Distributed TiVo Code Cracking

Twostep writes "With the newest version of the TiVo software (Version 3.2), TiVo has once again changed the secret password to enter "backdoor" mode, which lets advanced users enable hidden features. Unlike last time, people were not able to quickly find the new code, so a distributed computing project was started to find the backdoor codes. You can read about it Here, grab the Linux or Windows clients and pitch in some CPU time for a good cause."

Comments

Idiots

[__aafkqj3628]

Really, when the hell will these people (the companies) learn that this will do NOTHING.

In TiVo's case, would just removing the backdoor altogether work instead of just putting a new, totally hackable and insecure password on there?

Either way, I'm taking bets on how long it will take for the password to be cracked.

Re:Idiots

[Scrab]

I'd take a bet, but I think it's probably already been hacked.... ;)

Re:Idiots

[warmcat]

This isn't true, unfortunately. When the implementations of strong hash checking are done properly (everything in one chip, ROM a la Xbox), they WILL succeed in locking everyone else out without very expensive hacks.

Personally I think new law is needed to render this illegal, unless it is under the control of the user.

If you think that sounds extreme, consider that the persistent state for all copyrighted works is that they are in the public domain. It is a temporary aberration of a few years that the works are allowed to be held privately. After that they are meant to be available for everyone. As it is these encrypted fortresses inside consumer products will never yield up their secrets.

Re:Idiots

[z)bandito(_X]

This isn't true, unfortunately. When the implementations of strong hash checking are done properly (everything in one chip, ROM a la Xbox), they WILL succeed in locking everyone else out without very expensive hacks.

Personally I think new law is needed to render this illegal, unless it is under the control of the user.


while i concur that the notion of a company removing or limiting features after the purchase of a product is disagreeable, you are incorrect in citing the xbox as a 'hack-proof' design. The gamecube actually has the design you are referring to, where the bios and many/most/all security measures are contained in a single, integral chip such as the CPU, or the graphics chip as is the case with the gamecube iirc.. the gamecube media also contributes to the difficult of hacking the unit to run anything other than nintendo authorized games.

the xbox has been modded to the point where you can not only run games from different territories, you can actually run ftp clients on it and download games and movies onto an upgraded 120gb HDD and play them directly from disc. in the current hardware, the bios chip is seperate from other (more expensive and customized) hardware. the common media and seperate security measures (unencrypted signals travel an accessable path at one point) contribute to the xbox having been hacked.

that said, i believe your proposed legislation would be difficult to implement for at least two reasons; one being that you likely purchase a license to the software rather than the software itself. I guess you could still try and legislate acceptable license terms, but even then the definition of a 'good' or 'bad' feature being added to or removed from a product may be a matter of perspective.

and visit my website goddammit!!@!

Re:Idiots

[subuni]

In TiVo's case, would just removing the backdoor altogether work instead of just putting a new, totally hackable and insecure password on there?

I don't work for TiVo, so I don't know their intentions. But I can speculate. You can do some nasty damage to your TiVo through use of some of the back doors (Node Navigator being the most famous method). So, you get Joe Blow who accidently does this to his TiVo, screws it up, and calls support -- Their costs have now increased.

It's too difficult to remove the backdoors. They're quite useful inhouse during dev/test cycles (a QA tester notices a bug, they can easily view the log files, etc). Two branches of the software, one inhouse with the backdoors, and one w/o them for the public is a lot to deal with. What if you applied a patch to one branch, forgot about the other. Now QA has to test both branches, to make sure they're the same. QA people whine, a lot (rightfully so sometimes). They won't like that.

So, whats the best option? While doing inhouse testing, use a nice simple code (1234). Right before you're ready to GM it, change it the something "impossible" (i.e. uses characters that can't be entered through the TiVo). The code-base is the same, so QA can get away with just running a quick set of happy-path tests. And, this now reduces Joe Blow's chance of killing his TiVo (since he can't enable backdoors), it lowers support costs, and everybody (inside TiVo) is happy. A "win" situation for TiVo.

Of course, a "hacker" can go in and change the code to something that isn't "impossible", but if they screw up their TiVo and call support, support doesn't have to help them this time. They voided their warranty when they opened the case, to pull the drive, to change the backdoor code. Another "win" siutation for TiVo.

