U3

» see u3.com as it lived, on the wayback machine

~ the eulogy ~

U3 LLC was set up in 2004 in Redwood City as a joint venture between SanDisk and the Israeli flash company M-Systems. The product was not a drive. It was a specification that a drive could comply with, and what compliance bought you was a piece of trickery: a U3 stick reported itself to the operating system as two separate devices at once. One was the ordinary removable mass storage everybody wanted. The other was a tiny read-only CD-ROM, about 6 MB of it, which existed for exactly one reason. Windows would autorun a CD.

On that fake disc sat the U3 Launchpad, a green Start-menu-shaped panel that appeared in the corner of the screen the moment you plugged in. The pitch was genuinely appealing in 2005. Install Firefox or a password manager onto the stick, carry the stick, and your browser with your bookmarks and your logged-in sessions would open on any Windows machine you visited, then clean up after itself when you ejected. Applications had to be repackaged into a `.u3p` format to work, and there was a developer program and a downloads directory to get them from.

The first U3 drives went on sale in September 2005 and volume shipping of the 256 MB through 2 GB capacities started on 15 October. SanDisk led with the Cruzer Micro, the little retractable one, and it was hard to buy a Cruzer for the next three years without getting U3 whether or not you had any interest in it. Kingston and Verbatim licensed the platform too. SanDisk bought M-Systems outright in November 2006 and U3 LLC became a wholly owned subsidiary.

Flash sticks got to Turkey the same way they got everywhere, by quietly ending the burned CD as the way you moved a file across town. By the time I was at university and TTNet had put real bandwidth in the house, the thing in a pocket was a stick rather than a spindle of CD-Rs. U3 is not the part of that I remember fondly. It is the part where you plugged into a lab machine and a drive letter you did not create appeared next to yours.

~ the dossier ~

~ how it landed ~

Badly, and quickly. The virtual CD partition could not be turned off through Windows, because as far as Windows was concerned it was optical media and optical media does not get reformatted. Corporate machines with autorun locked down got a mystery device, and antivirus software had opinions about the whole arrangement. Macs and Linux boxes saw a read-only volume full of Windows executables they could do nothing with. The partition also took a slice off a 512 MB drive that people had paid real money for in 2006.

SanDisk's answer was the U3 Launchpad Removal Software, which is a remarkable thing for a company to have to publish about its own flagship feature. Running it destroyed the virtual CD partition and converted the stick back into a plain USB drive, wiping everything in the process. A meaningful share of U3 drives sold had the platform taken off them within an hour of purchase.

~ the funny part ~

The fake CD drive worked exactly as designed, which turned out to be the problem. Security researchers noticed that U3 had shipped a mass-produced consumer device whose entire purpose was to get Windows to execute code off a stranger's storage automatically. Tools with names like Switchblade and Hacksaw appeared, built on hacked U3 images, that would run on insertion and quietly copy password hashes or documents off the host machine before you had taken your hand off the drive.

None of this was U3's invention. Autorun on removable media was a Microsoft design decision left over from the CD era, and U3 was the highest-volume consumer product ever built on top of it.

~ what actually killed it ~

Microsoft and SanDisk announced a successor on 11 May 2007, a platform called StartKey that was supposed to expand what U3 did and work on memory cards too. StartKey as announced never shipped to consumers. What did arrive instead was Windows Vista treating autorun with more suspicion, then Windows 7 refusing to autorun anything off a USB device at all, then a February 2011 update that pushed the same behavior back onto XP and Vista. The mechanism U3 was built on was removed from the platform it was built for.

SanDisk pulled the SDK from developers in May 2009 and began phasing out support later that year. The application download servers behind U3 Central went dark, so a Launchpad on a surviving drive now reports that it cannot find the internet. SanDisk still publishes the removal instructions and still notes that they may not work on any operating system released after 2009, which leaves a small number of people holding a 2 GB stick they cannot fully reclaim.

u3.com is registered and serving today. It belongs to something called U3 that describes itself as a global technology investment institution focused on blockchain and international education. The address that once hosted a directory of portable Windows applications now offers a crypto payment solution and a quantitative trading product.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »