EXPOSED: The Windows Rootkit Scandal by Sony

Sony fought back against Napster and DAT with some aggressive tactics culminating in a Rootkit shipped on some 22,000,000 audio CDs spanning 52 titles. Dave was the dev manager for Windows CD Autorun and explains the scandal including technical details.
Secrets of the Autistic Millionaire: amzn.to/3diQILq
Discord: / discord
Wikipedia Page: en.wikipedia.o...
Mark's Blog: web.archive.or...
Gear and Equipment List:
Sony FX3: amzn.to/3EiYBg1
Sigma 35mm Art Lens: amzn.to/31sfJS1
ElectroVoice Mic: amzn.to/3EevlXE
Glide Gear Prompter: amzn.to/3oeO5AQ
Atomos Ninja V Recorder: amzn.to/3xQ4YVr
USB-C to SATA: amzn.to/3xOYZ3j
4TB Samsung SSD: amzn.to/3xPnHRl
Reticam MT-01 Tripod: amzn.to/3xRzCOy
Aputure Light: amzn.to/3EnvKHm
Aputure Light Dome: amzn.to/31qN0g5
The great Andreas Spiess, from whom I stole the reference to "sitting in the front row":
/ andreasspiess
"Star Trek" Excerpt Credits (via MovieClips.com)
TM & © Paramount (1984)
Cast: William Shatner, DeForest Kelley, James Doohan, Walter Koenig, George Takei, Christopher Lloyd, David Cadiente, Bob K. Cummings, Branscombe Richmond
Director: Leonard Nimoy
Producers: Harve Bennett, Ralph Winter
Screenwriters: Gene Roddenberry, Harve Bennett
Disclaimer: I am long since retired from Microsoft and wasn't an official spokesman even when I did work there!

[@kostis2849]

Horror story to share. At the time, I was doing customer support for AVID editing systems. Some customers who wanted to import some music from commercial CD's in their projects, discovered that ALL the Media Bins were deleted, both the current versions and the backups that the software kept in another folder. We were at a real loss as to why the Bins kept disappearing, until some nerdy editor discovered the cause. Seems like they were specifically targeted by this malware. Sony was trying to establish their own professional video editing systems at the time (not Vegas, can't remember the name) From then on, my recommendation to all customers that I happened to visit was "Never use original Audio CD's. Only copies from people selling them in the street." Good Job, SONY

[@northwiebesick7136]

Lol... I don't even do that... If I ever want a digital copy of ANY music for ANY reason, I just either get an mp3 version from online, or I use 1 of a select few ways to download an mp3 version from KZbin music on my phone (provided that I own a CD or other kind of possibly copy protected versions of the music in question, of course😉😉) and just say I want to listen to KZbin music songs that I like, but don't want to pay KZbin to get rid of the ads, I can just share my favorite songs with my downloading app, then play my music over Bluetooth in my car, or wherever I might be, in a different app like VLC, or even as offline media in the KZbin music app(or I use "KZbin vanced" to get rid of ads, which now has a modded music variant as well) Same with videos, if I can't back it up reliably, or don't have the proper software to remove the protections,(assuming I own the DVD) then I just act like a filthy pirate and get it that way... It's a grey area, yes, and it's a contested freedom depending on who you ask, but some big names in the TechTuber space say they would gladly pirate movies if they already own the DVDs, because they can't abide by the streaming movie market that doesn't work on many devices(and associated DRMs)

[@kostis2849]

@@northwiebesick7136 You have to understand that I was talking to clueless video editors. Some were older people that were stuck in the 90s. Plus, telling them to install a torrent client in the office environment..... not good with the speeds of internet here at the time

[@northwiebesick7136]

@@kostis2849 oh, I'm not trying to advise anyone else to do that, of course, it's just how I sometimes deal with certain problems. (With a suitable vpn around of course)

[@kostis2849]

@@northwiebesick7136 Hehe I do the same, tho I dont have to bother with VPN's here

[@tehs3raph1m]

Put the audio cd player behind a 3.5mm to 3.5mm cable or an optical cable and rip your own audio from the original CDs. Airgap everything

[@DavidWonn]

The irony is that Sony attacked its legitimate customers and zero pirates in doing so.

[@zunipus]

What Sony managed to do was INSPIRE PIRACY. It increased exponentially once victims understood Sony's bad attitude toward them. Anti-DRM strategies have a long history of their own, all for the purpose of screwing back the companies that perpetrate DRM.

[@szr8]

@@zunipus It's worse than that. Sony broke the public trust, and on such a way to demonstrate just how far these large corporations could go given the chance.

[@evoblade2000]

That is the root problem of DRM. It never does anything more than mildly inconvenience pirates and cheater and always harms the customer.

[@ozrithclay6921]

That's the exact problem with other laws. Probably the most obvious example is how gun control laws actually work.

[@chrisakaschulbus4903]

And today you get your keys of questionable origin for pretty much a bag of sand (compare prices for 5 kilograms of sand, i dare you) and you're still totally in bounds for the allmighty copy protection :D

[@justsomeperson5110]

What I "love" about this occurrence is that had an individual done this, it'd have been called hacking and resulted in jail time. But because it was a big corporation that did it...

[@evasadana8024]

Yep honestly the programmers with in sony and there direct supervisor and the execs that demanded it all should have been arrested. The only reason I include the programmers is they knew what the software was and what issues could come about from it and as we all know from some very famous trials because you were told to do it doesn't hold much water.

[@IceGorZilla]

Was there any jail time for the Volkswagen diesel emissions fraud?

[@Britt20654]

The executives may have been charged and the corporation could have been charged but the programmers didn’t break the law unless they knew or should have known that Sony wouldn’t get permission. Almost all flavors of computer trespass requires acting knowingly or intentionally. See 18 USC 1030.

[@BRBTechTalk]

I agree, that guy that was arrested and charged for loading a website and back spacing the address to see the parent folder was charged as a hacker, he was just looking at the existing file structure of a website, Sony gets away with this ... well they did end up in court and all but nobody went to jail for it.

[@Britt20654]

@@BRBTechTalk your own example shows why they are different: Computer trespass requires entering a computer network or computer knowingly or intentionally without authorization or in excess of that authorization. The guy who backspaced the address knowingly entered a serve without authority. Hence that is trespass as it satisfies the intent requirement (also note there is a difference between motive and intent in the law, what you described as mitigation is a motive not the intent which is not an element of the crime). However if the Sony Developers credibly thought permission would be sought it isn’t a crime. See it’s not a crime to write code. It’s a crime to use that code for an unlawful purpose with intent that it be used unlawfully.

[@pzeller1]

This, more than anything else, hastened the end of record stores. People wanted mp3's of their songs, and this made it SAFER to download the mp3's then to simply buy a CD and rip for yourself. I know, because customers specifically said this.

[@KabukeeJo]

Most people I know who used Napster did so for 2 reasons: 1: To get songs you could not buy even if you went to the music store with actual money. 2: People got tired of paying full price for an entire album just to get 1 or 2 songs from it. The good thing is that today's digital music stores have mostly resolved the 2nd problem.

[@MtnNerd]

Yeah most of what I downloaded was anime music. To get a legal copy I would have had to find an import. I remember trying to find one for Cowboy Bebop's OST because I loved it so much and all I could find were bootlegs or insanely priced second hand copies.

[@DenethorDurrandir]

The tax on blank CD's was always hilarious to me, it basically made piracy morally justified, because you already paid tax for pirating when you purchased the CD, regardless if you did pirate anything. The recording companies got to keep their cake and eat it, stealing from users while persecuting those who pirated, despite the piracy being already financially settled.

[@okaro6595]

In Finland the copying was legal and the fee was compensation for it. It was 20 cents for a CD and 60 for a DVD. Ten years ago it was removed and the state pays directly the compensation.

[@Dargonhuman]

@@KLondike5 Well, that just sounds like giving me permission to pirate to my heart's content then - if I'm going to be penalized and fined for something I haven't even done or was planning to do in the first place, then I might as well engage in the activity I'm paying for.

[@johndododoe1411]

@@Dargonhuman In my country (Denmark), the "tax" on blank media is legally classified as funding for an actual license to the entire population for all published music recordings, regardless of the media used for the copy. As recently as about a month ago Parliament debated if the latest law update should apply to the flash memory inside smartphones, or if those would be useless for music copying.

[@BoraHorzaGobuchul]

In Russia, a 1% few apples to any media you can record onto - blank CDs, DVDs, flash, hdds, and good to a company owned by Sergey Mikhalkov, a crony of the regime, ostensibly to be passed on to the owners of ip. Quite sure they're unlikely to see any of it though :)

[@BaronVonQuiply]

The people who make the stuff deserve to get paid a fair amount. The shareholders who put in extra millions they had laying around so they can get many more millions back? Let's just say there is an empathy budget and mine does not quite extend to greedy corporations and the cash hoarders running them not getting their 18 cents.

[@renewagain6956]

Sony: "We won't lose that revenue stream, no matter what." Customers: "Wrong. You will lose it, and in a humiliating fashion."

[@evoblade2000]

Perfect slam dunk business school case study for the consequences of hubris and arrogance when dealing with customers.

[@KatriceMetaluna]

@@evoblade2000 Corporate executives are made of hubris and arrogance. I guarantee not a single one of them learned anything from this debacle. They're only sorry that they got caught.

[@LTVoyager]

@@KatriceMetaluna This isn’t always true, but it is very often true, sadly.

[@D1g1tal_H1ppy]

i haven't bought anything from sony since then. no regrets, sony is trash.

[@llewellynjones1115]

​@Suicide Kyd Yes, trash. Remember the Nvidia Defect? Sony was about the only manufacturer that refused to replace defective laptops. I ended up with a £1000 paperweight in 2009. I have never bought Sony again, and I never will.

[@contentnation]

I was affected by one of those rootkits. the results were simple: I ripped the CD using linux and never bought anything with a Sony logo on it since then and never will. And no, Sony did not learn from it, they still phone home a lot, even if the device is "off". One of the benefits of working in a network security company heading the network analytics department, was the overwhelming network sniffers all around the network, including conference rooms with sony devices in it. So no rumors, I saw the traffic.Nothing with a Sony logo should be granted to access the internet.

[@SeanBZA]

To be fair, pretty much every connected device phones home in some way or the other. The difference is in what it does if it does not get a reply.

[@contentnation]

@@SeanBZA If they ask you and you say no, they have to shut up,.Other brands did that, Sony was phoning home anyway. No idea what the transmitted data was thanks to encryption and blocking from the firewall on the certificate exchange level.

[@nickwallette6201]

@@contentnation I agree with you in principle, but these days, if it does more than warm your toast, it will inevitably have a network jack or WiFi, and you will at some point be waiting for a firmware update to download. That's the world we live in right now. And no, it's not OK. But it would be a little naive to say Sony is any different than practically any other OEM in that regard. Maybe.. MAYBE.. you're right about the "if you say no, they have to shut up" part. Except, usually, if you say no, it will just say "OK fine, then I'll just shut down and you can put me back in the box, then. BTW, no refunds."

[@TonyPombo]

Agreed. I hate Sony for what they did, and I boycott Sony to this day - I will not even watch a Columbia/Tristar/Sony movie in the theater (or over streaming) because I refuse to give money to Sony. Sony makes nice products, and I would like to buy them, but I am waiting until Sony becomes non-Evil. I'm still waiting.

[@SeanBZA]

@@TonyPombo I do have some Sony stuff, including a selphy printer, that I got as used. Thus not giving them any money, and using the stuff till it is no longer repairable.

[@ElSarcastro]

The auto start function was a blight on all computers in my university. Hundred of file replacers/Trojans fought their way from every PC to any USB drive that was plugged in and then fought their way back, usually through autorun to the next PC. This made most PCs unusable for bringing your data with you as it will destroy anything on your USB drive

[@CoolKoon]

Perhaps the university you went to had crappy sysadmins then...

