Slashdot Mirror
DRM in Real-Time and Embedded Systems
An anonymous reader writes "In this guest column at LinuxDevices.com, Victor Yodaiken speculates on the implications (and potential catastrophic consequences) of Digital Rights Management Passport (DRMP) technology to embedded, real-time, and mission critical computer systems. Quoting from the article: "When a technology gets pervasively embedded in microprocessors, computer boards, and software, it will alter the performance of power turbines, jet engines, medical instruments, cell phones and missile guidance systems. Unfortunately, DRMP technology is incompatible with security and with the kinds of reliability needed in safety critical or mission critical applications.""
"Try browsing the Internet without enabling cookies and Java to see how easy it is for pervasive options to become non-optional."
It's a valid point, tho. I like some of the workarounds, such as Opera's willingness to throw out all cookies at the end of the current session, if said options are selected.
Still, the author appears rather alarmist; DRM is a licensing technology, not a security technology, as the author stated. Thus, WHY would consumer-grade "hardware" be found in professional-grade medical hardware? That's like buying a Packard Bell for IBM's web server... it just won't happen.
On that note, it'd be interesting to see if Intel/AMD/MS/blah will try to include DRM in "server" versions of hardware and software...
From the article:
The DRMP system is based on the premise that unlicensed use of software or data should make computers stop working. You could also argue that bridges should be designed to fall down if someone is detected crossing without paying the toll.
Ok, I don't like DRM either, but that's rediculous analogy. Most people's interpretation of DRM doesn't include making computers stop working if they're running unlicensed software. It's designed to stop a software package from running if it isn't licensed on the machine. I have a really hard time believing that DRM will ever be in anything like heart monitors or any other specially designed hardware. In my opinion, this guy really is just being alarmist.
why is this news? Of course DRMP embedded in stuff will slow the stuff down. Running virus protection takes processor cycles too, so security == overhead there.
As I've been saying, DRM / Content control will permeate every facet of ours lives given time..
At a certain point we wont even know what is the truth, and wont have the digital rights to find out... or tell someone if we do....
Though when i first started preaching we didnt have the cute phrases such as DRM, but the concepts were there.
1984? He was only off by the year.. more like 2004 is a more accurate guess.
---- Booth was a patriot ----
Thus, WHY would consumer-grade "hardware" be found in professional-grade medical hardware?
Because Fritzie-boy is all hot and bothered to close up the "Analog Hole". That means that NO commodity DSP or processor chips can fail to support DRM. One consequence is that embedded device makers will have to get special exceptions for un-screwed up processors and memory (vastly increasing costs and development time due to red tape). If embedded and real-time manufacturers use commodity parts anyway to control their costs then they'll have to contend with DRM just like anybody else. This is where the defib machine letting someone die on account of a licensing issue comes in.
Remember "professional-grade medical hardware" uses many of the same components as consumer grade hardware. The difference is in how it is configured and even more importantly certified to operate correctly. Mandatory DRM basically means that the well EVERYONE is drinking out of is going to be pissed in by Rosen, Eisner and Fritzie-Boy.
One of the trends of the embedded industry is to use off the shelf x86 processors. They are powerful, cheap and have loads of software for them. Now if intel put DRM into every pentium plus we lose those advantages. We either use other less generic processors or put up with the potential problems of DRM. And if you cannot disable DRM....
Choose your allies carefully, it is highly unlikely you will be held accountable for the actions of your enemies
"Just because you *can* do something, it doesn't mean you *should*"
I know I'm an old hippie, but I really believe that if Microsoft and Hollywood spent a fraction of the resources they're throwing at DRM solutions into creating a workable micropayments system for the web, and IP owners started selling their goods at reasonable prices, they'd be minting it in no time.
When VCRs first appeared, Jack Valenti decried them as the spawn of Beelzebub, and foretold the death of the movie industry because of home taping. What happened? They now make more money on VHS and DVD than they do in the cinemas.
And just to prove that piracy *isn't* an issue - the release on DVD of Harry Potter *without macrovision* was the biggest ever DVD release at the time. How come, if everyone was just waiting to pirate it?
A piece of code that runs behind the scenes and can stop the user accessing their data or even stop the machine from working at all. Didn't we used to call those Trojans?
