EU Data Protection Reform 2012

Europe Sets the Standard

The European Commission today proposed a comprehensive reform of the EU's 1995 data protection rules, to strengthen online privacy rights and boost Europe's digital economy. The text of the proposals (pdf) comprises a hefty 91 articles and supporting material, spread over 120 pages. Here, summarised in the form of annotated bullet points, are eight of the most important and/or controversial aspects from an initial reading of today's proposals.

• One Rule for All

The intention is to introduce a single regulation (law) across all 27 member countries. This contrasts with the 1995 directive, which specified only the desired results. While these results were themselves binding, they were left to the individual states to implement, using their own chosen methods and mechanisms. Nobody seriously considers the outcome of that process, predictably enough a patchwork of 27 variegated rule sets, to have been a resounding success.

• No Geographical Boundaries

Article 3 declares the scope of the new regulation, which would extend to anyone, anywhere in the world (yes you too, America!), involved in the processing of any personal information, relating to any EU citizen. And by personal information is meant not only names, dates, and places, but also technical data such as IP or Mac addresses; (explicitly) information of a genetic, biometric, or health nature; and so on. Service providers like Facebook or Google must accept these obligations in full, or else deny their services to EU citizens.

• The Right to Erasure

Article 17 guarantees EU citizens the right to "extended erasure" of their personal data. Not only will the organization that processes personal data have to erase it on demand, but the they will also have to "take all reasonable steps, including technical measures" to get any copy, link, or replication on the Internet removed. Now, although in practice search engine data removal can mostly be automated, data removal from e.g. sites repeating CC-licensed Wikipedia content could be problematic.

• Data Portability

Article 18 introduces the right to data portability - that is, to obtain a complete copy of stored or active data in a structured format. For example, this will allow users to switch between web mail systems with all their data intact.

• Mandatory Assessments

Article 30 binds organizations to systematic security risk evaluations; unlawful forms of processing, unauthorized disclosure, dissemination or access, or alteration of personal data must be prevented. Here, the commission reserves the right to define: what constitutes the state of the art, for specific sectors and in specific data processing situations, in particular taking account of developments in technology and solutions for privacy by design and data protection by default.

• Mandatory Notifications

Article 31, already being dubbed the Playstation Clause, requires organizations to disclose to their supervisory authority, effectively immediately, and in any case within a maximum of 24 hours, any personal data security breach. Sony famously waited one full week before telling their SEVENTY MILLION customers their personal data might have been compromised. This provision has of course come in for immediate and heavy criticism; 24 hours is not a lot of time for the kind of investigations that might be needed to avoid many false alarms. It might also be too short an interval to prepare measures to ensnare hackers, and serve only to warn them their attacks have been noticed and actioned.

• Enforcement: Data Protection Officers

Article 36 provides for data protection officers, designated in regard to their knowledge on data protection laws, who will be independent, and will receive no instructions pertaining to the exercise of their function. These officers will be mandatory in three prescribed cases, namely:

1. for any public authority or body;
2. for any company permanently employing more than 250 persons; and
3. for any company whose core activity consists of monitoring data subjects [qv].

One important corollary is the end of general notifications to local agencies, which measure alone should simplify the regulatory environment and save an expected 130 million € per annum.

• Enforcement: Enormous Fines

Article 79 aims to give the legislation the necessary "teeth" to enforce these rules. This it does by providing individual national data privacy agencies with huge administrative sanctions. Various levels are countenanced, depending upon the particular violation, but the headline figures are: up to one million €, and up to 2% of an enterprise's annual worldwide turnover. Just to put that in context, to Microsoft in 2008, that would have come to 1.2 billion € plus tips.