[@EllAntares]

@@CoolKoon it's probably that time when Microsoft considered autorun and autostart functions essential (some stuff didn't even work right without it, e.g. CDs with "special" on-standard file system), even if you use hsoftware that blocks autorun or edidit registry so it would be disabled, upadates would revert it and autorun somehw still happens. ActiveDirectory policy to disable autorun it came in later. Autostart was adouble-edged sword. But not for academic license OS. On Academic autorun was practically mandatory. On older versions of OS autostart was the only way how some system utilities worked and that's while shcheduler already existed. But now scheduler isstill a potential menace, along other things sometimes somthing fail and you can find 100+ google chrome updater events inthere

[@hjackson.92]

The irony of Sony including open source software in a way that violated the GPL while at the same time protecting its own copyrighted music. . . this is hilarious. I remember using Linux to rip CDs to get around DRM schemes, and for the most part it worked flawlessly. Sad to say, though, Sony hasn't learned anything from that. Last year it was filing DMCA requests and managed to get many videos of a certain PS4 game taken down from KZbin after leaks about the game were made public. Content creators for a while couldn't even talk about the leak without their videos getting a DMCA strike, even if their videos contained none of the "offending" content (which was still protected under fair use). . . and eventually Sony lawyers issued a DMCA strike against its own videos twice - once in May 2020 (I think) and again this past August. I haven't bought Sony products for more than a year because of its zealotry.

[@glenrisk5234]

I got a PS system to try VR a few years back. I'd never had one, not really that interested in gaming just really liked 3D tv. I was quite surprised by how abusive they are to their customers!...

[@LiEnby]

i bet sony's own PS3 can rip an XCP copy protected disc, which is pretty funny

[@hjackson.92]

@@LiEnby If that's true, not only is it funny, it's also downright hypocritical.

[@lucasrem]

Royalties ! NOT copyright ! Asian Royalties....?

[@tehonlynoobs5556]

And consumer didnt care Remember when psn got leaked so bad that court sue the sony But still people buy this shit

[@kkpdk]

I was working as a design engineer at the time, and my automatic response was to design-out sony semiconductors where possible. I know others in the field who did the same thing.

[@noalear]

Your efforts are appreciated. I'm sure that was a lot of extra work added to your plate, so thank you for your efforts.

[@TonyPombo]

With the rootkit, and unnecessary introduction of Blu-ray for greed's sake, in 2005 I decided to boycott Sony products until they became less evil. I'm still waiting. My last Sony product was PS2.

[@dosgos]

That would be an interesting topic to post at EEVBlog forums.

[@perwestermark8920]

Sony has managed to sell me one camera and one projector since that time. Quite a number of years on the black list for multiple unethical actions.

[@enlightendbel]

If they go to those lenghts fucking with software, imagine what humbuggery they'd hide in their hardware ...

[@PeBoVision]

You're a more forgiving man than me Dave. I have not allowed any SONY products into my home since the Rootkit fiasco. They didn't attack pirates, they attacked people who BOUGHT the music CD, so their faithful customers. I just can't get past that level corporate evil.

[@KWHCoaster]

@ThePatUltra Still have a copy of Vegas 10(?) that I'm too suspicious of to install after the CD B.S.

[@techguydilan]

Also before the product line was bought out by magix, their video editing software (Vegas MS and Pro software) had similar rootkits to detect pirated versions of it as well. The fun fact is that hackers making the pirated versions of it were smart enough to remove said rootkits, so pirates didn't suffer the same consequences. I have more recent versions of it, latest being Vegas Pro 18, and haven't encountered similar rootkits while using it, so I'm thinking it's one of the revamps Magix made once they acquired it for version 12 if I remember correctly.

[@martinlebl631]

Used to have a Sony desktop, Sony laptop, Sony camera, Sony external CD burner/video encoder. Then this happened, and I never bought Sony again. After all these years I am tempted by the Sony Pro I phone, which is one of the few flagship with a 4.5mm audio jack, but the idea of buying it leaves a sour taste in my mouth. Perhaps I hold a grudge, but perhaps you shouldn't betray your fans and customers. As this was violation of various hacking laws, if execs who OKayed it went to jail I wouldn't hold a grudge. Just imagine you rootkitted a million PCs; how many years in the federal pen would you be doing?

[@techguydilan]

@@martinlebl631 Their computers at least aren't as good as they used to be, so you're not missing much. Not sure about their smartphones, I have no need for a 4.5mm audio jack on a phone so, I don't need one of their Pro phones, sticking to my Pixel. I didn't start buying Vegas software until after the MAGIX switchover, which people stopped talking about the rootkitting in the software since. My Sony hardware, a pair of studio monitor headphones and a stereo amp, I bought used. While I'm in no hurry to get rid of them, for replacements, I'd rather buy a Yamaha, Denon, or other brand even if it costs more

[@CattyRayheart]

I'm also still boycotting Sony over this scandal.

[@prman9984]

You haven't heard of Sony's persecution of GeoHot or their removal of Linux from PS3? They haven't changed a bit.

[@doc_sav]

Thanks for mentioning this, exactly what I had on my mind. Sony is a pioneer of bizarre anti-consumer attitudes.

[@nickwallette6201]

@@doc_sav Any company of that size naturally trends toward looking out for its own interests above all, and to the exclusion of its customers' interests.

[@philrod1]

Sony's removal of Linux equally shady and stupid. It gave hackers a reason and motive to hack the PS3, opening the door for piracy

[@ccateni28]

Funimation and Aniplex anyone?

[@meyes1098]

@@doc_sav idk man, I'd put Apple way above Sony

[@WarrenLeggatt]

I rememeber when this happened. When it got exposed they denied and denied until proven and then just said "my bad". Even the "patch" to remove it from them was a security nightmare. I have never purchased anything Sony since then!

[@johndododoe1411]

Ditto, especially after they made it worse by attacking all buyers of first generation PS2 consoles by removing the "use as a computer" feature through a forced firmware update, then used highly dishonest legal arguments to not only get away with it, but also sue and harass a teen that provided a way around it by exploiting a Sony security hole . Later, Sony did more a-hole stuff to promote a comedy that made fun of Dennis Rodman's Korean friend, to the point that neither Sony nor any of the agencies backing their stunt retain any credibility . By the way, I'm old enough to remember the original definition of a rootkit: An entire collection of programs to hide the presence of an admin level intrusion, which for Windows XP would have meant lookalike replacements for explorer, command prompt and a bunch of other system files to hide not just the backdoor, but also the secret remote login .

[@lucasrem]

Sony is dead now !

[@CoolKoon]

@@johndododoe1411 "also sue and harass a teen that provided a way around it by exploiting a Sony security hole ." - Yep, the good ol' GeoHot case. That was the final straw for me that made me say "screw it" and to never buy anything Sony again (I've almost relented later on when I wanted to buy headphones, but I didn't in the end because it's VERY hard to get good headphones from them among the wide list of complete duds they sell too).

[@felixjohnson3874]

Shhhh, doncha know 'voting with your wallet' is a myth and we need to give politicians more power over our lives? If you keep saying insane stuff like 'people can voluntarily choose not to associate with a company they dislike' you'll be thrown in an insane asylum! I mean come on man, snap back to reality ffs, since when have consumers ever had any agency or impact on a company's bottom line; these are natural monopolies for crying out loud! Now if you'll excuse me I'm going to browse Myspace from Internet Explorer while I enjoy this Budlight.

[@Elliandr]

In the late 90s and early 2000s I remember I purchased a large amount of music CDs over time. Eventually started purchasing digital music and that's when I decided to rip my CD collection to hard drive. Shortly after doing so my computer was Kilt and I lost the license files for the digital music I purchased as well. I'm fairly certain now that this was caused by the Sony rootkit, although this would have been before any public information was known about it. In any case, I strongly suspected there was something going on to buy music CDs because as I would rip one CD after another it would make my computer act really weird. This eventually pushed me to download the music that I already purchased since I couldn't seem to rip it properly. I could no longer trust music CDs so I stopped buying them and I couldn't Trust music I purchased online because the license files break. It wasn't until a few years ago that I actually purchased any music whatsoever and that was only because Amazon was selling drm-free music that would just work. My point is that I was the kind of customer Sony should love. I spent a lot of money on their music regularly. Regardless, their antics pushed me away from being their customer and I didn't even know that they were the ones who did it at the time. Meanwhile, the people who would actually steal their music wouldn't encounter the rootkit because it's on the CD, not a downloaded music file. And the kind of person who would be pirating has no intention of buying their CDs so the only really hurt their customers. And the piracy was it really hurting their bottom line because if they weren't going to buy it anyway it's not like they would have gotten money out of them. Some years later I had an ironic experience with a Sony dvd-rw drive. I installed a game called Spore and my computer couldn't handle the included DRM which was actually made by Sony. It crippled the functionality of the Sony DVD drive and the game that I paid for would no longer work properly. A game that I pre-ordered a year ahead of time could not be played while the Pirates got to enjoy it the day before release without any restrictions whatsoever. The Sony software only worked to hurt the paying customers and did absolutely nothing to the pirates. Once again soon taught me a valuable lesson. Don't purchase their products. Of course, I didn't learn it very well because I later purchased the Xperia Z tablet and then afterwards the Xperia Z1 tablet. I actually love that device. 7 years later and I'm still using it. However, recently it started to automatically download Sony software that Sony doesn't even support anymore which I can't uninstall. It also started to turn the audio down on my Bluetooth speaker thinking that it's a headphone. And it would turn off the Wi-Fi on its own in the middle of watching a video as part of some weird power saving thing. There is a clear pattern of Sony acting like it should have control over my device and that makes me very uncomfortable. So, it's going to make me think twice before purchasing a Sony phone or tablet again. Sony should be taking note here. The kind of people that steal from them are not customers, the statistics on piracy do not represent a realistic assessment and how much money you were actually losing, and attacking your customers is the single best way to cause a loss of Revenue. I would go so far as to say that would cost companies like Sony Revenue over the years had nothing to do with piracy and everything to do with their stance against it.

[@sheeplehunter9651]

"And the kind of person who would be pirating has no intention of buying their CDs so the [ _sic_ ] only really hurt their customers." This is a big assumption. Many people like to support some of their favorite artists and/or they want to own the actual disc along with liner notes if it's an album they really like (especially double albums and box sets). Yet these same people may frequently pirate songs from newer unfamiliar artists or songs from artists of whom they might like 3 or 4 songs that are spread across different albums. That "kind of person" whom pirates several songs by a band without buying any particular album might be willing, however, to pay $50-$100 dollars to see that band in concert if they are in the area for a tour date (especially if friends are interested in going as well). Some people are more inclined to spend money on an experience such as a concert event than they are to own that same band's album. I looked over the list of Sony Music's artists and for a few of them I've both purchased past albums as well as paid to see them in concert, while on the other hand there's about an equal number that I've seen live but wasn't driven to purchase any of their CDs.

[@mpawli10]

Man, your story is really fascinating.. you're spot on, and, though I'm only learning of this event today- the video combined with your story and a few others in the comments- I will never buy another Sony branded product. Thank you for sharing

[@steen8156]

This happened to me up in the great white north. Purchased the cd, ripped it, clicked no on a pop up. Little did I know, to Sony, no means yes. A very frustrating two days later, after a complete fresh install, I made a serious decision: never purchase another Sony product ever again. I was working in the film industry back then, and I could get very deep discounts on Sony products, so over years, I had a house and studio full of their products. To this day, I have not personally purchased a single Sony product since then... right down to the movies they produce. Unfortunately, in the professional realm, it is next to impossible to not use Sony gear.

[@me67galaxylife]

At it ! That’s how customers should behave !!!

[@Lovuschka]

Microsoft should have prevented ALL Sony products from running on Windows machines as a reply to that. Once a corporation starts to install malware, EVERYTHING by them should be treated as malware.

[@noxagonal]

Totalitarianism doesn't suit this situation too well, you'll just get people angry at Microsoft then. Though now that I think about it, I could live without Facebook... User should be made aware of this however and nothing should be installed without consent.

[@Lovuschka]

@@noxagonal Windows Defender prevents other malware from starting too. But you can add exceptions of your own That's where Sony should be, identified as possible malware. Users can allow it to install, if they manuzally add an exception But generally criminals like Denuvo, Sony, SecuROM, who install kernel level crap, need a complete virtual bullet to the head, i.e. completely be banned from systems just as a preventive measure, as nobody should have to deal with their malware.

[@noxagonal]

@@Lovuschka I don't feel quite as strongly about it as you do. I do agree Denuvo is a nuisance however and I do want an extra notification or confirmation when something like this is getting installed. I would definitely appreciate an extra confirmation step for Denuvo.

[@Lovuschka]

@@noxagonal I mean the anti-cheat, not the anti-tamper.