Stephen
"Don't write down to your readers, the only people less intelligent than you can't read" - Sign on Newspaper Office Wall
Not so fast there. With the possible exception of the cell phone, none of the systems you've described have any application whatsoever to digital rights management and the idea that DRM code will "somehow" find its way into every IC / processor, even when such application is utterly useless and contrary to the design constraints (and adds substantial costs) is simply unfettered paranoia. Code doesn't just "appear" by itself and attempts to push meaningless extentions of technology into areas which may risk lives is not going to happen. I can assure you that Boeing's fuel management control systems are not built from parts purchased at pricewatch.com, the differential resonance processor in an MRI isn't a .Net Managed Code resource, and the Navy isn't sourcing on-board trajectory guidance modules from RadioShack catalogs. Legislation that attempts to make that happen isn't going to fly because it would cripple the very industries that rely on technology to succeed and form the heart of Western industry. Even the worst case, the one you've predicted, isn't that bad; we'll just do like we always have -- if they build a higher wall, we build a taller latter. It's simple, really.
Look, I don't want to dismiss your ideas outright. In fact, I share your feelings about DRM -- In its present form it only protects the rights of the corporations, not the rights of the consumer. (In that regard, it should be called "Digital Restrictions Management.") However, this article furthers the same "idea taken to an extreme" paranoia that made people worry whether their car would start Y2K morning.
So relax; take a deep breath and go find something substantial to worry about. There are enough big problems out there without sweating the details of something incredibly unlikely to affect the world in the way you've described.
Remember the 105 year olds getting the letters telling them it was time to sign up for kindergarten? That was a y2k glitch. On 1 January 2000 I visited the US Naval Observatory's Time Site and was informed that the date was 1 January 19100.
A cousin of mine was pulling a low six figure salary from 97 through 99 fixing COBOL systems. The bamks/hospitals/etc spent quite a bit of money fixing the systems.
Best Slashdot Co
Bold is mine. This will not just apply to software, it will apply to everything. Music, books, art, etc. The list goes on. Anything that you create now, even if it is for your own amusement, will be shut down by Digital Restrictions Management. This is just one step in the control of *creation of content*.
Entertainment companies do not want to just control all of their content, they want to control ALL content. You will need to register with 'a third party' for a signature to release your *own works*. Of course, to keep the sigantures from just being owned by 'anyone', they will be prohibitively expensive. You will be unable to compete with the entertainment companies, the software companies, and all others. You won't even be allowed to release your own works of art, music or writing.
Somehow I doubt that a themometer will be allowed to shut down anything, in law or in practice.
It is the independent creation of content that is being threatened, and don't you forget it.
This is why any sort of DRM will ultimately fail for any device that isn't a dedicated media player. In order to be successful, when a DRM device has a fault of some sort, it has to assume that process X isn't authorized to execute. This is the antithesis of mission critical systems, which must never fail.
This is also why Palladium will also fail. Microsoft has said that to be useful, Palladium must run on 100 million machines. In order for it to be useful at all, it must fault towards false negatives (i.e., if it thinks something is wrong, it prevents execution rather than defaulting to execute). Assume that a)Palladium works properly 99.9% of the time and b)that each person tries to run a Palladium enabled program one time per day. Even working 99.9% of the time, there'll still be 100,000 errors per day (and we assumed that each person only tries to use Palladium once in a day, too). Because of the way Palladium works, these errors can't be corrected in house, meaning each person must call Microsoft HomeBase (or internet in, if Palladium lets them) and have the error corrected by a person. This process won't be automated by definition, otherwise it could've simply been part of Palladium itself.
Suppose Palladium shits and dies on you while you're trying to do a presentation of your big proposal? Suppose IIS shuts down your business site on the day after Thanksgiving? This isn't something you can fix yourself, you have to fight 99,999 other people for the phone lines to get the error corrected. There's just too much risk using this sort of scheme even in the business world, much less in mission critical embedded processors.
We are developing ship control systems based on Pentium chips. Ok not the latest and greatest, but for our application there cost performance is good. In 5/10 years time we will probably want to be using the next generation. If that has DRM as part of the silicon that will be worrying.