Conclusion

It's a bold proposal, obviously designed to take the lead in the international areas of user privacy, data ownership, and data security. Certain of its provisions appear superficially to be quite "heavy" in their commercial import; some rather impractical, and maybe idealistic, although given the technological representation present and the consultancy that has taken place over the last 17 years, certainly not as naive as recent American proposals in adjacent fields (SOPA, ProtectIP). The Commission has clearly decided to take a stand against the piecemeal, partial, and largely failed implementations of its earlier directive. It will be very interesting to see how and where this extensive new structure flexes under the opposing pressures of commerce and politics in coming months.

Picture: Berlaymont building of the European Commission (Wikipedia).

Sony Handheld Nonportable

Vita has Flash Problem

And I don't mean Adobe. Even though discontinuing Flash development for mobile devices, Adobe are still in negotiations with Sony for a Vita version of (probably) Flash Mobile 11 - the last version they'll ever make available for phones and tablets. But Steve Jobs has driven all web video irrevocably in the direction of HTML5; and as for Flash games, well, they're mostly rubbish on wee displays like the Vita's 5" OLED capacitive touchscreen anyway. No, the issue I'm referring to is this new announcement from Sony, that the PS Vita will require the use of proprietary memory cards. And just why exactly might that be? A Sony spokesperson explains: [we are] using proprietary memory cards, both for security reasons, and to ensure a consistent experience for all users.

Ah right, security reasons, of course. And yes, a consistent user experience. Always thinking about its beloved users, Sony is. About their security. And about the consistency of their experience. So, we should expect these proprietary sticks to be priced similarly to existing, industry standard flash memory cards, right?


Prices are in dollars. Source: Amazon.com, except for Sony prices, which are current listings at Gamestop.

Is Jonathan Fargher Entirely Trustworthy?

Sony's Apology Package

Haven't had much to say about Sony's recent security troubles. Well, it's hard to travel anywhere on the news websites and blogs, without crashing into Floydian walls of opinion about the corporation and its permanently besieged Playstation Network. Even on the subject of this post, namely the "apology package", there are countless deafening choruses of "too little", "too late", "also, I want an Xbox", and related flamewars without end.

However

Jonathan Fargher, senior PR manager for Sony Computer Entertainment Europe (SCEE), has crossed a line with me. And I'm sure, with every other gamer with a gramme of technically literacy. If I may quote just two lines of his, from say the BBC's report:

1. Clearly there's going to be a minority of people out there who have some of those games.
2. We certainly believe [...] the choice of games that we're offering [...] is good value.

Of course I have to be careful what I say now, mindful of my country's draconian, and quite literally, unspeakably insane 17th century libel laws. But given these two statements, it is quite easy to prove with rigor, using little more than the rules of the predicate calculus, that Jonathan Fargher is either deranged, or a liar.

The proof doesn't depend on the truth or falsity of the individual statements themselves; given certain platitudes, it's as certain as any proof in logic, more so than any in the rest of mathematics. It is true regardless of whether or not some people already have some or all of these games; whether those people form a minority, or a majority; whether the choice of games is good value or a ripoff; and whether or not Jonathan Fargher believes some, any, all or none of the above. No single given factoid convicts. Rather, Jonathan Fargher's problem is that there's no consistent assignment of truth values to the various parts of his statements, that avoids the incriminating conclusion.

Reductio Ad Absurdum

We proceed by assuming the truth of everything Jonathan Fargher claims in those two statements above. From this we derive a contradiction. Finally we conclude that either Jonathan Fargher believes this contradiction, in which case he is arguably deranged; or alternatively, he doesn't actually believe (one or more of) his own claims. In that case, inescapably, he's a liar.

So, working from the back to the front: the second thing Jonathan Fargher believes is that the choice of games is "good value". How can we express this in less subjective terms? Let's take a look at that choice.

PS3 Title	Release Date
Dead Nation	Dec 2010
Infamous	May 2009
Little Big Planet	Oct 2008
Ratchet and Clank: Quest for Booty	Aug 2008
Wipeout HD/Fury	Dec 2009

Apart from the PSN exclusive zombie shooter Dead Nation, and the Fury addition to warhorse Wipeout HD, everything here is two or more years old.