[@enlightendbel]

There's no simple way to detect something is a Sony product tho. Unless they keep track of everything Sony puts out and manually adds that to a filtering method, which takes a ton of money and time investment.

[@fleeb]

I remember this very well... in fact, to this day, I refuse to use Sony products because of their abysmal attitude towards consumers back then. The rootkit removal not only failed to remove the rootkit, not only did they make you agree to all those awful promotions, but they buried the thing under so much tiny print and various clicks that you were hard pressed to even find it, even if you explicitly sought it. I wish, so badly, they had collapsed as a company for this behavior as a warning to others.

[@swarthybullxxx]

Yep. Now dozens of others followed suit and even surpassed them in some ways.

[@KlodFather]

There was an internal war at Sony where the hardware people gained control of the company over the entertainment people who were killing the brand and making enemies of the customers. That is why there was a shift in the company. The assholes who made all the trouble were put in chains in sony basements, jails, and dungeons :P But seriously there were a lot of pinheads in charge that killed lots of great hardware tech that Sony was so good at making and with the change in the company they started selling MP3 boom boxes, players, car stereos and other great tech around 2008 or so. It was a hard climb for them out of that hole made by the entertainment assholes.

[@FB-rn1bn]

I too remember this well. I have come across movie DVDs that contain unprompted software to run as well. I have disabled "Autorun" on every machine I own ever since.

[@Voorhees-Jason]

Whats frustrating about this is that anyone else like you or I would do something like this we would be charged for computer crimes even back then there was laws and people were arrested for passing viruses and hacking even way before then.

[@Caffin8tor]

I remember this whole Rootkit debacle as I was doing server tech support for Dell back then. It all boils down to the sentiment that media/software piracy is more of a service problem than a social/moral problem. Music piracy is very nearly nonexistent (in western countries as least) thanks to the abundance of legitimate, inexpensive and easy to access online music services.

[@giglioflex]

The same drop in piracy happened in the game industry after Valve's steam platform gained significant traction and refinement. Gabe Newell himself said that piracy was a service problem and I have to agree.

[@tonybarfridge4369]

I'd say it was because everyone got all their music long ago before the industry died and there's just no sharing anymore because of nothing new worth sharing

[@lucasrem]

Sony is NOT western ! DELL would never do this.

[@Tigrou7777]

In the end, those who paid the price were the people who bought the CD and wanted to play it on their computer, not those who were making a business out of piracy (i.e. making copies and selling them).

[@nticompass]

Yes, DRM only hurts the legitimate customers, not the pirates.

[@Dargonhuman]

@@nticompass I've heard (rumors of course) that in most cases, it only takes serious, large scale pirates a few hours to just under a full day on average to defeat any new DRM that's put out.

[@bertblankenstein3738]

Perhaps Sony itself is the big loser. Legal actions, and LONG TERM boycotts by many people - even to this day. Piracy continued.

[@skilz8098]

So let me get this straight... it's taboo if one makes a copy of an audio file for archival purposes based on the premise that they could potentially one day make mass copies for profit... yet it's okay for a large corporations to infiltrate and take over your system via rootkits or "spyware"?

[@Fasteroid]

lol

[@DaVyze]

It gets even worse. I don't know how the US works, but here we pay for ever burnable CD, every USB Flash Drive, each Printer, each HDD, each SSD ... in short everything that COULD store copyright protected material. At the same time, we're not allowed to actually do that. Saying "Yeah, I need a Flash Drive so I can install a Linux Distro on it", doesn't count. No matter what you actually want to do with the devices, you have to pay this "tax". And if you think, this is bad: This "tax" is not collected by the goverment but by a private corporation. And for whatever reason, they can force other companies to follow their rules on this. Or they can sue you. Funny enough, the goverment decided customers must have a means to get their stuff back. If you buy a CD/DVD and it got DRM and the Disc breaks, you can (in theory) force the provider to give you a new one. Only if they don't and you can make a copy of it, are they free of this obligation. That's one of the reasns why DRM on Audio CD is "not a thing" here.

[@LiEnby]

@@DaVyze DRM on Audio CD's was almost never a thing

[@BaronVonQuiply]

Yes, but you don't understand. The other side is rich. That means it's legal.

[@BaronVonQuiply]

@@DaVyze Probably the biggest reason for lack of general DRM on audio CDs is the comparatively low tech of audio CD players. The player can only read PCM data off the disc, meaning the audio tracks have to be entirely exposed to the player because the player is incapable of any form of decryption. If they'd updated the format to include some form of obfuscation, all the old players would no longer work with new discs and the old discs might even have issues in new players. So what they often did instead was similar to PS1 and have a data track with a launcher, and then the audio tracks. So if you put it in a CD player it would play as normal, but if you put it in a CD-ROM drive the autorun would kick in and you'd be looking at a proprietary player that would try to hide the audio files and block copying. (eq, I tried copying one of my physical CDs to .mp3 format and ended up with a folder of shortcuts to the CD-ROM drive instead of wave files)

[@seanclark8452]

They'd replace the CD/DVD driver with a crippled one that preventing burning. It also made other scumbag DRM systems fail. So, when a co-worker played a Celie Dion CD she couldn't do her taxes because Turbo Tax DRM was disable by the sabotaged DVD driver the rootkit installed. Some corporate software had similar problems. The best part is that repairing Windows is a felony, even reformatting for a re-install is as that removes a content control device. But... installing deliberately destructive and persistent software without permission? A-OK. :/

[@PatThePerson]

*inserts windows install disk* FBI OPEN UP LET ME SEE YOUR HANDS IN THE AIR *guns drawn*

[@seanclark8452]

@@PatThePerson More like, the rootkit phone home feature collected your identity, you get a letter from a lawfirm saying they'll make a statutory claim unless you pay a settlement fee. MS/Adobe/Apple were doing that lots through their joint venture the BSA (the 'turn your employer in for stealing software for a cut of the fine' radio ads were them)

[@szr8]

The rootkit didn't replace the actual CD/DVD driver, but rather added a (lower) filter driver to the CD/DVD as well as an upper filter on the IDE controller channel; these filters basically intercepted I/O requests for those devices and did their own thing where it suited it. The CD one played watch dog on your optical drive and the IDE one did the cloaking, hiding any file starting with _$sys$_ from WINAPIs. In other words, abusing low level system facilities just like (and even worse that some) malware were known for doing.

[@kohlrak]

@@szr8 You act like sony wasn't making malware. COnsider for a moment that someone might bring over their own cd and play it on another person's computer whom might not buy music. "Yo, dude, you gotta hear this sick CD, man!"

[@marx4538]

@@kohlrak he literally said that it was like, if not worse than actual malware of the time. that person was merely informing, not defending sony.

[@Jeffs_Effects]

I remember this quite well. I was a Sony fanboy at the time (I had Sony everything), and this burned me for good. Afterwards got rid of all of my Sony devices (phone, receiver, speakers, TV, alarm clocks, etc) and haven’t bought a single Sony product since.

[@PhirePhlame]

There is another common reason for piracy: a lack of availability. This one has happened a lot with software in particular, as several games have been constrained to certain regions.

[@roycsinclair]

I remember disabling autorun because it was a bad idea from the start, auto installing viruses was a heavy price to pay for a touch of convenience. Yeah, now you get prompted but that should have been in the initial implementation though I'm afraid that's more hindsight than foresight as we spent too long just assuming most people would be nice.

[@roycsinclair]

@@stingcool9455 Microsoft was arrogant to be sure, but the truly arrogant company was their partner IBM from whom they learned that trait.

[@MattiKoopa]

@@stingcool9455 At this time, CDs were not really something people would deistribute malware with. They were mainly music or software you bought at the store. And every playback device would behave the same - meaning it would auto-play the CD when you inserted it. Windows just copied that behavior.

[@Ynno2]

@@MattiKoopa At what time? autorun.inf worked all the way up to XP to silently autorun software from all types of removable media (including floppy disks). It was certainly obvious by then how dangerous that was, because I remember disabling it on all my personal computers for security reasons.

[@DKboy001]

This is the kind of anti consumer behavior that I still see companies do today and it almost always leads to negative outcomes, or only ever benefits the companies that practice them.

[@perwestermark8920]

@Brap Nation It seldom does. Many of these tactics resulted in 10x or 100x more pirated software because the pirate scene had people that invested a lot of time into releasing safe and well working rips just to collect personal rep as a "professional" ripper. When DVD took off, the companies also started to make two releases. One quick and thin release. Then 6 months later they made a re-release with directors cut and lots of extra material. After having been tricked a couple of times to buy the movie twice, people learned it was worthless to buy the firat release and instead get a rip. And if there were no special edition released later, they stayed with the rip instead of buying the first release. So the attempt to sell two copies ended in many times with the movie comoanies selling zero copies. Pee on customers, and it *will* hit back in the end. Another ugly thing was all CD audio released with intentionally broken error correction to make a PC ripper fail to rip. But also removing the error correction intended to make the disk handle a scratch. I have a number of bought albums that can't play cleain on either PC or an audio player.

[@KritikallyAkklaimed]

Until the companies that do it are fined 500% of more of total revenue (not profit) gained from it, there's no reason not to. Do it, make money, if you get caught settle out of court for pennies on the dollar. Still profited from it!

[@okaro6595]

Content producers always see new technology primarily as a threat and not an opportunity. Disney tried to kill VCRs. Later it made millions selling copies of the Lion King. I think they should pay to Sony. Without technology the music producers would still sell sheet music.

[@doc_sav]

This video only touched on the fact that the recording industry was mandating nerfs on recording hardware of all kinds rather than trying... you know... some forward progress. It is a wonder we ever made it out of that era.

[@GeoNeilUK]

Have we really? How do you record things nowadays? In the olden days you could record from the radio onto a cassette or MiniDisc that was permanent and could be used in any other cassette or MiniDisc deck. In the day, you could record from the TV onto VHS or DVD, again permanent and portable, usable in any other video or DVD player. Nowadays, any kind of device that can actually record is rare, footage of modern TV tends to be from a phone pointed at the TV screen rather than a rip from a VHS, there's often no way of recording from radio (digital or analogue) you _might_ be able to do it on cassette... but only in mono. Entertainment that would have been recorded on something like a removable tape or disc that could survive decades, is now either steamed (as in, not recorded at all) or recorded onto a PVR, temporarily in an encrypted form to be deleted after viewing.

[@Bananananamann]

Nothing stops you from using USB VHS devices or cassette players, plenty of software for screen recording, ssds built into TVs... Not sure what you on about. Shaky smartphone recordings of TVs is because it's most convenient, always at hand and people are lazy. Not because "SoNy wOn tHe FiGhT aGaInSt ReCoRdINg"

[@GeoNeilUK]

@@Bananananamann "Nothing stops you from using USB VHS devices or cassette players" To record live TV and radio broadcast today? To capture streams? How do USB VHS and cassette players do that? "plenty of software for screen recording" Ah right, so instead of having a device with a media drive directly receiving the transmission with a button marked record you now have... a program on a PC. "ssds built into TVs..." Because VCRs and cassette recorders didn't have interchangeable tapes, nope, you had TVs and radios with a giant built-in reel of magnetic tape, just like the SSDs built into (some) TVs which I referred to in the post you responded to as PVRs. "Not sure what you on about. Shaky smartphone recordings of TVs is because it's most convenient, always at hand and people are lazy. Not because "SoNy wOn tHe FiGhT aGaInSt ReCoRdINg" Why is it smartphones that are the most convenient when earlier it would have been a VCR recording directly from transmission? That was lazy people did in the olden days, put in a tape and pressed record. But hey, you keep saying nothing changed and put it down to OmG yOu ToTaLlY hAtE sOnY. I'm sure it has nothing to do with the hardware manufacturers (eg Sony) buying up the software manufacturers (eg CBS Records, Columbia Pictures) between the days of Betamax and the days of BluRay.

[@alexs7670]

@@GeoNeilUK the knowledge barrier is a bit higher, but the technology is far better. You have to remember vcr recording was only really feasible from the late 80s to the early 2000's, At least for regular people. That being said, ripping video from steaming services is extremely easy so I don't think access is worse today. You just need the new skill set. But you should also know that the increased tax on recording equipment was implimented at about the same time as the parental advisory label was introduced. Frank zapp testified before congress that he believed it was a smokescreen being fueled by the riaa to try to force through taxes. And lots of cabel channels used similar notch filter tech to cause visual noise if you tried to record it with a vcr. The industry has always tried to mitigate piracy.

