I imagine it is quite rare. However, what is not rare at all and is actually pretty common is that people just type in the name of the organisation (and also quite often the entire url) into a Google search. Now, maybe those people would change their habits if they couldn't find the site they typed in, but maybe they'll just choose a "close enough" result from the results that were returned. I certainly wouldn't want to be the guy responsible for potentially not only killing a lot of traffic to my company's site, but maybe even directing said traffic to my company's immediate competitors...
The problem with that is that these companies know mud sticks. If the report says they were hacked, then no amount of them saying they fixed the holes and are now more secure than ever will completely remove that taint. Not only that, if these companies cared so much about security in the first place there wouldn't be holes, the main problem is that security is often sacrificed in the name of economy, so they're unlikely to want to shell out money fixing holes if they can just carry on ignoring them for free. Unfortunately that's why a lot of sites are insecure, because it's the cheaper option to turn a blind eye and hope that you won't get hit - for the most part it works I guess.
The simple way to police this is as you've hinted at by suggesting that the number of returns are limited. Instead of doing that, you just monitor how much people are returning and if you suspect they are attempting to defraud you, you report them to the authorities who can take the appropriate action - i.e. investigate the devices those people are using to see if they really did delete the music files.
There is absolutely no reason for anything more than that for a company to protect itself. It's like an insurance company, they pretty much take most of what their customers tell them on trust, but if a customer flags as suspicious (too many claims in too short a time, or claiming for something particularly expensive that is more than likely a fabrication) they can report them and the customer is investigated. If you think about it, music stores have even less to lose from this "trust" approach, since they are dealing in items which are pretty inexpensive and they don't physically lose anything even if someone does abuse the system.
We're constantly being told that we're not buying the data, we're buying the right to listen to the track, so what you would be "returning" is this same license. You would do this implicitly by agreeing not to listen to the track once you have "returned" (or revoked) your license and received your refund.
A digital download is never faulty. If you want to claim that you never listened to the song, how can the company tell, and how can they ensure that the file is deleted after you return it?
Well how about they just don't assume that their customers are criminals? That might be a good starting point. After all, it's hardly difficult to find "illegal" content online for free, so why go to the trouble of signing up for a paid-for service, paying for a track then ripping it and going through the procedure to get a refund just to get a free track?
It's more likely that the pirates will continue to find their free content and the majority of people asking for a refund have a legitimate reason for doing so. Even so, it's not like they can't monitor abusers easily enough. If someone asks for one or two refunds in a year then they're probably not pulling a fast one (and even if they are, it's costing you next to nothing so who cares). If they're asking for a few hundred refunds a year then you can probably assume they're not entirely on the level - feel free to investigate further.
That brings me to another point, if people did abuse this to rip off music, they'd have to be pretty dumb since they're leaving a much more damning digital paper-trail behind than someone who anonymously uses a p2p site, so if anything this would make it easier to identify and weed out the less honest downloaders. Instead, not offering this service and saying it's because people will abuse it unecessarily criminalises your entire customer base, which is in nobody's best interests...
I don't know what the situation is like in the US, but over here in the UK there is chocie even amongst the huge supermarket chains. If all the little local stores closed overnight, Tesco, Asda, Morrisons, M&S, Sainsbury's etc would still all have to compete with each other. You would only find yourself in a monopoly position if there was no competition at all, is WM really your only big supply chain over there? I know here Tesco are a lot bigger than their nearest rivals, but they still have to compete on prices or they know their customer base would switch in a second.
What they should do is disappear. Neither artists or consumers need them and, in fact, they're hampering the business of the artist getting his/her music out to his/her fans. Their parasitic business model has no place in the digital era. What we need to do is convince more artists and consumers that they don't need the record labels - the internet has cut out the middle man in so many other areas and it's primed to cut them out here, too. The only thing that's keeping them around is the fact that they currently have money and therefore influence with politicians and starry-eyed newcomer artists.
You make several excellent points and I wish that all musicians saw the situation with such clarity. It's never been easier for an artist to make it without the support of the "recording industry", unfortunately too many artists seem so easily swayed by the (often false) promises of fame and wealth that record labels make.
