how do i listen to music at my computer?

Volume 1, Number 3
April 21, 2001
IN THIS ISSUE:
* RealPlayer: RealSpyware?
* Product Profile: O&O CleverCache
* Mailbag: Fast Reboot Is A Hit, RealPlayer Woes and Macromedia Flash
Problems
* Newsletters: More Or Longer?


Before we begin this issue, I need to mention that the Windows 2000 Power
Users newsletter has been featured in the Windows Daily section of
Lockergnome.com! For those of you who don't know about Chris Pirillo's
LockerGnome, it's a site loaded with news, reviews, opinions and newsletters
pertaining to just about everything digital. They come strongly recommended
from me and have something there for just about everyone.


RealPlayer: RealSpyware?

Last week's article on RealPlayer being a RealPain prompted a flurry of
letters, some of which insinuated that RealPlayer was in fact a piece of
spyware. Was all this stuff true? Was RealPlayer in fact one of the most
ubiquitous pieces of spyware out there?

I buckled down and did my homework, and when I finally lifted my head from
the desk I found some things that did bother me.

The first and most alarming thing was the repeated mention of RealPlayer and
Comet Cursor in the same breath by many people. For instance, a review in
Epinions.com of Comet Cursor mentioned that "...if you downloaded and
installed Real Player 7 and 8, you've downloaded and installed Comet Cursor
2.0 since it was bundled with it." (The review:
http://www.epinions.com/cmd-review-34A-509F7B7-39D3CDC4-prod1 )

I later found that this was incumbent upon what type of RealPlayer
installation you chose. The most basic, bare-bones installation of
RealPlayer, while still rife with all those incredibly annoying nag boxes
that refuse to die, doesn't appear to have Comet Cursor as part of its
package. So if you haven't downloaded it yet, go for the most stripped-down
version of the program you can get.

The most damning evidence about software from Real Networks in general
appears to come from Gibson Research ( http://www.grc.com ), Steve Gibson's
site devoted to PC security. There, he has a page --
http://grc.com/downloaders.htm -- in which he dissects the data sent from
RealNetworks' RealDownload package. His findings boil down to this:

1) RealDownload, one of the RealNetworks programs, transmits a considerable
amount of personal information back to the RealNetworks servers whenever it
is used.
2) RealNetworks has repeatedly denied that they are using this information,
and that their software could behave in such a fashion. The second part of
that statement runs completely contrary to what Gibson has unearthed; as for
the first, the jury is still out.

RealDownload is not part of RealPlayer by default, but there is nothing that
says that RealPlayer doesn't also behave the way RealDownload does, as
described in Gibson's piece. In fact, I got a letter from a reader
(detailed below) that seems to hint towards this.

Steve Gibson, in case you haven't browsed his excellent site yet, is
probably one of the smartest and most with-it people in the PC security
space today. His tools, including Shields Up! and LeakTest, have helped
thousands of people determine if their systems are insecure. I doubt that
he would make allegations this serious unless there was something behind it;
he's not someone I would call a crackpot. Overly cautious, perhaps, but one
of the benefits of being overly cautious is you catch the things other
people don't. So his word goes a long way with me on these matters.

The biggest problem with all of this, as I've mentioned before, is that it's
hard to do WITHOUT RealPlayer in a lot of cases. If we must have it, then I
say let's have it in the most minimal, least-intrusive configuration
possible.

How to avoid or delete "RealPlay"™ spy implants
Martin Webster writes:

I GOT two responses arising from my bulletin which drew attention to the fact that the American 'RealPlay' software, which the BBC's web site requires punters to download in order to access its broadcasts, has implants which enable the RealPlay company to monitor the activity of all those computers world-wide which have its software installed (when they are online). These responses appear below and are self-explanatory.

P.S. I'm not quite sure where all this advice leaves me, since I live on Planet Mac. If anybody has any relevant info, I should be glad to receive it.


--------------------------------------------------------------------------------


1: To: Martin Webster

July 18, 2002

WE are aware of the RealPlayer software you mention produced by RealNetworks Inc. And can offer RealPlayer V7 & V8 users the following advice to protect their privacy.

In the absence of expensive packet-sniffing software and the technical knowledge to understand the data such software produces, it is impossible for the average RealPlayer user to know precisely what the software actually sends to RealNetworks.

The user is therefore has take all necessary measures to prevent RealPlayer from contacting RealNetworks.

Measures the user can take to make sure the software behaves itself.