[@GeoNeilUK]

@@alexs7670 "the knowledge barrier is a bit higher, but the technology is far better." How so? Why should "better" tachnology be harder to use? "You have to remember vcr recording was only really feasible from the late 80s to the early 2000's, At least for regular people." Why? What happened since the early 2000s. Also, you do realise that you've just made my point. Why do you think this is a good thing? "That being said, ripping video from steaming services is extremely easy so I don't think access is worse today." OK, then. If it's extremely easy, how do you do it? "You just need the new skill set." What new skill set? Why is said skill set better and more convenient and extremely easy compared to "insert media, press record"? "But you should also know that the increased tax on recording equipment was implimented at about the same time as the parental advisory label was introduced." Nothing to do with this conversation. "Frank zapp testified before congress that he believed it was a smokescreen being fueled by the riaa to try to force through taxes." Nothing to do with this conversation. "And lots of cabel channels used similar notch filter tech to cause visual noise if you tried to record it with a vcr." Nothing to do with this conversation. "The industry has always tried to mitigate piracy." Or in other words, SoNy HaS aLwAyS bEeN fIgHtInG a WaR aGaInSt ReCoRdInG.

[@BigCar2]

Thanks Dave - fascinating background story. Did you know Ron Radko? He told me he co-created Autorun back in the Win95 days. He wasn't in the Windows team by the mid-90s though, he'd moved on to Windows CE where I met him.

[@johndododoe1411]

Ah yes, Windows CE, such a lovely system that I still work with regularly.

[@Mauronic100]

AT&T was going to use a 2600 Hz notch filter to prevent phreakers from hacking their phone system in the 80s. But, like the DAT story you mentioned it was abandoned due to the impact on audio quality.

[@johndododoe1411]

The obvious alternative actually chosen was to move signalling out if band where it could not be attacked by playing signal tones into the microphone . Unfortunately, the out of band digital signal system 7 is still routinely attacked by scammers faking their phone number .

[@vwestlife]

As my video about "copy-protected" CDs showed, there were other systems used by record companies on CDs from the early to mid 2000s which also tried their best to make playing and ripping CDs on your PC or Mac impossible or at least a frustrating experience -- although at least they didn't install a rootkit on your machine! And if you do still have any of the Sony CDs with XCP on it, the best thing to do is to hold down the Shift key when the computer is loading the disc, or better yet disable Autoplay entirely, to prevent it from attempting to install any software on your computer.

[@jackkraken3888]

Nice seeing you here!

[@georgeyreynolds]

I remember using a piece of OSS called grip which bypassed some of these methods such as adding physical disc defects which made reading difficult on a data level but CD players ignored. Still wasn't official Redbook though I think.

[@RiversJ]

Such attempts to block copying were very much illegal aswell in most countries prior to the 2010's. The whole justification for fees for recordable media is that it is legal to make a personal copy. They were their own worst enemy, what they needed to do was make sure you got the better product by buying it, not the other way around. Blind inchoate greed rarely ends well in the long term

[@paperbea]

I've never used autoplay.. even as a late teen on xp, I never trusted it out of anxieties.

[@RiversJ]

@@paperbea I just found it so insanely annoying that pretty much the first thing after installing windows always was mutilating the feature in a manner where it wouldn't even exist on my system (since sometimes it would run even if prefs said no).

[@dingokidneys]

This DRM fiasco was the reason I actively avoided buying Sony anything until very recently. I relented and bought a Blu-Ray player. It still makes me feel dirty.

[@RJARRRPCGP]

Albeit I was borrowing a 2005 Sony Cyber-shot DSC-S90 and I was elated! (back in 2008, the same year I joined KZbin)

[@laner989]

Personally I believe people in general want to be honest. I believe that the widespread sharing of music was cased by the demise of the single, now you had to pay $17 for 1 song people liked off a cd instead of $1 for the single. People rebeled against the music industry. Proof is now you can buy a song for $1 dollar, streaming paid services are successful, and music sharing is dramatically reduced. The music industry created the problem themselves, buy being overly greedy. Greed is good, until somebody wakes up.

[@melody3741]

The reason Sharing doesn't happen anymore is cause of Spotify, 8tracks, Pandora. And KZbin musical that ppl can just watch an ad to pay for.

[@CaptainWumbo]

There are a lot of reasons but mostly it's harder now because the internet is more predatory as an artifact of a lot more people doing online banking, so computers are more valuable targets. It's easier for people to stick to well known large services. The illusion of internet anonymity has also been dispelled, but 12 years ago people really thought they were invisible, especially kids. imo it's not really that people try to be honest, but people are afraid of consequences and are risk averse. Honesty is a relatively rare, usually slightly dysfunctional trait.

[@nekoimouto4639]

"Piracy is almost always a service problem." - Gabe Newell

[@Skank_and_Gutterboy]

@@CaptainWumbo I tend to disagree, I think people go in wanting to play it straight and turn to shady methods after they play by the rules and get screwed for their trouble. Just like in the workplace, most people don't show up day 1 wanting to be a pissy disgruntled employee. They usually get driven to that by an employer's poor leadership or employees that constantly lie, cheat, and screw each other over.

[@raygunsforronnie847]

@@Skank_and_Gutterboy People tend to give value to "easy" first, followed by cheap, and resorted to file 'sharing' piracy because the record industry was stuck in a model where they controlled the physical media. They were clueless, mostly, about how to monetize their catalog in the emerging digital market, to buyers who wanted convenience, selection, and non-sketchy billing. They remained clueless for close to 20 years, and the various purchase and streaming services - and armies of lawyers, agents, and accountants - created delivery products that were more in line with consumer desires. The only thing 2021 has in common with 1990 is that if a record label was in charge of it, you can bet the artist is getting the short end of the deal.

[@janwinterhagen8388]

On a general note: Your narration is FLAWLESS Despite being interested in whatever your videos are about (it was cooking amirite?), it in particular stands out. Proceed!

[@alexanderjones9766]

Since the DRM software was Windows-only, if you put the disc in a non-Windows computer (Linux, BSD, Solaris, etc), you could copy it just fine. Even on a Windows machine, you could just disable autorun or hold down the shift key.

[@stuartcastle2814]

I remember reading an article about piracy a few years ago. It was written at the start of the online music stores. It was about a study that was trying to work out how much money the record industry was losing to piracy. They came to the conclusion that there was a loss due to piracy but the main loss was caused by the fact that people who just wanted one or two tracks from a given album only had to purchase those tracks, whereas previously, they'd need to purchase the entire album. Why spent £9.99 (or $9,99) on an album when you could spend £1.58 or $1.58 for the two tracks you want?

[@RupertReynolds1962]

I used to disable autoplay and hold down for data CDs, but the PC was shared and somehow the Sony BMG Dido disc managed to pop up a window... I had to re-install everything (including a battle with SCSI drivers) to get full functionality back. I was in a bad mood that day, and ironically that's what made me decide to improve my defences, and then rip every CD to an open standard (.flac) :-)

[@stungunnotapplicable1953]

I still by instinct hold down shift every time I insert an optical disc (in the rare cases these days I ever have to use one) to bypass autoplay.

[@Grommish]

Oh, now it makes sense. Dave has always taken a "The OS should never lie to the user" approach, no wonder he took 16 years to cool down 😁🤣

[@DavesGarage]

Hee hee...

[@vincei4252]

@@DavesGarage This genuinely made me laugh.

[@BDJones055]

I heard Dave has a ....trouble history with honesty and company's he has been a part of. Check out Dave's fiasco with software online. Reading about Dave's shady practices has soured my opinion of him. At first I was extremely excited to hear about stuff "from the inside" but uts clearly just easy monetization for the channel owner.

[@greggv8]

@@DavesGarage so why does Windows Device Manager lie to the user about "unknown device" when it knows perfectly well what the device is? From Windows 95 to now it hides information that would help the user find driver software to make the devices work. Utilities like Unknown Device Identifier and Snappy Drivers identify what the hardware is so with UDI one may go and search for it, or with Snappy it will download a driver pack for the device class then extract and install the correct one. Then there's Microsoft's ever increasing application of making it more difficult to get to "Have disk", forcing the user to go through several pointless steps before they can shove the driver disk in and tell windows "There! The driver is ON THIS DISK! I could have already had this done if the *first* option was to SKIP the 'wizard'.". The last STUPID thing about The Install "Wizard" is the pointless MRU Registry key for it which it *doesn't actually use*. Rather than scan that MRU list to automatically find files, all it's ever been used for is populating the drop list the user must so often manually select from - which further increases user annoyance, especially for the less knowledgeable who don't know *where* the needed files are. I still remember my first encounter with this back in 1995 where I had a device that needed Win 95 to be held by its digital hand and led to the driver files, which for some reason required files to be copied from two different paths. Every time The "wizard" choked on a not found file, I had to "grab it by the nose" and select the other path, then back to the first one when it ran out of files again. Windows should have always had the ability to recursively search through all the paths stored in that MRU, but unless it's been changed very recently in Windows 10, it still doesn't. The same thing could happen with software installs - apparently installer authors expected the MRU lists to be *used by Windows* rather than being almost always for the user to manually control that part of Windows operation.

[@sploders1019]

@@greggv8 You do realize he's retired, right? The changes you describe most likely couldn't have been made by him, and Microsoft is a big company. One good person in Microsoft isn't going to make everything they do good. I can't stand Microsoft, but that doesn't mean I'm going to go to every ex-M$ employee on KZbin and crap on them for working there. That's not fair to them. Everyone's got their reasons for doing things, and even if they *were* involved in the things you hate about it, they're not now. There's nothing they can do to change it at this point, so there's no sense crapping on them for it

[@mar4kl]

Thank you so much for this, Dave! I remember the Sony DRM rootkit scandal. I didn't remember exactly when it happened, and by the mid 2000s, most of the CDs I was buying were Old Time Radio CDs for my parents, so I was blissfully unaffected by it. I used to wonder exactly how it worked, and now you have satisfied my curiosity.

[@alanmusicman3385]

Dave, I dealt with a lot of music companies during the early part of the digital music transition (late 1990s) and they were ALL in a blind panic that their role as sole gatekeepers between the talent and the public was being 100% subverted and they were all thrashing about looking for protection solutions that would work. There were a lot of people making a lot of money pitching and selling protection systems to them . I used to advise them that they were all wilfully ignoring ignoring a simple reality, which is that if music can be played it can be copied and what is the point of recorded music that nobody can play? We did a demo where we played a high quality CD on a player to whose speakers we had hooked up a PC audio input and showed what a good quality copy could be got that way - far better than any cassette to cassette copy. We then showed how quickly we could replicate the digital copy we made from HDD to HDD. A lot of these music company guys were very non-technical and were visibly shocked at this demo - and we usually concluded by advising them that we - as consultants - were advising them to look for ways to adapt their business model to suit this new state of affairs. Almost all of them said that no, they could not allow the gravy train which the record company business had been in the 20th Century to be derailed and they would continue looking for a foolproof protection system - and thus they went to war with their customers. Ironically, when the explosion of hard drive capacities made video collections possible about a decade later, the movie companies went through the same cycle and were forced to the same realisations as the music companies had been before them. I guess nobody wants to be told that what made them fat and happy is going away.

[@szr8]

Great video. I remember this all too well. Few things served as such a wide eye opener as this event. It was a massive breach of public trust, and it really showed how far companies were willing to go, and also showed how paying customers were ending up getting a worse over all experience from the pirates, something that was known since the 80s with game manuals and decoder trinkets (all while pirates happily traded cracked versions on BBSs and and such.) It really changed how DRM was viewed, given how we realized that campanies would utterly violate personal computers with what was effectively commercially-sanctioned malware (e.g., Secu-ROM, SafeDisc, Star Force, etc.) Even product activation was more often viewed what it was. I remember downloading simple tools that completely gutted out WPA on legitimate paid copies of Windows XP just so one wouldn't have to deal with it during hardware upgrades, etc. The scandle effected all media related industries. To this day a lot of people just do not trust the RIAA, MPAA, and related firms, and to be honest, any massive corporation in geneneral. Sony BGM seriously harmed much more than just themselves.