PSP Title	Release Date
Killzone Liberation	Nov 2006
Little Big Planet PSP	Nov 2009
ModNation PSP	May 2010
Pursuit Force	Nov 2005

Wow. I'd forgotten there even was a PSP console in 2005.

Yet regardless of the considerable age and the low current prices (below £10) of many of these titles, and notwithstanding the fact that you get to pick only two games from either list, none of this allows us to deny Jonathan Fargher's claim of "good value". Why? Because here, they're free. Any attempt to compute the value-for-money of a given selection results in a division by zero error.

That can't be right. Are we now agreeing with Jonathan Fargher, and going fargher still, to say that the selection represents infinite value? No. Clearly the concept of value-for-money is inapplicable to truly free offers. A better gauge is the popularity of the selections. The more popular the game, the higher its value as a free offering. But here we begin to see the seeds of the contradiction that we seek. In a given console community, popular games are by definition those most likely to be owned already. And to such an existing owner, a free download of such a game obviously has a very low value indeed.

Summing Up

From Jonathan Fargher's Second Law, we are being offered a "good value" selection of games, in other words, a set containing at least some popular games. By definition, such games are already owned by a majority of a given console community. That contradicts Jonathan Fargher's First Law, that no more than "a minority of people" will already have any of those games.

Quod erat demonstrandum.

Security Digest #15: 27C3 Special

The 27th Annual Chaos Communication Congress

With the application of my superior skills of decryption, I deduce that this logo says 27C3. Well, the 27th CCC has just happened in Berlin, spread over the last four days (Monday 27th to Thursday 30th December). Required viewing for all security professionals, the conference was broadcast live on the Internet, which is where I caught the absolutely riveting presentation of Sony PS3 Security Epic Fail. More on that later.


Blah, blah, blah...

• GSM eavesdropping is now easier and cheaper than ever. Wow, I thought they'd have patched that one by now. Not. One of the most interesting aspects of Tuesday's presentation was the researchers' casual references to two-terabyte rainbow tables. Now we really are living in the future. The use of these tables of precomputed encryption keys is as old as decryption itself, but their sheer size allowed the session's secret encryption key to be found in less than 20 seconds. The presenters also used various software (open source), one laptop, and for their network sniffers: four $15 telephones.
  

• FireEye security researcher Julia Wolf discloses a plethora of new PDF vulnerabilities. Actually this one is new (in the detail) and worrying indeed (in scope). I read it and wept, nearly.

• WikiLeaks defector details new whistle blowing model, OpenLeak. Well, Wikileaks itself was born at CCC in 2007, in a presentation by Julian Assange; so this is an entirely appropriate time and place to announce that. Good luck with your new venture, you former WL operatives, I'll see your new site and raise you 9,000 others. I mean, shouldn't we be calling this Hololeaks already?
  

• Hackers Crack PS3 Master Key: yeah, calm down, we're coming to that. Actually I heard Geohot has already discovered the Sony console's root key; let's just wait and see how that pans out. No, I don't condone piracy either. [Update, Jan 12: they've filed suit against both him and fail0verflow.]
  

Sony FB Part 3

Required viewing for all Sony development engineers. And I'm quite certain every one of them has watched this by now.

As a PS3 owner, I should have a vested interest in Sony's ability to protect their private walled and perfumed garden of game software development. That I do not in fact feel that interest, is a consequence of some cold industry facts. Specifically:

1. Protected development is no longer directed at creating the staggeringly imaginative games found on previous console generations - Zelda Ocarina on the Nintendo 64 being both archetype and zenith - but instead aims for common denominator, hyper-realistic sandboxes or short span missions, quite devoid of creativity. In fact...
   