Whether or not this is the case, I don't know... But, it sounds very likely to me.

Re:Idiots

[Martin Blank]

It's too difficult to remove the backdoors. They're quite useful inhouse during dev/test cycles (a QA tester notices a bug, they can easily view the log files, etc). Two branches of the software, one inhouse with the backdoors, and one w/o them for the public is a lot to deal with. What if you applied a patch to one branch, forgot about the other. Now QA has to test both branches, to make sure they're the same. QA people whine, a lot (rightfully so sometimes). They won't like that.

Not intending flamebait, but isn't this exactly what we're usually complaining about companies doing? This is one of the highest examples of insecure design. It's not that difficult to remove the backdoor code from the public release, if you code it right to begin with. I know it's just a TiVo, but at some point, a lot of these things that we refer to as "just a" will be network connected, and it's best to start early on best practices, especially since the TiVo is networkable.

Yes, people like to get into their TiVos (and other gadgets) and tinker with them. A friend who has a TiVo does it all the time, and when I see word of a new hack on Slashdot, I usually let him know. That being said, he's perfectly well aware that what he's doing can seriously screw him if he breaks something. If TiVo really wanted to lock people out, they'd disable the backdoors to begin with, and if they really needed to see the logs on a defective unit, they could load it up on a custom system that can pull the logs from the drives after putting them in a read-only configuration. It wouldn't stop everyone from getting in, but it would stop all but the most determined.

Re:Idiots

[mindstrm]

Because Tivo doesn't really care. They are doing this, probably, so that they can safely say that joe average doesn't have these features.

Do you think they are so stupid as to think that the community won't crack this? of course they know it will.. the point is that they be seen as shipping a product with these features disabled.

If it's too easy, and already public knowledge, they will change it, otherwise they could be seen as supporting those features, and could end up in court. Forcing peopel to go through this kind of crap makes it so it's easy for them to point out that it's unsupported, not part of their main product, etc.

Re:Idiots

[warpSpeed]

This isn't true, unfortunately. When the implementations of strong hash checking are done properly (everything in one chip, ROM a la Xbox), they WILL succeed in locking everyone else out without very expensive hacks.

It is true! It only takes ONE successful hack, then it is out of the bottle, until they release the next upgrade. With pooled resources, ala distributed CPU power, the problem will be solved eventualy. These companies are not going to put in real expensive CPUs to do heavy duty crypto when they are selling a comodity product. The cost per unit is too great. There will always be more powerful CPUs then the ones in these appliances.

Re:Idiots

[jpt.d]

I think the persistent state for all copyrighted works made after Micky Mouse will continue to be copyrighted...

Disney: "You can have Micky Mouse, when you pry it from my cold dead fingers"

Re:Idiots

[warmcat]

The RSA Crypto done on the Xbox XBE for example uses a 2048 bit key. It does not take an inordinate amount of time because they do a fast SHA-1 hash of the XBE contents, and then RSA-encrypt just the hash.

This is unbroken because anyone who knows enough to have a go at it can do the 2^2048 math and realize they are doomed, even with a planetful of Space Year 2100 supercomputers.

The fact is that strong crypto is going to lock out anyone other than the keyholder from being able to contribute to whatever platform is being locked up. The ONLY way through it will be implementation problems.

Re:Idiots

[LupusUF]

I don't see the problem...they are giving people who don't care about support the ability to access the backdoors. Sure, they could take them out...but they would likely loose the "hacking" customers that way. Now they get the best of both worlds, some people will buy the TIVO because they know it can be hacked...but TIVO can easily deny support to people who break their TIVO doing this since you used an encrypted code, and opened up your TIVO to find it.

Re:Idiots

[HoneyBunchesOfGoats]

If you check the stats, it says that the current batch of work units will be done in about 3 days at the time of this post.

Re:Idiots

[mesocyclone]

They tried this way back in the '80s with the VideoCipher II. The encryption keys were stored in a single MCU chip, in RAM (with a battery on the baord). If you pull the chip, the keys vanish - that was the idea.

I know of people who strapped a battery to the MCU, unsoldered the MCU from the board, took it to a semiconductor manufacturer's failure analysis lab (there are several here in town). There, they read out the bits with an electron microscope and had they keys and the algorithm. My acquaintances, btw, never did anything with this information. They were hackers, not crackers.