The thing is embedded systems are now expected to do a lot more. They need to route packets act as web servers have embedded databases, in many ways act as embedded PC's. x86 processors are very good for this.
So what is intel going to do? develop a embedded x86 without DRM? How long before PC's etc start coming out with that chip instead of the crippled version.
Choose your allies carefully, it is highly unlikely you will be held accountable for the actions of your enemies
"I see in the near future a crisis approaching that unnerves me and causes me to tremble for the safety of my country.... corporations have been enthroned and an era of corruption in high places will follow, and the money power of the country will endeavor to prolong its reign by working upon the prejudices of the people until all wealth is aggregated in a few hands and the
Republic is destroyed."
--U.S. President Abraham Lincoln, Nov. 21, 1864
-=[ Who Is John Galt? ]=-
"The capitalists owned everything in the world, and everyone else was their slave. They owned all the land, all the houses, all the factories, and all the money. If anyone disobeyed them they could throw him into prison, or they could take his job away and starve him to death. When any ordinary person spoke to a capitalist he had to cringe and bow to him, and take off his cap and address him as 'Sir' "
--Orwell 1984 p. 73
-=[ Who Is John Galt? ]=-
Please schedule immediate surgery to have the Fritz chip removed from your cerebellum before it is too late.
You have made a critical error in assuming that "Fritz" will have anything to do with the writing of any such law. The "Senator from Disney" did not write the proposed law. He merely took the money from the lobbyists along with the draft of the bill written by the lawyers retained by the concerned industry. There will not be any exceptions to the law - no matter how "sensible or reasonable" an exception might seem.
But let's not get despondent over this after all the bill still has to get through both houses of Congress and signed by the President before we have to worry about it. And once it passes Congress, but before it gets to the President is the time to fix it. Simply borrow a play from the RIAA and insert a paragraph to "clarify existing standard business practices". Here is my proposed "clarification":
No case may be brought before any Court using any section of this Act save by a licensed lawyer who has had a DRM protected override chip installed on their vagus nerve for a period of ten years.
Kind of breathtaking in it's simplicity eh?
You either believe in rational thought or you don't
And that would cost Hollywood how much from the few people around the world who have enough time and a lab to build one? As it is hollywood is down only %9 this year of what it blames on piracy. How many millions of systems out their run kazaa or gnutella?
Now imagine lets say only 100 homemade computer? The piracy caused would be not even be seen due to rounding errors.
I admit the real pirates in China will make systems specifically designed to burn several hundred cd's an hour with non drm chips but they will not be made in the USA but in China or Twaiwan. Either way, real pirates will continue to pirate and these embedded processors will remain drm free. That or perhaps the cpu's will be bought oversea's at the expense of American jobs.
http://saveie6.com/
However, his contention that the only use for Palladium/Trusted Computing Platform technology is DRM is wrong. It could be used, for example, with the Brazilian voting machines, to make sure that what you think is the output from the voting software really is. Without keys protected in hardware, you can't be sure. With TCPA, the output from the software (over the net or on floppy disk) can be signed with a chain of keys right down to the hardware. Without hardware help, there's no way to hide keys on remote systems.
On a less serious note, you could be sure that your opponent in a network game is a person, not a gamebot.
That being said, DRM would still be the #1 use for the technology.
The Ukraine has allready suffered from the music industry over zellous rights management. I can't believe how blatent the corperate sponsership of the sennate is in the US. It seems to be accepted that if a sennitor (or president for that matter) has their campaign funded by a company or interest group then he will legistlate in their favour. It even seems like some companys hedge their bets and back both parites. This is supposed to be a democracy? I thought the idea was to look out for the interests of the people who vote for you. I have no dowbt that simmalar things happen everywhere but it is not quite as blatent. The Fritz chip and related technologies do not help the little people at all. They only help content producers and M$.
What's wrong with encoding a session identifier in the URL? You don't have to put it in a query string if you don't want to. The entire URL is available for coding state.
Cookies are evil and software architects need to get that through their heads. Unfortunately, many projects are staffed only with developers and application programmers incapable of a deep analysis of anything.
The only way drm would be included in embedded systems is by law.
Even then, it's doubtful if it will matter with many embedded real-time systems. And it ain't
gonna matter with consumer equipment, either. There will simply be massive "civil disobedience" and it will be roundly ignored.
