Apple Cease-And-Desists Stupidity Leak

Remember Apple's "free, plus $19.95 shipping" updater CD for Mac OS X 10.1? Turns out it's actually a full version of the operating system (which helps explain why it's so large) but it adds an extra little package called "CheckForOSX." Remove that and you can install 10.1 on any disk -- or at least, that's the secondhand version I got of what used to be at MacFixIt's Nov. 20 report, which yesterday was taken down after a note from Apple's lawyers. Here's the cease-and-desist story. We've included Apple's letter, below.

Apple cites the Lanham Act (see below) and I have no idea what that covers. But Bill Innanen pointed out on a mailing list that the operating system might be said to violate its own access control rights under the DMCA:

...since the possession of the tools to violate a copyright has been criminalized, we have yet another case of circular legal "logic." The only tool necessary to violate this particular copyright is the very operating system that the copyrighted software (the updater/full-installer) installs (or an earlier version of same).

(Just pop open the installer package with the built-in "context sensitive menu" module, find the CheckForOSX module and drag it to the trash can. Voila!)

Is the possession of MacOS X v10.1 or its installer illegal because it can be used to violate its own copyright?

(Well, actually by the letter of the law in 1201(2) I think you'd have to argue that Mac OS X 10.0 was "primarily" designed to circumvent the access controls in the 10.1 update... but it's still pretty funny.)

Bill goes on to point out: "The problem that this converted updater fixed is that there are reported problems with 10.1.1, and with a 10.0.x and the updater you can't backtrack. With the 10.1 full installer you can."

Apple's lawyers write:

We represent Apple Computer, Inc. ("Apple") with respect to its intellectual property matters. Recently, it has come to our attention that you are providing unauthorized instructions concerning the modification of the Mac OS X 10.1 update software (the "Software") on your website. Specifically, it appears that you are providing instructions for converting Mac OS X 10.1 update Software to a full install version of Mac OS X from your web site in violation of the Copyright Act and in violation of your software license agreement with Apple.

You should be aware that Apple has never authorized you modify the Software. Moreover, by providing instructions on how to modify and circumvent restrictions within the Software, you are infringing Apple's copyrights in violation of the Copyright Act and engaging in acts of unfair competition in violation of the Lanham Act. Additionally, Apple's license agreement, which you accepted upon purchasing a copy of the Software, specifically prohibits you from copying, decompiling, reverse engineering, disassembling, modifying or creating derivative works of the Software.

Consequently, on behalf of our client, we demand that you cease and desist from publishing or distributing the above-referenced materials. We believe that this is a very serious matter, thus we ask that we receive confirmation in writing from you that you have removed the infringing material from your web site.

Thank you for your prompt cooperation on this matter.

Comments

You're a little confused though.

[aidoneus]

remember that Apple has to protect its intellectual property

No, they don't. Copyrights and patentsdo not have to be defended (remember gif, mp3, etc?). It's a good idea to defend them along with patents, or else you can lose out big time (Frauenhoffer and mp3). Trademarks and servicemarks are the only things that need to be defended, lest they be diluted and become generic (kleneex, asperin, etc). Now the law that's being cited, the Lanham Act, is a trademark law so a defense seems reasonable until you realize that they're using a trademark law to prop up a copyright argument. Something about that doesn't seem quite right. Maybe they need to go back to law school.

Straight from the mouth of Steve Jobs

[cygnus]

didn't Steve Jobs just say something like, "Any security scheme that's based on secrets will be broken sooner or later." about the iPod's lax copy management scheme?

so did Apple do this on purpose, or are they just being hypocrical? seems like the latter.

EULA?

[TheTomcat]

Apple's license agreement, which you accepted upon purchasing a copy of the Software, specifically prohibits you from copying, decompiling, reverse engineering, disassembling, modifying or creating derivative works of the Software.

*headscratch*
Semantics aside (who's to say that by not installing something, you're "reverse engineering"?), since when do you agree to software EULA at purchase time?

I haven't installed OSX10.1, but any other EULA I agree to presents itself before I open the CD enveloppe, or when I run the installer.

Does Apple really make you agree to the EULA at PURCHASE TIME?

