Princeton computer science professor Ed Felten has drafted a four-step program to help Sony/BMG recover from its serious security stumblings with rootkit-like software -- the unfortunate side effect of an ongoing addiction to consumer-hostile DRM.

The first step? Say it together, everyone:

(1) Admit that there is a problem. The companies can admit that the software uses rootkit-like methods and may expose some consumers to increased security risk.

Step two? Admit to the Higher Power, to yourself, and to other human beings the exact nature of your wrongs.

(2) Modify product packaging, company websites, and EULA language to disclose what the software actually does.

Three? Make a list of all persons you have harmed, and become willing to make amends to them all.

(3) Release a patch or uninstaller that lets any consumer easily remove or disable the rootkit-like functions of the software. Having caused security problems for their users, the least the companies can do is to help users protect themselves.

Finally, come to believe that a Power greater than yourself can restore you to sanity. Computer security experts can expose you to ridicule by the entire Internet community -- or help you climb out of the gutter and start anew in the world of respectable, trustworthy computing.

(4) Make clear that the companies support, and give permission for, research into the security implications of their products. Saying “trust us” won’t cut it anymore. Having betrayed that trust once, the companies should publicly welcome the Mark Russinoviches of the world to keep studying their software and publishing what they find. If you act like you have something to hide -- and you have had something to hide in the past -- the public will be smart enough to conclude that you’re probably still hiding something. This is especially true if you announce that you are trying to find new ways to do the thing that you were just caught doing!