Buying MP3 Music: Amazon Cloud vs. Google Play

I just bought Tal Ben Ari's Sheelá on MP3 from Amazon. I've been buying most of my music lately from the Google Play Store, but strongly dislike the limited number of downloads they allow a purchaser. Purchasers do buy the MP3s, right? And, no, I don't care about any fine print since the e-mail receipt which Google sends clearly states that the track is purchased. Quote: You've purchased a track on Google Play. 

The reason I switched to Google from Amazon was that Amazon no longer supports Linux, and forces Linux customers to download songs one at a time. PITA for albums.

So I can purchase the MP3s from Amazon and then download them to my Android. I probably want them there anyhow, and, of course, backed up in the cloud. Then I can sftp them to my desktop machine. Amazon doesn't get in the way, and the Google bean counters don't get involved.

An issue that may have me reconsidering the above is that Google says they have Tal Ben Ari's Sheelá at 320 kb/s, whereas the Amazon MP3s vary from 203 kb/s to 230 kb/s.

Note to Android users: AndFTP is a wonderful app, allowing me to connect to my desktop at home and a server at work wirelessly.

Amazon, This Will Take Some Getting Used To

Amazon has a new "feature" which I find to be quite annoying. I decided it's time to read Wittgenstein's Philosophical Investigations, and so visited Amazon. It's not available for Kindle, and is fairly expensive as a physical book, so a summary of the book caught my attention, and I thought it was pretty inexpensive:

As I went to click the purchase button, I noticed the "good" price was for a rental, so suddenly it was not a good price. Why make the rental price so much more prominent than the purchase price? It's especially more prominent in the search. Smells like bait-and-switch to me.

Amazon Cloud Reader: Almost Useless

This morning I wanted to look something up in an e-book that I had previously read and archived on my Kindle. Rather than download it to the Kindle, re-read small portions of it, and then put it back in the archive, I figured I could just use the Amazon Cloud Reader. I opened the book, and tried to search the book. No joy. ^F just does a find on the visible portion of the book, and there are no other search controls.

After a search (powerful idea, no?) of the Kindle help forums and learning there is no search, I sent Amazon customer service a query in case there really was, but no.

So how could a text-based application, like an e-reader, possibly be shipped without a search function? How could Amazon possibly make this omission? Really, how could they consider the Cloud Reader ready to ship without a convenient way of searching a book?

How can an organization that did such a great job on the Kindle do such a poor job on the web-based stand-in?

Gaming Amazon Gaming Me

Amazon and I are gaming each other. Several days ago I got interested in a video, checked Amazon, and decided to add it to my cart. My total was under $25 (the free-shipping minimum), so I went away until there was something else to add to the cart.

Then I decided I need more NiMH AAs, and so added them to my cart. The total went over $25, so it would have been time to order, except the video price had gone up slightly to top $10. I have a rule that I will not pay $10 for a video; less than that, maybe. So I moved the video into the save for later category and wandered away without placing the order.

The next day, not surprisingly, the video price had dropped back to $9.99, so I moved it back into my cart, and placed the order. The danger here is that Amazon may pin my behavior down too precisely and boost the price of any DVD I place in my cart up to $9.99 if I don't place the order that day.

Resisting the Monopolies, Unsuccessfully

I've had occasion to be unhappy with both Google and Amazon lately, and one difference is that Amazon has employees that work in customer service, though it seems they become dysfunctional as soon as one says 'Linux.' Google, though they have no customer service personnel, does understand Linux well.

It is unfair, of course, to say that Google lacks customer service. The fact of the matter is that, though I send them a little money every year to store more stuff on their servers, Google does not view me as a customer. The advertisers and marketeers are Google's customers.

But first, Amazon, since that's a quicker issue. Overall I love Amazon. If I can buy it at Amazon (or Zappos, or LL Bean), I tend not to shop. I love my Kindle. The last time I moved the price was a fixed price plus something like $0.50 per pound. Kindle books weigh much less and fit well into carry-on.

I also used to like local bookstores. I still like Barnes & Noble, but their locations are inconvenient, and indeed have been inconvenient to every place I've ever lived. By and large, local bookstores are gone. There are none that I'm aware of in or near Catonsville. I blame Amazon. I blame myself and people like me. I blame the states for not collecting sales tax on online purchases.

