I guess part of the problem with boycotts is that it's very hard to know who will not buy your product because of e.g DRM, and who won't buy it because they're not interested in it.

I haven't bought a single Sony product since the rootkit fiasco, but I've never been able to tell them this directly. I don't buy products with DRM in them. I just don't. I'm not going to be appearing in the balance sheet, however, and won't appear in the calculus of lost growth for an MBA.

The only time I think boycotts do work is when they cause a direct negative action to a company's bottom line that is sufficiently obvious that an accountant can see it. Long, slow protests -- such as exist against Nestlé for example -- are worthy but likely for the birds.