Sony DRM: Your Comments
I posted yesterday that Microsoft should ban the installation of Windows applications that are invisible to the user. That generated some excellent e-mail, and here's a sampling.First, from DQ reader Jason Maskell:
Well here's the thing--Microsoft doesn't allow them.
However, the OS is extensible. What these apps are basically doing is hacking (hooking, technically) kernel32.dll so that it lies to anyone asking it about those processes. That part could probably be patched.
The only way this will be fixable for sure will be if Windows ever goes to a model where the user doesn't have full root privileges over a machine, which is unlikely to ever happen.
So, in this case - not Microsoft's fault.
Thanks and I stand corrected. Which is oh-so-common.
Then, from Skylander, more details on rootkits.
It's not Microsofts fault.
I'll give you a run down of rootkits. There are 3 Generations of rootkits. The first rootkits were basically copies of system files, basically the hacker or whatever takes a key system file and replaces it with his own, it still does the same things it just....does something extra--like a keylogger in Internet Explorer.
Now from there hackers developed a process called "hooking." The basic principle of hooking is a redirect call. Basically you called a primary system driver and there would be a trigger in the rootkit, checks for the file and then the rootkit changes the address so instead of going to abfxe005H it would go to cCdefx003H which would be the the built hacker file. Now the only way to check for hooking is to cross reference regular windows address with the address the programs are going to.
Once that weakness was shown hackers created the 3rd generation of rootkits using Direct Kernal Object Manipulation(DKOM), which goes in and generates a true memory address table giving the proper values while it uses the fake one.
You can download rootkits of any of these generation off of white-hat hacker sites. Sony used a 2nd generation rootkit that uses the hooking method, a white-hat hacker figured out what was going on and traced the files back to Sony. Rootkits in and of themselves don't really do much--they just hide files. Granted, they do it in an insiduous way that the regular user would never know. That is what makes them a viable hacker tool.
Finally, from DQ Legal Advisor and Swimming Captain Lee Rawles, a legal perspective:
I would note the following:
1) It is not such much that laws about EULAs need to be changed (after all, they are just another form of contractual relationship), but that perhaps there needs to be some form of "truth in labeling" regulation applied to software programs, applications and data (regardless of whether distributed via download or via purchased media (CD-ROMs, disks, DVDs, etc.)). An analogy that breaks down upon close inspection, but that provides some clarity to the issue, is the ingredients label on any purchased food item. I can see it now:
LEGO(R) STAR WARS(TM) The Video Game
79.5% Game code
06.7% Sony DRM spyware (and related Crap -- yes, Crap is a technical term)
05.9% Marketing Crap for LucasArts content
04.1% Marketing Crap for Lego content
03.3% ESRB censorship and content monitoring code
00.4% GameSpy spyware code
00.1% Undiscovered memory leak that will cause your computer to crash repeatedly for months to come
The problem is programming code, in this context, is not fungible. It is--or at least can be --relatively unique. One person's dipotassium phosphate is the same as the next person's. Not so with code. A simple listing of the contents of a download/media--even if in plain English--would be insufficient to protect against some asshat (again, technical term) playing fast and loose with the rules and your computer's security.
2) To require exhaustive (or any modest) notice/disclosure regulations concerning distributing of software programs, applications and data may present an additional hurdle for independent and start-up game companies, that already have enough hurdles to overcome. This is not to say that regulation or legal oversight is a bad thing in this or any other context, but rather, it is something to consider in balancing the need to regulate versus the costs of doing so.
You people are all smarter than I am. And I think I speak for all of you when I say "thank goodness."
<< Home