I've just started another round of Amazon doesn't care about Linux-based customers, or doesn't care enough to provide a working MP3 downloader. First, why make us use a downloader? Why not just use open web protocols? Users have perfectly usable web browsers. Second, why not let us use clamz. I can sometimes download an MP3 album using clamz, and sometimes not. Sometimes it works without a hitch, and sometimes the Amazon web page holds me hostage until I either cancel the order or download a non-functional Amazon-provided downloader, one that would have been perfectly appropriate a few years ago on a Linux of the era.

Of course, the Linux community shares some of the blame for that, by not providing backward compatibility. As Henry Spencer reputedly said, those that don't understand Unix (e.g., the Ubuntu folks) are doomed to re-implement it, poorly. Why exactly can I not install a program on a current Linux that worked fine a couple releases ago? I know I can play games and force it to install, but there's nothing interesting about that and it's not a constructive use of time.

So, now I've taken a step away from the monopoly and downloaded an album from cduniverse.com, a completely satisfactory experience. However, their descriptions are less complete than Amazon's, and their prices seem higher. In other markets, the monopolist, e.g., Microsoft, produces low-quality products at high prices. In this market, Amazon doesn't care about fringe customers.

Google has made me reconsider my reliance upon them by screwing up their user interfaces across the board. Okay, Google Translate, formerly Google Language Tools, has improved, and maybe other things have as well in ways I have not noticed. How reliant upon Google am I?

• Gmail
• Chrome
• Blogger.com
• Picasa
• search
• reader
• calendar
• documents
• maps
• YouTube
• alerts

I would certainly miss them if they were gone. To avoid Gmail's terrible interface, once Google stops nagging me about switching to the the new interface and tries to ram it down my throat, I may go back to an e-mail client, like Thunderbird.

For search I have been using DuckDuckGo fairly regularly, and mostly like it. What I don't like it that it seems Wikipedia is almost always the first result. Why start with something that's unlikely to be very good?

I could abandon Blogger and go back to LiveJournal or some such.

I could go back to a mix of Firefox and Opera rather than my current mix of Firefox and Chrome, but I find that Chrome works better at the financial and e-commerce web sites than any other browser, though it's been a few releases since I've tried using Firefox to pay a bill.

If Picasa's UI doesn't degrade much from it's current state, I prefer to stay there since I don't know of any other similarly-useful photo site. Maybe I could adjust to photo streams, but for most of what I do, albums are a better fit. Yahoo? Who else?

Reader is very convenient, but I could start using RSS more directly. That's inconvenient, though, which I guess is Google's point.

"Free" Online Storage

A couple months ago I related my experiences with Google Documents and Windows Live Skydrive for online storage. Mostly my online storage is .tar.gz.cpt files (gzipped tar files fed through ccrypt); everything I put on the cloud with no intention of sharing is encrypted. The brief discussion is at http://martesmartes.blogspot.com/2011/08/skydrivewindows-live-or-google.html

Since then, I have used Amazon's Cloud Drive for this, and it works fine. Since I almost always have Gmail open, though, Google is a tad more convenient. Also, I think Google's commitment to cross-platform interoperability is stronger than Amazon's, so I feel slightly more confident that I'll always be able to access the Google cloud.

So the score is Google Great, Amazon Good, Microsoft Bad. Today I finally successfully logged into my Verizon account; it only took 13 months to get in. I use FiOS at home, but don't use Windows much, and in the past Verizon has required installation of software on the home client to use a supposedly-web account. So I've been s.o.l. But today I got a notice from Verizon on changes to its privacy policy, and I was actually able to log in through a link in that e-mail. It was not smooth, as at one point I received an error message saying my phone number was invalid (I have no Verizon phone), but a shrug got me past that.

Verizon provides users with 2GB of space, but I cannot see that since some script at mylibrary/members/logincheck.aspx goes into an infinite loop, repeatedly reloading the same useless-looking page. So, as bad as Skydrive is, I have to rate Verizon's service as worse.

Personal Data in Amazon MP3s

In December I discussed the buyer ID data that Amazon is placing in MP3 files, noted that the standard tools seem to not notice these IDs, and expressed a desire to write a script to display these IDs. See http://martesmartes.blogspot.com/2010/12/need-to-write-my-own.html and http://martesmartes.blogspot.com/2010/12/personal-information-in-amazon-mp3.html.

First, the script:

// Time-stamp: <2011-05-27 22:23:37 jdm>

// JFlex script to look for UID tags in an MP3 received from Amazon. If
// such a tag is encountered, it is displayed. Otherwise, there is no
// output.

