Elixis Technology

Las Vegas IT

Emulators And The Legal Gray of AbandonWare

Elizabeth Technology April 23, 2024

What is an Emulator?

An emulator is a program that emulates a game console, usually for the purpose of playing a game that is – either by price, age, or device – inaccessible. Streamers commonly use emulators to play Pokemon games made for the Gameboy, so they can screen-record their gameplay directly from their computer instead of having to somehow hook the Gameboy up to it. Zelda fans might want to play Ocarina of Time, but they might also find that the console to play it on is awfully expensive for one game where an emulator is pretty cheap! In certain cases, games are geolocked – countries restrict access to certain forms of art as a means of censorship. Emulators can make those games accessible to people who want to play them in that country.

In the 1990s, consoles were on top when it came to games. Computers were rapidly gaining in power, however, and some folks realized that the console could be recreated using a home computer. The first emulators were born via reverse-engineering console coding. They evaded legal action by only copying devices that were outdated, but that changed too with a major emulator made for the Nintendo 64 while it was still in production. Nintendo pursued legal action to stop the primary creators, but other folks who had already gotten their hands on the source code kept the project going.

Ever since then, emulators have lived in a strange space of both making games available and making them so available that the parent company decides to step in and try to wipe it out, which is nearly impossible once it’s out on the open web. Gamers simply won’t allow a good emulator to die!

Copyright

Copyrights are crucial to the gaming ecosystem, and it’s a delicate balance of allowing fan art, but disallowing unauthorized gameplay. Allowing game mods, but disallowing tampering that could lead to free copies being distributed against the company’s wishes. Allowing fun, but not theft. Copyright laws are always evolving – new tech comes with new ways to copy, create, and distribute intellectual property. Generally, though, copyright falls back to permission: did the original company intend for their IP to be used in this way?

Emulators and copyright don’t get along very well at all! Emulators are, by their very definition, creating access to the game in a way the original company didn’t intend. As such, it’s unofficial, and if money is exchanged, it’s not normally between the copyright holder company and the customer, it’s the customer and some third unauthorized party.

Games aren’t selling you just the physical disk. You’re buying a license to play the game. If you take it as far as Xbox intended to back when the Xbox One was coming out, friends are only allowed to come over and play with you on your license because the company can’t enforce it. It’s a limitation of the system that they can’t keep you from sharing disks or accounts.

Not every company thinks like this (see the Playstation 5 and a number of more recent cases regarding digital content ownership), but that’s the most extreme possible interpretation. You bought a disk so you could play a copy of their game that they have licensed out to you. You own the right to play that copy of the game, you don’t own the game itself.

Consider: Death of a Console

When a console dies, it’s taking all of its content with it. There is no more money to be made off of it, and the games are going to slowly disappear into collections and trash bins.

Does art need to exist forever, or is it okay if some art is temporary? Not every Rembrandt sketch is still in trade – some of it was just sketches, and he obviously discarded some of his own, immature art. Immature art is interesting to see, but it’s not what the artist wanted their audience to see. Otherwise it would have been better kept. Think about the ill-fated E.T. game that Atari made, they weren’t proud of it, they didn’t want it seen, and they saw fit to bury it. So they buried it. It was directly against their wishes for people to find this game and then play it. Emulating it is obviously not what the copyright holder wants.

But then consider all the little games included on a cartridge that’s just forgotten to the sands of time, made by a programmer who didn’t want it to fade away? Acrobat, also for the Atari, isn’t very well-remembered, but it still made it onto Atari’s anniversary console sold in-stores. 97 games on that bad boy, and Acrobat was included. It’s not a deep game, it’s nearly a single player Pong. But the programmers who made it didn’t ask for it to be excluded from the collection, so some amount of pride must exist over it, right? Does the game have to be good to be emulated? Is only good art allowed to continue existing officially?

Is all art meant to be accessible to everyone?

If some art is made with the intent to last forever, is it disregarding the creator’s wishes to not emulate it, against their production company’s wishes? If a corporate exec decides a work of art is better used as a tax writeoff than launched even though it’s already complete, is it better to listen to that exec, or the dozens – perhaps hundreds – of people opposing the exec’s will?

If art’s made to last forever but the artist (and society) accepts that that’s simply unrealistic, is it weird to emulate it, in the same way it’s weird to make chat-bots out of dead people?

When you get past the copyright, it’s a strange, strange world to be in.

Ethical Dilemma

Stealing goes against the ethics of most societies, modern or not. The case against emulators is that it’s stealing.  It often is! An emulator/ROM (ROMs act as the ‘disc’ or ‘cartridge’ for the emulator) for Breath of the Wild was ready just a few weeks after the game launched, which could have seriously dampened sales if Nintendo didn’t step in to try and stop that. That first emulator, the one for the Nintendo 64, also drew a lot of negative attention for the same reasons, potentially siphoning away vital sales.

However, there’s a case to be made for games and consoles that aren’t in production anymore.

Is this a victimless crime, if the original game company really can’t make any more money off of it? It’s one thing to condemn piracy when the company is still relying on that income to make more games and pay their workers, it’s another entirely when the game studio isn’t interested in continuing support, and the console had a fatal fault in it that caused many of them to die after 10 years. That game is as good as gone forever without emulators. With no money to be made, why not emulate it?

In less extreme circumstances, the console’s still functioning, but the cartridges that went to it are incredibly rare. The company could potentially make money off of the game if they someday decided to remaster it, but that’s unknowable. Licenses could be available for purchases… but they aren’t right now.

Or, even better, the cartridges are still available for purchase in the secondary market. You just don’t happen to have the console, which has now spiked to a cost of 400 dollars due to reduced supply over time. You buy the cartridge – you’re still buying the license, you just don’t have the car, right?

According to copyright, you need a specific car for a specific license, but ethically, you’ve done the best you can as a consumer.

Brand Name

Much like Disney did with Club Penguin’s many spinoffs, emulators are kind-of sort-of overlooked up until they start eating into sales. More aggressive companies will go after emulators before they blow up (see Nintendo challenging Yuzu, an emulator) but most companies just don’t want to spend money to enforce an issue like emulators – their game is still being played, their brand is still out there, and the users are going to be very upset if this big company decides to step in and ruin fun when they don’t need to (see Nintendo challenging Yuzu, a beloved emulator). It may do more harm than good to try and wipe the emulator out when most people want to do the right thing.

Obviously, they’ll need to put a stop to emulating new games – the goal is to spend just enough money to do that effectively without also overstepping and destroying emulators for consoles no longer in production. It takes money to make games, games should earn money as a result. Removing emulators for games and consoles no longer in production isn’t helping them earn money – as such, many are allowed to stay. For now.

Sources:

https://www.pcgamer.com/the-ethics-of-emulation-how-creators-the-community-and-the-law-view-console-emulators/

https://scholarlycommons.law.northwestern.edu/njtip/vol2/iss2/3/

NeoPets Is Still Online, Somehow

Elizabeth Technology April 18, 2024

Neopets was huge. At 21 million users during its peak, the website was a behemoth of the early 2000s. It’s still going today! Neopets is a free-to-play digital pet game, where the user can interact with digital pets, the Neopets. Games, chatrooms, and all the usual fixings of 2000’s era children’s sites were available to users.

It was also the subject of a couple of scandals, although nothing quite as dark as Club Penguin Re-Written’s issues.

