(Wednesday, May 30)

"We call it riding the gravy train" - Non DRM'd iTunes songs are made just for you (with your name!)

A while back I wrote about how happy I was that Jobs and Co were moving to a non-DRM'd solution. I said I would gladly pay $1.29 for a song if I knew that I was going to get a better quality sound file with no restrictions on where I played it. So today when I came across an article describing this I had to laugh at myself. I don't think this is the root of all evil by any means, but I think that people should know about this:

When you decide to download one of the new iTunes plus songs, you get a non-DRM'd mpeg4 audio file. Yeah you pay an extra $.30 but it Is not DRM'd and the sound quality is better than a regular iTunes song.

So I went and decided to download on of my favorite Floyd songs, Have a Cigar off of Wish You Where Here. I downloaded the file and listened to it ( it does sound better!).

So try these steps:

a.) Go download a new iTunes Plus File of any song

b.) Right click after you download it and find the song's path

c.) open up your command (start -> run -> type "cmd")

d.) nav to that directory and type find "[insert your last name]" [insert filename.m4a]

As you can see I did it here on Have a Cigar:



See that result? You just did a string search inside that file for your name. And it found it! Your Name!

If you download Have a Cigar you would actually not have the same file as I do because even though the DRM isn't present, you still have "technically" a different file because your name is now encoded in it.


I understand that with the music industry there is going to be tradeoffs between the listeners and the record companies. I will glady pay the extra $.30 a track for non DRM'd music, and I am by no means clamoring for DRM'd music either, BUT say I accidentally shared my Documents folder for a coworker to grab some files and it was recursive on all lower directories. I think that the default directory for iTunes is the My Music folder under My Documents, so it would also share this folder. Say some unscrupulous person finds my music and (pre iTunes plus) could see my music but was unable to access it based on DRM restrictions, not with iTunes plus they CAN listen/copy my purchased music. So whats the big deal right? Well what happens if that unscrupulous person decides to share that song on the net to all their buddies? You are probably thinking who cares right? Well now it is a big deal, because the music file that is being shared across the net now has MY NAME encoded in it. I don't know about the legalities of anyone getting back to me and blaming me for it, but I still don't like the fact that it is being shared under my name. I am fairly well versed in securing my files from other people, but what about mom and pop? what about grandma who just wants to download her Neil Diamond? People who are not aware of how much access people have to their computers should be worried. There maybe music that they purchased legally that is floating around the net with their name on it.

What if google wrote a parser for m4a files and tracked that meta data (I think singing fish used to do this?) and the song (with your name) got spread to all corners of the net. Say all your library was spread around. Well anyone could search your name on Google with an m4a extension and find your whole collection or atleast the fact that it is circumnavigating the net (is the net round?).

To be fair each music file type generally has a meta layer of information associated with the song (album cover art, information about song, encoding etc) but I don't really understand why Apple feels the need to put their customers names encoded into their songs. I purchase A LOT of music from iTunes, and I always burn a copy of any new CDs I get and then reimport them on my home pc as non-DRM'd music files and I guess I still plan on doing that now because of this. Kinda scary.

UPDATE: There also seems to be a meta data variable named "user" (just do the same search just replace your name with the term "user". I have no clue what value it holds, but if iTunes had a hash of your email or your user acct ID I assume it could also be stored there (who cares about your name, when they Apple can look you in in their DB)

Anyone know the file structure for m4a song files and it's piggybacked meta data?

Labels: DRM, iTunes