2. One of the best things to come out of Sony last year was a Sly Cooper retread, retrofitting HD textures to the identical set of polygons first marketed to us (abysmally marketed, in the case of SCE Europe) way back in 2002; adding some unbelievably meh Move mini games, and trumpeting 3D capability. After all, who's going to remember the original Sly 3 from 2005, arriving on the PS2 already replete with anaglyphic 3D and free blue-red specs? Meanwhile, 2011 seems set to repeat such repeats, with an HD/3D reskinning of Ico & Shadow of the Colossus poised for imminent release.
   
3. More than most electronic conglomerates, scofflaws Sony appear particularly to despise their customers, treating them with the same apparent level of dismissive contempt as the corporation exhibits towards all consumer protection legislation, internationally. Examples are legion, and entire websites exist solely to bear testament to this single proposition.
   

Therefore it was with the squealing glee of a wee girl, that I found and devoured the brilliantly presented 40-minute CCC talk Console Hacking 2010: PS3 Epic Fail, presented by fail0verflow members bushing, sven, marcan and segher...

After a little history, the ubiquitous Michael Steil appeared in cameo to present statistics relating to the time taken to hack various consoles, and supporting his assertion that any console without Linux will be hacked to run it within its first year. The apparently atypical run of luck enjoyed by the PS3 (four years) seems to have been due to Linux already being officially available there. But Sony, famously and illegally, removed that feature; now their security has likewise been annihilated. Again, within that twelve month window.

Interesting though, how this narrative thread fits into an emerging pattern of virtual terrorism (cf the many DDoS attacks recently launched both against and in support of Wikileaks). Upsetting the Linux/hacker community looks a bit like pissing off 4chan, or anonymous, in that, you probably don't want to do it. Anyone can see that DDoS attacks in support of say, Wikileaks, are just as indefensible as attacks on Wikileaks itself; yet they continue, trumpeted by the same, sometimes naive, mostly disingenuous, idealistic justifications.

Anyway (removes equivocation apparatus)...

The core of fail0verflow's presentation featured a table of security features implemented on a sampling of consoles. This was followed by a step-by-step account of the group's deconstruction and reverse-engineering of each of these, by means of spectacularly varied and creative vectors of attack. At the finish, as evidenced by the same table, the wretched PS3's security features had been comprehensively deleted, and you could feel nothing but pity for it:


There's a lot to love about this presentation, but the highlights for me were (1) the playing of the Sony "Trophy!" bell and icon each time another layer of security was breached; and (2) the hilarious specific details of one particular attack, the compromising of ECDSA signatures.

This latter was deliciously presented by fail0verflow member and future standup legend segher, who self-deprecatingly explained just enough about this solid encryption scheme to make it obvious to any high school student, that a certain private random number must be truly random.

Actually, he didn't explain that at all. That would have insulted the intelligence of his audience of hackers. Instead he showed the relevant formula, then observed "... but m is supposed to be a random number. And for some reason, Sony uses the same random number all the time." Instantly, the overhead display changed to show two simultaneous equations. The hall erupted in a gaggle of hysterical laughter, and the kind of rapturous and loud applause that actually hurts your hands and feet.

Just to rub salt in the wounds of any Sony devs watching, he showed us his attempt at reverse-engineering Sony's prang:

// Sony's ECDSA code
int getRandomNumber()
{
return 4; // Chosen by fair dice roll; guaranteed to be random.
}

As I mentioned above, there's much more very clever stuff in the presentation; but come on, who could ever follow that? See you next year!


Security Digest is brought to you by the inimitable flavours of Talisker, the only single malt scotch whisky from the Isle of Skye. Actually that Glenmorangie fae Tain's no hauf bad an' all. Aye, and the Lagavulin. Which isnae a patch on Highland Park, incidentally... Happy New Year! Hic.

The Sony PS3 Linux Saga: Part 2

Update: John Lewis's reply letter appended below; my reply, subsequent correspondence, and the dénouement, are all now in the Comments. At the time of writing, there are three American million dollar class action lawsuits (update: now four) pending against Sony (all at the US District Court of Northern California, oddly enough).

Best of luck also to Michael Trebilcock from Modbury, Adelaide, who is on disability pension, and is suing Sony for $800.