Later it turned out that one could rebond one pin in the package, and read out and send back in crypto data. This lead to a whole industry providing free "pay" TV.

Putting it in one chip just isn't enough.

Now, if they have a cryptographically good hash, even knowing the desired hash result isn't good enough to allow you to build boards that satisfy the hash. That limits the damage to those folks willing to modify (or, most importantly, pay greedy techs to modify) their boxes, which is exactly what happened with the VideoCipher II.

Last time I looked, less than half of all VideoCipher's sold were *ever* enabled with a paid-for code.

And this was in the '80s!

Re:Idiots

[Lord Apathy]

Has anyone ever thought that they might be leaving this there on purpose? Sure they can take it out and piss off thier core group of buyers. Or they can leave it in knowing that one day it will be hacked and give the technological elete one more reason to buy tivo's.

Re:Idiots

[Anonymous Coward]

> Personally I think new law is needed to render this illegal

That's tricky stuff, policywise.

A lot of people are saying: "If you don't like it, then buy from someone else -- let the free market sort it out."

And a lot of developers are saying: "I don't want the government telling me which features I am required or forbidden to put in my product. If TiVo gets slapped by the heavy hand of government regulation, then my little business could easily be next."

For software, the law is an extremely blunt and indiscriminate weapon. Don't even think of suggesting legislative action unless the situation is demonstrably harmful for many consumers.

Re:Idiots

[Anonymous Coward]

> It's too difficult to remove the backdoors. ... Two branches of the software, one inhouse with the backdoors, and one w/o them for the public is a lot to deal with. What if you applied a patch to one branch, forgot about the other. Now QA has to test both branches, to make sure they're the same.

Geeez, you've got to be kidding me.

You use an #ifdef around the backdoor code, and you build 2 versions: "development" and "release" from identical source code.

You spend 99% of your testing resources on the "release" version. If a bug is found, then the developer uses the corresponding "development" version for debugging. 99% of the time, the bug will be reproduceable on both versions.

The overhead is that the software build takes a tiny bit longer, and the developer has to do one additional PROM-flash per version. The tester's overhead is exactly zero.

Problem solved.

Re:Idiots

[Mr. Red Baron]

Then why change the password? The only reason I can think of was that the original became so widespread that even dumb users were using it and TiVo was seeing that reflected in their call center.

Re:Idiots

[subuni]

Not intending flamebait, but isn't this exactly what we're usually complaining about companies doing? This is one of the highest examples of insecure design. It's not that difficult to remove the backdoor code from the public release, if you code it right to begin with.

No it's not that difficult to remove them. But if you keep the backdoors in, and then wait until the last load before you go GM to remove them, you've just increased the amount of work your QA department has to do. They have to be insanely thorough to make sure that removing of the backdoor code hasn't affected any other code. They're not going to be very happy if you do this at the last minute. And albeit in perfectly designed system, the removal wouldn't affect anything else. But, QA has to do what they have to do. They refuse to make assumptions like that. So now QA has more work to do, which means there's a possibility of the release date being pushed further back (maybe by a week -- but that could push it into the next fiscal quarter, thus screwing up revenues), and now you have shareholders that are unhappy.

Net result? Unhappy engineers (QA for doing more work, devs for having to be "on call"), unhappy customers (people always get upset when they have to wait longer), and unhappy shareholders (they want to see $$$, not QA test results).

If TiVo really wanted to lock people out, they'd disable the backdoors to begin with, and if they really needed to see the logs on a defective unit, they could load it up on a custom system that can pull the logs from the drives after putting them in a read-only configuration.

Yes, they can do that. But, speaking for the QA engineers again, since they're fairly important during the dev cycle... Now, instead of hitting four keys on their remote (clear-enter-clear-thumbs up) to view the log files on their standard system (i.e. you have to test on the exact configuration a customer would have) they now either have to pull the drives out and read the log files on another system (very time consuming just to see one log entry).

They can't very well have a network connection for a couple of reasons. 1- You can't have any daemons running on the TiVo while you're testing it, because the customers won't have them running on their units (i.e. telnet/ftp/etc). Ignoring that, the 2nd issue is that they can't leave the TiVo connected to the network during their tests, because what if that's "altering" the behavior of code -- i.e. a bug only exists when there is no network connection, but a QA tester never notices this because they always have their test station connected so they can view log files through the network. So a bug goes unnoticed, they GM the release, and all of a sudden TiVo's support line is swamped with buggy software reports, and they now have to spend more money rolling out an emergency patch.

Net result? TiVo's not happy (more work/more money spent/public black eye), the customers aren't happy ("This TiVo is a POS! Lets go check out UltimateTV!"), and the shareholders certainly aren't happy.

And quite frankly, I think they also leave the backdoors in for the 'hacker' community. But, they need to protect themself from the 'Joe Blow' community. By doing what is discussed here (changing it to an impossible code for 'Joe Blow' to enter, but allowing a 'hacker' to change it with ease), maybe they've found a nice balance. Aren't we always talking about companies doing something for "us"? Isn't this a case where they're doing something for us? -- leaving in useful utils (log viewer on tv), prototype code (Teach TiVo was very useful, and only available through backdoors), etc.

Then again, I could've been completely off in my original speculation. But the above scenarios of QA are accurate of every software shop I've worked in. You change two bytes in a boot record, and they'll rerun 28 hours of tests that have nothing to do with the boot record, just to make sure there wasn't any code that was dependant on the previous boot record value. And rightfully so, in all honesty.

Re:Idiots

[__aafkqj3628]

Personally I think new law is needed to render this illegal, unless it is under the control of the user.

When was the last time the law stopped anybody from doing anything. Also, wouldn't that law be similar to the DMCA? It would come under the same fire that the DMCA has, because you have the technology, you paid for it and you have the right to crack at it.

Re:Idiots

[__aafkqj3628]

There doesn't seem to be any marketing reason to do that though because sales would not be pushed that much.

I wouldn't be pursuaded to buy a Tivo just because it's been hacked (same reason I'm not buying an xbox).

Re:Idiots

[ctucker]

Disney: "You can have Micky Mouse, when you pry it from my cold dead fingers"

Sounds like a win-win situation to me :)

Re:Idiots

[Jouster]

Nope, sorry, wrong. Bankrupt on Wheel of Fortune, a Whammy on Press Your Luck--you've screwed up.

When you've worked as a QA team member and have spent five days working on an execution-stopping problem that ends up being the interaction between a copy-protection routine and the removal of some trailing whitespace from a label widget, you can talk again.

Any change, no matter how seemingly insignificant and unconnected to other parts of the system, can have far-reaching consequences. If someone changes a single one to zero, or the other way around, it's time to unleash the full fury of QA, because even the slightest change can bring down the whole program.

Even when all you're doing is trying to make "First Name: " look a little bit prettier.

Jouster

Re:Idiots

[Anonymous Coward]

> Any change, no matter how seemingly insignificant and unconnected to other parts of the system, can have far-reaching consequences.

True. But my original 99% statistic stands. Yes, there will always be 1% of bugs that are absolutely hellish to find.

You took a pathological 1% case and focused exclusively on it. BZZZT! Wrong! You forgot to optimize for the 99% case, where the dual-build approach works just fine.

You anecdote was understandable; but your answer makes you sound like a frustrated programmer -- not a software engineer with an balanced understanding of overall productivity.

Additionally, the developer needs to take responsibility for releasing backdoor code to the customer. Marketing requirements might forbid this. In other cases, the developer takes the risk that a released backdoor might be exploited, which can result in a huge monetary damage due to security breach, lost revenue, or other. I've been in exactly this situation, and I very very wisely chose to #ifdef out the backdoor code.

Technique

[RoC MasterMind]

It's been proved and proved again that changing the code to get to the "secret menu" is not effective. If these companies really want to keep people out, they should get rid of the secret menu.

Re:Technique

[Anonymous Coward]

What makes you think they really want to keep people out? Look at it from a marketer's point of view - free hype. Just like cheat codes in video games.

Re:Technique

[Wolfrider]

You may have a point there.

I see a solution: Regular customers get a no-backdoor-at-all Tivo.

Pay $20 more and you get the backdoor code AND PASSWORD supplied and Enabled.

For $20, you can be ROOT on your TV box!
.

Password

[floamy]

How long was it last time? Is it just a random 20 chars of letters or what?