The Avatar Swap

Firstly, the biggest one: the black market surrounding rare avatars.

Like many children’s games, Neopets self-funded with website ads sprinkled here and there, right up until it was purchased by a larger company, Viacom, with some big ambitions for the franchise: everything from console games to real-life toys was supposedly on the table. They’d need more money to execute these plans, however. Additional funding snuck in, and certain items became purchasable with Neocash, which players could buy with real money!

Now pets with certain upgrades are more valuable than others because they have money invested in them – the market begins to form as soon as an update allows for pet trading. Trades weren’t an official thing by any means prior to that, all a player can do is drop off the Neopet in the Neopet pound and hope the other guy managed to snag the ‘abandoned’ pet. This feature of the game actually held back the flood for a while – no guarantee of pet? No guarantee of pay, and so trades were rarer in the early days. Still, trades happened, and finally Neopets admins allowed trading to happen officially. It allowed them to monitor the action, and the feature was very much requested anyway.

Trades: Value

Trades were about to become an issue, however. Neopets was constantly bandaging over or changing things, which left items in the lurch. New features and decorations for pets were steadily coming and going, but the old versions weren’t always taken out of the equation.

Once such change converted the formerly-unclothable pets into new, exciting, dressable ones. Most of the Neopet avatars were changed overnight with little warning. Players were disgruntled, as some pets got swapped into new categories: ‘sponge’ pets, brightly colored pets made of dish sponge material, turned into ‘mutant’ pets, a collection of tentacled and fanged creatures with a muted gray/green color palette. This is understandably upsetting! Pets that were cute became cuter, pets that were weird became weirder. The visuals on the ones that didn’t change category were still tweaked – the update added eye-shine, fur texture, and new poses to flattened original arts. However, not all of the avatars were converted! Some were allowed to keep their old art, although new art had been made for the species.

Neopets allowed players in this final category to choose whether or not to convert, and essentially created a black market for unconverted pets with unconverted art. Only a few species were allowed to stay as-is in their player’s dashboard, and any new players who created a pet of that species would be using the new art. As a result, these unconverted pets became legacy items, and their value exploded. People began trading real money for these pets, with deals set up in forums and private chat rooms. It was against the rules, of course, but when did that ever stop anyone? A tiered system that ranked pets popped up, which turned the pets into a sort of stock market! Pets had value based on what the community perceived their value to be.

Security

Admins did their best. Club Penguin had an enormous team covering a smaller userbase, while Neopets’ team was too small to focus on anything but the biggest fires.

Nowadays, the end of Flash Support means the game is frequently buggy and uncooperative with player inputs. Staff is working to move to HTML5, but the age and size of the website makes that a Herculean task. Even before then, though, it had issues. It’s initial transfer from Viacom to Jumpstart Games in 2015-ish came with a lot of lag and glitches all by itself during the move to new servers. Glitches that only made the situation with that black market worse! Now certain items could be ‘accidentally’ duplicated or deleted, and minigames were harder to play, encouraging the purchase of Neocash with real cash over grinding for points day in and day out. This is understandably frustrating for younger users.

Today, the website struggles with maintaining time – the game’s clock is about two minutes behind the real world’s time, and as a result, things like 2-Factor authentication are very difficult to use. The website can send a code, the user can receive it and try to put it in, but at that point the website sees a code from two minutes into the future and declines it. Essentially, the website’s security is broken by the grandfather paradox.

Hacks

Admins could reverse trades. But, doing so could reset an entire train of transactions if that pet was obtained illegitimately. This is obviously very annoying to players who just wanted a new shiny pet and had nothing to do with the initial theft. Responses to the issue from admins were mixed, and no one solution was universally applied. That sounds great, but every custom solution left people questioning the admins’ decisions. They seemed uncoordinated.

Even worse, hacking the website itself became a problem, and some guy created a bunch of unconverted pets via admin tools. The next few hours of gameplay for everyone were strange as the admins worked to remove the new unconverted pets from the game again, some of which were already traded far down the line. Since black-marketeering was against the rules, the community could only police itself by banning issue players or thieves from their forums, but their work was in-demand and theft would happen anyway.

Surprisingly, big external hacks seem to be pretty rare – all the hacking going on for the black market are done from inside the site, which needed the site to keep going to be worth it. Rare doesn’t mean non-existent: one very big hack got several million assorted accounts in varying levels of completeness… the database was too old to be of much use, and many passwords were missing corresponding emails. Which brings up the next point!

Dormant Users

The site never purges old, inactive users. This is a problem when the pet’s name is essentially it’s ID number – once a Neopet is named Spot, there can’t be another named Spot. Pets don’t disappear when they’re voluntarily discarded, either, they go to the Neopets pound where another player can adopt them. As such, the pet’s name adds value to the pet! Pronounceable names with no underscores, dashes, or numbers are significantly more valuable than keysmashed names in the black market.

This favors the early users who got first pick of the names, many of who then abandoned their pets as they outgrew the game. Which encourages hacking! It’s not exactly malicious, as the hackers have no idea if the original user is ever going to come back to their pet, but it’s not exactly white hat, either, because of the personal information tied to the account and all that. Rather than treating abandoned accounts like accounts, they’re being treated like a mine. This is a non-renewable resource, so when the old accounts inevitably run out, what happens next? Where does the next supply of market-fodder come from? Not to mention that it’s difficult to actually gauge inactivity from the outside– the age of the account doesn’t necessarily mean it’s abandoned!

The admins could prevent the issues all of this causes by purging the accounts, so why not do that?

Purging users means that the unconverted pets in these inactive accounts would either A) flood the market, if the team releases them to the pound, or B) disappear forever, thereby destroying the new supply of unconverted and well-named pets. The adult users have more voice than the kid users do, so they’d be flooded with complaints and negative feedback on every channel.

Sources:

https://www.polygon.com/videos/2021/5/6/22423404/neopets-future-black-market-drama

https://www.polygon.com/22334511/neopets-still-exists-black-market-cheating

https://www.vice.com/en/article/ezpvw7/neopets-hack-another-day-another-hack-tens-of-millions-of-neopets-accounts

https://theoutline.com/post/4190/neopets-was-run-by-scientologists

http://www.neopets.com/

What Remains of Flash

Elizabeth Technology April 16, 2024

It’s been a while since Adobe Flash was made defunct.

What Did Flash Actually Do?

Flash was one of a host of plugins that allowed users to view ‘rich’ content. Everything from Flash games to autoplay audio to vector graphics to dynamic menus… if the website had visuals besides plaintext on it, there was a solid chance Flash was used somewhere. Adobe Flash Player sorted to the front of the pack because it was free, and played well with most mainstream browsers. It allowed a whole new world of interactive content! Since most browsers had a version of Flash, most websites were able to use Flash content – notable exceptions included Apple products. Even then, Safari could still view it.

Why Drop?

Adobe Flash and Flash Player had problems. They always had problems, but the benefits of dynamic content and nice, quickly-loading visuals outweighed the issues Adobe Flash had. Most of the time, Flash was used on a stationary device that didn’t need to worry about battery, like a home computer. Laptops were growing in popularity, but they were still bulky, and often prioritized battery life over size. Flash could afford to be a little inefficient to get the content moving on screen faster.

Then the first iPhone came out. Safari users could access Flash content, but most webpages weren’t optimized for mobile yet, so the iPhone was using excessive battery on websites anyway. The next gen of smartphone owners, who also had Android or Microsoft devices, noticed that Flash ate battery life even though the website was designed with mobile in mind. That was more of a problem now that smartphones were popular, but vendors hoped they would improve on their own. After all, Flash was always updating to keep up with browsers and plug-ins.

Windows 8 came with Flash Player bundled in, and it was better, but it still wasn’t the picture of perfect efficiency. What was Windows going to do, reinvent the wheel, and then ask everybody to switch to their version of Flash, for greater efficiency? No. Adobe’s products were fine, and fine doesn’t have to be perfect. They filled a gap, and they enabled a lot of creativity via those browser games, which eventually became Flash’s number one usage for users aged 10-20. Interactive content needed Flash.

Adobe’s advantages far outweigh their negatives at this point. However, that was about to change.

Security

Having a tool that can run rich content all by itself was great. However, Adobe was about to get into a slog of zero-day attacks and malware fixes that would have ruined anybody’s reputation, in 2013. Flash’s widespread use meant that hackers could assume Flash Player was on a targeted device. By creating online ads that contained specially designed malware, hackers could get into any device where Flash content could play. It was as good as an open door if the virus could trick the browser into thinking it was also Flash content that needed to be downloaded to view the page. Suddenly, a Trojan Horse is on the device!

Antiviruses of the time could stop the clumsy attempts before they became a real problem, but undefended people were often unpleasantly surprised by a Flash malware getting into their system and downloading things. 2013 onwards saw a constant uphill grind against hacker organizations who had access to real tools and real skill.

Apple then releases a memo clarifying that they won’t be using Flash because of these security issues. A malware known as Flashback had infected about 600,000 devices, and Apple is unhappy – users were duped into downloading a fake Flash update that was indistinguishable from a real Flash update notice. ‘Don’t download things from a third-party website’ is common advice now, but because Flash was always pushing to keep users as patched up and flawless as possible, they often pushed these ‘update Flash’ notifications to other websites that were hosting Flash content. You might remember the gray screen and plug warning when trying to play a flash game – Flash did that so often it got kids as well as adults.

The Outdated

Flash did a lot of things, but they were all things that could be done better if web developers had better tools. HTML5 was released in 2014 and was extremely lightweight compared to Flash. It used web browsers to its advantage, by using a tagging system that most browsers (which was updated for the new tech) could interpret, rather than download. Since less data needed to be shared over the user’s internet connection, the content loaded faster – all the browser needed was those tags.

There were issues with this, in the early days of HTML5, different browsers could interpret the same tag differently, and sometimes older versions couldn’t interpret a new tag at all, but it was so much easier to work with and so much faster that minor issues were overlooked. Another bonus was less malware!

HTML5 and WebAssembly both step in to take some of the weight off of Flash after it’s first major security event, and people notice that loading times have gone down. Apple’s departure from Flash also slashed it’s popularity, and Flash starts it’s downhill decline.

Support

Adobe announced it was planning for Flash’s End-Of-Life a whole three years before the end-date to give developers time to remove it. Still, for older sites that couldn’t switch, an open-source project called ‘Ruffle’ hopes to fill the gaps and keep Flash games running a bit longer. Ruffle behaves a lot like Flash, but it’s third-party. The website itself has to support Ruffle’s use, so if all the Flash stuff was abandoned because the website itself was abandoned, Ruffle isn’t going to be much help. At least there is an option, though, as limited as it may be.

Ironically, Flash was so deeply embedded in the fabric of the internet that fake Flash updates are still getting people. Remember, if a pop-up says you should update something on your device, whether it’s Minecraft or Excel, you should always go to the home site and verify it there. It’s really easy to copy an application’s layout nowadays!

Sources:

https://www.adobe.com/products/flashplayer/end-of-life.html

https://www.infosecurity-magazine.com/news-features/flash-post-support/

https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support/

https://www.forbes.com/sites/barrycollins/2020/06/22/adobe-flash-cut-off-will-kill-millions-of-websites/?sh=413027e3d718

The History of Adobe Flash Player: From Multimedia to Malware

https://blog.trendmicro.com/history-of-flash-zero-day-and-other-vulnerabilities/

HTML5 vs Flash

Is Brand Twitter Over?

Elizabeth Technology April 11, 2024

Popular fast-food restaurant chain Wendy’s has been getting a lot of attention online. It’s not a good thing: Wendy’s briefly attempted to announce “surge-pricing”, where prices would go up around mealtimes, and was promptly (and rightfully) bullied into retracting the idea. Wendy’s used to be a cornerstone of the hip, online, highly-Millennial marketing of the 2010s, so how could it make such a huge mistake?

You Can’t Win Marketing Bad Ideas

This should be obvious: people will tolerate your jokes at their expense only as long as they like you enough to overlook you crossing lines. Wendy’s forgot this. Sunny-D forgot this when it tweeted it’s now infamous “I can’t do this anymore” tweet. More severely, Elon Musk forgets this when he tried to convince advertisers to stay on the platform after a number of controversial statements regarding advertisers and free speech. Once that rep is lost, it’s almost impossible to recover. Metaphorically, even companies can say things that they can’t take back.

So what part of this pricing plan is a bad idea? Think about it from the investor standpoint, people who don’t actually eat a lot of fast food: every part of restaurant life is harder because people tend to come in waves, with giant lines out the door at lunch and dinner time and long periods of quiet in between them. Everything from stocking to training to staffing is beholden to this cycle. If companies could have a perfect world, they’d probably choose to have people come in at a steady pace throughout the entire day, rather than bunching up at lunch. So, discouraging people from showing up all at the same time with a time-sensitive fee makes sense! Right?

But, if you do regularly go to fast food restaurants for lunch, this is a terrible idea. It reeks of being out-of-touch: most people don’t have much flexibility around when they get their lunch break. Most people don’t choose when they get hungry, either. Some consumers will eat a late breakfast if they know they’ll be going to lunch late, sure, but is Wendy’s good enough to plan your entire day around like that, assuming you even can? What if it’s not? It doesn’t spread out the surge at all. If someone is already a devout Wendy’s fan, they’ll still go during their lunch break. If someone is not, they’ll go somewhere that doesn’t jack up the price during lunch, they won’t just wait for the price to go back down if they’re already hungry and there are other options next door.

All this also fails to consider the climate: right now is a mega-uncool time to pull tricks like this!

Who Is Wendy’s?

Everyone is feeling the impact of inflation. The tradeoff, the secret agreement when it came to fast food was always “sure, it’s not really good, but it’s cheap!” and when it’s not cheap, what is it? We’re experiencing a crisis of market share, where companies aren’t sure what their consumer is supposed to look like or act like any more. The rising prices of everything are forcing consumers out of their reliable habits as a matter of survival. Wendy’s targeted Millennials when it was funny on Twitter a decade ago, but when that market is not going out to eat because they’re trying to save money or pay down debt, Wendy’s seemingly has no idea what to do. So they did something that instantly cracked the fragile shell of relatability that they’d been cultivating, and made everything worse.

When Wendy’s threatened a price spike now that every big business is selling goods at overinflated prices, suddenly it wasn’t “cartoon mascot Wendy, who’s funny on Twitter” sending out news and slinging burgers, it was “corporate giant Wendy’s spokesperson, a man in a suit”, telling me that if I showed up at the wrong time, I’d be charged an extra fee for the inconvenience of daring to ask for a hamburger at lunchtime. To then try to joke with users on Twitter like Wendy’s is still a relatable, friendly restaurant after that is insulting. Other people on Twitter consistently refused to let them and instead mocked Wendy’s relentlessly no matter what it said in the tweet, until eventually Wendy’s was forced to backtrack on the idea altogether. Wendy’s Twitter will no longer be a viable source of marketing material until this dies down. Even then, potential customers are going to remember this. The internet never forgets.

Wendy’s was allowed to be funny and edgy on Twitter during the 2010’s because the burgers were what they said they were (not frozen, square, pretty decent for the price) and because they weren’t actually being all that offensive when they responded sassily to someone who said something goofy in their retweets. “Looks like you forgot refrigerators existed for a second” isn’t exactly a burn worthy of being signed to a label, not that this stopped Wendy’s from launching a rap track dissing Burger King. It’s not like that anymore – they have no diss capable of dispelling three hundred tweets all saying “at least Burger King doesn’t charge more at lunch”. The era where companies could just pull up a seat and act like other real users was already on the way out, but this might have killed it for good.

Are ARGs Still Cool?

Elizabeth Technology April 9, 2024

Okay, so the Mandela Catalogue’s creator recently got into some hot water, and now the interference from the real world is starting to rain on the parade he had going on in the virtual world. Many of the ‘great’ projects are either on haitus or unofficially finished, meaning no new content. But hey – maybe this is an opportunity, and not a downside to the ARG’s big moment in the spotlight a couple of years back?

Firstly, What is an ARG, or an Alternate Reality Game?

It is what it sounds like: the game’s creator wants to create an alternate reality where their game takes place. Whether it’s through implying the existence of demons in ‘real life’, or simply moving game elements into physical locations like Geocaches, ARGs create a new alternate reality for these things to happen. These games have existed before, but they used to be limited to the people with TV or print presence – the internet allows the Average Joe to get in on reality-bending fun!

Video Series

ARGs are trying to lead users into unraveling more of the story – unlike games, it usually doesn’t come in the form of unlockables, and sometimes there is no solid answer after the fact. The most distinguishing part of Youtube-based ARGs is that they’re played straight, as though everything in them is reality and being posted by a real person. Picture a movie like Paranormal Activity, but instead of purchasing a disk or watching it in theaters, it’s posted up on Youtube as though a friend of the family found it, and is even looking for answers themselves. Suddenly the context changes a lot, and the movie changes with it.

Marble Hornets, one of the most popular Slenderman fictions, can be called an ARG by these standards. It tells the story of a man attempting to film a movie while a mysterious figure comes closer and closer in the background, slowly being edited together by the original filmer’s friend, who he swore to never discuss the film with.

Adult Swim’s This House Has People In It spun a wild tale of an allergy medication that spread psychosis and split apart struggling families. One video, which focuses on a family right before their young son’s birthday party, is used as advertising for a surveillance company that doesn’t exist – but it does have a website, which reveals that the company’s incredibly shady. How else are we, as viewers, seeing this content if not through that company posting it?

Another plays as an advertisement for that aforementioned allergy medication with side effects including psychosis and death. It starts like an average ad, only to bleed into a strange waltz through a woman’s life as she struggles to fight off the effects of the meds. Police are seen in front of her house, she dances through an unfinished basement in her wedding dress, she even draws over her child’s portraits with caricatures… the drug has done something to her, and she can’t reconcile that reality with this one.

Film ARGs are some of the most entertaining communities to be a part of, as popular theories come and go. Maybe these take over the space left behind by weekly TV shows – the puzzles keep coming, and the community is united by a common goal of understanding an Alternate Reality.

Other Types

But if the creator is especially skilled, you may find projects like Welcome Home even more engaging than any video-based project. Welcome Home is a current favorite of many ARG fans because of it’s unique approach to the “haunted children’s media” trope. Instead of scaring you with hyperrealistic images or distorted pictures of the cast, Welcome Home invites you into a seemingly normal website based on a seemingly normal show from the seventies where a couple things here and there are… off. The site itself seems to be leaking something from an alternate reality into our world, where links sometimes take you places you don’t want to go, or play audio clips from “behind the scenes” of the show. But that doesn’t make sense – the show is based on puppets, and puppets need to be puppeted by real people to put on a show. Right?

…Right? It’s brilliant!

Such a convincing setup would be impossible without such a well-polished website. The Welcome Home project is currently ongoing, and – because the creator has set this up in such a brilliant way – the breaks between updates are very natural and make sense to us as outsiders.

Bad ARGs

All of this sounds great, and entertaining: what happens when the ARGs kind of suck? When the creator doesn’t understand puzzles, or the conclusion doesn’t make any sense? Or even worse: what if it’s way too easy to solve? What if it was derivative of another project from beginning to end?

Reddit’s ARG subreddit laments the split between the bad ARGs and the good ones: the bad ones are often promoted more than the good ones are, because the original creator either doesn’t know how to suck people in organically or spread word on social media well enough. An ARG on Tumblr managed great success by imitating spam ads, so sometimes it really is just a matter of repetition and posting about the project obsessively, something too commonly associated with pushy salespeople to feel comfortable to most. Popular ARGs put a lot of work in to get a following, for better or worse, and being easy to spot or jump into is not necessarily a great indicator of quality.

Bad ARGs often don’t know where they’re going, story-wise. Or if they do know, it might not be compelling or interesting. Have you ever gotten to the end of a video game, and it goes off the rails in a bad way? Or have you ever watched a TV show end so badly it erased all of it’s cultural impact afterwards (looking at you, Game of Thrones)? When the world ends in the story, you are reminded, as a viewer, that it was just a story and not a window into a different world. The story of the ARG is just as important as puzzle features.

Now that we’re past the initial buzz of the medium itself getting attention, what happens next will be interesting: will creators keep falling into these tried-and-true paths about extra-dimensional monsters and secretly-murderous children’s content? Or will we find something else frightening to build puzzles around?

ARGs are a great new way to tell stories – finding good ones are like finding gold!

Sources: https://wiki.gamedetectives.net/index.php?title=Afterbirth_ARG

https://www.youtube.com/watch?v=x-pj8OtyO2I (This is the video for This House Has People In It)

What is WRONG with ARG’s
byu/RegularDimension inARG

Your IoT Devices Are Opening Doors For Hackers

Elizabeth Technology April 4, 2024

Internet of Things items are convenient, otherwise they wouldn’t be selling. At least not next to regular, non-wifi-enabled items. They don’t even have to be connected to the internet, and they should stay that way!

An Internet of Things item, or an IoT item, is a device that has a WiFi- or network-enabled computer in it to make the consumer’s use of it easier. This includes things like WiFi-enabled/networked washing and drying machines, ovens, fridges, mini-fridges, coffee makers, lamps, embedded lights, etc. anything can be an IoT item, if it’s got WiFi capability.

Network Entry Point

Internet of Things items, when connected to WiFi, represent a weak link in the chain. They’re poorly protected, they’re designed to favor user friendliness over all else, and they’re usually always on. You likely don’t unplug your fridge or washing machine when you go to bed – that device’s computer may sleep, but it’s not off. You probably don’t disconnect the internet when you go to bed, either. Some devices take advantage of this, and only schedule updates for late at night so you don’t notice any service interruptions. Unfortunately, their strengths are their weaknesses, and an always-open port is a dream for hackers.

