Sony Rootkit Allegedly Contains LGPL Software 623
Deaths Hand writes "According to this Dutch article the Sony DRM software (or rootkit, if you may prefer) contains code from the LAME MP3 encoder project, which is licensed under the LGPL. However, the source code has not also been distrbuted, hence breaching the license. Here is an english translation of the page." So apparently Sony violates your privacy to create a backdoor onto your machine using code that violates an Open Source license. This story just keeps getting stranger.
Well, hang on a minute (Score:3, Interesting)
In fact, I thought that was the whole difference between the GPL and LGPL.
Did I get this wrong, or is this a non-story?
D
Code vs metadata (Score:3, Interesting)
Re:just say no (Score:3, Interesting)
Yes, but this time, it's customers suing them!
This counts as a violation *why*? (Score:1, Interesting)
Uhh... Probably not going to say something popular here, but wouldn't it only violate the LGPL if they had made changes to the code and then not made those changes available?
If they just linked against it as a library, well, the LGPL exists for exactly that reason.
Not to say that I find it all that unlikely that Sony did in fact make changes (adding some other DRM, beyond the rootkit itself - Though even that, they could theoretically have done without modifying the Lame code itself), but this seems all too much like exactly what we fault SCO for.
"You used our code! Give us your changes!" "We didn't make any changes..." "Well give us the code and prove it!"
This story gets better and better (Score:1, Interesting)
A bit misleading (Score:2, Interesting)
This probably is copyrightable data, but it appears to be use on a par with that occurring in spyware detection, as reported in the last news item [slashdot.org].
Disclaimer: I'm not the techiest person in the world - if I've made a mistake please tell me.
It even has some GPL compnonets (Score:5, Interesting)
So it is not only LPGL, but also the more strict GPL. This is of coarse all meaningless if nobody from the mpg123 project steps out and tells sony to go with the license.
Re:Code vs metadata (Score:5, Interesting)
I don't think it contains LGPL code. (Score:1, Interesting)
The strings just look to be a part of a search function for various LAME versions on the users computer,
and both programmes contain an array with the highly original title of "largetbl".
"Large Table" for those non programmers amongst us.
I'd like to see a bit more evidence before I cry foul.
What I find interesting. Why the Sony Rootkit is looking for LAME in the first place?
Does it alter or break LAME in in some way if LAME is found ??
... or maybe yes (Score:5, Interesting)
Sabotage from within? (Score:5, Interesting)
The more I think about it, it really smells of dissention from within.
Either that or it looks to me like this is a mix of business people not understanding their market, customers, or technology and sloppy code work. I mean, what asshat would grab some open source code and not adhere to the license? It is either a tremendous faux pas on Sony's part, or there was some intentional act here to make this as reprehensible as possible.
Sort of like watching the music industry test the waters on this sort of thing and finding them extremely chilly.
Re:This counts as a violation *why*? (Score:4, Interesting)
Re:More info (Score:2, Interesting)
Interestingly this comment [groklaw.net], over at groklaw, suggests that the Sony EULA restrictions on disassembly/reverse engineering may be incompatible with them distributing (L)GPL software in there.
no excuse (Score:5, Interesting)
Since Sony already argues against fair use of samples, one need only supply the court
with Sony's own arguments against fair use.
What does the rootkit do when it detects LAME? (Score:5, Interesting)
So the interesting question is: what does the rootkit do when it detects LAME on your hard drive? Does it disable or corrupt LAME? Does it phone home? Does it automatically initiate an RIAA lawsuit?
*This* is what I think the next Sony class-action lawsuit should be about. I doubt there is enough grounds to get them on an LGPL copyright infringement suit.
2. Muzzy points out that the Sony uninstaller installs a "safe for scripting" Active-X control with remotely exploitable entry points for rebooting your machine and possibly for installing arbitrary code on your machine. More fuel for the tasty class action suits that are starting up.
3. Sony has done so many evil things with the rootkit fiasco (and we haven't discovered them all yet); the outrage is spreading, and it may lead to a major backlash against the whole industry practice of distributing corrupted CDs in the name of DRM. Here's hoping for a brighter tomorrow.
Doug Moen.
Re:Code vs metadata (Score:5, Interesting)
Are you arguing that the included code is being used in a way that violates Fair Use, or that simply including the code for comparison (as the grandparent argues) is not fair use? I can't imagine why Sony would need to "use" several MP3 encoders (this comment [slashdot.org] links to a list of them) to actually encode music. Thus, I would assume that Sony is including bits of code from these programs in order to prevent them from running. Is that a violation of the LGPL?
Re:Glee (Score:5, Interesting)
I haven't bought a CD in years. It's put a big damper on my listening to new music, but it's just not worth it to support that industry. I've heard that Ani DiFranco's label is completely independent though, so I might go buy her stuff.
Not Sony (Score:5, Interesting)
But it's worth mentioning at this point that Sony didn't develop the software in question here - the XCP [xcp-aurora.com] software was developed by First4Internet [first4internet.com].
Not being a lawyer, or particularly knowledgable about (L)GPL terms, who could be held liable when a piece of software is developed by one party, but distributed by another? Is ignorance a defence, for instance if Sony said "We didn't know it had unlicensed code!", how would that affect things?
Re:Thank god! (Score:5, Interesting)
Yup, that's right. The thing that kills me is that certain members of our government are busy drafting legislation that would make criminal penalties against copyright infringement harsher [slashdot.org], including jail time. No doubt Sony is a sponsor of this bill - or at least the RIAA/MPAA, of which Sony is a member. Yet do you think that Sony would ever be concerned about holding themselves to the same standard? Would they, as a sponsor of this proposed legislation, support the CEO, CIO, chief architect, programmer, or otherwise spending some time in jail for an LGPL or GPL copyright violation?