Re:Password

[Anonymous Coward]

just a random 20 chars???
It's not 20 random chars, it's 20 definite chars.

run the numbers: assume 32 chars for simplicity's sake. you got 32^20 possibilities to brute-force, that's about 2^100 if I got that right. Try even counting to that number using your 2048mhz machine. it'll take you 2^89 seconds. ok, use all 4 billiion pcs (forget about the 4 billion tivos), you still need 2^67 seconds. a year are roughly 2^25 seconds, so your down to 2^42 years, that's 4 billion millenniums, man.
so even with the craziest assumptions, you'd have to be really really lucky to brute-force a 20-char password, try the infinite improbability drive.

Re:Password

[numark]

From what I'm getting from the forum, it was 6 letters before. However, it's unlikely it's any amount of random passwords. The backdoors exist for testing as well, so it's no use if you have to enter some meaningless string everytime. Somehow it has to mean something to someone, and be easily remembered by a large group of testers.

the proper URL

[Anonymous Coward]

you might try the Ars Technica team if you want to win the prize ;)

Re:the proper URL

[Anonymous Coward]

That doesn't even work.

Searching for aliens? Curing disease?

[Anonymous Coward]

TV! Now there's a cause I can get behind.

Re:Searching for aliens? Curing disease?

[de_rus]

you should if you're heading for the backdoor

Is it updated via modem? if so, tap your own line!

[aaron_pet]

Is it updated via modem? if so, why not tap your own line!

i don't have a TiVo... nor... well yes I have a modem but it is currently being used as a paperweight...

But couldn't we get one of these software modems to just listen in on the other trafic?

I suspect that some Satelite TV companies do their stuff over the satelite... and some do it over the modem... either way, If I buy something... it's mine... No bugger is going to get away with deactivating it on me...

hmmm.... is this redundant?

[user311]

good cause?

How is this a good cause? I am asking out of sheer curiosity, not against the statement. If there is a legitimate reason to cracking it, then can someone point me to some literature about this subject, or just explain to me why TiVo deserves to be cracked in this manner???

I'm just confused, sounds like this is cracking, and last time I checked thats a pretty illegitimate thing to do, even advocate.

Re:hmmm.... is this redundant?

[JabberWokky]

Yes, this is cracking - it's getting the password to a machine that you have bought and paid for and is your private property. In other words, to move it to a metaphor for the physical world, people are trying to unlock their own bike locks.

A different, and possibly more interesting question is this: Why does the builder of the bike chain it to a bike rack *after* you have bought it and not give you the combination to the new lock? The scary thing is that according to the laws passed recently in the United States (by congressmen who likely did not understand the ramifications of what they were voting on), it is not only illegal to unlock your bike, but the original builders of the bike are allowed to lock it down any way they want after you have purchaced it, and it is illegal for you to even discuss the lock with other people or try to unlock it by yourself so you can use the bike. It is generally illegal (not always, but often) to take apart the bike to turn it into a tandem bike. And if you discuss bike locks in general including starting up a website or discussing them via email it's not only illegal, but you might be a political activist, one of the threats to the United States according to the intelligence community:

Political activism on the Internet has generated a wide range of activity, from using e-mail and web sites to organize, to web page defacements and denial-of-service attacks.

Life in these United States scares me of late. People have just about convinced themselves that they don't need to have physical power (the right to bear arms), and society is now casting organized groups in a bad light. First the right to bear arms, now the right to assemble.

And you, a presumably intelligent person, cannot understand that you should have the right to crack into your own private property? Or that there is anything wrong with the fact that you have to do so?

Ah, well...

--
Evan

Re:hmmm.... is this redundant?

[prichardson]

First the right to bear arms, now the right to assemble.

Actually, almost any loser can buy a gun in the US. In Texas all you need for a concealed weapons permit is a driver's liscense. Really what you should be worrying about is free speach and fair use.

Also, your bike analogy doesn't really work, you can still use the bike, you just can't change your tires, fill your tires, modify you brakes or anything worthwhile.

Re:hmmm.... is this redundant?

[Martin Blank]

You also need to pass the background check to ensure that you're not a felon, wanted for arrest, have a restraining order against you, or have a history of mental illness.

