Is the truth harmful?

The Truth? You can't handle the truth.

TrackBack — Thu, 17 Nov 2005 10:19:00 GMT

Was Sony BMG justified in deplying copy protection based on root-kit stealth technology?

The truth is not harmful, it is what it is.

TrackBack — Mon, 14 Nov 2005 03:17:00 GMT

I was about to blog in response to Susan Bradley's post "Is the truth harmful?" asking if XCP copy protection...

re: Is the truth harmful?

bradley — Sat, 12 Nov 2005 00:57:00 GMT

Does anyone really think that if Mark had talked to Sony that this would have been fixed, addressed, etc? I seriously doubt it. The fact that they were sloppy with PR and were not honest about this should tell you something. They probably never expected many people to find out about this, but oops, someone did, and it was someone who knows Windows inside and out. Bad move Sony.

Great point - poor disclosure is poor disclosure.

bradley — Fri, 11 Nov 2005 14:40:00 GMT

You know, I hadn't even thought about the obvious nature of this - it's a public disclosure of a security vulnerability. It's a really _bad_ security vulnerability - bad in terms of poor practice, rather than bad in terms of how much it can afflict you.

But there's a flip side to this. Is a vendor entitled to such a notification when it uses sleight-of-hand to install their software to begin with? If a worm or Trojan made its way into millions of systems, and suddenly was detected, even if it had no ill effects other than CPU use, you'd want to have it announced quickly.

There's an ambiguity here, in that Sony told Russinovich, in the EULA, that some software was to be installed, but it did not mention any of its functionality, intercepting the driver chain between the OS and the CD drive, and hiding files of specific names; as such, it seems like it might qualify under the description "Trojan horse" - you install it for one thing, but it does something else that you didn't expect and don't want, that is by the design of the software developer.

So, as a Trojan, it needs to be disclosed pronto, so as to be removable. As a security vulnerability in a vendor's product, the vendor needs to be informed. Which outweighs the other?

If this was Claria or some spyware company, would you have written this article?

Flash advisory

TrackBack — Fri, 11 Nov 2005 02:04:00 GMT