Outdated Password Policies

Internet of Things items are rarely password protected, and if they are, many users don’t bother actually changing the password from the factory default. This makes them excellent places to start probing for weaknesses in the network!

Assuming someone’s hacking into a place to ding it with ransomware, there are a number of worthy targets: corporate offices, nuclear facilities, hospitals, etc. are all staffed by people, and people like their coffee. A well-meaning coworker bringing in an internet-enabled coffee machine for his coworkers is suddenly the source of a critical network vulnerability, an open port in an otherwise well-defended network!

If the coffee machine, or vending machine, or the lights are IoT items, they need to be air-gapped and separated from the main network. They don’t need to be on the same network supplying critical data within the center. The devices are simply unable to protect themselves in the same way a PC or phone is! There’s no way to download a suitable antivirus onto a coffeemaker. If something gets past a firewall, and that password is still the default or nonexistent, there’s no second layer of protection for IoT devices.

Malware

For example, hacking into a fridge is not nearly as hard as hacking into an old PC. Even great antivirus can struggle with traffic coming from inside the network. Even worse, IoT devices are often missed in security checkups anyway. When McAfee or Norton or Kaspersky recommends you scan your computer, are they offering to scan your lightbulbs as well?

Once they’re in, the entire network is vulnerable. Ransomware events with no obvious cause, malware that’s suddenly deleted all the files on a server, stolen data and stolen WiFi – all of it’s possible with IoT devices. There’s more to gain than just bots for the botnet, which is why hackers keep going after these IoT items.

IoT devices are also much easier to overwhelm to gain access, even with firewalls and effective load balancing. DoSing an IoT item can be as simple as scanning it. No, really. A team in the UK found that they could shut down turbines in a wind farm by scanning them. The computers inside weren’t equipped to handle both a network scan and their other computing duties at the same time. Many user devices are in the same spot or worse!

Security

Besides turbines, items like cameras and door locks probably shouldn’t be connected to the internet just yet. A terrifying string of hacks let strangers view doorbell and baby monitoring cameras, for example. The cameras themselves were difficult to defend even though the network was protected by a router. This is terrible for obvious reasons and class action suits were filed soon after. It even happened accidentally; Nest users would occasionally end up viewing other people’s cameras unintentionally, a bug in the system that was only fixed after complaints were made.

A consistent pattern is forming here: security patches are only issued after vulnerabilities are discovered by the consumer! Any other type of programming wouldn’t get away with this without some public outcry. You shouldn’t have to become a victim of a security flaw as large as “someone else is viewing the inside of my house” to get it fixed.

And then there’s things that physically interact with the security features of a house, like electronic locks. There’s nothing wrong in theory with a password lock. However, electronics are not inherently more secure than physical locks, and adding in WiFi only gives lockpickers another ‘in’. Hacking the lock could lead to being locked out of your own home, or worse. Besides, a regular lock will never unlock itself because its battery died, or because you sat down on the fob while getting on your bike or into your car. If you do want a password lock, it’s better to get one that’s not network enabled.

We aren’t quite at the point where hacked self-driving cars are a legitimate issue, although the danger is growing on the horizon. Cars are also poorly protected, computer wise.

BotNets

The fridge doesn’t need a quadcore processor and 8 GB of RAM to tell you that it’s at the wrong temperature, or that the door’s been left open and you should check the milk. The voice-controlled lightbulbs only need enough power to cycle through colors. IoT items are weak. But not too weak to be used for things like Botnets, even if your main PC wards off botnet software.

Botnets are networks of illegitimately linked computers used to do things like DDoSing, brute-forcing passwords, and all other kinds of shenanigans that a single computer can’t do alone. By combining the computing ability of literally thousands of devices, a hacker can turn a fridge into part of a supercomputer. No one ant can sustain an attack on another colony, but an entire swarm of ants can!

This is another reason tech experts are worried about IoT items becoming widely used. Their basic vulnerabilities give skilled hackers the ability to ding well-protected sites and fish for passwords even if the network they’re targeting doesn’t have any IoT items on them. It’s a network of weaponizable computers just waiting to be exploited. Remember, password protect your devices, and leave them disconnected if you can!

Source:

https://eandt.theiet.org/content/articles/2019/06/how-to-hack-an-iot-device/

https://danielelizalde.com/iot-security-hacks-worst-case-scenario/

https://cisomag.eccouncil.org/10-iot-security-incidents-that-make-you-feel-less-secure/

https://www.courtlistener.com/docket/16630199/1/orange-v-ring-llc/

How To Handle A Hack: Blizzard in 2012

Elizabeth Technology April 2, 2024

In 2012, game developers were beginning to experiment with a principle known as “always on”. “Always on” had many potential benefits, but the downsides keep the majority of games from ever attempting it. Many of the notable standouts are games that require team play, like Fall Guys or Overwatch. Others without main-campaign team play tend to fall behind, like Diablo 3 and some of the Assassin’s Creed games. Lag, insecurities, perpetual updating, etc. are all very annoying to the end user, so they’ll only tolerate it where it’s needed, like those team games. It’s hard to say that this hack wouldn’t have happened if Blizzard hadn’t switched to an “always on” system… but some of their users only had Battle.net accounts because of the always-on.

Blizzard’s account system was designed with their larger team games in mind. It was forwards facing, and internet speeds were getting better by the day. Users were just going to have to put up with it, they thought. Users grumbled about it, but ultimately Blizzard was keeping data in good hands at the time. You wouldn’t expect Battle.net accounts created purely to play Diablo 3 to lose less data than the user profiles in the Equifax breach, right? Blizzard kept the ball here! What did Blizzard do right to prevent a mass-meltdown?

Hacker’s Lament

The long and the short of it was that Blizzard’s storage had multiple redundancies in place to A) keep hackers out and B) make the info useless even if it did end up in the wrong hands. Millions of people had lost data in similar events before, and security experts were more and more crucial to keeping entertainment data safe. Blizzard was preparing for the worst and hoping for the best, so even when the worst struck here, they weren’t left floundering telling people they lost their credit cards.

The actual hack was defined by Blizzard as ‘illegal access to our internal servers’. It released the listed emails of players (excluding China), the answers to security questions, and other essential identifying information about accounts into the wild. However, due to Blizzard’s long-distance password protocol, the passwords themselves were scrambled so much that the hackers might as well have been starting from scratch. This is still a problem, but it’s not a world-ending, ‘everyone has your credit card’ problem. Changing the password on the account and enabling 2FA was considered enough to shore up security.

Potential Issues

Lost email addresses aren’t as big of a problem as lost passwords, but they can still present an issue. Now that the hacker knows an email address was used on a particular site, it’s possible to perform a dictionary attack, or regular brute forcing! This strategy will eventually work, but the longer and more complicated the password is, the less likely it is to succeed on your account in particular.

A secondary problem is the lost security questions. Those are a form of 2FA. Depending on the question asked, guessing something that works or brute forcing it again is dangerously easy. Sparky, Rover, and Spot are very popular names for American dogs, for example. If the hacker is able to identify that the player’s American, and then guess the name of their first dog, they’re in! They can change the password to keep the legitimate player out. (Part of Blizzard’s response is forcing users to change their security questions for this reason). 2FA that uses email or mobile is generally preferred.

Battle.net acted as an overarching account for all the games, and made the stakes higher for an account breach. All the online Blizzard games went through Battle.net. Losing access could mean losing access to hundreds of hours of game progress. Or worse: credit card data and personal info.