[@szr8]

As for the morality issue mentioned at 6:33, I always found this kind of strange considering the amount of music trading and copying from a friend's tape or CD, or from the radio, making mix tapes, et al, which was regarded by everyone (save for maybe the record industry itself) as perfectly acceptable behavior, back in the 80s and 90s; practically everyone I knew was doing this. This is how we discovered music. So the rise of Napster, WinMX, gnutella, et al, felt more like a natural jump from there with how technology itself was progressing. Keep in mind that most mp3s weren't the highest quality. Sometimes you could luck out and find as 320 kbps or so file, but most were around 128-160 or lower, which isn't a whole lot better than recording off the radio / from another tape/cd to a good quality tape. Not saying it was all OK, but it also wasn't a world of evil either.

[@singletona082]

Given I have a special needs little sister, and my older brother tended to treat CDs like coasters? Everyone got a folder on my computer where their CDs got ripped to and the original CDs put in a flipbook folder nice and safe. So when 'oh hey my cd broke!' 'ya which one?' ___ 'alright' and i'd have the replacement burned, sharpie'd, and everyone's happy. Gets really fun when you consider game systems. My sister has a wii (and had one since the thing launched.) She Loves it. She also has never gotten any better about handling discs. Fortunately homebrew exists to rip wii games to a hard drive, and the wii has a USB port in the back. So, same thing applies. All her games are nice and safe, and she gets to sing her little heart out (much to everyone else's annoyance because the girl Can Not sing...) Win/Win. As for sony's 'most people don't know about it so why should they care?'' Is literally like me going 'well most people don't know that I have a key to their house why should they care? The amount of arrogance on display there....

[@ErraticPT]

Autoplay was always the first thing you disabled after a fresh install of Windows back then. There was a crapload of root kits, malware, buggy drivers and simple infected software out there on CDs. DVDs also got similar root kit like "protection" malwares installed, usually bundled in with "enhanced experience" bloatware. But atleast you were warned by a single line of misleading text somewhere in some 50 page EULA and could usually uninstall it.

[@RupertReynolds1962]

Yes autorun started off handy, but soon got abused. I used to turn it off like a lot of people, but somehow it got turned on again, either by an installer, or by the other user. I learned a lesson that day :-)

[@nickwallette6201]

I remember seeing an interview with somebody at Microsoft prior to the launch of Windows 95, where they were talking about AutoPlay. The quote was something like, "The directions on how to install new software can literally be as simple as 'Insert the disc and follow the on-screen instructions.'" On the surface, I guess that sounds good. Or at least it makes for a good sound bite. But it misses a few very important points: 1) The "on-screen instructions" bit is a significant part of the technical burden of installing software. I don't think finding SETUP.EXE was or is the steepest part of the learning curve. Even for someone who has used a given software package before, the questions asked along the way about what should be installed, where to put it, how to handle upgrades, or whether to enable certain features... wasn't always intuitive, or even decipherable. Microsoft's "wizard" approach was meant to soften the blow of these gauntlets of jargon, but it just made the same non-sensical tech adventure more verbose, take longer, require more clicks to get through, and more difficult to script or summarize in walk-throughs. 2) Having things happen automatically, without any kind of sanity check, had already caused no end of trouble from the likes of (e.g.) boot sector viruses, so it wasn't exactly a new attack vector. It was just a new attack surface -- right when more average, non-techie consumers were starting to get computers.

[@afre3398]

Yeah the intention of autoplay was good. But it was a pesky function. Every time you inserted some kind of CD/DVD Windows nagged you with questions of what will you do with this media. So I killed it on every machine machine I had. It was also abused to spread virus

[@joe_ferreira]

"Enhance mouse pointer precision"

[@perwestermark8920]

Autorun was the worst. "Auto-accept something written by someone else based on what *they* think is best happening on your computer".

[@TheBunzinator]

I have to say that while I'm no fan of MS, due to its past malign behaviour involving customer lock-in attempts, the ISO 29500 debacle, license agreements with OEMs that preclude them from selling machines without an OS installed etc. etc., I really love your content - and I in no way blame you for any of MS's aforementioned unethical behaviour. Subscribed.

[@WmTyndale]

Most public announcements of Exploits are hugely technical in nature and provide even fairly knowledgeable individuals little useful actionable steps to take. More importantly they give little or no insight into how the exploit was "pulled off". THIS VIDEO WAS GREAT. You learn a bit of "computer science", coding etc. I'm a subscriber!

[@VegasGuy89183]

I always found autoplay to be intrusive and unhelpful. The first thing I always did when setting up a new system was to disable it.

[@johndododoe1411]

A bunch of other post-Dave changes are equally bad, such as almost everything done since 2014 .

[@WilliamHaisch]

I remember one could use a marker and cover the outside track of the Sony CD to disable the copy protection. Millions of dollars of copy protection defeated by a Sharpie. That’s why copy protection is such a scam and benefits no one.

[@LordChariot]

I remember doing that on a CD I had.

[@LordChariot]

I remember doing that on a CD I had.

[@trueriver1950]

Not sure how that would work, tho I know it did. The first track on an optical disk was the innermost one which contained the directory. That was deliberate so that a player did not need to know at the outset if it was a 5" disk or a smaller one. So I have always wondered how that defence worked...

[@UnitSe7en]

That's not why it's a scam.

[@Dj-Mccullough]

Wrong. It benefits the corporation to give their software a limited life, so that it will die without constant updates from them. Old drm wont work on new computers, making the software (without mods) useless. They use it to ensure you have nothing for what you paid for, when enough time passes.

[@egh3]

At the time I worked for a small company as their IT guy while in college. The owner of the company would give me CD's to copy so he could have a copy at home and in the office. He handed me one of Santana's greatest hits CD's and had me make a copy. A few days later I saw an article on Slashdot about the rootkit, and checked my work PC. At the time I was in a long term relationship with trying to run my Windows XP machines as a "limited" account. Which was frustrating in those days because many programs needed read/write access to the Program Files directory. (Or at least requested the permissions) I was probably one of the few people what were happy to see when Vista added the UAC dialog. Anyway, my PC did not have the rootkit, but my boss' PC did. Told him never to put CD in a PC ever, and wrote that on the label. He probably forgot and ignored that warning, but that is another story...

[@GeorgeMulak]

Thank you for this. Very interesting. I saw this coming many years ago. My wife was a pianist and accountant and so I am sensitive to this issue. What I did was always (yes always) buy the CD and rip it. I then stored it on a HDD and kept the CD. I still do this, and it is a pain. I "took advantage" of Google's music service and uploaded my 60+ GB of music to them so that I could stream my music at any time. They transferred this to KZbin. Now I can only get parts of my collection AND when I listen to some of my favorites, or try to they present me with their music first, or predominately, or after mine plays and I end up paying a premium for it anyway. To me it is evil. I have over 400 CDs and will eventually go back to putting it on my entertainment system and listening to it that way. Very frustrating. Thank you so much for sharing, you are amazing. God bless. BTW. I have never shared my library with anyone.

[@eskieguy9355]

Speaking from the radio side, I've heard, that Napster made obscure tracks available, so if you needed something not easily obtained, there it was. I thought at the time, that if the record companies fought Napster by going online, and even charging something per track, ala iTunes, they could have made bank. Along with opening up their back catalogs, but they were too stuck in the old ways of doing things, they had to be dragged screaming and kicking into the 20th century.

[@furzkram]

Sony promised that at least ONE digital copy could be made from CD to MiniDisc using the optical connection. Bought a Sony audio CD, inserted it into a Sony CD player, got a Sony MiniDisc recorder ready to record, started playing the CD and recording synchroneously, and after less than 10 seconds the MD player reported "directory full". The whole MD was filled with one second long empty tracks. Thanks, Sony. That was the day I stopped buying and using ANY Sony things. For good.

[@ohwow2074]

Your decision was dead wrong. But whatever...

[@luckymcgamer7747]

​the thing can be bypassed by disabling autorun, open the disk, and do piracy. actually just commit piracy in the first place and you can avoid the whole shenanigans without changing settings

[@DavesGarage]

Or just buy your music and software legally, that works too!

[@iwh7]

@@DavesGarage Here in germany you have the explIcit right for a backup copy and even the right to make private copies for friends you personaly know. Have bought hundreds of cds over time and at a time i simply stopped using them. i listend 99 % over my pc and still do ;-). I shure as hell wont buy the stuff again, already payed for it. So extracted with EAC and compressed with flac / lame mp3. Saved a few of those cd´s which i cant read anymore. They are waiting in the basement in a box. My Flacs are still readable from the Backup. But at the end when you as a legitimate buyer / customer get punished for buying. Whats the point? Rather support the Artist directly if anyhow possible and skip the unnecessary middleman. And for piracy, someone always will find a way, so putting to much effort / money in copy protection AGAIN punishes the legitimate customer. And by the way thank you for your very informative videos.

[@blahorgaslisk7763]

@@DavesGarage Thing is it was those who bought their music legally that got burned... Alienating your customers. Way to go Sony! I was there and I remember the whole thing. It was as you said a disaster that Sony unleashed. I never had a disk infected by this root kit, but just the way they behaved made me put Sony on my personal Blacklist and to this day I actively try to avoid having anything to do with Sony products. Yep I know it's silly to hold a grudge to a company like Sony, but so far I haven't seen a product from Sony that I can't find an equal or better alternative to.

[@glubothemad]

@@DavesGarage problem is when a legal copy is an inferior version so your paradoxical best option is to buy for a good conscience but use a better pirated version of the product :(

[@Juanguar]

@@DavesGarage so what you’re saying is that I should just take the rootkit

[@spudhead169]

I had a list of things to do with a new install of Windows before I did anything else. Things such as setting all folder views to details with only date, size and file name columns, turning off hiding of known file extensions, setting the background to just a solid color etc.. One of those things was to disable autorun. The list has expended over the years and now includes (b ut not limited to): never combining taskbar items (Windows 11 made this trickier), installing and defaulting a decent browser, debloating & pruning, disabling telemetry (admittedly this is mostly done by OpenWrt on my router but there is some blocking on the OS), installing Visual Studio (Solves so many potential problems later on), turning hibernation off and setting up a RAM drive for the temp folders and browser caching (I want my SSD to last).

[@liesdamnlies3372]

…man. That sounds like getting to the point of having more manual setup to do than when I install Linux (w/ KDE). :|

[@geoffstrickler]

If you have sufficient RAM, SWAP will be small and won’t materially affect the life of your SSD. Allocating a RAM drive will increase swapping, but as you put your swap on the RAM drive, probably won’t notably impact performance except in extreme cases. One good thing about doing that is it compensates for an absurd issue with Windows cache memory management which allows disc reads to force extra writes to the swap file, which slows both read and write processes and hurts multi-tasking, so there are potential benefits…so long as you have sufficient RAM.

[@jayzo]

So is disabling the combining of taskbar items possible on Win11, or do I need 3rd party tools?

[@liesdamnlies3372]

@@geoffstrickler Oof. And here I am needing to add at least 32GB more to make a RAM drive to replace swap (have 32GB in dual-channel right now).

[@nickwallette6201]

Modern SSDs are a lot smarter about wear-leveling, and have such high TBW figures that you would have to be hitting the cache and logs pretty hard to be a problem in the useful lifetime of that disk. If you're the kind of person that wants to be using the same disk in 10+ years, maybe ... _maybe_ ... you could take some steps. (*) Swap shouldn't even be a consideration now. RAM is cheaper than it used to be, and we all have enough of it these days that we don't need to keep moving working sets in and out of memory. Software has also gotten more sophisticated, and capable of streaming assets into memory as needed, then discarding them when not needed, so the shuffling to/from disk takes place on the app level instead of the OS level. * Granted, I do this (RAM-disk log storage) on my DIY Linux appliances, because I used to use Compact Flash cards as solid state storage, and those didn't have the write-cycles of modern SSDs. I then moved to DOMs, which were also not quite as good as where we are today. Now, I use USB thumb drives or SD cards or small (8GB, 32GB, etc.) flash storage, which won't have quite the number of cells to spread those writes over. Even still, I probably don't really need to bother anymore, but it's kind of just part of the procedure now.

[@malectric]

Dave, this suddenly reminded me of a simple trick I used to read user data files from a windows disk which had a trashed operating system on it. I ended up making up a phrase "Linux doesn't care about WIndows security".