// Compiling (assuming JFlex is installed)
//
// jflex findUID.lex
// javac Yylex.java

// Running:
//
// java Yylex <MP3 file name>

// Bugs:
//
// A left angle bracket, <, within the UID will cause the tag to not be
// displayed.
// Even though the MP3s that I have seen with UID tags have the tags
// near the beginning of the file and only one UID tag per file, this
// searches the entire (possibly long) file and will display multiple
// UIDs if found. Though this is probably not a bug, it does cause a
// perceptible delay.

%%

%standalone

%unicode
%int

openAngle  = <
uid        = UID
stuff      = [^<]+
tagEnd     = "</UID"
closeAngle = >
tag        = {openAngle}{uid}{stuff}{tagEnd}{closeAngle}

%%

{tag} { System.out.println(yytext()); return 0; }

.     { return 0; }

\n     { return 0; }

\r     { return 0; }

As mentioned in the comments, this is a JFlex script. JFlex's lineage dates back to the standard Unix lexical analyzer-building tool, lex, which was superseded by flex. JLex has been well-known in the Java community for awhile, but work on it seems to have ceased. JFlex, however, appears to be an active project (and an Ubuntu package). Of course, it works on Windows, too.  See http://jflex.de/

It turns out that Amazon informs the consumer when an MP3 will contain identifying information. I did not notice this before Michael D. pointed it out to me in January. The Amazon notice is in the product details and says "Record Company Required Metadata: Music file contains unique purchase identifier." Then they have a "Learn More" link. This is what Amazon has to say:

Record Company Required Metadata

The record company that supplies this song or album requires all companies that sell its downloadable music to include identifiers with the downloads.  Embedded in the metadata of each purchased MP3 from this record company are a random number Amazon assigns to your order, the Amazon store name, the purchase date and time, codes that identify the album and song (the UPC and ISRC), Amazon's digital signature, and an identifier that can be used to determine whether the audio has been modified.  In addition, Amazon inserts the first part of the email address associated with your Amazon.com account, so that you know these files are unique to you. Songs that include these identifiers are marked on their product detail page on Amazon.com.  These identifiers do not affect the playback experience in any way.

The idea seems to be that the record companies are requiring Amazon to put the information in, and Amazon is being honest about what's in there, though most consumers likely never see this information and never notice the link to it.

A few comments are in order.

• My script displays the UID tag and contents, but does not modify or remove it. I have no intention of providing such a script.
• People share MP3s at their own risk. As someone who has made good money developing software, I understand their need to earn a living. I even understand, though am less sympathetic toward, the RIAA's outrageous damage claims in suits. Any individual's decision to share, or not, is between him, his conscience, and the RIAA.
• The UID is the user's Amazon user ID. On the MP3s containing the UID that I have, my script displays this:  <UID version="1">martensjd</UID>. That's me. 
• Amazon says there is other identifying information embedded in the MP3. Read the statement above. So stripping this out will not be sufficient to hide the original buyer.
• I would rather not have this in my media files, but I don't object strongly enough to go through the files stripping it all out.

Amazon MP3 Downloader

I get the feeling that
(a) Amazon cares little about Linux, and
(b) the Amazon MP3 downloader was done by very inexperienced or very poor developers.

Linux is a very small sliver of the market, so (a) is unsurprising.

My reason for casting stones at their developer is that the downloader does not work with 64b CPUs and now when I try to install it on a 32b Ubuntu 10.10 I get the message Dependency is not satisfiable: libboost-filesystem1.34.1. After installing version 1.42.0 of the libboost filesystem, I still get the error message. This strongly suggests that someone coded the dependency checks for only one version of the library, or wrote the code not considering the possibility that newer versions would be backward compatible.

I like Amazon, though I am done dealing with Amazon Sellers. Tonight Amazon had me thinking I might have to go elsewhere for MP3 downloads. However, a little googling and then a moment in the Ubuntu Software Center led to clamz. It appears there are a few other tools to do this, but clamz is the only one I see as an officially-supported Ubuntu package. And it works (or at least on the one album I pointed it at tonight).

I prefer using clamz over the Amazon downloader, because it's less closed software on my machine. Clamz likely does it's job, and nothing more. The Amazon downloader, for those lucky enough to have a system it works on, has always been an unknown factor--it downloads MP3s, but does it do something else? Probably not, but one never knows.

As an aside, the MP3s that I downloaded tonight do not have the same identifying information as the ones I wrote about last week. It may be obfuscated, encrypted, or just not present.

Personal Information in Amazon MP3 Files

A few days ago I wrote about Amazon placing personally-identifiable information within MP3 files. Here is an example, from near the beginning of an MP3 downloaded recently.