The double standard kills me, and in cases like this where Sony's actions are quite simply audacious, I almost start to feel physical anger. I'm tired of being treated like a criminal, and it's really about time that a company like Sony be held responsible for the huge amount of personal and other violations that they have trampled on with this one single action of releasing this software.
Re:I don't get it (Score:3, Interesting)
Re:I don't get it (Score:5, Interesting)
Well, according to some people who have had to exorcise the demon from their windows PC, what happened after installing the rootkit is that MP3 files ripped from other CDs came back worse to wear, with noise, loss of quality and whatnot.
If that is true, you can probably connect the dots easily and see what Sony was after
Re:Takedown noticy against Sony (Score:4, Interesting)
Why hasn't anyone issued a takedown notice to Sony, so they have to pull these viral CDs from the stores and issue a recall?
WRONG (Score:5, Interesting)
If Sony don't provide the source they must make THE source available to all third parties for at least 3 years.
This is an obligation they must fulfil.
http://www.gnu.org/licenses/gpl-faq.html#Distribu
http://www.gnu.org/licenses/gpl-faq.html#TOCSourc
Merely pointing to "a website" or "the website we got it from" is not enough.
You have to make-sure-it-stays-there. And thats not enough.
You also have to let people request it by mail charging only a minimal fee.
You have to track your releases and make sure you keep the source of each release seperately so you can give people the source to the version they had.
Too many people consider only casually the obligation that the GPL puts on them. GPL is not an easy way out.
It's easy to receive GPL software because the burden is on the distributor, but you must understand and fulfil the burden when you are the distributor.
With most commercial software you pay some money before you receive it but you still have to follow the license guidelines.
Is it too often for me to say again that too many people distibute binary packages to open source software and distribute the source they compile to make the binary package but do not distribute the source to making the binary package; i.e. the
Sam
GPL gives rights beyond copyright law (Score:5, Interesting)
The thing that people don't seem to realize is that if the GPL doesn't hold any water (and it may not), then the whole thing just collapses back to plain old copyright law. In that case, they can't copy and sell the code at all without permission from the writer.
If I write a book and release it on the internet for everybody to download for free, you still can't copy and sell it without my permission. The fact that the code is offered for free doesn't mean that the writer has given up his rights to the work. In fact it is the GPL that gives people the right to copy and sell the work, if they follow the rules outlined in it. Breaking the GPL means you don't have permission to copy and sell the works at all. It is the GPL itself that makes it legal for people to copy and sell GPLed work. Without the GPL it's just plain ol' copyright infringement.
Let EFF know what you think (Score:5, Interesting)
Nonsense (Score:2, Interesting)
Re:So... How about them statutory damages... (Score:3, Interesting)
What incredible irony it would be if the LAME group ended up owning Sony Corp.
Yeah, I know, not a chance in hell, but one can dream...
Re:Not Sony (Score:2, Interesting)
Re:Takedown noticy against Sony (Score:2, Interesting)
Re:So... How about them statutory damages... (Score:5, Interesting)
Because each copyright holder can sue independantly.
Oh, and in case anyone forgot the RIAA sued a college student for $97.8 Billion. [slashdot.org] SO they have absolutely no right to bitch about how supid-huge copyright infringments can get to be. Their own lawyers participated in drafting the law the stupid-ass damages.
-
Too many license lawyers (Score:3, Interesting)
The LGPL does not require you to distribute the source code, it only requires you to give the source code to a user who asks for it. Including the source code with the software is only one of several means to accomplish this. Has any legal user of the software asked Sony for the source code? Anyone? I thought not...
It's not that I think Sony is innocent. Hardly! But that's no excuse for hundreds of Slashdot posters to be whining about licnese terms that don't even exist.
SKYNET is growing exponentially! (Score:2, Interesting)
This researcher has probed the caching on DNS servers to see how many requests are made for the www addressed used by the rootkit. He's gone a generated some nice geospatial plots of the results. The West is burning! [doxpara.com]
Sony's Missed Opportunity (Score:2, Interesting)
Is anybody else just awestruck by the delicious irony of Sony violating a licensing/ distribution agreement in an effort to prevent folks from violating theirs? This has the potential to venture into Greek tragedy territory before it's all over, folks.
You know you've hit rock bottom when even the Bush Administration has enough politcal clout to condemn your actions. Sony'd be better off if they were using this stuff to actively spy on users. That way, they could spin it as some kind of Patriot Act double-secret probationary counter-terrorism measure to prevent Al Queda pirating their content and funneling the black market proceeds to imbedded cells worldwide. That they didn't dub their root kit "the Freedom patch" was truly an opportunity missed.
Re:Too many license lawyers (Score:2, Interesting)
Good advice! Now follow it.
You will notice that there are several requirements in LGPL, and some of them include words like "reverse engineering" and "prominent notice" and "a copy of this License".
Re:Notification? (Score:3, Interesting)
Re:How many of you have PS3's on preorder now? (Score:3, Interesting)
Sony just lost any possibility of purchases from me. If I find out a product is affiliated with Sony in any way I will look for alternatives. They are now considered worse than Microsoft, Sun, and possibly even SCO. I don't care what you do, I'm going to boycott.
Sony violates DMCA, commits IP theft? (Score:3, Interesting)
If this isn't the most blatent case of a pot calling a kettle black. They should be sued under the DMCA for each CD they have sold in the US market.
It would seem this is no longer a civil matter but a criminal matter. Will this be taken as a case by the FBI?
-l