When the installation process is complete RealPlayer will ask if you would complete a registration form. It goes without saying the user should not.
When the software is installed, two additional applications are also installed; RealJukebox, and RealDownload. Unfortunately users are not given the option as to whether these applications are installed. Only when the installation process is complete, are users able to uninstall both.
RealJukebox has received extensive coverage in the computer press (An informative article can be found at http://www.theregister.co.uk/content/archive/7586.html) for surreptitiously logging of MP3 files stored on a user's hard-drive, and connecting to RealNetworks to upload the data. Get rid of it.
RealPlayer by default creates a 'shortcut' in the (C:\WINDOWS\Start Menu\Programs\StartUp), which will cause RealPlayer to connect RealNetworks, when Windows connects to the Internet.
Fortunately this can be prevented simply and safely by deleting this 'shortcut'.
The RealPlayer user can by further operations protect his privacy by selecting certain Options:


Under: View > Preferences > Support: remove ticks for (i.e. de-select):
Send connection-quality data to RealServers
Send RealPlayer GUID to Real Servers (GUID stands for Globally Unique Identifier)
Send configuration info when connecting to technical support
Enable cookies


Under: View > Preferences > Proxy > HTTP options: select:
"Manually configure HTTP proxy." Under "Proxy server" users should enter the following URL. http://anon.free.anonymizer.com/ (This may no longer work, but is worth a try)



Under: View > Preferences > General > StartCenter > Settings:
Users should make sure the "Enable StartCenter" option is not selected.



Under: View > Preferences > Content > Channel > Settings:
Users should make sure the 'Enable automatic Channel headline update' option is not selected. In addition, the 'Enable automatic scrolling for Channel headlines' option should not be selected.



Under: View > Preferences > Upgrade:
Users should Click the "Turn off notification for 30 days" button.

5) One of the most important tools defence against RealPlayer and other Spyware is the Firewall. Firewalls do not only prevent hackers gaining entry to a user's PC/Network, but can prevent unauthorised outboard communication. A good piece of free software is ZoneAlarm. ZoneAlarm users can; specify to always allow, always disallow, or to ask individual permission each time for any outgoing communication. It is the last option which is recommended, and can be used to stop RealPlayer from phoning home (Look for any attempted communication with any address at the real.com domain.

6) Lastly 'WebWasher' available from (http://www.webroot.com/) and 'Evidence-Eliminator' -- both these includes options to clean the playlist log of RealPlayer 7 & 8, as well as other software.

We hope the above is of use. Please feel free to distribute the above to any interested parties.

Pete
British Nation Webmaster



--------------------------------------------------------------------------------


2: From: [email protected]

Date: Wed, Jul 10, 2002, 6:57 am

To: Martin Webster

Subject: Re: 'Real Play' surveillance software implants

Yes, it's true that Real Player is spyware. But so are newer versions of Windows (2000 and XP). (I use Windows 98SE.) Generally, they use the data for marketing/advertising, but what you want to know is could they abuse this? Certainly, it's possible.

If you've got a high-speed Internet connection, some FireWall software is a good bet. (I don't have a high-speed connection myself, though I have the software, which is then useless because it bogs down my system too much.) There are programs that let you know when some sort of spyware is being used. You can probably find some at www.webattack.com .

Personally, every time before I log on the Internet, I make sure I right-click beforehand on my Explorer icon, select Properties, then select the tabs Security and Privacy, setting them to the maximum. Make sure you hit the button Apply at the bottom. (You may have to lower the security settings for downloads or to view certain sites, but put them back up afterwards.) Also, in the General tab, regularly select cookies and delete them. And change your web page history to a day or two. Your "index" webpage file cannot be deleted to the best of my knowledge. (I'm sure it can, but not sure how. This is the file that also keeps track of web pages and is found by doing a Start-Find-Files and then typing in "cookies"--in that folder. While it cannot be destroyed, you might be able to do a "save as" some type of file that will cause it problems such as an Excel file. Also, you might want to search for any "applets" while you're at it and delete them.) As an added precautionary measure, you might want to encrypt your trash before deleting it out.

After doing that, before I log on, I hit CTRL-ALT-DELETE simultaneously and then close all the programs running in the background of my computer (and RealPlayer is one of them) one at a time (this is done several times in a row) EXCEPT Systray and Explorer. (You can still open any programs afterwards after having done this, but this might cause problems if you do it while you're online.)

Now, keep in mind that Big Brother might have implanted a stealth program too. (And while you're at it, when you do the CTRL-ALT-DEL, if you do this while you're online, check to see if RNAAPP is running, as I never noticed this program running until recently on my computer. And I think it's transmitting my personal data to someone, not that I have anything to conceal. Of course, I'm paranoid, too, so this might be part of it.) A stealth program would monitor all your keystrokes, where you go, what you say, and report it back to someone. Usually, such programs operate while online, but this isn't always the case. I "think" a good FireWall would prevent this, however.

yes winamp is the best but real and quicktime are necessary evils.
look for "realplayer alternative" and "quicktime alternative" for spy-free versions.

ye110man wrote:

yes winamp is the best but real and quicktime are necessary evils.
look for "realplayer alternative" and "quicktime alternative" for spy-free versions.

*shakes his head*

There are far better alternatives to those hunks of crap out there....as well as a few freeware players that will play most if not all of the file types including realplayer and quicktime..

agreed.
lossy compressed music doesn't cut it for me. if they were selling lossless music, i'd be all over it.

Buy the CD.