Update [July 22] Seven (!) class actions so far filed against Sony in San Francisco federal court have now been consolidated into a single class-action complaint, the request of "all counsel." The three law firms involved will act as co-lead counsel against Sony.

The Story So Far

Big surprise! Sony Corporation screwed a bunch of their legal, fee-paying, law abiding customers, including me - as described in this earlier article:

http://mycodehere.blogspot.com/2010/03/sony-fb.html

I took up the matter with my retailer, John Lewis, as documented by the email exchange recorded in the Comments section of that article. Now we've got to the big standoff, and while we wait to see who blinks first, I've sent to the retailer this PSA, which was a little too big, and a little too RTF, for a comment...

~

To: [name], Customer Service @ John Lewis Glasgow
From: John M. Kerr
Date: 23rd April 2010
Time: 4:53 PM

Hi [name],

Thank you for your recent message, and also for returning my telephone call on Saturday 17th April, regarding our Playstation 3 loss of function.

As I said to you on the telephone, I am currently keeping an open mind with respect to your recent offer of a £75 payment to me, which I recognise is after all 25% of the purchase price, and as such represents an improvement on previous refunds in the history of this issue. However, I do feel that I must insist on a clear statement of the terms and conditions under which this offer is being made, for if they involve my agreeing that John Lewis have not contravened the relevant consumer protection legislation, clearly I should be quite unable to comply with that.

We acknowledge your intention to reply more fully next week. As you know, we are now more than halfway through the 5th week since I filed my initial complaint with John Lewis, by email, on Tuesday 30th March at 10am. I am sorry to hear that in the interim, your legal department appears to have misinformed you on this matter. Perhaps while awaiting your final response, I might take the opportunity to clarify the applicable law, and to reiterate our position.

[1] EU Directive 1999/44/EC

The Directive states the following:

“The goods must:

• comply with the description given by the seller and posses the same qualities and characteristics as other similar goods
• be fit for the purpose which the consumer requires them and which was made known to the seller at the time of purchase.”
  

The Directive applies to the contract of sale between the retailer (not the manufacturer) and the customer. It also mandates a minimum two-year warranty on all new consumer goods (in Scotland, the Sale and Supply of Goods Act 1994 extends this to five years; in England, six).

[2] The "Purpose"

The Purpose, for which we required the goods, was: as a general purpose computer, Blu Ray player, and online games console. This Purpose was made known to the seller, viz. John Lewis personnel, at the time of purchase.

[3] How the Purpose was made known:

There were three distinct ways in which this occurred, any one of which alone suffices to establish liability.

[3.1] We explicitly made this Purpose known.

We made our requirements perfectly clear to your sales personnel at the time of purchase. And that, essentially, is all that is required under consumer protection law.

[3.2] Your salesman pointed out the Playstation's suitability for our Purpose.

We were shopping that day for either a computer (for use as [my] "home office" machine, and also to let my wife edit & process photographs), or a games console (for my upcoming birthday), or both. Your salesman pointed out to us that the Sony Playstation [3] could do both; and that although it could not run Microsoft Windows, there was a lot of free software available for its "Other OS" feature.

[3.3] Sony advertised the Playstation's suitability for our Purpose.

At the time of purchase, I was in fact already aware of the "Other OS" capability of the Playstation 3; since launch, it had been widely advertised by Sony personnel on their websites, their public forum websites, and elsewhere. Here are four such published examples, all of which predate our purchase:

[3.3.1] http://www.playstation.com/ps3-openplatform/index.html

Sony Computer Entertainment Inc.:

Overview of the Open Platform for the PLAYSTATION®3 system

There is more to the PLAYSTATION®3 (PS3™) computer entertainment system than you may have assumed. In addition to playing games, watching movies, listening to music, and viewing photos, you can use the PS3™ system to run the Linux operating system.

