candy.js spyware embedded in ebooks

[Doitsu]

IMHO, there's no reason to panic unless you use an ePub3 enabled reading app, e.g. iBooks, because .js file support is an ePub3-only feature

Shameless plug:

If you're unsure whether your reading app supports JavaScript, download this simple ePub3 test file, select the first chapter (Local storage test) and tap/click the Version button.
If nothing happens, your reader/app doesn't support JavaScript.

For a more detailed test, download the official scripting support test file: EPUBTEST 0102 - Scripting Tests.

[fjtorres]

A refresher of the enabling tech:

http://the-digital-reader.com/2013/0...-civilization/

http://ebookne.ws/19gC1mk

http://ebookne.ws/11unQ53

[fjtorres]

Originally Posted by danicca

I wonder why would publisher care if buyer read the book or not?

They need it to weed out one-hit wonders.
The bulk of their money comes from blockbuster sellers that draw in casual readers but with pbooks they have no way of telling whether people buying the book actually read it and like it enough to buy a follow-up. Whether they've found another Harry Potter or another Goldfinch.
They need it to adjust the print run and marketing commitment as well as in negotiating contract terms. (If half the copies of a million seller never get finished, the follow-up isn't very likely to sell a million. It probably won't get to half a million.)

How much it matters was exposed last month with all the whining and FUD surrounding the pay out changes at Kindle Unlimited from tradpub authors who *aren't* in KU and never have been. A lot of established tradpub authors owe big chunks of their income to books that never get read so this is something that can evolve into a wedge issue in tradpub.

This development isn't going away: there's money at stake.

[avantman42]

Originally Posted by fjtorres

Going by the above reports it sounds like Apple and Google are in on it.

The only mention of Google appears to be in their referring to it as a "Google Analytics for ebooks" service. That just appears to be a simple way of explaining what it does. I don't see any indication that it will (or won't) work with Google Play.

[Calenorn]

Sorry, folks. All my ereaders have the w-fi turned "off."

If you want my customer-use data you can damn well pay me for it.

Originally Posted by jhowell

From their Google Analytics for Ebooks page:

It seems like all the tin foil hat wearers have come out on this one. Realistically, I seriously doubt this can work that well over multiple devices. We have Android, iOS, Chrome, Windows, Mac OS X, Linux, and some proprietary OS devices on which people can read eBooks. Do you really think a single JS can figure out how to phone home from all those devices. I think this is more hype, more look at we can do, than reality. And even if they can do it, companies have been watching us watch TV and do other things for decades. Nothing to get too paranoid about. There have been website trackers for nearly as long as the internet has been around. I would be more concerned about your insurance company collecting data about you than this piddly poop stuff.

[Cinisajoy]

Fjtorres,
I have a question. I noticed you mentioned print runs. Only one problem with your theory. Most people I know that buy the hardcovers do not buy the e-book so how would knowing how far an ebook is read be any indication of how far a hardcover is read?

Also Amazon has this technology or a similar program because the reader can sync between devices.

[fjtorres]

Originally Posted by Cinisajoy

Fjtorres,
I have a question. I noticed you mentioned print runs. Only one problem with your theory. Most people I know that buy the hardcovers do not buy the e-book so how would knowing how far an ebook is read be any indication of how far a hardcover is read?

Also Amazon has this technology or a similar program because the reader can sync between devices.

eBook buyers these days aren't all that demographically different from pbook buyers. Not in the US and not in the UK.
Smaller undeveloped markets (dominated by techies and hobbyists) yes but not in those two.

So, what applies to ebooks can be taken as a proxy for the larger market.
The biggest difference is going to be in pbook gifting where people buy trendy books as a gift (usually in the holiday season) but that practice is declining and being replaced by gift cards.

And yes, amazon (and Kobo) track reader behavior.
But they don't pass it on.
They use it for the reader's benefit.

Even in KU, where authors are now paid by rental pages read, they only report the gross total of read pages. Reader data is not a product Amazon sells.

This is.

As Nate Hoffelder of the Digital Reader blog often points out, in the online world if you're not the customer you're the product.
If you're going to be both, you should do it knowingly.

So far, the candy.js script has only been deployed for product testing with full user consent. I have no problem with that. Live and let die and all that.