Online, Always, Forever

The event provided ammo for anti-always-on arguments. There was no option to not have a Battle.net account if you wanted to just play Diablo’s latest game. Some users were only vulnerable as a result of the always-online system. If they’d simply been allowed to play it offline, with no special account to maintain that always-online standard, there wouldn’t have been anything to hack! Previous Blizzard games didn’t require Battle.net. People who stopped at Diablo 2 seem to have gotten off scot-free during the hack. This is annoying to many users who only wanted to play Diablo 3. They might not find value in anything else about the Battle.net system. Why bother making users go through all this work to be less secure?

When discussing always online, there’s good arguments to be made for both sides. Generally, always on is better for the company, where offline gaming is better for the consumer. Always on helps prevent pirating, and it gives live data. Companies need data on bugs or player drop-off times, which can help them plan their resources better and organize fixes without disrupting the player experience.

On the other hand, consumers with poor internet are left out, as lag and bugs caused by poor connection destroy their gaming experience. As games move more and more to pure digital, buying a ‘used game’ only gets more difficult for the consumer. Companies treat purchased games as a ticket to a destination, rather than an object the consumer buys. Games used to be objects, where anybody could play the game on the disc even though save data stayed on the console. Buying access to Diablo 3 via Battle.net means that there’s no way to share that access without also allowing other people to access the Battle.net account, which stores the save data. It’s the equivalent of sharing the console, not just the disc.

Handling

The response to the stolen, scrambled passwords was for Blizzard to force-reset player passwords and security questions, just in case the hackers somehow managed to unscramble them.

2FA is always a good idea, and Blizzard strongly recommended it too. 2FA will do a better job of alerting you than the default email warning  ‘your password has been changed’ will after the fact. After you’ve received that email, the hacker is already in. Depending on when you noticed, they could have already harvested all the data and rare skins they wanted by the time you get your support ticket filed! Setting up 2FA first means that you’re notified before that happens.

All in all, Blizzard handled this particular incident well! Companies are required to inform their users about potential online breaches, but some companies do this with less tact than others. Formally issuing an apology for the breach isn’t part of their legal requirements, for example. What made this response possible in the first place was Blizzard’s competent security team, alongside a set of policies that were strictly followed. Logs and audits in the system ensured that Blizzard knew who accessed what and when, which is critical when forming a response. Blizzard was able to determine the extent of the problem and act on it quickly, the ultimate goal of any IT response.

Sources:

https://us.battle.net/support/en/article/12060

https://us.battle.net/support/en/article/9852

https://www.forbes.com/sites/erikkain/2012/08/09/its-official-blizzard-hacked-account-information-stolen/?sh=2ecadbc955d1

Blizzards Gaming Server Has Been Hacked

https://medium.com/@fyde/when-too-much-access-leads-to-data-breaches-and-risks-2e575288e774

https://www.bbc.com/news/technology-19207276

ShovelWare

Elizabeth Technology March 28, 2024

Shovelware refers to a certain kind of small, quickly made game that’s there purely to boost the number of games on the cartridge. They appeal with quantity, not quality, hence ‘shovel’ware. Shovelware’s rarely remembered and usually boring, like the middle song on the B-Side of the tape.

Old Games

The pinnacle of old games are the originals and their best copies. The Donkey Kongs, the Super Marios, the Space Invaders… games with a unique idea and easy-to-learn mechanic dominated arcades, and then the at-home gaming devices.

There are cases where a game can be a rip-off and still be good fun. There are a lot of Centipede and Donkey Kong clones in arcades, for example. They still behave like the original game does, and they look  different enough to evade copyright, so they get to stick around – those aren’t shovelware.

Alternatively, there were a lot of little games that were fun for an hour, and then got boring. Pong against the computer is one example: it’s totally playable for longer, but the content gets a little dry when it’s just you. That makes sense to include in a game compendium, because while it’s fun, it wasn’t worth 15$ all by itself. That might be two weeks of allowance! The kid’s going to be disappointed. Throw in some other games, like Acrobat and a Donkey Kong clone, and you’ve got yourself several hours’ worth of fun for a marginally higher price.

Compendiums were a fantastic way to showcase minigames that weren’t flashy enough for arcades and too short for their own cartridge. Unfortunately, the compendium market was about to be flooded with shovelware.

Bad Old Games: Especially Action 52

Shovelware was the worst intersection of game characteristics. Unoriginal, unplayable, and unfun. For example, Action 52. Only a few games on it were even slightly playable, and the vast majority of the games were either A) repeats of earlier games on the disc, B) too easy, or C) broken. Action 52 had 52 games on it, but maybe 10 were playable, and 5 were original. Of those 5, most were copies of other, better-liked games like Galaga or Super Mario. Not good copies, either.

‘Levels’ within Action 52’s games were often just recolors of the previous stage. This is a cheap trick to give the player a sense of progress, and most early shovelwares were just re-colors and re-skins of the same game, over and over. The obvious downside to putting so many low-quality games into the same product is that they literally don’t have the space to be good even when the programmer wants them to be. There’s not enough memory in the cartridge itself. “Unique and Good” takes a lot of space! Action 52 was already behind the ball when it came to programming expertise, there was no way they were going to pack that many original games into the limited computing power afforded by the 90s.

The worst part of all of this? The original cartridge for Action 52 sold for 200$ in-stores. That’s 200$ in 1991. “Less than 4$ per game”, they said. It’s difficult to make a game worth less than four dollars, but by golly, Action 52 did it repeatedly.

Action 52 gets a special spot in shovelware history because of just how poorly it was made. It plagiarized music. Games would crash or stop responding to the controls with no warning. Unused assets wasted space within the cartridge. There was a competition to get to stage five of one of the games, Ooze, but the game worked so poorly that it wasn’t possible to get past level 2 without an emulator.

Action 52 is now a collector’s item, and it’s so infamous that it has an entire Wikipedia page dedicated to it.

Bad New Games

Shovelware wasn’t just a phenomenon of the 90s, and shovelware still shows up to fill in gaps in the library. The Wii had four separate games that were just the same game with different character models and level aesthetics – the gameplay was nearly identical. As a fun bonus to this already inefficient system, testing is usually also pretty lax! Even if the player enjoys the game, bugs can suck all the fun out of it!

Shovelware can also refer to older games being put back into the regular ‘new’ library for cheap reasons. There are a lot of old games for consoles that are no longer supported, games that may have some nostalgia attached but were otherwise mediocre. Old, weak games take up less space than newer ones, so a developer can fit five outdated games onto one disc for the newest console, and say they’ve contributed to the game’s library. This isn’t the same as remastering, because remastering takes skill. The studio packs up as much of the old content as they can without touching the coding.

By shovelware’s very nature, it’s much easier to pump out than real, new, unique games.

ShovelWare Vs. An Actual Compendium

Shovelware is distinct from better games because it’s missing the love. Pong had love put into it, and the puck never mysteriously phases through the paddle. Banjo Kazooie’s legitimate remake is much better than anything anyone could steal and slap onto a disk with five other late 90’s game clones.

Good compendiums also usually have a central theme. Wii Sports, Rhythm Heaven, and WarioWare all have a unifying theme. Nothing in Action 52 tied into the other games except for Cheetahmen, which was supposed to tie into their sequel and nothing else on the cartridge.

