Get your nerd on
Today was our holiday meeting at work, which was fine. I didn't really learn anything, but free breakfast was nice. Bonus: I had to work anyway, so instead of shelving [yuck] for two hours I got to sit in the cafe and misbehave. I think I offended fewer people this year than last year. :-)
But something our music manager mentioned has my blood pressure up. He mentioned a recall of CDs that have what he called "spyware" on them. I have been following this for like a week now, and I didn't know there was a recall.
Let's review:
Sony, the music CD company, has/had a new technology called XCP [eXtended Copyright Protection]. They didn't come up with it--a company in the UK actually wrote the software--but Sony decided to start putting it on your disks. When you insert a CD with the XCP "protection" into your computer, you will NOT be able to play the songs on your Windows Media Player or iTunes. The only player that supports the disk is the rather basic one that is actually on the CD. That means no making MP3s of your songs. Also, you cannot burn a CD through any program other than the same one on the disc that you use to play the music. This program limits you to making three copies of the disc. Ever. Those three copies aren't exact duplicates; they've been altered so that they can't be copied at all.
That's pretty evil, but there's worse. Running this music player on the CD installs some EVIL shit on your hard drive. The installed files are commonly referred to as a "root kit." They live in the core of your operating system files (the root), where your critical Windows files are. These files were designed in a way that makes them very, very difficult to even detect on your computer. The files use "cloaking" to hide themselves from you when you search for them--assuming you know they're there to begin with. You don't know any of this is being installed; there's no permission screen, no wordy legalese with the "I Accept" button we all hit anyway. These files enforce the rules about listening to and copying CDs. They're used by the program that lets you play the music.
A few people have discovered these files, using methods so complicated I can't even summarize the article I read about them because I understood so little. Basically, no normal user, and all but the most expert professionals, will ever even find these files, much less try to get rid of them. But getting rid of them actually damage your computer. [!] Should you be lucky enough to find this rootkit, disable its "cloak" so that you can manipulate its files, and find it again when you have to restart your computer, you can get yourself in hot water. There's no "uninstall" for this software. If you stumble across these files, and you can't uninstall them, you might just be tempted to delete them outright. [Here comes my favorite part] If you delete the files, you will no longer be able to use your CD drive for anything.
This has to do with a complicated structure that allows data coming off a CD to be seen by some programs before it is seen by others. If you delete the files, the computer will wait for this XCP software to check the data to make sure it isn't protected [in other words, not Sony]. If the program is missing, the data goes nowhere, and you can't use your CD drive at all. At. All. [angry yet?]
This discovery and it's recent publication on the internet has unleashed a firestorm of anger, and, because this is America, lawsuits. Users whose computers have been screwed up by their accidental deletion of their CD drive are taking Sony to small claims court. There is a national class action lawsuit, and a class action lawsuit just for Califoronia residents.
Because--and only because--of this negative publicity, Sony has decided to recall CDs with this XCP stuff. Whether or not they've been opened, every store that sells these CDs is sending them back to Sony, as are the customers who have already purchased "infected" CDs. Sony has identified about 55 titles with this software. The new Bette Midler CD? Recalled. Frank Sinatra? Recalled. Even Neal Diamond's newest CD is "infected."
Very early in the recall process, Sony had a webpage where you could run a free web program that claimed to uninstall this XCP program. Using this removed all the files except one, which could easily be exploited by harmful code hidden in an ordinary webpage to take over your computer. Sony realized this, three days after they released this uninstaller, and took it off their website. As of tonight, there is no way to safely remove XCP without endangering your ability to use your CD drive.
To say that this angers me is an understatement. This whole mess is another example of how the music industry inherently does not trust its customers. The fact that customers had to explain this technology to Sony and demand a refund shows nothing but negligence and greed. I hope this whole ordeal costs Sony tons of cash. I wish success on every one of the class action lawsuits against Sony by consumers who have had their computer damaged without their consent. If these consumers had violated the same End-User Licence Agreement [the thing with the "I Accept" button] that Sony violated, you know that Sony would come down on them like a hammer.
I hope they enjoy having the tables turned on them. I'm glad I don't really buy CDs anymore.
[I realize how long and detailed [boring?] this is now that I'm finished. Sorry if it's too nerdy to read].