Only combined CD-ROM/CD-R + CD-DA formats together with the unfortunate eagerness of Windows to auto-execute everything allows such rootkits.

So if you feed a music CD to a real old CD player, or to (say) a properly configured Linux computer: No privacy terrors.

My personal experience with this was with some import CDs (from Japan) that, from what I recall, messed with the error correction part of the data so that it skipped horrendously in my PC (so it was impossible to rip in cdex) but played fine in (most) standalone audio players.

"As the Copy Control discs do not conform to the requirements of the CD standard, they are not labeled with the CDDA logo, which is trademarked by Philips."

Redbook CD-DA has one subcode byte and eight error correction bytes per frame.

FTFY

By default, Win96 would run that CD. You didn't tell it to. You had to go change the setting from the default. You had to tell Win95 to not autorun a CD.

More on u3: https://en.m.wikipedia.org/wiki/U3_(software)?wprov=sfti1

0: https://forums.hak5.org/topic/2843-usb-hacksaw-development/

1: https://forums.hak5.org/topic/2361-usb-switchblade-developme...

But as usual, one rotten apple spoils the entire barrel.

Having said that i did have my aunt (who is generally afraid that if she does something wrong the computer will break forever) spell me out the options in a popup (for a photo dvd she got from a photographer for a relative's graduation) over the phone once though, so i'm sure that, if nothing else, it can be a bit unexpected for less knowledgeable users.

I, as a teenager bought a Sony BMG album with this rootkit.

At the time I didn't own a standalone music player, just my PC. I had a nice Creative sound card and some decent speakers, and an appreciation for audio quality.

To my surprise I found that the Sony album prevented you from playing back anything but some low-quality 128Kb MP3s stored in that data portion of the Disc if using a PC and there was zero chance I was allowing their crapware onto my machine.

I contacted them and they sent me out a replacement disc without the root-kit data rubbish but only upon me first posting back my own disc, without its case no less.

Don't get me wrong, I have my issues, sometimes I have to fix things, but I would rather this any day than having to go back to using Windows.

Is gaming a thing on Linux now? I was given to thinking that if you're into PC gaming you're really stuck with Windows ...

Never used the Epic Store or Origin though, so cannot speak to that.

[0] https://www.gamingonlinux.com/articles/apparently-valve-are-...

But yeah Epic Games is terrible.

GOG/Humble have done wonders for Linux as alternative stores.

This is why, I, sometimes a CD buyer, believe all listeners of Audio CD should try maintaining the status quo of CD, as defined by the Red Book, and resist/boycott any attempt by the industry to "make a better CD" (e.g. SACD, Audio DVD, Audio Bluray), or "add more functionalities" to the existing CD standards.

Technologically, I would be happy to see a Doubly 5.1 Bluray Audio CD playing at living room from my surrounding speakers (better channel separation allows improvements of sound reproduction even on speakers of moderate quality), or CDs with real filesystem and error correction (an Audio CD by its original design, only streams music in real time, as if it's a digital LP track. There is no way to even know if the data you've just read from the disc is correct or not [0]), or a FLAC-encoded stereo CD (it would allow 30% more songs to be recorded on a single CD).

However, I'd better to live without them, as history has shown: all the newer standards would definitely be more "consumer-unfriendly" at best (go to any AV forum, and see the compatibility issues caused by HDCP [1] for example...), and malware at worst. The Audio CD, even with its historical limitations, is good enough, it plays lossless music with 44100 kHz sampling rate, and it did/does this job well.

Also, you may have noticed the recent renaissance of LP discs, and some LP lovers' arguments of how analog has better sound quality. While I don't believe those arguments are persuasive, I'm highly supportive of the LP industry for the same reason - you cannot install malware on a LP disc.

[0] Why I Ripped the Same CD 300 Times

https://news.ycombinator.com/item?id=17649374

[1] https://news.ycombinator.com/item?id=1689823

I don't think I'd ever be so confident as to say that given some of the incredible hacks I've seen ;o)

But doing it at an industrial scale and including an 0day exploit in all albums is a separate thing, I don't believe it would ever happen. On the other hand, creating an extension of the standard to "make a better CD" is a real threat, for example, a plausible example would be:

"a CD-based service that connects to a server to obtain metadata and lyrics of your music, like a proprietary version of MusicBrainz, but with ads and tracking added."

It simply got this bad.