[@alfonsorodriguez5449]

I remember buying a Rolling Stones cd that was also 'multimedia' so you could hear it normally on a cd player, but if inserted on a Windows PC, it would let you hear and at the same time have a fancy graphic of the group. It was nothing special, but at the time (late '90 if I remember well) this type of CDs with additional content were all the rage. I did check one or two times the so called multimedia content, and later found out that it had installed some kind of rootkit. The computer began to work odd , and so searching on forums and so I found out that it was this thing that got installed. Never again I installed anything coming from a music cd.

[@jonathansturm4163]

I own ~2,500 music CDs. Hardly any of the Sony titles were purchased new after Sony infected my computer with their rootkit. No idea how many Sony customers were sufficiently pissed off as I was to effectively boycott them. It didn’t help that my Sony 19 inch monitor took five months to be repaired under warranty. Needless to say I never purchased a Sony TV or other equipment since.

[@elosacle]

If I'd have heard of this earlier, I wouldn't have bought anything from Sony either. I think I was a young kid at the time they did this. That being said, their hostility towards their paying customers still continues to this day.

[@uzaiyaro]

Gotta love anti-user digital restrictions management. Why treat some people like criminals when you can go the route of equality and treat everyone like one?

[@Dj-Mccullough]

Havent you heard? Equality is out because its racist. and EqUiTy is here now. So those who can shout you down will, and dont you dare defend yourself or else...

[@grumpyoldman5368]

I realize auto-run was to reduce calls from people that can't find the "any" key. However, I wish that if you bought the "pro" version of the OS that it came defaulted with all the consumer protection crap turned off: no auto-run, let me decide how I want to handle the new IP address, etc. If you buy "home" version then you are treated as the untrusted end user that you are, buy "pro" and you are responsible for your own actions. So tired of the OS thinking it knows more than I do, and not trustable with all the unnecessary telemetry reporting, edge firewalls FTW. Switching everything to Linux and maybe a Mac for the wife.

[@kibe2134]

I like the fact that your name fits your personality. But you're right, Windows has become condescending with time.

[@gergelyvarju6679]

I have tried Linux as desktop OS several times in my life, and it never went well. Mostly because Linux folks almost thought they know better what I would need, and that an "ideologically superior software" that might just offer you a choice between an outdated version with security holes, and an updated version with changes that break compatibility and can stop "critical" systems is better than telemetry. Even if they lack key features you need, even if their changes can lead to pretty bad thing their zealotry is superior. When they explain why people should choose GPL over LGPL for a library, they speak about how these things can trick people and force them to go GPL... If it bankrupts the company and cost your coworkers their job and their house might get foreclosed, you should still focus on dishonest zealotry. Yet Linux is good at selling pretty standard stuff to users who can't find the "any" key. When the Linux community with its toxic elements betrayed companies that tried to focus on Linux (I have used Nokia N900, and remember how things with maemo and meego went, how plenty of linux phones had even less apps that Windows Mobile) when those companies were forced to back down, there is drama and the toxic elements of Linux community play the "we are the victims, we were betrayed" card and complain about lack of support. I feel that those problems make Linux far less trustable than Windows. On the other hand, when I have ended up using various BSD variants, we have seen how the people behind them doesn't encourage deception, but encourage honesty, free market, and adequate products that are good for a specific purpose. Yes, most BSD distributions aren't as user shiny (graphically) and user friendly than some Linux distributions (Darwin and the commercial stuff built on Darwin are user friendly BSD variants), but they tend to be very reliable, trustable, etc. with far less unwanted drama.

[@BosesBjorn]

I agree with the sentiment, but I think the trouble with removing that stuff from Pro versions is that a lot of people in professional environments don't know any more than a basic consumer. I work in IT and I've had to explain to people how to open up file explorer and find their downloads folder.

[@gh8447]

@@kibe2134 There's a reason old men become grumpy - a lifelong struggle putting up with other people's bullshit! 😄

[@KiraSlith]

Yeah it's the same problem in Linux though, with the added "benefit" of the powerusers being jerks and functions being put in obscure places you have no way to find on your own. No matter which way you swing it with Linux though, I hope you like regularly using the command line and editing massive batch scripts like we're back in the late 80s again. Because all hail the Command Line, true god of the computer, may he bless your soul with binary bliss and -I'm already tired of this bit.

[@MrPir84free]

I didn't learn about the term rootkit until the time of Sony's blunder. However, I became more familiar with the concept doing IT work circa 2006. After learning more about such things after "a set of incidents", I realized that I had already written code, in assembly, back around 1993/1994 that used some of the same functions, with a non-nefarious purpose - to protect certain system files from modifications by, well, a colleague that liked to install wasteful and bothersome screensavers ( DOS 3.something ) . The rootkits from 2006, well, along with the rootkit files, also contained plain text copies of everyone's logins & passwords. It took Symantec 3 months to figure out what the files actually were; after which I noticed that the files were also in a few remote offices.. Actually used rootkit revealer back in 2006 to discover the cause of some systems that kept getting re-infected with a relatively benign - unrelated - virus..

[@jabiraidan]

First off, very nice cause, approved. Second, for me as an "archiver" it was literally just that. Part of my going to digital was hard copies have a tendency to well break (I spent £120 approx, twice replacing my damaged copy of FFVIII and unfortunately not every CD was good the first time around). Where piracy still has a place however is the shark like practices companies exhibit with regards to "your" purchase, they view it as not a purchase but a lease, one they can revoke at their leisure, be it shutting down the servers or throttling your media by region locking it. Now granted when I was a wee lad I couldn't afford all the music, movies and PC games I really wanted to experience so, sadly pirated, which I got bit hard quite a few times (but I did vow that once I earned I would buy everything in either digital or hard copy, and best to my knowledge I have, go me).

[@OverDriveOnline7921]

I remember this happening and at the time people would put small music collections on their laptops for when they were working away. Work was fine with that so long as they could prove they owned the CD and that none of this music would end up on the corporate servers. But when the weaknesses on Sony’s DRM were exploited, the problems this caused the IT department ended up with the consultancy department I was in being diverted to fixing the issues rather than generating revenue for the company… Last I heard, the MD was contacting Sony for compensation for the lost revenue, no idea what happened after that as I went to work elsewhere not long after

[@christianankerstjerne]

Speaking of bugs in Windows' calculator: In some early international versions, the unit conversion feature in the calculator translated 'Volume' (liters, gallons, pints, etc.) to the local language word for audio volume, not physical volume.

[@tactileslut]

Pints make a lot of people louder.

[@cheeseisgud7311]

They did this recently with English UK, calling zip files postal codes iirc

[@okaro6595]

Such localization issues are quite common. In Finland the term used for hibernate on XP was used for sleep in Vista and newer versions. One funny was in the Nero Burning Rom. It has two buttons: "Add" to add files to the disc and "More" to give more options. In Finnish the same word is used for both. The worst localization bug is how Excel treats CSV files. In Finland it uses comma for the decimal point and semicolon as a separator. That means it just cannot read CSV files from the net. I have Libre Office only for this purpose.

[@UmVtCg]

"Collector instinct" that's a good one Dave. I call it "digital hoarding" and personally I'm a big one. I never let Sony slow me down even for a millisecond. And I like to play open world role playing games like now Microsoft owned IP Skyrim. And in those games I hoard, pick up and collect every object I encounter to the point of a compulsory neurosis.

[@rodneysmith1750]

I agree, and like yourself, if you put me into a "collecting gaming environment" I am as happy as a pig rolling around in a pigstye.

[@afre3398]

It was a time when I downloaded any kind of pirated software. I burned it to a CD/DVD and label it and put some drawer never to be looked at again. And not if but when a new version came out it was rinse and repeat. Some years ago a threw several boxes of CDs/DVDs in the trash. Well some of the reason was that the hard drives back in the days was not that big. But is was also some thought that wow this software is so cool I must store it safe. because tomorrow the source can be gone, Doh what was I thinking

[@edwardallenthree]

This is why I quit streaming and started buying music. My collector instinct loves the physical media.

[@srpenguinbr]

@@afre3398 Download 100GB of music just in case there's a nuclear war and the internet ends (or that one song gets removed from Spotify) I use yt-dlp a lot to download online classes my teachers upload because I prefer playing them on VLC and because they don't need the ad revenue. That's also why I'm a fan of FOSS. Why pirate if there's a free alternative that's enough for home use?

[@DustinRodriguez1_0]

I am the same. If I weren't digital hoarding I'd end up physically doing it which would present far more problems than the 60TB of usable disk space has. Anti-piracy measures have never done anything to dissuade pirates. There is exactly 1 effective anti-piracy measure (that doesn't involve creating a better product or offering a better service, which was always something they were never willing to even consider considering) - put functional and non-replicable aspects of the thing on a remote server operated and physically controlled by the publisher. That, of course, costs the publisher money and effort, and while they do indeed 'publish' things, the only value labels ever actually provided that was worth their price was distribution. Which is now a service provided for free, or which can be provided by a child as a hobby, and provided more effectively than the labels are permitted by their distribution agreements to accomplish. The album might be ready right now, but a label can't just sell it to consumers. They have to make sure their physical retail outlets have time to get discs that were pressed, labels printed, boxes stuffed, boxes shipped across the country, those boxes unloaded and stacked onto shelves, so that every retailer can offer it for sale at the same moment coast to coast. Putting it online would violate those agreements. THAT is why record stores closed. They were not willing to renegotiate those retail distribution contracts. They thought they could force the publishers hands. But, stunningly, publishers chose iTunes instead even though it required they offer individual songs, for a flat price, which guaranteed the ability for people to burn regular CD copies of their M4A files. It was wild.

[@donwilber1628]

I was a Sony fan until I purchased one of the very first CD players back in the early 80s. CD players were running $600-$1000 at that time. I had a coupon from them for $100 off the purchase, which needed to be mailed in. Sony wrote back saying I wasn't eligible because this was for US addresses only. Well, my mailing address was APO NY (a US military address), and the coupon was marketed in a military periodical. So, they were basically refusing to honor the coupon to the audience they marketed it to. So, to this day I still say at every opportunity...FUCK SONY.

[@davidewhite69]

I witnessed the "collector instinct" way back in the early 90s. A friend who had an Amiga had over a thousand floppy disks, nearly every program known to that system. The weird thing was he only played a couple of games, the rest just sat on his shelves. He HAD to have anything and everything that came out. BTW, were Linux users effected by this root kit?

[@TheDarkestPhoenix]

“The easiest way to stop piracy is not by putting antipiracy technology to work. ... It's by giving those people a service that's better than what they're receiving from the pirates.” Words of wisdom from Gabe Newell, and one that helped Valve dominate and continue to dominate the game space. And one that I feel a lot of companies keep forgetting. That is the reason, in my opinion, why those streaming services provide such a good revenue stream.

[@goldcd]

I can assure you that Valve is quite happily shipping games with Denuvo etc. But I'm being pedantic - I love Steam to bits. DRM is like taxes - if not onerous, I can see the role they play and the indirect benefit I get. Rise of Steam co-incided with me actually having money - and I agree with Gabe's sentiment. Steam is pretty damn frictionless and provides all manner of benefits (auto-updating, cloud saves, IM, reviews etc etc). The games are available elsewhere, but I prefer them on Steam because of the value Steam adds. (unlike the current bun-fights on mobile - Steam was always just an option on the PC and had to fight for and keep consumer loyalty)

[@ozmobozo]

@@goldcd You're speaking out of your ass. Valve and steam are two different things. Let me give you an example, Half Life 2 is a game made by VALVE which you can buy using STEAM. And it's DRM free, meaning you can copy the game files and play it in another computer without even installing Steam. So you need to blame dumb companies for implementing denuvo, not Steam. Especially not Valve.

[@Skank_and_Gutterboy]

Very true. The more they tighten their grip, the more they increase demand for pirated products. Yeah, go give a greater market-share to the pirates, great plan!

[@goldcd]

@@ozmobozo Different in that Valve wholly owns Steam? Steam allowis third parties to sell games with DRM, and therefore "Steam owned by Valve" is the largest supplier of DRM games to the PC market. Valve could, if they wanted to, only ship games without DRM - like CDPR's GoG. Downside would be they'd lose publishers demanding their games ship with DRM and Valve likes making money.