What ultimately separates the wheat from the chaff when it comes to game compendiums? Passion, a reasonable schedule, and a love for the games being made.

Pirating Is a Crime

Elizabeth Technology March 26, 2024

Piracy is a crime. Don’t pirate things. They’re serious about it. There are real reasons beyond “big music corps are people too”.

Why are the fines so steep?

Piracy seems victimless. In reality, the victims are just barely affected with each instance, up until the cumulative effect starts to affect their desire to create. Art has a price, and if folks aren’t willing to pay it, art disappears. Not all of it, of course, but the niche, unusual, and otherwise less profitable stuff goes by the wayside.

Fines are a strong motivator for many people – the main goal is to make piracy so undesirable that nobody does it for fear of the fines, not for the fear of being a thief (or “thief”, depending on how you define copyright violation). Many people don’t see anything actually wrong with stealing content from big name artists. What would the harm be? They aren’t really wrong, but they’re not right – they won’t be affecting that artist very much by themselves, and the amount missing from their art consumption is maaaybe a couple of pennies.

For example, Pharell only made something like $2,000 on Spotify when he was #1 on the top 40. Pirating that song would cost him maybe a twentieth of a cent, more in potential lost sales if you were intending to buy it on iTunes but went to LimeWire instead. However, now that Spotify is not monetizing any songs under 1,000 listens, you not listening in a legitimate channel could make a bigger difference to smaller artists. It’s like littering: if everyone left their trash at the park, the park would close for cleanup. One person is just an inconvenience to the groundskeeper. One plastic bottle won’t ruin the park’s water, but dozens will, and the rangers only need to catch one to get some of the others to stop. Fines keep litterers and minor pirates alike in check. If everyone thinks ‘my trash won’t hurt’, you get a trashed park. If every pirate thinks ‘my pirating won’t hurt’, you get musicians and moviemakers on strike.

Besides, fines for piracy are massive. Up to $250,000, and possible jail time!

Who are you actually going to hurt?

Small artists who get ripped off with copyright breaches and stolen songs are the people on the cutting edge of new. New music, new tech, new art – the small artists create things that you won’t find in Bed, Bath and Beyond, or on the Top 40. Cost these people money, and you’re destroying a complicated ecosystem of inspiration and passion-projects that the Top 40 is not looking to recreate. Layer Ariana Grande songs over each other, and you’ll discover patterns you didn’t notice before – patterns the producers definitely did notice, and they went down a checklist to get that song out and on the charts.

Small bands don’t have the same resources. When something sounds good, it’s because they made it sound good by themselves – you’re rewarding individual talent by not pirating. Tame Impala didn’t have access to a recording studio for their first album. He wrote the songs himself. He mixed it, himself. The same goes for Billie Eilish, and any other number of bedroom musicians (musicians who record their music in their bedroom). No disrespect to Ariana Grande, but she can’t make albums with the creative freedom that a bedroom band can. The people who invested in her can’t afford to have a flop, so she always gets breathy, poppy, peppy songs with high notes. It’s her strength, so it’s all she gets to release. She has creative input, but not a lot of control.

Pirating wouldn’t directly affect her unless everybody started pirating. It would take significantly less to accidentally crush something like early (early!!!) Tame Impala, or early Billie Eilish, and you might not hear anything like them ever again.

Don’t pirate the music if you want more of it!

Movies: More Serious

Movies are more serious to pirate. The theater runs on a tight margin to keep the tickets cheap. This is why a cup of popcorn is six dollars, that’s where the operating cost goes – the ticket is just paying for the movie’s rental of the reel from the studio.

The studio puts its money towards making back the budget of the film, and if the film does well enough, there may be a sequel. Trolls, for example, did well enough for studios to invest in Trolls: World Tour. The same goes for Tenet, and for Sonic. They made enough money back that the studio wants to keep the gravy train running. Not all sequels are good – and some may say that money shouldn’t be running art – but the world we live in has these rules. More money = more creation. Many talented artists literally cannot afford to create art full-time if they aren’t being paid for it.

However, assume pirating eats into the profit. One guy copies the file and sends it out and around, and a bunch of people see the pirated version on disc or download. They don’t want to spend money to see it again. Pirating takes the movie off the watchlist of hundreds or thousands without actually funding the movie. That wouldn’t have ruined Sonic or Tenet necessarily, but for an indie project, that can be devastating.

Pirating can happen at the theater too! You think you’re watching a legitimate copy of Fast and Furious 8, but the owner had pirated it from a connection he had who got it early for review. That theater makes blockbuster movie money, and the studio sees none of it. Stuff like that is why the fines are so huge, that owner would gladly do it again for a $2,000 fine. Illegitimate rental places were also a real problem. BlockBuster franchises (and small locally-owned rental stores) making illegal copies of recent hits was a profit-killer.

And as small bands suffer more than big bands, so too do small movie studios. Some of the wildest, most creative movies ever pushed to the big screen come out of small studios. The group that made Coraline, for example, is relatively small compared to Disney or Pixar. Pirating a newly released movie en masse could seriously dampen their funding for the next movie even if it wouldn’t make a dent for Disney.

It’s cumulative. They won’t catch everyone who pirates… but they’ll get enough to be a deterrent. Good art comes from protecting the artists who made it!

Sources: https://variety.com/2020/film/news/trolls-world-tour-streaming-theatrical-window-future-1234573263/

Sony’s DRM Nightmare

Elizabeth Technology March 21, 2024

In 2005, an organization had been covertly installing a program similar to a rootkit onto consumer devices without warning. For those who haven’t heard it before, a rootkit is simply a program that is designed to remain unfindable on a device. They aren’t all bad, but their difficult-to-detect nature and ability to evade even aggressive anti-virus makes them a top-of-the-line tool for hackers. Back to the story.

The rootkit was on the lookout for ‘suspicious activity’, and if it detected any, it would quietly alert the parent company. However, even if you had nothing to hide, you still had something to fear: the rootkit left a gaping security hole, and a smart enough hacker could piggyback off of it to get Trojan Horses, Worms, and other nasty bugs in without alerting the computer that “hey, there’s an .exe file doing weird stuff!”

The rootkit was designed to hide itself, and it would hide the bugs behind it. There was no mention of this anywhere in the EULA agreement for the program that had the rootkit.  The parent company hadn’t meant to leave a backdoor, but they did, and attempts to fix it without removing their own program just made the problem worse. Attempting to fake fixing it with an uninstaller only hid the program deeper in the system, and trying to uninstall it could brick the computer, depending on which program you got. They’d really screwed themselves, and they hadn’t expected to get caught.

This wasn’t some Russian hacking scheme, or some government overreach – it was Sony, attempting to keep copyrighted material off of pirating websites. Talk about an overreaction.

The History

At some point, a company has to admit it would rather ruin the legitimate user’s experience than let a pirate go unpunished. That’s very understandable: stealing is wrong, and smug pirates behaving like they’ve gotten one over on ‘the system’ are frustrating. Ordinary responses to this can be anything from asking for the license # on the inside of the clear case to more subtly ruining the audio quality of pirated copies. This is a normal level of copyright protection. Very determined pirates could still get around these measures, but hey, you can’t spend all your resources on the fringe cases.

Companies are aware of this, and some begin to factor ‘unstoppable piracy’ into their calculations – you know, like grocery stores will factor in ‘lifting loss’ and spoiling produce. Companies usually determine they’d be spending more on preventative measures than they’d be keeping on the shelves. Theft is wrong, but so is littering and driving without a license. Somehow, all three still happen anyway. Sony is very mad that pirates are getting away with fresh content, and they want to do the equivalent of TSA pat-downs on everybody at the exit of the grocery store to stop a small percentage of thieves.  They don’t care anymore; nobody is going to get away with it.

Was it Reasonable?

Napster and LimeWire are making inroads into the music industry’s profit, and 2005 was the peak. The pirating of copyrighted content is only made easier with the rise of the internet, and Sony realizes it’s nigh impossible to find the illegitimate downloaders, and uploaders were only marginally easier. They decide to go for the source, but they decide to hit hard.

“The industry will take whatever steps it needs to protect itself and protect its revenue streams… It will not lose that revenue stream, no matter what… Sony is going to take aggressive steps to stop this. We will develop technology that transcends the individual user. We will firewall Napster at source – we will block it at your cable company. We will block it at your phone company. We will block it at your ISP. We will firewall it at your PC… These strategies are being aggressively pursued because there is simply too much at stake.” – Sony Senior VP Steve Heckler

This quote was said in 2005, after Sony had merged with another company, BMG. BMG had an incident in Europe in the 2000’s, when they’d released a CD without warning users of the copyright protection on the inside. Apparently, burning money to replace those CDs (and burning goodwill) was not enough of a lesson, and Sony and BMG together prepared to take a stand against pirates.

The Problem

They’re going after the big boys, the folks downloading music to upload everywhere else…for free.

These are the people depressing profits, in theory. Some companies theorize that once these people are gone, the people passively pirating by downloading stuff from them will also disappear and go back to buying the content. They’re somewhat right, and this audience shrinks over time. More on that later.

This is illegal and very annoying! The estimated lost sales from piracy were in the billions, and many companies were beginning to look at more intense DRM: Digital Restriction Management.

To some people, DRM is the root of all evil, the seed of the eventual downfall of consumer’s rights. After Sony’s screw-up, they were right to call it as such. John Deere, Apple, Sony, Photoshop, etc. are all slowly eating away at their own best features for the sake of pushing users into proprietary software. Software they’re not allowed to repair because of DRM. Take Deere: if a new Deere tractor detects a common tractor repairman’s diagnostic software, a Deere tractor will stop working until you call out a Deere technician. This obviously drives up demand for Deere technicians, and it’s horribly restrictive to the user. Lawsuits are in progress right now over this because the obvious result is that Deere can cost you your farm by doing this.

To others, DRM is an essential part of the free market. Companies should be allowed to protect what they made, and if users find their methods extreme, they shouldn’t have bought it. And in less extreme circumstances, they’re right! That’s what the EULA, the End User License Agreement, is for. The user can decide if they’re willing to put up with the DRM specified in the Agreement, and if they’re not, they don’t have to buy it. ‘If you pirate this, it will only play static’ is reasonable.

Sure, some super-cheapskate who found a sketchy download off some sketchy site is going to listen to static with Hint of Music, but the average user would rather buy the disc and be done with it. If the company can make the ripped upload sound like garbage when it’s off its home CD, they won. The company has successfully used DRM here to keep their honest customer honest, and any would-be pirates away. And they did it without destroying either computer! As Stewart Baker of the Department of Homeland Security said, “it’s your intellectual property – it’s not your computer”.

Doing it this way means normal consumers still get a high-quality product, and if the DRM is limited entirely to the content itself, there’s no risk of it coming back to bite the company in the butt.

Still, if you really disagree with DRM, there were companies that successfully reduced their piracy problems in other ways. Some found that guilt was enough, others found that once certain websites were gone, their piracy problems disappeared too. Warning folks that piracy was still a crime got the people who didn’t know any better to stop. Fines did a number on the folks who were too bold or too dumb to not get tracked with non-DRM means, and for the people who were doing it because it was more convenient? They reduced their pirating when better paid methods became available. Sony’s problem could have been solved in a lot of ways!

Besides, Sony wasn’t struggling. Lost sales are not the same as losses! Companies are still making profit, just not as much as they’d like. Property is not being damaged, and nobody is experiencing physical harm as a result of pirating.

The Response

Sony’s DRM was a severe overreaction to the problem at hand, and it did lead to several lawsuits. As said at the beginning, Sony had not only installed software without the user’s knowledge, but they’d then left a big entry point for security threats to get in undetected. Hundreds of thousands of networks were affected, and some of them were government. Once someone blew the lid on the DRMs, they released a cover-up “uninstaller” that just hid the rootkit better and installed more DRM content on the user device.

This does not help!

The blown cover for the rootkit meant that black-hat hacking organizations could tool around and create something that could get into anything with that rootkit on it, undetected. Eventually Sony was forced to admit this was wrong, but not before screwing over a couple million people who just wanted to listen to Santana or Celine Dion from a CD they paid for. Over pirates.

Yeah, there’s some lost profit – but it doesn’t outweigh the regular customers.

The Aftermath

Sony’s first instinct is to hide it. As mentioned in the article above, the uninstaller available didn’t actually uninstall it, and some users reported issues of system crashes and their machine bricking up when the uninstaller’s poor programming tried to interact with the rest of the device’s programming.

Their second decision is to lie – ‘the DRM has no backdoors and doesn’t pose a risk to your computer’s security’. This is demonstrably untrue, and given that they were already in the beginning stages of recall, could be considered a deliberate lie.

Sony’s third action is to recall the discs with the DRM on it, but they don’t get all of the discs. Some users aren’t sure if their disc is affected or not, and even non-profit organizations dedicated to maintaining free internet can’t figure out what discs have it and what discs don’t. The best they can do is a partial list. Stores in New York and Boston are still selling the discs three weeks after the recall. However, users do get to swap their disc with an unprotected one through the mail. Sony seems to have acknowledged their screw-up at this point.

Sony’s fourth action is more a consequence – they stick a class-action lawsuit sign-up notice on their home website, and users affected can claim damages up until 2006. Class-action lawsuits filed by individual states start to drag down Sony’s profits more than the piracy ever did, and the end result is a mandate to put warnings on the cover of discs and to stop using DRM that could damage a user’s computer. DRM is still allowed, it just can’t be possible to destroy a computer to protect a song license. The feds actually considered this a breach of federal law and stated that it was engaging in deceptive and unfair business practices. Sounds about right – consumers wouldn’t have bought a disc that downloaded DRM without their knowledge. From conception to execution, this was a moral, ethical, and legal mistake. While pirating is wrong, it’s possible to be more wrong trying to stop it.

https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal

https://us.norton.com/internetsecurity-malware-what-is-a-rootkit-and-how-to-stop-them.html

https://www.wired.com/2006/12/sony-settles-bm/

https://www.theregister.com/2005/11/01/sony_rootkit_drm/

https://money.cnn.com/2005/06/24/news/international/music_piracy/

https://www.networkworld.com/article/2998251/sony-bmg-rootkit-scandal-10-years-later.html

https://fsfe.org/activities/drm/sony-rootkit-fiasco.en.html

https://digitalscholarship.unlv.edu/cgi/viewcontent.cgi?article=4058&context=thesesdissertations

https://www.networkworld.com/article/2194292/sony-bmg-rootkit-scandal–5-years-later.html

‹  Older posts Newer posts  ›