With new chart rules on downloads, artists in the UK don't even need to sell a single physical CD to have their songs chart and the unsigned band Koopa made chart history by doing just this. I had kinda hoped this would herald a new and glorious age in which musicians threw off the shackles of the record labels and we all enjoyed an era of sharing music and seeing artists properly rewarded for their work. Unfortunately the first thing they did on making chart history was to state that they'd had several record labels approach them with offers and they were seriously considering them. The first band to crack the charts without a label and the first thing they do is consider offers from the same vultures who didn't want to know them weeks before, I could weep. I don't know how this panned out in the end, but what we need is more artists to say, "No thanks Mr Record Label, I don't need you any more".
That doesn't seem to be the case at all - at least in music stores here in the UK. Initial releases are priced around £13-15, after a couple of months they will usually drop to maybe £10-12 (I assume so they can squeeze as much revenue as possible out of the initial release by offering "super-whizzy discount prices"). After that the prices are generally ramped up to anywhere from £15-18, sometimes even higher. The stores then seem to periodically cycle through these older titles and offer them at reasonably discounted prices but these seem like loss leaders to get people through the doors rather than the normal price, so buying music this way is very hit and miss.
With CDs being a digital storage medium and digital downloads being purely digital, I would say that CDs are in the tech sector. Production and distribution costs have also seen massive tech-led price drops (to practically zero in the case of downloads). Hell, an artist these days can record a massively successful album using cheap, reliable digital equipment from his own bedroom. The inflation argument only works if the product is not massively over-priced to begin with and if the product hasn't seen massive cost reductions since it's launch, neither hold true for the music business.
I also saw an Open University late night/early morning show where some scientist in brown tweed drilled a hole through a CD and then proceeded to play it without any detriment. So it never fails to amuse me when the minutest scratch causes my CDs to either take up residence in Skipsville or just outright refuse to co-operate on the playing front. And by amuse, I of course mean enrage.
You are right, of course, that they are just trying to make us all shut up and be happy with what we've got. Unfortunately for them, as someone already pointed out:
1) there are plenty of us who were around and remember the initially massively over-priced CD and promises of huge price drops once the technology took hold, and
2) pretty much everyone of any age already knows that CDs are a lot more expensive than they should be, not a lot less.
This is yet more panic-induced, ill-conceived **AA FUD, when will these people learn how to die with dignity?
I couldn't agree more - the X5 is an awesome little player, handles a ton of file formats (including WAV and FLAC) and best of all, you can add files to it just by drag and drop - it appears just as an external hard drive, you copy over your folders and you're ready to go, no messing about with proprietary software to upload and organise. It also supports playlists, so if you have all these created already for winamp or whatever, you can just copy them over too and they'll work, or you can create a playlist from the actual player. It also has all the other requisite bells and whistles you'd want on a player these days - file storage, movie player, image viewer, radio receive (and record), dictaphone, text file reader, etc. Maybe not the prettiest player around, but it's certainly not the ugliest either.
Maybe they have different contracts? It's not inconceivable that the behemoth that is MS managed to leverage themselves a better deal to facilitate licensing - especially if it was something Apple didn't push too strenuously for at the time.
What the trial should address is not what they looked like, but what was the intent behind planting them. If the intent was to create a bomb scare then they are guilty of planting hoax bombs. Since a major advertising company was involved in this (rather than just some college prank) it's going to be hard to argue that they did intend such a scare, since they would be well aware of the legal ramifications. There's also probably a paper trail tied to the campaign which will show it was just meant to raise the profile of their show, not make people think they were under attack.
No, the astonishing thing is that, even after the cops blew the thing apart with water (revealing a total lack of explosive components), they continued to tell the media that it was a suspicious device and that there were more suspicious devices located in key areas of the city. That's where someone really screwed up big time.
You're not thinking quite laterally enough! What if the terrormen made the first one (or handful) of the devices perfectly innocent and then called them in themselves so that authorities would declare them safe, only for the rest of them to be stuffed full of plutoranium gas. The only way to deal with that level of cunning is for everyone to be permanently terrified of everything. For ever. I'm going to go hide in a bunker, now.
Acquitted for "terrorism" or "intent to cause panic", yes. However, what they did is akin to placing graffiti around the city and they *should* be charged and held accountable for such.
Isn't graffiti more accurately markings which are physically painted or sketched onto another surface, whereas I was under the impression that they just left these cases lying around? It sounds more like a serious case of littering - they should throw the book at these low-lifes...
