Connect software questions (rootkit?)

[HarryT]

Originally Posted by kacir

I am afraid I have to agree with many of your observations.

I got a little bit carried away. ;-)
I always do when I talk about that ... aehmmmm ... unfortumate event. Most people do not realize the extent of that ... aehmmmm ... incident.

Hi kacir,

I am a software author myself. If I licenced a 3rd party DRM package for use on my software CDs in good faith, who would you blame if the DRM messed up your computer? Me, or the company who produced the DRM software? Doubtless I would be legally responsible, since it was my software that you bought, but could I really be "blamed" for it?

Isn't this the situation with Sony? That they licenced this DRM package in good faith from another company? One may disagree with their decision to impose DRM on music CDs (I certainly don't think it's a good idea), but is it really Sony's fault that it all went horribly wrong?

Don't you think that you might be blaming the wrong people for this?

[Nate the great]

Originally Posted by HarryT

Hi kacir,

I am a software author myself. If I licenced a 3rd party DRM package for use on my software CDs in good faith, who would you blame if the DRM messed up your computer? Me, or the company who produced the DRM software? Doubtless I would be legally responsible, since it was my software that you bought, but could I really be "blamed" for it?

Isn't this the situation with Sony? That they licenced this DRM package in good faith from another company? One may disagree with their decision to impose DRM on music CDs (I certainly don't think it's a good idea), but is it really Sony's fault that it all went horribly wrong?

Don't you think that you might be blaming the wrong people for this?

The company who put its name on the product and sold it to me gets the blame. It may not be their fault, but that doesn't matter. Sony was responsible for QA to make sure the user wouldn't be damaged.

[kacir]

Originally Posted by HarryT

If I licenced a 3rd party DRM package for use on my software CDs in good faith, who would you blame if the DRM messed up your computer? Me, or the company who produced the DRM software?

Good faith is the key word here.

The problem is, that I *personally* do not think they acted in good faith. My judgment is partially based on:
- a very arrogant first response of Sony BMG's Global Digital Business President Thomas Hesse,
- their trying to cover up after they were informed about the problem (weeks before the scandal broke out),
- the fact that their rootkit remover did not remove their installation
- the fact they also used other, highly dubious "protecton" for their CDs
- the fact that they never properly apologized
- general longtime experience with Sony

Originally Posted by HarryT

One may disagree with their decision to impose DRM on music CDs (I certainly don't think it's a good idea)

I personally do not think that DRM is a good thing. Look what it did to Windows Vista.

I do think, however, that they do have right to use whatever super draconian protection scheme they wish on their music CDs, as long as they do not endanger innocent bystanders, and as long as their DRM protected CDs are clearly marked as such.
Users, on the other hand, have right not to buy such CDs.

I think that DRM crippled media should be clearly marked the way the cigarettes are marked here in the EU by a big, bold text stating something like this:
"This media is protected by DRM technology [insert name here] and you might be unable to use it in certain players/circumstances"

[HarryT]

Originally Posted by Nate the great

The company who put its name on the product and sold it to me gets the blame. It may not be their fault, but that doesn't matter. Sony was responsible for QA to make sure the user wouldn't be damaged.

I'm sorry, Nate, but I completely disagree with you.

If I buy a program from a 3rd party, then I am not responsible for doing "QA" on that software - that's the responsibility of the company which produces the software. By your argument, if I buy any piece of software and find a bug in it, then it's my fault for not doing QA on the software? I'm afraid that sounds completely irrational to me!

It's one thing to blame someone for something which is their fault, but quite another to blame them in a situation in which they appear to be no more than an innocent victim of "blunders" made a third party.

[HarryT]

Originally Posted by kacir

Good faith is the key word here.

The problem is, that I *personally* do not think they acted in good faith. My judgment is partially based on:
- a very arrogant first response of Sony BMG's Global Digital Business President Thomas Hesse,
- their trying to cover up after they were informed about the problem (weeks before the scandal broke out),
- the fact that their rootkit remover did not remove their installation
- the fact they also used other, highly dubious "protecton" for their CDs
- the fact that they never properly apologized
- general longtime experience with Sony

It certainly sounds as though they could have handled it better, I agree with you. I have, however, been a long-time buyer of Sony products (I am writing this e-mail on an excellent Sony VAIO notebook) and personally believe them to be a company which produces high-quality products. I appreciate that other people may feel differently.

I do think, however, that they do have right to use whatever super draconian protection scheme they wish on their music CDs, as long as they do not endanger innocent bystanders, and as long as their DRM protected CDs are clearly marked as such.

I agree with you.

I think that DRM crippled media should be clearly marked the way the cigarettes are marked here in the EU by a big, bold text stating something like this:
"This media is protected by DRM technology [insert name here] and you might be unable to use it in certain players/circumstances"

Again, I agree.

[Nate the great]

Originally Posted by HarryT

I'm sorry, Nate, but I completely disagree with you.

If I buy a program from a 3rd party, then I am not responsible for doing "QA" on that software - that's the responsibility of the company which produces the software. By your argument, if I buy any piece of software and find a bug in it, then it's my fault for not doing QA on the software? I'm afraid that sounds completely irrational to me!

You may not have to do it, but you should at least check to make sure it has been done. If you do not, and then you sell the software to someone else you put your name on it and yes, you are to blame.