[@stevedixon921]

Mostly agree with the sentiment here. Steam is a great game delivery platform. I have a single point where I can download and install any game in my collection. The convenience of Steam outweighs my frugal tendencies and keeps me uninterested in 'piratic alternatives'. When Valve opened up Steam to third parties it really took over the market. Not perfect, they take a huge chunk off the top for themselves, but if you can tolerate their terms its a good delivery model. Valve no longer needs to make games thanks to the revenue from Steam (yes, I know they are different companies, but think one is the parent of the other, unless I've been misinformed). Now, if Steam were to remove *anything* from my library I'd be extremely upset and re-evaluating their need to exist.

[@SuperSmashDolls]

One of the things I remember hearing about Sony XCP was that security researchers had learned about this and refused to publish it, owing to the aggressive overprosecution the Adobe and the US did to Elcomsoft over tools that decrypted ebooks for screen reader use. DMCA 1201, the law that gives DRM legal force, *does* have exceptions for security research that would have protected them from Sony litigation. However, not a lot of people actually knew this. They just knew that this new and annoying law that had been policy-laundered through the WTO meant that anything DRM-shaped was radioactive. And this was not an irrational fear: even third-party printer cartridge and garage door opener companies have been legally dogged for *decades* over misinterpretations of 1201 that SCOTUS had to fix, at the aforementioned companies' expense. Even if Congress did not intend it to be as such; most companies still believe 1201 is a blank check to sue people for contempt of business model, and it needs to be dramatically limited to stop these nuisance lawsuits.

[@seanclark8452]

Yep. It's a felony count for each person you tell about the malware; another felony if you tell them how to remove the infection; a felony for possessing tools to remove the malware and another for using them. If found guilty of each offense in the DMCA you could trigger a 'three strikes' law for clearing the infection from a single computer. It made work as a corp IT person risky when business software DRM failed as a result of the Movie/Music industry drive by malware installs and you were ordered to 'just fix it'.

[@retrozvoc6189]

@@seanclark8452 And I wouldn't be surprised that this is the reason why hackers pwnd Sony later down the road.

[@seanclark8452]

@@retrozvoc6189 I wouldn't be surprised either. They earned lasting ire from me with that episode, that's for sure.

[@jacekatalakis8316]

Wait what? I don't know abou the latter one... Go on. I want to know now. Surely you could argue in the US an ADA/DMCA case for decrypting for access for disabled users?

[@SuperSmashDolls]

@@jacekatalakis8316 The problem with Elcomsoft is twofold: 1. Adobe pushed the US government to overprosecute 2. All of the exceptions for allowable circumvention do not apply to the part of the law that bans distributing circumvention tools AFAIK the US government more or less let Elcomsoft settle the case as long as they agreed to leave the US. However, #2 still remains. Even if the US government says it is legal to crack an ebook so that you can read it with a screen reader, it is illegal to give someone a tool that lets them crack the ebook so they can read it with a screen reader. Or, at the very least, you'll have to spend 10 years and millions of dollars defending yourself to get SCOTUS to realize and patch the obvious gaping hole in the law. This applies for every other exception in DMCA 1201: jailbreaking, right-to-repair, emulation, security research, putting movie clips in documentaries, and so on. You can break DRM in order to do any of those things but you can't tell anyone how.

[@DrakeDaraitis]

A story I’ve heard thousands of times and yet this video from you revealed to me a whole other side to it. Super great stuff Dave! I’m only a 20 something year old and I’m glad because it means all the stuff I heard as a kid and young teen now gets fully explained to me by software devs from Microsoft who’ve since retired (;

[@MrReese]

One thing that got overlooked in the video when talking about "why" people pirated stuff...is the in my opinion most obvious one: they wanna have it but they either don't have the money or don't wanna spend the money. I am gonna paint a completely hypothetical picture here now. There was a 13-year-old who grew up in the 90s and was hooked on music from the moment he bought his first CD, "Americana" by Offspring in ~1998 that was suggested by a friend of his. This love for music only got worse when basic cable in his home country in EU started showing Mtv. This 13-year-old then wanted to listen to music whenever possible and so one day he got a Sharp Minidisc player as a present for his birthday. Being the 13-year-old that he was his funds to buy all the music he wanted were very limited, but Internet connections got a big boost with ADSL at the time and that opened up a whole new world to him. Back then there was no KZbin, there was no Spotify, there was no flat-rate streaming (or probably any streaming), but there was a certain software that was mentioned in this video that could download music files and he could then record them onto his Minidisc player - and they both lived happily ever after! btw, Mark Russinovich is a genius, I have been using his Sys Internals tools for ages :).

[@LordCarpenter]

Holy jamoley! You kept me totally spellbound for 20 minutes 46 seconds. Makes one wonder how many other nefarious forces are creeping around under the hoods of our PCs.

[@magnusnordlund3787]

The funny thing was that you could quite easily rawdump the discs anyway. I never even had to fiddle around - it just worked. Maybe I had a weird CD reader...

[@emblemi6345]

Rawdump means? Those were technically data cd so you can just dd it. But the content is encrypted as is.

[@nickwallette6201]

@@emblemi6345 ... no, not that I'm aware of. After all, it has to play in a standard audio CD player, so it has to have a standard audio CD layout. The only real options to obfuscate the CDDA is to prevent the standard Windows API from seeing it (which, it sounds like, is what they did), or fiddle with the sessions. A normal audio CD player would only parse the first session, but a CD-ROM would look for the last session, and you can omit parts of the previous TOCs in later sessions. That can be worked around by specifically selecting an earlier session, though.

[@kelvinstokes996]

It was also dead trivial to rip them via a cd player and an analog input.

[@SenileOtaku]

Remember, it was a *MSWindows* rootkit. No problem ripping disks on other operating systems. Heck, the CD Duplicator I used at a multimedia software company (running some version of MS-DOS as I recall) could have done it (copy, not ripping). For my own usage, I'm ripping actual records, you know, the ones made of "vinyl" (or whatever the correct plastic formulation name is). Other than that, I'm buying Doujin and Vocaloid music from iTunes, Booth or Bandcamp (they're independent artists, so I can support them directly rather than big-name record label that steals most of the money).

[@sjoervanderploeg4340]

No, you dumped the drive using direct IO instead of WINASPI back in those days!

[@CristiNeagu]

Man, isn't that weird. We're all used to having a company we love screw us over in one way or another. But it's never at all personal, in any way. But to have a company you love go after your work in particular? Wow. That's pretty cool.

[@ehsnils]

I'm one of the persons that really hate the autorun feature and turns it off as one of the first thing I do after installing a new system, and that might have saved me from that root kit (but I don't know if I have such a CD). After all my feelings when hearing of this would be "how stupid can you get to make such a root kit".

[@jontnoneya3404]

WOW! I remember this period of time but I certainly didn't understand it very well. This was also during the time of RIAA's massive lawsuit judgements against regular citizens for sharing like 10 songs on Kazaa and other sharing services. Crazy times!

[@RickyTickyTshirt]

Loved this flash back in time from the inside view point. As an aged user/client/hacker type I so see me in your references of collecting; a thing were only now shedding...!! Thanks Dave.

[@Hauketal]

In Germany they are just now in a lawsuit trying something similar with the internet DNS. One DNS resolver in Switzerland, just doing recursive resolving, should refrain from answering about a certain name hosting something from Sony. The courts have until now granted their wish, but the is still a level of appeals. This just reinforced my years old aversion to Sony from the rootkit times. They are blacklisted from any buying wishes by me.

[@DustinRodriguez1_0]

Heh, you mention the pucker factor on modifying something like Calculator... I worked on a system with similar issues. One where the only time the system went down for a grand total of 15 minutes, it was on CNN in the cafeteria within 5. (Not software! A test on switching between the two separate utilities providing electricity to the site (which also had its own power generation facility) resulted in (I was told) a giant busbar welding itself in place, destroying the main power delivery apparatus entirely AND removing the ability to switch to the on-site power generation). That and working on specific components that oversaw the handling of tens of millions of dollars worth of transactions per customer, with both internal and external auditors regularly doing their thing being anal about every penny... there were times it could be stressful. But that's a good kind of stress. Where as long as your code is solid, you'll be OK. The only stress that really bothered me was the 'office politics' kind which was thankfully fairly rare. You are actually incorrect about the 'personal backup' aspect of copyright law. There is no such justification which can be used unless the copyright holder specifically permits it. Copyright law is interesting and has always fascinated me, how the legal system approaches what is essentially just a large number (any file) and pretends like it is as distinct and immutable as a physical thing like a painting or analog record.... without ever actually dealing with that core issue at all. The definition of what qualifies as a "copy" to a court often surprises 'computer people' (anyone who understands how data works). There is a landmark precedent-setting case which establishes that a copy of data in RAM? That is a separate copy than the copy of the work on disk. And even if you have rights to have the copy on disk, you probably do not have any right to the copy in RAM (and with software, that copy is very likely a derivative work since it is likely not an identical sequential copy of the sectors on disk, to say nothing of paging and the vagaries of memory management). A company was running a system, and the OS was loaded into RAM. They did not have a copy of it on any disk or tape or anything. They were still judged to have violated the copyright and made to pay damages. I know what you're thinking - data copies have to be created in RAM just to move data around. Those are exempt. The copies which exist only ephemerally in things like network switches as it transits the network ARE copies covered by copyright law, but are specifically exempt under precedent. There is no definite amount of time which defines when a copy is 'ephemeral' but it is routinely assumed that for something like playing a song, as long as the data is unloaded from RAM after playback, it is presumed an 'implied license' exists to have the copy during the playback. If it persists after that, you are almost certainly breaking federal law and violating international treaties. Canada does have a 'personal copy' law, and they also give a kickback to media industry people that adds a few cents to the purchase of blank media, making personal 'piracy' lawful (not exactly piracy then). The Internet always guaranteed the death of record labels... but piracy has nothing to do with it. The service that record labels provided which created value was primarily (to the degree that it was very nearly the only thing of value they ever provided) distribution. The Internet makes them providing that service even worse than worthless. In fact, their own distribution networks, which operate through retail distribution agreements, are restrictive (requiring the publisher not make the works available through any other means sooner or at a lower price or as a more attractive package, ie iTunes)- making the service they provide to artists and consumers even WORSE than something any clever 12 year old can (and do) do in their spare time for free. You can't build an empire on a service that children can outperform you at as a hobby. Whether people continued buying the stuff labels distributed or not, artists were guaranteed to abandon them in favor of Internet-centric options which give them a direct relationship and instant release windows without scalping 99%+ of the sales money. Sure they could limp along providing marketing and other services - but that's only if they were willing to radically (and I mean radically) slash the cut they take. And have you seen how American businesses handle it when growth simply slows? The idea of actually shrinking isn't even in the nomenclature! To cope, those companies turned to attacking their own customers. Which worked about as well as can be expected. Now today if you're an artist, do you sign with BMG and agree to give them 99% of the sales (and they will even lie about your sales numbers, since they control what they report to you)? Or do you just put it on iTunes or elsewhere and get a radically larger amount? It's not even a question. Only artists manufactured by record labels go with record labels. Anything else is financial suicide in most cases.

[@ltsiver]

Steve Gibson loves to point out the inherent security flaws in Windows that caused many troubles back in the day and continues to today - that tradeoff between convenience and security.

[@marcelhh2101]

Yeh good point that microsoft lets trainee developers develop this important parts of the core OS. What could possibly go wrong.

[@madcockney]

In the UK when Napster started up until it's demise a lot of radio stations used it for music that they could not get from other sources. It had probably been deleted from catalogues, no other available sources and better still it had immediate downloads. Most of that music would get paid for via the various licence to play music and mechanically copy it so the artist, composer, publisher, etc would get paid. That was the downside when Napster went, other sorces often cannot do that so a different system was required that certainly wasn't available then. (I do agree that what artists, etc get paid is too low with streaming services.) I had already been using the tools that Mark Russinovich had produced (Winternals) before it was acquired by MS. I can remember this clearly as I was a Network Manager at a large secondary school in 2003 and we all know what students and staff do with music CDs. It caused some issues not only this way but for some other software, some on CDs that schools legitimately used. It was not uncommon to have to re-image computers and then do it again a few days later and sometimes on the same day. When the rootkit removal tools became available we used to use them, and over time the Anti-Virus systems started to detect these types of things. (IIRC some anti-v would stop you running the CD, etc if either normal viruses or rootkits were detected.) Sony from memory were saying that no copies whatsoever should be made even for legitimate purposes and were trying to circumvent local laws and regulations. If you want a further copy to play elsewhere then you need to purchase it in that format. (The Sony Minidisc debacle is another interesting story.) Sony did their brand name a lot of damage across multiple industries in those days. However MS also got it wrong on several occasions which appears to coincide with whoever was running MS at the time. These days I tend to use Linux and Android the majority of the time.

