Hacker News Reader

Comment by SmellyGeekBoy | Hacker News Reader

No privacy terrors? What short memories we have.

https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

To nitpick: Pure musics CD (CD-DA) can't contain any DRM or rootkits, because the format doesn't allow for data - it's all sound.

Only combined CD-ROM/CD-R + CD-DA formats together with the unfortunate eagerness of Windows to auto-execute everything allows such rootkits.

So if you feed a music CD to a real old CD player, or to (say) a properly configured Linux computer: No privacy terrors.

Or a properly configured windows. Not even windows 95 would autorun a CD if you didn't tell it to.

> ... if you told it not to.

FTFY

By default, Win96 would run that CD. You didn't tell it to. You had to go change the setting from the default. You had to tell Win95 to not autorun a CD.

Win96 = Win95OSR?

I think it’s a typo.

Indeed a typo that I didn't catch until after the edit window.

Autorunning CDs was the default until windows vista, which is how the u3 usb devices were used for “hacksaw”[0] and “switchblade”[1] attacks.

More on u3: https://en.m.wikipedia.org/wiki/U3_(software)?wprov=sfti1

0: https://forums.hak5.org/topic/2843-usb-hacksaw-development/

1: https://forums.hak5.org/topic/2361-usb-switchblade-developme...

Its quite incredible how long this was working for. Autorun was a dream for malware.

It was also incredibly convenient - put game CD in drive, game launcher appears with INSTALL / PLAY (depending on the status). Also it was neat to give a DVD with some sliceshow/photos/videos/etc to your grandparents/aunt/uncle/etc who didn't knew much about computers and tell them "just put the disk in the drive and it'll do the rest".

But as usual, one rotten apple spoils the entire barrel.

The way it works today is just as simple. The OS automatic asks permission to run the program.

The UX is certainly worse, especially on Win10 where it displays a tiny popup at the bottom right side (at least in Vista and 7 it had a popup at the center and IIRC the popup even had an icon of the game/program if autorun specified one). For most users it isn't a practical issue though, just a lesser experience. If you are comfortable with computers after a while you ghost through such popups :-P.

Having said that i did have my aunt (who is generally afraid that if she does something wrong the computer will break forever) spell me out the options in a popup (for a photo dvd she got from a photographer for a relative's graduation) over the phone once though, so i'm sure that, if nothing else, it can be a bit unexpected for less knowledgeable users.

... or you could press Shift while the CD was being loaded.

IIRC there was some consumer association action in France back in the day against such hackish DRM practices mandating the labelling of such CDs with a notice that the thing you were just about to buy may not play at all as well as requiring them to drop the CDDA Phillips iconography, all because someone bought a CD and couldn’t play it in his car or whatever. After that one it seems like the DRM scheme was basically dropped around here.

To nitpick your nitpick: there were many attempts to implement DRM even on pure music CDs, see https://en.wikipedia.org/wiki/Copy_Control

My personal experience with this was with some import CDs (from Japan) that, from what I recall, messed with the error correction part of the data so that it skipped horrendously in my PC (so it was impossible to rip in cdex) but played fine in (most) standalone audio players.

From that Wikipedia article:

"As the Copy Control discs do not conform to the requirements of the CD standard, they are not labeled with the CDDA logo, which is trademarked by Philips."

> the format doesn't allow for data - it's all sound

Redbook CD-DA has one subcode byte and eight error correction bytes per frame.

I came here to mention exactly this and am glad to see it at the top.

I, as a teenager bought a Sony BMG album with this rootkit.

At the time I didn't own a standalone music player, just my PC. I had a nice Creative sound card and some decent speakers, and an appreciation for audio quality.

To my surprise I found that the Sony album prevented you from playing back anything but some low-quality 128Kb MP3s stored in that data portion of the Disc if using a PC and there was zero chance I was allowing their crapware onto my machine.

I contacted them and they sent me out a replacement disc without the root-kit data rubbish but only upon me first posting back my own disc, without its case no less.

wasn't it a thing, that you could bypass this by holding shift (to disable autoplay) when inserting the disc?

or use linux :)

I know this statement of yours is somewhat of a meme, and you may even be saying it tongue-in-cheek, but, this is one of many tiny cuts over the years that caused me to switch entirely to Linux. I don't run Windows at home or at work for the best part of a decade now. I run bleeding edge hardware, I have a high-end gaming PC, my laptop is a 2019 model that only works if I use Linux 5.0 and my wife complains that Open/Libre Office sucks on her laptop.

Don't get me wrong, I have my issues, sometimes I have to fix things, but I would rather this any day than having to go back to using Windows.

> I have a high-end gaming PC

Is gaming a thing on Linux now? I was given to thinking that if you're into PC gaming you're really stuck with Windows ...

With Valve (steam) involved and wine much improved, it is a thing now, but you are still very limited compared to windows.

Agreed. The only major problems right now are alternative clients and anti-cheat engines (many of which inject themselves into the Windows Kernel, yeah...) not working. Seems Valve may be leaning on publishers to fix that though.[0]

[0] https://www.gamingonlinux.com/articles/apparently-valve-are-...

A slight hitch: https://www.rockpapershotgun.com/2018/10/08/epic-games-buyin... and https://twitter.com/timsweeneyepic/status/964284402741149698...