<?xml version="1.0" encoding="UTF-8"?>
<uits:UITS xmlns:uits="http://www.udirector.net/schemas/2009/uits/1.1" 
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <metadata>
    <nonce>Yvjd12Il</nonce>
    <Distributor>Amazon.com</Distributor>
    <Time>2010-10-24T04:41:17Z</Time>
    <ProductID 
       type="UPC" 
       completed="true">
      10731458698620
    </ProductID>
    <AssetID 
       type="ISRC">GBAAN0200016
    </AssetID>
    <TID version="1">
      plaIo2V1UdVjRvVYo2vBICme1kF4PYav
    </TID>
    <UID version="1"> MY USERID HERE </UID>
    <Media algorithm="SHA256">
      4fda5179408e867619d5321b804fd1d16cb1ffd4f3d3485b48c241f803444897
    </Media>
  </metadata>
  <signature 
     algorithm="DSA2048" 
     canonicalization="none" 
     keyID="9b3a698acfcfea37b486aba46bdfb50c92b8f7fe">MC4CFQCLUjy5GJIaXROMGuef/iTBI3ADngIVAI1ZVWo9+IA6FAVXQ5feBVbi3yH6
  </signature>
</uits:UITS>

I've done a little reformatting, replaced my user I.D. with a placeholder, and modified some hashes and keys, but you can easily get the basic idea. My advice is to be reluctant to share these files, or to strip the XML at the beginning.

This is a fairly recent change for Amazon. This information is not present in a song I downloaded from Amazon in August.

Need to Write My Own

MP3 files purchased from Amazon have identifying information within them, likely to catch, if not to actually deter, file sharing. At the beginning of the file is some XML including time and date downloaded, the Amazon user ID, a nonce, the distributer (Amazon.com in this case), and a digital signature (presumably so modification will be detected). Easytag does not display any of this XML data.

My intention was to place an excerpt here, but formatting XML within Blogger is more trouble than it's worth. Just view an MP3 from Amazon within an editor, e.g., emacs.

The upshot is that, since easytag doesn't display these tags, I'll have to write my own filter to do such.

Throughput from Amazon

I just downloaded an MP3 album and a couple MP3 tracks from another album from Amazon. With the first album, download speeds were about 500kB/s (over 4Mb/s). For the other two tracks, the download speed dropped to under 200kB/s. How come? I noticed it, but didn't give it much thought until receiving the e-mail confirmation from Amazon, and then it was clear. Amazon Digital Services was the seller of the album, and Sony BMG was the seller of the other tracks. They were coming from another server, one which was slower, at least in terms of the bandwidth it was able to give me at the time.

Security Issues Solved!

From the CircuitCity.com review of the Yoggie Gatekeeper SOHO Network Security Server:

Features Complete protection: Yoggie Gatekeeper SOHO offers corporate-grade security for your small office or home network. Protect up to five computers with 13 built-in security packages packed inside a small, palm-size, Linux-based security server. No additional software needed: No need to purchase or manage additional security software for your PC’s—just plug the Yoggie Gatekeeper SOHO into your Internet router and your computers are completely safe. Parental controls: Yoggie Gatekeeper SOHO manages the security from outside the child’s computer. Through an intuitive remote management environment you can enforce web content filtering policies, and control on-line time, without actually accessing the child’s computer. Easy to install and use: With Yoggie Gatekeeper SOHO you don’t have to be a security expert to enjoy corporate-level security. All you have to do is simply plug the Yoggie device into your network router and you are completely safe. It even feature automatic security updates and upgrades, so you don’t have to worry about downloads. Not once, but twice this review says that the user is "completely safe." Additionally, Circuit City begins the review with the phrase "complete protection." Finally a security device that offers complete protection! I can discard any other devices, software, or processes I have in place--Yoggie has it covered! To be fair, it appears that this is a stateful firewall and a proxy for a number of popular protocols. It probably does a fine job, but it certainly doesn't completely secure a network. Indeed, if a naive user believes reviews such as the one at CircuitCity.com, it's likely to make the network less secure. Unfortunately, the Yoggie site itself says "Connect your laptop to any hotspot without security-related concerns." So now I can send personal information over unencrypted wireless LANs with no security concerns? Another troubling thing is that one of the review sites says that software updates are free for a year, and an eBay seller mentions a three-year subscription. That raises red flags, and I can't find any mention of subscription prices or durations on the Yoggie site. The Circuit City page gives essentially no information beyond the market-speak given above. Amazon's description is roughly the same as Circuit City's "review," lending credence to my impression that the "review" was written by a marketer. Yoggie also provides something called the layer 8 security engine [sic]...