[@Borsting89]

The takeaway I get from this is Microsofts inability to judge the increased attack surface that came with auto-running inserted CD`s. Yes, you can blame Sony and other adversaries for infecting your computer, but I believe an OS`s security goes before convenience.

[@hanro50]

Well this was an issue in XP. Basically XP ran everything at an administrative level to maintain backwards compatibility with Windows 9X. Windows Vista fixed it with UAC and added some more sandboxing into the mix. In truth. Windows still suffers from the fact 9X had virtually no concept of security.

[@OH2023-cj9if]

We still have useless people at Microsoft, they are still leaving us at risk

[@RonnyJakobsson]

Thank you Dave. I really had forgotten this happened. I actually got the root kit on my computer back in the day and had to reinstall XP from scratch. After that i disabled CD autrun forever.

[@lotekchapra]

The failure of the whole piracy thing back then was the failure to highlight how little the artist actually gets paid. instead it was truly bigger companies purse clutching and using the artist as an image that they could rally people behind. Most pirates I think ignorantly thought that the recording/publishing company would be hurt over the artist but me included failed to realize that the companies would sacrifice the livelihood of their artists in order to save themselves. though now days with more platforms like bandcamp and napster coming back as a streaming service its still not that much better but i do believe the mass piracy then aided a little bit to the freedom of choice artists have today. Currently i feel like i fight with drm on my phone on the reg will delete music i bought off bandcamp without telling me. fuck streaming.

[@DavesGarage]

They get paid even less when people steal it!

[@nickwallette6201]

Absolutely. Streaming and the like will be a good option when the licensing model shifts to perpetual use licenses, and the archival of that media isn't in the hands of short-sighted companies trying to scratch for their dime on a per-month or per-play basis. Until then, media will be removed from access when the licensed period expires and the content provider are engaged in a slap-fest over who gets to keep how much; or when server upkeep for a single product or service no longer makes fiscal sense; or when tides of opinion change the feasibility of hosting certain content; or when the lineage of a particular item is so obfuscated by changing hands too many times; or when a content creator loses interest in maintaining it; or when a content creator has vested interest in you moving on to newer properties; etc. etc. etc. Meanwhile, my collection of CDs is playable now and essentially forever. If not from the physical disc, then from the .CUE+.WAV copies I've made of each and every one. Ditto BDs, game carts, game discs, software on floppy and CD and DVD and BD, and so on...

[@lotekchapra]

@@DavesGarage I would never contest that.

[@gh8447]

@@nickwallette6201 Exactly! I always buy the CD of music I want and rip it to my NAS so it can be played over my Sonos system. I also make a copy to my phone so I have my music on the go. If I can't buy the CD, then I simply won't have the music in question. No one can tell me when I have or no longer have the 'right' to listen to a certain piece if music. Other than an anonymous TuneIn account (on Sonos), I don't use _any_ music streaming service and never will.

[@szr8]

@@DavesGarage With respect, I have done quite a lot of research on the subject over the years and I've never been able to find any conclusive evidence that downloading (or copying earlier back) and sharing itself had harmed artists, software/game companies, or film makers. Piracy has long been a convenient scapegoat, but what is often ignored is how it has created awareness of works that otherwise would have gained little notice on the shadow of the more popular. I'm not saying it is necessarily ok, nor would I advocate it, just that it is not so the black and white evil some see it as, as there is clear much more to it.

[@ardemus]

That's a fun story. I never ran into it, but I have cleaned out a lot of machines over the decades for people who were victims of the many software companies dishonestly installing exploitative garbage. For my part, I routinely disabled auto-run when I installed windows. It was nice for a few things, but companies often installed or ran pointless garbage software. Best case it just slowed you down, worst case it broke things or installed malware. I always either used explorer to do what I wanted, or opened the CD from the app I wanted to use.

[@ColonelSandersLite]

I think you missed a 3rd motive for the whole music share thing from back then - People without money (kids in particular) that just wanted to listen to their favorite music. This niche is filled today by various streaming services which play ads but that wasn't really the case back in the Napster days.

[@ThriftyAV]

As a CD "collector" with over 7000 titles (and no I have not listened to them all in full), I now wonder how many of those titles have that rootkit. I still have two old 32 bit machines that I use for demonstration purposes, so I will be VERY careful with Sony titles that lack the Compact Disc Digital Audio logo.

[@MechanicalMooCow]

"This doesn't paint a flattering picture of Sony in the early 2000's" - sorry... but anybody alive at the time wouldn't exactly be expecting sunshine and roses - early 2k Sony was a horror for everyone, most of all, consumers.

[@todortodorov940]

Still is horror. I bought a "smart" Sony all-in-one home entertainment system. Within months, Sony started discontinuing services.

[@TremereTT]

Napster, when it was created, was inline with German law. BMG Sony (Pretty much a German company owned by Sony) bought themselves some new laws and judges to change that! In Germany it was legal to have security copies as much as you want and you could share copies of your music with your family and friends up to 5 copies. This law was from a time when a copy allways came with a loss of quality. It also kept working as intended when double speed CD-Burners costed about 1200DM(Deutsche Mark) the SCSI-card that was needed not included. And an empty CD costed about 5DM to 10DM depending on the quality "Verbatim" was a the best quaility brand. Also every CD-Burner, MC-recorder or VHS recorder or printer and every empty medium had a tax on it that was payd to the creative industry in Germany. So BMG Sony made money on every recording device that other companies sold. When the Frauenhofer Institut developped MP3 they asked BMG Sony if they had any problems with it or if some form of DRM should be included and the Music industry in Germany didn't even answer this request! So this Frauenhofer Institut released MP3 as GPL or MIT in the open wild and it made Napster in Germany possible. The music industry was just stupidly ignorant abou the possibilities of the internet or psychoaccustic music compression. MP3 + German copy laws + Napster was a problem for the Music industry.

[@hanshans387]

Dave, you're such a good storyteller, I don't know how you make these videos so engaging but it seems to come so naturally to you!

[@DavesGarage]

Thanks for the kind words, I never know how these will be received :-)

[@jeffreyrombough8360]

I was working at Microsoft at this time. They were furious with Sony. All the work which was done to protect the customers and these guys pull this.

[@scottdrake5159]

With respect, Microsoft was warned, and repeatedly ignored warnings, about autorun being flawed, dangerous, and *already being exploited*.

[@Stevo.100]

How could Napster have anything to do with this? The assumption is if you're pirating the music you aren't going to the store to buy the CD, to put it in your computer so the rootkit can be installed.

[@DjVortex-w]

"When the user inserts a CD, if that CD has a particularly named exe file, let's just run it without even asking. And if the user clicks on an exe file that's attached to an email, let's just run it without even asking. And, rather obviously, we run everything as system administrator because it would be an inconvenience to users if they had to deal with user accounts and administrator accounts. Sure, we have this NT version of the operating system that does have more security features, but that's not for normal users. Normal users want to run everything automatically with admin privileges. Nothing can go wrong with this scheme." It took Microsoft a surprising amount of time to get over that mentality. And Windows is _still_ suffering from the effects of that mentality, because of the curse of backwards compatibility.

[@DjVortex-w]

One side effect of this horrible Windows history is that even to this day something like 90% of Windows program installers want admin privileges (even if they don't actually need it for anything). What exactly am I supposed to do when that annoying popup appears once again, asking for admin privileges for that installer? I have only two options: Not install the program, or risk the program hosing or hijacking my system if it has been infected or is buggy. There is no third option. This is a real problem that should really be fixed as soon as possible.

[@johndododoe1411]

@@DjVortex-w At least the prompt shows the result of a check on the anti-infection digital signature on the installer. But the implementation has many other shortcomings, such as basic Windows functions requesting Admin rights unnecessarily in the first Windows release with the prompt, "fixed" by creating an exception of not prompting for Microsoft programs.

[@CnCDune]

If M$ actually cared about backwards compatibility, there'd be no trouble running older programs on newer systems without having to nick DLLs from older versions - let alone rely on custom-made DLLs just to get them to *run* .

[@beardymcbeardface69]

So the takeaway lesson was that it is dangerous to buy Sony audio CD's and that people should therefore just download the mp3's instead. LOL Sony has a history of anti-consumer and anti-competition behaviour. They railed against people modding their own Sony hardware (Playstations) and they also do not allow the use of Bluetooth devices on their Playstation 4 consoles which they do not bless (Sony bluetooth headsets only, for example), which is a violation of the use of the Bluetooth trademark. Then there's their anti-consumer stance on refunds, which they recently got fined $3.5M for. Removal of Linux on PS3's. The fines are not enough. Maybe Sony would consider doing the right thing if the fines were in the billions.

[@lethauntic]

Piracy, with anything, is pretty complicated. There's just so many factors that go into it all that it's really just a moral obligation 99.9% of the time. I'm not saying that piracy is cool, but that it kinda doesn't matter that much, I think. There's that famous Valve quote about piracy being a service problem and that's about that.

[@jasongomez5344]

Great story. Perfect level of technical explanation without dumbing it down.

[@FrankConforti]

The Google/KZbin algorithm suggested one of your videos and now I’ve gone down the rabbit hole but in a good way. Subbed, belled, and liked all of the videos I’m now binge-watching. A very small bit of trivia about me. I worked on the original IBM PC power supply back in the day, redesigning the circuit board of the prototype to make it UL/ever other agency’s standards.compliant. My tiny contribution.

[@edwardallenthree]

The real story that you glossed over: the autoplay feature was a security nightmare and Microsoft learned nothing from it. My wife used my *keyboard* from razer on her secure work laptop and it installed software and drivers. She doesn't have the right to do that on her machine! It's just a keyboard.

[@DavesGarage]

Sorry, but Linux is just as easily compromised once you have physical access to the machine. All bets are off on a modern PC, except for your encrypted data, once I have hands on it. If I was your wife, I'd learn about Thunderbolt next! That's even scarier!

[@edwardallenthree]

@@DavesGarage That is an interesting response. My criticism is that 1) autoplay is a security issue and 2) auto driver install and poor approval of drivers by Microsoft is a problem. You reply with a critique of an unrelated operating system. I am sorry if you were personally offended by my critique of Autorun a d windows driver installs. The criticism is constructive. *Bitlocker* and other security approaches are why Windows is critical for industries that are highly regulated and have highly sensitive data. I don't hate Windows.

[@edwardallenthree]

@@DavesGarage I am really frustrated by your hostility to criticism here, Dave. I know you understand the corporate need for group policies and group policy management of company hardware. We always turned off Autoplay, but that was a few years later, after this incident. I am now retired, but I worked for years administering Windows networks. I am a MCSE for Windows 2000 and 2003.

[@kc9scott]

How could a *keyboard* install anything? I assume it’s probably a USB keyboard. Perhaps it might also act as a storage device, and let Windows Autorun do its thing if enabled. However, if it’s really a secure laptop, it will have had Autorun already turned off.

[@edwardallenthree]

@@kc9scott it's the drivers from Razer for the RGB. The big problem is that the same week this happened, the drivers from Razer were reported to have a security issue. Of course it had Autorun turned off, and a slew of other normal group policies applied. I don't know exactly what policies, because I respect the information security policy of her company.

[@lawdelpus]

I think I'll stick to linux

[@espacemaxim]

Windows, huh? It takes a rootkit to spot one!

[@wysoft]

I remember manually removing this from a friend's PC and leading to showing him how to use limited user accounts on XP, since all he did with the PC was download and rip music, do MIDI stuff, and browse the web. The rootkit couldn't install if you inserted the CD while logged in as a limited user account. That being said, I actually do miss the social aspects of this era of MP3 piracy.. Every time you got together with a friend who was into music one of the first things you'd talk about was everything new you'd added to your collection since the last time you talked. Then you went home with a CD/DVD filled with new MP3s.

[@mirzosharifjalolov4247]

Thank you very much for refreshing our memories of the 2000s beginnings. I used to bypass all that DMRs and protection by installing JetAudio in my ThinkPad R32 under Windows XP, though Napster, Kazaa, WinMX and Winny were quite popular among my friends.