By installing the Linux operating system, you can use the PS3™ system not only as an entry-level personal computer with hundreds of familiar applications for home and office use, but also as a complete development environment for the Cell Broadband Engine™ (Cell/B.E.).

[...]

To use the Linux operating system, you must update the PS3™ system software to version 1.60 or later.

Very recently, a red warning has been added to the top of that page, saying: "On PS3™ system models sold earlier than the CECH-2000 series models, the Open Platform feature will not be available if the system software is updated to version 3.21 or later". This condition was of course not present at the time of our purchase.

[3.3.2] http://kotaku.com/235049/20-questions-with-phil-harrison-at-dice

Phil Harrison, February 2007,
President of Sony Computer Entertainment Worldwide Studios 2005-2008:

"One of the most powerful things about the PS3 is the 'Install Other OS' option."

[3.3.3] http://www.gamasutra.com/php-bin/news_index.php?story=9290

Sony executive Izumi Kawanishi
Sony Computer Entertainment Inc., 2006-2009:

"The Linux Distributor's Starter Kit provides information, binary and source codes to Linux Distribution developers who wants to make their distro support PS3."
"Because we have plans for having Linux on board [the PS3], we also recognize Linux programming activities... Other than game studios tied to official developer licenses, we'd like to see various individuals participate in content creation for the PS3."

[3.3.4] http://www.spiegel.de/netzwelt/web/0,1518,418642,00.html

Phil Harrison, May 2006,
President of Sony Computer Entertainment Worldwide Studios 2005-2008:

"The Playstation 3 is a computer. We do not need the PC."
[Note: German text]

In the past several weeks, Sony moved urgently to remove some such evidence from certain promotions similar to those detailed above, to alter the wording of agreements, and so on. But in fact their websites had by then already been cached by search engines such as Google, and many further "incriminating" backup copies have also been secured since then.

I have mentioned earlier in this ongoing email exchange, the console games that we are presently unable to play online, and the Blu Ray discs whose BD-Live content we are currently unable to access. What I did not mention, because it wasn't obvious until we received the relevant papers and began preparing our sheriff court claim, is that these purchases themselves amount to literally thousands of pounds. Should this case go to court, this is indicative of the level of damages that we would claim.

In view of your message today, we shall make our final decision on how to proceed, based on all available information at that time, no later than Monday 3rd May 2010.

Thank you once more for your efforts in trying to negotiate a happy resolution for us.

Yours Truly [...]

~

Here is the letter I received in reply (click to embiggen):

page 1 page 2

I'm especially fond of the part where they assert my PS3 can't be a computer, because it is a games console; designated by the numbers 826 against the product on your receipt [...] If it had been sold as a computer the number would be 827.

Yes, I literally laughed out loud too. Wasn't it Jodie Foster who said, They should have sent a poet...

But then reading on to the part John Lewis remain not liable [sic] for what has happened to your product... I realised that I hadn't won after all. What I want is neither a partial £75 compensation, nor a return for a full refund - both of which I've now been offered - what I want is just my retailer's acknowldegement that giant corporations like Sony cannot simply EULA their blustering way past any and all consumer protection legislation, to steal from me in my living room, or at my place of business.

John Lewis are indeed liable. They should accept their responsibilities under EU Law. Yes, they are also victims; but they should be kicking Sony's arse, not their own customers.

I'm about to decline this latest offer, just as soon as my language cools down to the optimum temperature for discursive efficiency. Meanwhile, as we prepare for war both in the media and in the Sheriff Court, we should perhaps pause to see what happens next in America. For it is extremely gratifying at last to see Anthony Ventura, a user from California, launch a class-action suit against Sony, alleging deceptive business practices:

http://ps3movies.ign.com/ps3/document/article/108/1086720/gov.uscourts.cand.226894.1.0.pdf

Sony FB

My Beautiful Yellow Dog Linux 6.1 Desktop

Updated & extended; most, though not all, foul language excised. My correspondence with retailer John Lewis has been added to the Comments.

