS feed eventually.

reset the counter to zero...

[Hosiah]

You know those signs in the office that say "We have gone [x] days without a work-related injury"? I have one on my wall that says "[x] number of days sunce a Sony-related screw-up hit the news". Anybody have a javascript version of that for our blogs? Some RSS-witchcraft that cranks automatically?

Stop living in such a sheltered world.

[CyricZ]

Do you know how many people it will take to actually affect Sony's bottom line? Far, far more people than currently know about this whole debacle.

Please stop living in such a sheltered world. Just because most people at Slashdot are aware of the situation does not mean that everyone else is. And almost everyone else will continue to buy Sony products, even if a few hundred people who visit this site do not.