Apple did the right thing with their update

[maggard]

Honestly I'm glad that Apple didn't put elaborate protections all over their update. As we've seen time & time again these heavy-handed mechanisms just get in the way of the legitimate users, invariably bollix up some percentage of systems and don't deter determined pirates.

So was Apple stupid? No. Customer-service oriented? Yes. Ease-of-use oriented? Yes. Transparency-of-upgrade-process? Yes. Safe-and-reliable-installer prioritized? Yes.

Heck, I'd think the /. crowd would be thrilled there isn't some elaborate product activation scheme or big encrypted block of material. Yeah, it's easy to defeat and steal the product. On the other hand if one's determined it's trivial enough to copy a buddies CD or download the original.

Hey - Apple ENCOURAGED folks to pass along their update! They didn't do what so many other vendors do and require proof of purchase. They didn't charge some outrageous rate. They didn't even go the MS route and call it a new OS. They even stated they'd have made it free for download if it wasn't so honking big.

All Apple did was ask (ok, in a heavy-handed legal fashion but that's how the legal system works) a website to take down directions for circumventing their security mechanism. I've no doubt numerous other companies send out reams of the same boilerplate every day asking folks to stop posting how to crack their demos or post their passwords.

And here we have folks bustin' on 'em.

So - what SHOULD they have done? Would folks REALLY prefer encrypted material doing who-knows-what after some onerous registration process and limited distribution? Crow all you want that Apple "gave away" their product, they went about their technology in a far more responsible way then many others. Think about that the next time you install an MS/Sun/Irix/IBM/HP/Compaq/Unisys/etc. OS.

Yes they are.

[Chris Burke]

Apple is in most certainly in the wrong here, in as much as it is wrong to be stupid, lazy, and legally defensive of the first two failings.

Look, ignore for a second that the label on the CD reads "10.0 -> 10.1 upgrade" or somesuch. The fact is that you legally purchased a CD that contains the entire 10.1 operating system. It is the fully functional operating system, and the only requirement for having 10.0 is an artificial one that is easily removed. Does Apple wanting it to just be an upgrade CD change the fact that it is the entire OS + 1 package? Not at all.

It's like overclocking. You might buy a processor that is labeled as 1GHz, but it can run at 1.2 if cooled properly. Does the fact that the vendor would rather you buy the actual 1.2GHz part make a difference? They sold you a device with a capability, and you are using it.

Or it'd be like if Stephen King was doing his online book thing, but his "preview" was actually the entire book, with a note to please not read past page 47.

Or it'd be like a video card upgrade that came in the form of a completely new computer, but you were expected to only take out the video card and leave everything else in your closet.

If Apple really wanted the upgrade CD to be just an upgrade CD, it should have contained only the data necessary to make the change, like every other software upgrade I've ever seen in my entire life. That they didn't do this is a sign of laziness on their part, not moral obligation on mine.

They sold me a CD containing data, and I'm using it. I'm not copying anything they didn't sell me; I'm not giving it to someone who didn't pay; I'm not modifying their code and redistributing it. If it is, well, that wouldn't surprise me, but that doesn't mean Apple isn't wrong.

What _would_ be wrong was if I (probably as a reseller) bought a bunch of the upgrade CD's, and resold them as the full thing (at full price). You'll note that in the case of CPU overclocking, the chip makers have made that distinction, and while they make overclocking harder for everyone, they only really care about the dishonest resellers.

I think the only protective action that Apple could take that would put them in the right would be if they stated they would not give technical support to those who used the upgrade CD to do the full install.

Think about Time To Market

[valmont]

You gotta give Apple developers some credit for crying out loud. If they packaged the upgrade the way they did, running the risk of someone mucking with their packages, it clearly had to be because it was easier *and* faster to do it that way.

Mac OS X 10.1 is a pure Jewel of an Operating System, and I for one like to see frequent major upgrades that acutally render my work more productive. And this one sure did.

Chances are I am not the only one thinking that.

So Apple saved time and figured their money would be better spent on lawyers sending out semi-generic cease-and-desist letters, rather than delaying the release of their upgrade by a few more months and miss the X-Mas rush.

Are they dumb? NO. It's about money. Time-to-Market translates directly into money. I'm sure they knew the risks they were taking and carefuly measured them.