When I read this post on Slashdot yesterday...

The next system software update for the PlayStation 3 (PS3) system will be released on April 1, 2010 (JST), and will disable the 'Install Other OS' feature that was available on the PS3 systems prior to the current slimmer models, launched in September 2009. This feature enabled users to install an operating system, but due to security concerns, Sony Computer Entertainment will remove the functionality through the 3.21 system software update.

... I just clocked the date and went back to sleep. But not without some stress. I was perfectly aware, after all, of the very real threat posed to Sony's business model, by the recent work of iPhone hacker George "GeoHot" Hotz, in circumventing the Playstation 3's hypervisor, gaining full memory space, direct-to-kernel and device driver ring 0 access, and ultimately promising the RSX GPU.

More than that, I was now looking forward to DMA pipeline programming just the curmudgeonly but venerable 150 GFlops Cell processor myself (today's Core i7 975 offers just 111 GFlops by comparison), even though aware of corporate eyes watching with poisonous contempt, laying their plans to move against their own honest customers.

With all that DRM breaking, should I be worried about this Slashdot post, claiming that on April Fools' day, Sony will remotely shut down my entire home OpenOffice.org? Without my consent? Without more than half a week's notice? Well, I also had in my other pyjama pocket, this recent (month old) personal guarantee from Sony Computer Entertainment America's principal software engineer, Geoffrey Levand:

Please be assured that SCE is committed to continue the support for previously sold models that have the "Install Other OS" feature and that this feature will not be disabled in future firmware releases.

In the event, sure enough, I awoke today to a chorus (thanks, Google) of more than six million voices, all confirming Linux's imminent removal from my PS3; and the furious backpedalling rattle in my head, of Levand's "The text above was provided to me by SCE management"...

The Rig, Posing

Just in case you don't believe that I run my evil multinational business empire on PS3 Linux: here is our entertainment centre, oblique, home office.

The speakers are normally a room apart, but they'd recently been moved in close together for a photo shoot connected with an unrelated article on audio standards. The main thing you will observe, I hope, is my meticulously maintained PS3 Linux desktop, where as you can see I'm presently engaged in patient composition of my measured response to the latest Sony news.

What we are finding more and more, in this era of devices infected with strong DRM and phone-home functionality, is that not only do we no longer control our own devices to any reasonable level, but that we are also subjected to the summary cancellation of sundry features after the sales transaction has been effected.

How many customers of Amazon's Kindle ebook reader were convinced to buy because of the automatic audio reader functionality? In the blind and partially sighted community, I suspect a significant proportion. Yet Amazon allowed itself to be blackmailed by the disingenuous and thoroughly, hatefully stupid Authors' Guild, to redact this feature after the contract of sale.

Caveat emptor. If you deliberately buy DRM, if you invest in devices that are defective by design, then like me, you're just a mark - you deserve all the pain that you get, and more, because your meek acceptance of this crap brings it down, inevitably, on everyone else.

By Grabthar's Hammer, by the Suns of Warvan, I Shall be Avenged!

This time I really mean it. I will never buy another Sony product of any kind. Not even a CD, a game, a movie DVD or a Blu Ray.

Or at least, I'll do my level best not to. But I'll eventually fail. After all, if I could really forswear all future transactions with the Sony Playstation Network, deny myself every future Sony game, boycott all mandatory Blu Ray updates and all BD Live content, and so on... then I'd be able to yank out the devil machine's ethernet wire, dodge the update, and keep using my Linux solution.

However that would reduce my plastic toy to just a Linux box, and a very mediocre, deliberately impaired one at that. Remember, we gave Sony our money, on the written understanding and agreement, that this technological DRMfest would also serve as an up-to-the-minute games console and media centre.

As one commenter put it: "It's like they sold you a table, then cut off two legs." Yes, that's it, exactly. This is evil of the kind for which Sony is justly famous. Once more (sigh), we must get the lawyers involved.

Oh, yes. There will be lawyers.