Not condoning piracy, but it is a great equaliser. Hackers and modders will find their way around anti cheats anyway, I believe there's nothing unethical about exploiting that to play through Linux.

But yeah Epic Games is terrible.

GOG/Humble have done wonders for Linux as alternative stores.

Hopefully, for people like myself, who really aren't into multiplayer, that'll be less of an issue. I'm not sure which games do and don't contain EAC but I've generally had good results with my catalogue on Stream Play the biggest limitation being those which use Windows-specific codecs for their cut scenes or sounds.

It obviously depends on what you're playing exactly, but many titles (from indie to AAA) run great on Linux, either natively or through Proton (Steam's integrated Wine distribution with DX11/12 support).

Never used the Epic Store or Origin though, so cannot speak to that.

Origin, Uplay and Battle.net are working fine. I play Battlefield 1 and Overwatch with friends on Linux. EGL works too, but I know nobody who is using it (except for the free giveaways and the engine).

It's not perfect, but thanks to Steam Play/Proton it's becoming viable, I've played several high end "Windows" titles on Linux through Proton (modified Wine), and then others like Tomb Raider have native ports. DOOM 2016 runs better on my Linux box with Vulkan than it does on Windows, where it averages 100FPS/4K/Ultra vs ~60FPS in Windows. I'll be honest, _what_ I play is more driven by what's available now than it used to be, but I'm not much of an online/multiplayer, I prefer single-player so there's no huge rush and I have a back-catalogue that'll keep me busy for years to come, with more being added faster than I can play them.

Linux gaming has come a long way. Steam even has a fork of wine they are working on which is built into their client.

Ubuntu today is easier than windows 10 for me. Granted I use Linux heavily.

I think holding shift just works for autostart when booting up. Autorun/autoplay of CD's can be disabled in the system settings.

No, shift would disable autoplay. The question is whether this could defeat the malware ... I seem to remember that it did but few were wise to this.

That didn't work for getting you access to the better quality audio. The PC's drive would just skip the audio section, even if you prevented it from installing the malware/rootkit.

A standard Red Book audio CD cannot install malware to your system. It was the data CD with music that Sony shipped made it possible.

This is why, I, sometimes a CD buyer, believe all listeners of Audio CD should try maintaining the status quo of CD, as defined by the Red Book, and resist/boycott any attempt by the industry to "make a better CD" (e.g. SACD, Audio DVD, Audio Bluray), or "add more functionalities" to the existing CD standards.

Technologically, I would be happy to see a Doubly 5.1 Bluray Audio CD playing at living room from my surrounding speakers (better channel separation allows improvements of sound reproduction even on speakers of moderate quality), or CDs with real filesystem and error correction (an Audio CD by its original design, only streams music in real time, as if it's a digital LP track. There is no way to even know if the data you've just read from the disc is correct or not [0]), or a FLAC-encoded stereo CD (it would allow 30% more songs to be recorded on a single CD).

However, I'd better to live without them, as history has shown: all the newer standards would definitely be more "consumer-unfriendly" at best (go to any AV forum, and see the compatibility issues caused by HDCP [1] for example...), and malware at worst. The Audio CD, even with its historical limitations, is good enough, it plays lossless music with 44100 kHz sampling rate, and it did/does this job well.

Also, you may have noticed the recent renaissance of LP discs, and some LP lovers' arguments of how analog has better sound quality. While I don't believe those arguments are persuasive, I'm highly supportive of the LP industry for the same reason - you cannot install malware on a LP disc.

[0] Why I Ripped the Same CD 300 Times

https://news.ycombinator.com/item?id=17649374

[1] https://news.ycombinator.com/item?id=1689823

>A standard Red Book audio CD cannot install malware to your system. //

I don't think I'd ever be so confident as to say that given some of the incredible hacks I've seen ;o)

Well, theoretically, "an Audio CD that exploits a buffer overflow of your music player on your computer and installs malware" is always a possibility, and a good intellectual challenge.

But doing it at an industrial scale and including an 0day exploit in all albums is a separate thing, I don't believe it would ever happen. On the other hand, creating an extension of the standard to "make a better CD" is a real threat, for example, a plausible example would be:

"a CD-based service that connects to a server to obtain metadata and lyrics of your music, like a proprietary version of MusicBrainz, but with ads and tracking added."

> It then released, for one of the programs, an "uninstaller" that only un-hid the program, installed additional software which could not be easily removed, collected an email address from the user, and introduced further security vulnerabilities.

In all fairness, I'm not sure how much of that applies 14 years later.

We’re now invulnerable to rootkits?

Speaking as someone who actively boycotted Sony products for a decade because of this fiasco, I also think it's time to put this to rest.

I'm still boycotting Sony, for the rootkit and the PlayStation Linux switcheroo. They never actually apologised for either.

Trust is hard to earn and easy to lose.

I guess I should've scrolled down more, I made a similar comment. How quickly people forget!

Brutal, but only really affects people who should have no expectation of privacy to begin with, such as Windows users.

Everyone should have a reasonable expectation of privacy. That certain groups more frequently find this expectation violated does not mean that it is not a reasonable expectation.

I have no expectation of privacy when I use windows. You shouldn't, either.

It simply got this bad.

Reply on news.ycombinator.com