My interest is knowing which platforms the tech works on because technology is ethically neutral. The same tech that is openly used for product testing can be used for less ethical purposes. And where money is at stake whatever can happen probably *will* happen.

Knowing how it works and where it happens helps me know if I'm being exploited or not and decide if I'll play along or walk away.

[DiapDealer]

Originally Posted by fjtorres

My interest is knowing which platforms the tech works on because technology is ethically neutral. The same tech that is openly used for product testing can be used for less ethical purposes. And where money is at stake whatever can happen probably *will* happen.

Knowing how it works and where it happens helps me know if I'm being exploited or not and decide if I'll play along or walk away.

I'd say any epub device/app that uses the Adobe RMSDK rendering engine (but doesn't use the very latest and greatest RMSDK which supports EPUB3) has very little to worry about. And I suspect that even EPUB3-capable versions of RMSDK aren't going to allow internal (inside the ebook) scripts free reign to communicate to external servers. Worst case scenario, IMO, is that a script inside an ebook might be able to save data to local storage. After that, it's going to need to rely on either 1) the user voluntarily sharing the saved data (through means entirely outside the scope of ebook rendering/managing devices and apps), or 2) the app/device manufacturer is going to need to update software/firmware to allow that local data to be transmitted. Either voluntarily through a menu interface, or silently--behind the scenes.

I don't expect Amazon to play--period. They track their own data. There's no way they're going to let 3rd-party scripts inside ebooks access the internet willy-nilly.

I frankly don't see any major device/app manufacturer allowing scripts inside ebooks the kind of autonomy that would be requried to make this sort of thing work "silently" -- that is to say without user approval and/or user interaction. There may be security holes in some EPUB3 reading systems that will let people get away with it for a short time, but the outrage generated by things like this--when they hit the news--will close those holes rather quickly.

[fjtorres]

Originally Posted by DiapDealer

I frankly don't see any major device/app manufacturer allowing scripts inside ebooks the kind of autonomy that would be requried to make this sort of thing work "silently" -- that is to say without user approval and/or user interaction. There may be security holes in some EPUB3 reading systems that will let people get away with it for a short time, but the outrage generated by things like this--when they hit the news--will close those holes rather quickly.

I wouldn't either but there is a growing trend towards app-locked ebook systems where this kind of monitoring could already be in play. It might be a revenue booster for Scribd and Oyster, for example.

And if it's not in play, it could be.
As for Adobe, I wouldn't be so sure. There was the kerflufle where ADE was scanning ebook libraries and phoning home in the clear.

Publishers want this data: phone-home wasn't added to the epub3 spec by accident. They can't get it from Amazon but others might be more cooperative come negotiation time. They'll keep trying.

[crossi]

Another reason to keep whispernet and other such web enabling fuctions permanently off beyond first registering your new device and sideloading everything. I've VERY unsocial. I don't share any data on the web I don't absolutely have to.

I hope my friend alf adds cleaning of all such addons to his helpful program.

[drofgnal]

Originally Posted by Calenorn

Sorry, folks. All my ereaders have the w-fi turned "off."

If you want my customer-use data you can damn well pay me for it.

I'm the same, off the grid! I'll turn on long enough to download a book then back off.

[darryl]

Originally Posted by drofgnal

I'm the same, off the grid! I'll turn on long enough to download a book then back off.

Hate to be the bearer of bad news, but long enough to download a book is long enough to upload any information that that may have been stored waiting for you to connect.

[DiapDealer]

Originally Posted by crossi

I hope my friend alf adds cleaning of all such addons to his helpful program.

In my experience, Alf tends to stick solely with the decryption of ebooks files so users can take ownership of their purchases. Diddling the content of ebook files is not something he's shown much interest in doing thus far.

[ZodWallop]

Either I'm missing the point, or this whole conversation feels a bit like a tempest in a teapot.

Everybody seems to be ignoring what I thought was the important point in that announcement: Selected readers receive a complimentary ebook (ARC) prior to publication date... So they are in fact, paying you for your data. Also, it seems to be something that would be used before proper release of major book to enable better marketing. Not something that would be stuck into every book sold, willy nilly.

I'm assuming nobody on here uses Facebook, GoodReads, Amazon, Gmail or a cell phone of any type?