There is an obvious precedent for this: In the early 1900's, laws were passed all over the US to prevent the use of automobiles. Speed limits of 5 mph were passed. Several states had laws saying that an auto had to be preceded by a rider on horseback. Others passed laws requiring that if a horse was nearby, an auto's engine had to be turned off to avoid frightening the horse, and left off until the horse was gone.
Such laws were simply ignored. Few if any policemen were silly enough to try to enforce them. They could be used occasionally for harassment purposes, but for all practical purposes, they were just the last gasp of a dying technology.
One of the fun legal things is that such laws are still on the books in many places. Almost all citizens are criminals. Nobody worries about this, for some strange reason.
Similarly, the recording and entertainment industries will come to terms with the Net. We will have the right to record things and play them later, or in our car or at a friend's house. We will have the right to back up our disks. We will have the right to upgrade our hardware and play our old purchased recordings on the new equipment. Attempts to stop this will simply be ignored, as the anti-auto laws were ignored.
And we will all end up criminals. But that's ok; if you're driving any sort of motor vehicle, you are probably a criminal already.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
Uh-oh... what's scary is that his scenario might prove very attractive to the computer industry.
The computer industry is currently reeling from the high degree of competition that has been brought about the commoditization and universality of the PC architecture.
In the bad old days, IBM deliberately kept product lines separate and incompatible so that they could segment individually manipulate different groups of customers. Certain product lines were arbitrarily designated for certain classes of customers (small business, large business, scientific, etc.) If competition developed in one area, they could cross-subsidize and lower prices for that group while raising them for another. The victimized group couldn't do much, because migration to the more cost-effective hardware was too difficult. High margins were maintained.
With DRM, we can foresee a return to the golden days of yore. If DRM makes computers useless for applications where security and high reliability are required, voila! we have market segmentation.
We could have cheap consumer PC's with DRM in them, basically unusable for many applications for the reasons so clearly articulated by Yodaiken.
This would, of course, create a market for exactly the "very expensive nonstandard hardware" he talks about.
Vendors could make high margins on products like "medical computers," knowing that hospitals did not have the option of migrating to commodity consumer PC's.
"How to Do Nothing," kids activities, back in print!
The point is that cookies are effectively mandatory, though they were introduced as being strictly optional. The point is that the same thing can (even more easily) happen to DRM as well.
The actual security (goodness?) of cookies isn't the point here; it's simply that "optional" technologies don't always remain so.
So why is it that every major chip maker is coming out with DRM when there is NO "consumer" demand? DRM is univerally loathed and no one wants to buy it. The reason is that it's being pushed by publishers, who have displayed their greed before, and the chip makers themselves who would love it if everyone had to constantly buy new equipment. It's not economic! It will cost more, it's performance will be poor by all measures and no one wants it. Yet it is hapening.
If the chip makers can get away with it on your PC they WILL get away with it elsewhre. History shows that todays big iron is tomorrows embeded system. If they can't, they will continue to push legislation that forces it. In the mean time, it's much easier to push DRM onto closed boxes that few people other than embeded systems designers ever examine or care about. EVIL. Cars, ironically, are a great example of demand for gimped up systems that defeat the end user. Yes, in the end those gimped up systems might refuse to start a perfectly sound engine. The author is entirely informed and correct.
Comparing this to Y2K hysteria is at best ignorant. The alarms should be loud and clear. "Digital Rights Management" IS and extreem concept on it's own. The whole idea of you being deprived of control of YOUR machine because you might "steal" a look at your entertainment without paying a fee to a publisher is a radical concept impossible to impliment in the past. Libraires will not be possible if DRM takes hold and is accepted. DRM will be used to impliment the DMCA's non reverse engineering clauses for embeded systems, regardless of performance because clueless executives make up for their ignorance with greed. The author's insight into performance issues for embeded systems and how it will happen is a useful thing to consider.
Friends don't help friends install M$ junk.
This paper is just fear-mongering since it requires you to make the leap that DRM will be embedded into everything, which makes no sense at all. You can easily reproduce this arguement for nearly any technology, since almost nothing will be appropriate everywhere.
I think that papers like this do not help our effort. Let's attack the real problems we face today, rather than making up imaginary ones.