That's all well and good so long as the security measures don't impact on you doing your job. When you have to jump through multiple hoops and be made to feel like a criminal just for wanting to do your job efficiently, it's not so much fun. A loyal employee who has only ever done his best for an employer has every right to feel resentment when such security measures are making his job more and more difficult every day. Treat people well and they generally react well - treat them badly and this generally impacts on their morale and, ergo, their work. The bad apples will still find a way to buck the system no matter how hard you try to stop them, so why risk angering 99.9% of your employees to try and minimise (not completely remove because that'll never happen) the risk of 0.1% going rogue.
And if you treat your employees like criminals they're more likely to act like criminals. There is a fine line to be trodden, here. A company will never be able to completely lock down their systems against a truly determined inside attack, but what they can do easily is crush morale to such a level that more people are willing to risk such an attack if it means a way out.
That's reasonably useful for keyloggers, but if a user was tricked into installing a logger it could just as easily be a screen logger as well - all it has to do is kick off when the user visits a bank url and record the next 30-60 seconds of screen activity.
For the more traditional phishing attack, where a user is tricked into entering details on a fake site, it's pretty much useless - since the phishers will just record what icons are clicked and use these to log onto the real bank site.
Not to mention they're completely inaccessible to the blind/partially sighted - but I guess this system of showing the user an image is no use to these people anyway - I wonder how/if they get around that?
However, if you then add an extra layer of security to the standard padlock that substantially alters the way it works compared to all other padlocks, and you fail to properly educate the padlock consumer about how this new feature works, then arguably you are at fault. I know more than anyone that end users can be dumb when it comes to technology - especially new technology - but we all know this already, so implementing new technology then saying "well, it would have worked if the users didn't mess up" is inherently irresponsible. We should be focusing on solutions that the users can't screw up.
I'm not really sure how this system works having not seen it in action, but about they make you click on the token image when you log in, would that work? People generally go into auto-pilot during these processes, but if they're used to always clicking on an image and suddenly the image isn't there or has changed, they might pay more attention.
Slashdot Mirror
I imagine it is quite rare. However, what is not rare at all and is actually pretty common is that people just type in the name of the organisation (and also quite often the entire url) into a Google search. Now, maybe those people would change their habits if they couldn't find the site they typed in, but maybe they'll just choose a "close enough" result from the results that were returned. I certainly wouldn't want to be the guy responsible for potentially not only killing a lot of traffic to my company's site, but maybe even directing said traffic to my company's immediate competitors...
The problem with that is that these companies know mud sticks. If the report says they were hacked, then no amount of them saying they fixed the holes and are now more secure than ever will completely remove that taint. Not only that, if these companies cared so much about security in the first place there wouldn't be holes, the main problem is that security is often sacrificed in the name of economy, so they're unlikely to want to shell out money fixing holes if they can just carry on ignoring them for free. Unfortunately that's why a lot of sites are insecure, because it's the cheaper option to turn a blind eye and hope that you won't get hit - for the most part it works I guess.
The simple way to police this is as you've hinted at by suggesting that the number of returns are limited. Instead of doing that, you just monitor how much people are returning and if you suspect they are attempting to defraud you, you report them to the authorities who can take the appropriate action - i.e. investigate the devices those people are using to see if they really did delete the music files.
There is absolutely no reason for anything more than that for a company to protect itself. It's like an insurance company, they pretty much take most of what their customers tell them on trust, but if a customer flags as suspicious (too many claims in too short a time, or claiming for something particularly expensive that is more than likely a fabrication) they can report them and the customer is investigated. If you think about it, music stores have even less to lose from this "trust" approach, since they are dealing in items which are pretty inexpensive and they don't physically lose anything even if someone does abuse the system.
We're constantly being told that we're not buying the data, we're buying the right to listen to the track, so what you would be "returning" is this same license. You would do this implicitly by agreeing not to listen to the track once you have "returned" (or revoked) your license and received your refund.
A digital download is never faulty. If you want to claim that you never listened to the song, how can the company tell, and how can they ensure that the file is deleted after you return it?
Well how about they just don't assume that their customers are criminals? That might be a good starting point. After all, it's hardly difficult to find "illegal" content online for free, so why go to the trouble of signing up for a paid-for service, paying for a track then ripping it and going through the procedure to get a refund just to get a free track?