Originally Posted by HarryT

It's one thing to blame someone for something which is their fault, but quite another to blame them in a situation in which they appear to be no more than an innocent victim of "blunders" made a third party.

This last part cracks me up. (Sony, as an innocent party.) Thanks. I needed a laugh.

[LaughingVulcan]

Originally Posted by Alexander Turcic

Harry, something that got Sony into a lot of trouble in the past. <snip>

Actually, not just "in the past." Now, also.

Article from pcworld.com which talks about Sony's wonderful new fingerprint recognition on usb sticks.
There seems to be some debate as to whether or not this is truly a "rootkit" or not, but it does install hidden directories on the computer; said directories can then be exploited according to the company F-Secure.

I also just read that Sony has decided to either cut the line or make changes.

[Alexander Turcic]

Originally Posted by LaughingVulcan

Actually, not just "in the past." Now, also.

Article from pcworld.com which talks about Sony's wonderful new fingerprint recognition on usb sticks.
There seems to be some debate as to whether or not this is truly a "rootkit" or not, but it does install hidden directories on the computer; said directories can then be exploited according to the company F-Secure.

I also just read that Sony has decided to either cut the line or make changes.

Heh, I remember reading about this on Engadget. I think they said that the product in question has been phased out already before, and that what you find in the store are just left-overs from a time when the term "rootkit" didn't ring a bell yet.

[HarryT]

Anyone ever bought a USB key with software called "U3" on it? Absolutely ghastly - installs automatically, with no way to cancel it, on any machine that you put the memory stick in, and automatically loads at boot time. In order to get rid of it, you have to download an uninstaller from the manufacturer's web site. If anything should be banned, it's that!

[JSWolf]

Originally Posted by kacir

I would not be able to say it better.
You perfectly describe my feelings about the whole situation.

I haven't even updated my firmware yet from the original version.

You really should. It does fix things and the battery meter works even better then ever.

[JSWolf]

Originally Posted by HarryT

Hi kacir,

I am a software author myself. If I licenced a 3rd party DRM package for use on my software CDs in good faith, who would you blame if the DRM messed up your computer? Me, or the company who produced the DRM software? Doubtless I would be legally responsible, since it was my software that you bought, but could I really be "blamed" for it?

Isn't this the situation with Sony? That they licenced this DRM package in good faith from another company? One may disagree with their decision to impose DRM on music CDs (I certainly don't think it's a good idea), but is it really Sony's fault that it all went horribly wrong?

Don't you think that you might be blaming the wrong people for this?

Ok, granted, Sony did not write that DRM software. But what Sony should have done was to at least test it to make sure it worked as advertised and to see exactly what it did. Then if it was to their satisfaction, then they could have released it knowing it was what they wanted. I do blmae Sony for not testing this abomination before releasing it. Also, if I was contracting someone to write code for me, I'd want the source code as well to look it over.

[HarryT]

Originally Posted by JSWolf

Also, if I was contracting someone to write code for me, I'd want the source code as well to look it over.

Were they contracting the company to write code for them, or were they simply licensing an already-existing product?

[LaughingVulcan]

Originally Posted by HarryT

Were they contracting the company to write code for them, or were they simply licensing an already-existing product?

It shouldn't matter much, according to my sister who has been working for some time as a Project Manager or Business Analyst in projects. Even if the technology is licensed out, the company doing the contracting or buying the license has the ability (and right and responsibility) to do a code walkthrough. (Assuming that the contract initiating the licensing is written correctly.)

And I'm with the "Sony is responsible" camp. It's ultimately their product; they are responsible for knowing what goes into it.

To me, it's akin to American brands subcontracting product production in China. The Chinese company acquires materials from other companies, and then said materials turn out to be defective (lead paint in toys, for instance.) Yes, the blame rests with the materials producer. That does not excuse the American contracting company from responsibility, if there's any reasonable expectation that they should have tested their products. (Or even the store selling it, in some cases, which is why you find the sellers sometimes enforcing a recall.)

And it's really irrelevant if the company is Chinese, Estonian, or American - it's just far harder-if-not-impossible to enforce liability internationally.

[Alexander Turcic]

Some more background regarding the "new" discovered rootkit:

http://www.securityfocus.com/archive.../30/0/threaded

That is not exactly new news.

The devices are old and all that is "rootkit-like" about them is the
fact that they interact with the kernel in order to hide their own files
from corruption.

Not everything that interacts with the kernel is a rootkit. Or would
anyone want to classify GRSecurity as a rootkit? RBAC will let you hide
parts of your filesystem as well...

[HarryT]

Originally Posted by LaughingVulcan

It shouldn't matter much, according to my sister who has been working for some time as a Project Manager or Business Analyst in projects. Even if the technology is licensed out, the company doing the contracting or buying the license has the ability (and right and responsibility) to do a code walkthrough. (Assuming that the contract initiating the licensing is written correctly.)

I work in a company which produces software solutions for its customers, LV. Most of these involve licensing numerous 3rd party components and tools. Rarely, if ever, do these have source code available. One has to trust that things that you buy in do what their producers say that they do.

I'm not arguing, but the way, that Sony were legally responsible. I was asking who you blamed - Sony, or the company which produced the faulty software. To my mind, the blame lies clearly with the latter.