Does the fact that they released a full working version of an operating system on a demo-disk harm the user in any way? NO. But that's what is unconsciously implied: "oh Apple made a quick upgrade hack that can easily be worked around, quick hacks are dumb, quick hacks are bad, so *I* as a geek, must absolutely go out there and make a big fucking fuss out of it so I can look cool and get some publicity out of it". Again, this is not microsoft quickly hacking their "Passport architecture", loading it with obvious security holes to make a deadline, thereby harming the greater computer user community, we're talking about a legitimate software upgrade that happens to give you more, MUCH more than what you bought.

Exploiting this for any other purpose than recovering from a failed upgrade is *wrong* and, indeed illegal. Beside, keep in mind that even if leveraging this weakness to shorten the installation process to recover from a broken upgrade may be *very* convenient *and* tempting, doing it the regular way, which was installing OS X 10.0.x and *then* using the OS X 10.1 upgrade as just that, an upgrade, still works. While this appears to be a cool, convenient hack to share with close friends and family to save them time, I do believe this information to be a little too sensitive to be permantently published on a web site for everyone to leverage. Again, this is *not* like a security hole, this is publishing information which deliberately violates the Software License Agreement.

MacFixIt most likely understands that.

Are they trashing freedom-of-speech? FUCK NO. Stay real guys and look at this whole thing for what it really is: a very simple, dumb hack which violates a very clear, simple, software license agreement. Software Vendors have those agreements so they can actually make money off of the shit they make. Duh.

MacFixIt handled the situation very maturely but anyone here invoking "freedom of speech" rights for this particular case is merely making a devious use of one of our most cherished inallienable rights, and such behaviour can easily become one day its most threatening enemy.

Re:how many lawyers does it take...

[Nonsanity]

Looking at Apple's summary of their EULA:

...Apple's license agreement, which you accepted upon purchasing a copy of the Software, specifically prohibits you from copying, decompiling, reverse engineering, disassembling, modifying or creating derivative works of the Software.

And looking at the instructions to make a 10.1 install CD from a 10.1 updater:

1. Using instructions posted on this page, create a disk image of the Update CD.
2. Delete the CheckforOSX file from the Essentials.pkg file in System/Installation/Packages folder of the image file. [You need to use the Open Package Contents contextual menu item to access this file.]
3. Burn the image to a CD using Disk Copy.

One might come to the conclusion that burning the modified files onto a new CD is copying the "Software" and therefore in violation of the EULA. Arguing that making a personal backup copy is permitted might get into some grey area if that backup is altered. But unless you give or sell your modified CD to someone else, I can't see that as being a violation.

Chris Innanen
(Son of Bill Innanen)

Re:No, they're not

[Chris Burke]

The correct analogy is if the cashier at a store gives you a $20 instead of the single that you were supposed to get in your change. Or buying a car from someone and finding an expensive watch between the seats.


For that analogy to be even close to correct it would have to be the case that Apple -accidentally- put the entire functional Mac OSX 10.1 on the CD. Since I doubt this is the case -- that the only difference is the CheckForOSX package attests to this -- your analogy is "correct" only for definitions of the word opposite the accepted usage.

Your analogy might be in the same hemisphere as reality if they willfully put the watch in the car, but asked you to kindly just leave it where it is between the seats. Or better, they're selling you the watch, but the box it comes in happens to be a Mercedes.

If it seems like only a complete idiot would do that, then you understand my point -- there is nothing illegal going on, just Apple being very, very dumb.

It is very, very simple. Apple sells you an upgrade CD. They - through incompetence or ignorance - included the whole OSX 10.1 install. You inadvertently receive something you didn't pay for. Keeping it (or similarly, installing it without paying for a copy) is stealing.

Well, you're right about the simple part, at least. They sold me a CD containing the entire 10.1 operating system, I paid for that CD, and now I'm copying that data to my system. MY system, the one who paid for it. There is nothing on that CD that Apple didn't knowingly give me, and to call it stealing to use that which was knowingly sold to you for the purpose for which it was intended is insane.

I mean, the idea of illegal copying of software being stealing is dubious in and of itself (since copying software leaves the original intact), but here not only is there no loss, I'm not even gaining a single bit of information that I didn't pay for!