It's more likely that the pirates will continue to find their free content and the majority of people asking for a refund have a legitimate reason for doing so. Even so, it's not like they can't monitor abusers easily enough. If someone asks for one or two refunds in a year then they're probably not pulling a fast one (and even if they are, it's costing you next to nothing so who cares). If they're asking for a few hundred refunds a year then you can probably assume they're not entirely on the level - feel free to investigate further.
That brings me to another point, if people did abuse this to rip off music, they'd have to be pretty dumb since they're leaving a much more damning digital paper-trail behind than someone who anonymously uses a p2p site, so if anything this would make it easier to identify and weed out the less honest downloaders. Instead, not offering this service and saying it's because people will abuse it unecessarily criminalises your entire customer base, which is in nobody's best interests...
I don't know what the situation is like in the US, but over here in the UK there is chocie even amongst the huge supermarket chains. If all the little local stores closed overnight, Tesco, Asda, Morrisons, M&S, Sainsbury's etc would still all have to compete with each other. You would only find yourself in a monopoly position if there was no competition at all, is WM really your only big supply chain over there? I know here Tesco are a lot bigger than their nearest rivals, but they still have to compete on prices or they know their customer base would switch in a second.
He was probably thinking about this one.
What they should do is disappear. Neither artists or consumers need them and, in fact, they're hampering the business of the artist getting his/her music out to his/her fans. Their parasitic business model has no place in the digital era. What we need to do is convince more artists and consumers that they don't need the record labels - the internet has cut out the middle man in so many other areas and it's primed to cut them out here, too. The only thing that's keeping them around is the fact that they currently have money and therefore influence with politicians and starry-eyed newcomer artists.
You make several excellent points and I wish that all musicians saw the situation with such clarity. It's never been easier for an artist to make it without the support of the "recording industry", unfortunately too many artists seem so easily swayed by the (often false) promises of fame and wealth that record labels make.
With new chart rules on downloads, artists in the UK don't even need to sell a single physical CD to have their songs chart and the unsigned band Koopa made chart history by doing just this. I had kinda hoped this would herald a new and glorious age in which musicians threw off the shackles of the record labels and we all enjoyed an era of sharing music and seeing artists properly rewarded for their work. Unfortunately the first thing they did on making chart history was to state that they'd had several record labels approach them with offers and they were seriously considering them. The first band to crack the charts without a label and the first thing they do is consider offers from the same vultures who didn't want to know them weeks before, I could weep. I don't know how this panned out in the end, but what we need is more artists to say, "No thanks Mr Record Label, I don't need you any more".
That doesn't seem to be the case at all - at least in music stores here in the UK. Initial releases are priced around £13-15, after a couple of months they will usually drop to maybe £10-12 (I assume so they can squeeze as much revenue as possible out of the initial release by offering "super-whizzy discount prices"). After that the prices are generally ramped up to anywhere from £15-18, sometimes even higher. The stores then seem to periodically cycle through these older titles and offer them at reasonably discounted prices but these seem like loss leaders to get people through the doors rather than the normal price, so buying music this way is very hit and miss.
With CDs being a digital storage medium and digital downloads being purely digital, I would say that CDs are in the tech sector. Production and distribution costs have also seen massive tech-led price drops (to practically zero in the case of downloads). Hell, an artist these days can record a massively successful album using cheap, reliable digital equipment from his own bedroom. The inflation argument only works if the product is not massively over-priced to begin with and if the product hasn't seen massive cost reductions since it's launch, neither hold true for the music business.
I also saw an Open University late night/early morning show where some scientist in brown tweed drilled a hole through a CD and then proceeded to play it without any detriment. So it never fails to amuse me when the minutest scratch causes my CDs to either take up residence in Skipsville or just outright refuse to co-operate on the playing front. And by amuse, I of course mean enrage.
You are right, of course, that they are just trying to make us all shut up and be happy with what we've got. Unfortunately for them, as someone already pointed out:
1) there are plenty of us who were around and remember the initially massively over-priced CD and promises of huge price drops once the technology took hold, and
2) pretty much everyone of any age already knows that CDs are a lot more expensive than they should be, not a lot less.
This is yet more panic-induced, ill-conceived **AA FUD, when will these people learn how to die with dignity?
Whined to us?
I couldn't agree more - the X5 is an awesome little player, handles a ton of file formats (including WAV and FLAC) and best of all, you can add files to it just by drag and drop - it appears just as an external hard drive, you copy over your folders and you're ready to go, no messing about with proprietary software to upload and organise. It also supports playlists, so if you have all these created already for winamp or whatever, you can just copy them over too and they'll work, or you can create a playlist from the actual player. It also has all the other requisite bells and whistles you'd want on a player these days - file storage, movie player, image viewer, radio receive (and record), dictaphone, text file reader, etc. Maybe not the prettiest player around, but it's certainly not the ugliest either.
Maybe they have different contracts? It's not inconceivable that the behemoth that is MS managed to leverage themselves a better deal to facilitate licensing - especially if it was something Apple didn't push too strenuously for at the time.
What the trial should address is not what they looked like, but what was the intent behind planting them. If the intent was to create a bomb scare then they are guilty of planting hoax bombs. Since a major advertising company was involved in this (rather than just some college prank) it's going to be hard to argue that they did intend such a scare, since they would be well aware of the legal ramifications. There's also probably a paper trail tied to the campaign which will show it was just meant to raise the profile of their show, not make people think they were under attack.
Students have been unsuccessfully trying that same excuse with traffic cones for years.
No, the astonishing thing is that, even after the cops blew the thing apart with water (revealing a total lack of explosive components), they continued to tell the media that it was a suspicious device and that there were more suspicious devices located in key areas of the city. That's where someone really screwed up big time.
You're not thinking quite laterally enough! What if the terrormen made the first one (or handful) of the devices perfectly innocent and then called them in themselves so that authorities would declare them safe, only for the rest of them to be stuffed full of plutoranium gas. The only way to deal with that level of cunning is for everyone to be permanently terrified of everything. For ever. I'm going to go hide in a bunker, now.
Acquitted for "terrorism" or "intent to cause panic", yes. However, what they did is akin to placing graffiti around the city and they *should* be charged and held accountable for such.
Isn't graffiti more accurately markings which are physically painted or sketched onto another surface, whereas I was under the impression that they just left these cases lying around? It sounds more like a serious case of littering - they should throw the book at these low-lifes...
That's all well and good so long as the security measures don't impact on you doing your job. When you have to jump through multiple hoops and be made to feel like a criminal just for wanting to do your job efficiently, it's not so much fun. A loyal employee who has only ever done his best for an employer has every right to feel resentment when such security measures are making his job more and more difficult every day. Treat people well and they generally react well - treat them badly and this generally impacts on their morale and, ergo, their work. The bad apples will still find a way to buck the system no matter how hard you try to stop them, so why risk angering 99.9% of your employees to try and minimise (not completely remove because that'll never happen) the risk of 0.1% going rogue.
And if you treat your employees like criminals they're more likely to act like criminals. There is a fine line to be trodden, here. A company will never be able to completely lock down their systems against a truly determined inside attack, but what they can do easily is crush morale to such a level that more people are willing to risk such an attack if it means a way out.
That's reasonably useful for keyloggers, but if a user was tricked into installing a logger it could just as easily be a screen logger as well - all it has to do is kick off when the user visits a bank url and record the next 30-60 seconds of screen activity.
For the more traditional phishing attack, where a user is tricked into entering details on a fake site, it's pretty much useless - since the phishers will just record what icons are clicked and use these to log onto the real bank site.
Not to mention they're completely inaccessible to the blind/partially sighted - but I guess this system of showing the user an image is no use to these people anyway - I wonder how/if they get around that?
However, if you then add an extra layer of security to the standard padlock that substantially alters the way it works compared to all other padlocks, and you fail to properly educate the padlock consumer about how this new feature works, then arguably you are at fault. I know more than anyone that end users can be dumb when it comes to technology - especially new technology - but we all know this already, so implementing new technology then saying "well, it would have worked if the users didn't mess up" is inherently irresponsible. We should be focusing on solutions that the users can't screw up.
I'm not really sure how this system works having not seen it in action, but about they make you click on the token image when you log in, would that work? People generally go into auto-pilot during these processes, but if they're used to always clicking on an image and suddenly the image isn't there or has changed, they might pay more attention.