And no, the bike analogy doesn't work. There's a difference in the law between a physical item like a bike, where ownership does completely transfer, and the TiVo. You own your TiVo, but you do not own the code inside it. Modification of the code or unauthorized access to features is something TiVo doesn't want. Fair or not, cracking this code is probably right on the border between legal and illegal. TiVo would have full justification to revoke a warranty -- or perhaps even further updates, tracked in a database by serial number -- for systems it finds hacked, cracked, or modified.

Re:hmmm.... is this redundant?

[JabberWokky]

And why don't you down the code? I'm not saying the bike analogy is good, so let's discard that - it was the first thing I thought of, and like most metaphors, does not stand up to extended usage.

But while I agree that you *don't* own the code you bought, I disagree that you shouldn't. I'm saying that the current fact that you can't legally alter something that you bought and was transferred to you is morally wrong. That private property should be wholly yours. Now, if you were to alter it to get free service, that's something else entirely - you are taking something you did *not* pay for. But altering, disassembling and reverse engineering is, I strongly feel, part of the rights of private property and transfer of purchace.

To move it (again) to a physical equivelent, it's a bit like selling a swingset with two swings and having a bill of sale that says you don't actually own the swings and can't add a third swing. I should be able to take the swingset and weld it into a ditchdigger if I want. And I should be able to take my TiVo and reprogram it into an alarm clock if I want. Sure, it voids the warranty - but it shouldn't be illegal.

--
Evan

Re:hmmm.... is this redundant?

[Anonymous Coward]

"In other words, to move it to a metaphor for the physical world, people are trying to unlock their own bike locks."

Dude. Funny thing about a TIVO is, you can "ride the bike" without "unlocking the lock". You just can't necessarily swap in a new gear mechanism.

People are making this out to be some kind of moral issue. TIVO delivers X product for Y price, and you get to make the choice to buy or not. They then deliver this X product, as promised, and just because you also want Z product doesn't mean they are morally obligated to give it to you.

If you want to play with your TIVO, hey, it's yours. Have fun. But let's not pretend this is a violation of Human Rights (like, say, the Patriot Act) or anything of that level.

Better analogy: You bought a happy meal. The happy meal used to come with a toy, but before you bought it the Hamburgler told you they were out of toys. You bought it anyway, and are now threatening to burn down the McDonalds because you wanted a toy.

Re:hmmm.... is this redundant?

[b_pretender]

JabberWokky, your analogy is poor. Although I agree that they should be legally allowed to access the backdoor, I don't like your analogy.

The reason why is that you can't *use* your bike if it's locked. You are perfectly capable of *using* a locked Tivo for its intended purposes.

A better analogy might be if the bicycle manufacturer *locked* the wheels to the bike. You'd still be able to ride the bicycle (aka use the tivo for its intended purpose), but you couldn't steal wheels from other bicycles and you wouldn't be able to change a tire unless you went to a *bicycle-company* certified mechanic who had the key (they do actually sell skewers for bike wheels with locks/keys). This might be akin stealing content from other Tivos or opening up and fixing/modding the Tivo.

I'm sure there are better analogies, but I just didn't think that yours applied very well. I do agree with your points, however.

Re:hmmm.... is this redundant?

[JabberWokky]

As I said, it was a poor analogy. I was also awake at 5am having spent the night wrestling with a server/firewall that was balking at serving DNS. I'm not attached to the bike analogy - it was the first that came to mind. :) The swingset analogy is marginally better, but I still picked that off the top of my head, so don't pick at that one either. They were just used to illustrate points... which you agreed with, so I think you got the points.

--
Evan

Re:hmmm.... is this redundant?

[Anonymous Coward]

I'd go a step further than the other posters who have rightly agreed that your analogy is bad. It's not just a weak analogy, it's a fundamentally inaccurate analogy. The interpretation that applies to your bike and lock world (or whatever analogy you choose) must distinguish between a product offered for sale and the R&D / intellectual property that led to the availability of that product. If intellectual property is not protected, you might not get much of a Tivo to begin with. Are you saying that Trek (or whatever bike mfr.) or Master (lock mfr.) should give you access to their intellectual property? There is a fundamental difference between Tivos and "hard manufactured" goods like bikes, locks, and radial saws. Such "hardware-only" items - which have no software component - are relativly easy to distribute without threat to intellectual property. Your analogy is totally bogus because it doesn't have anything - at all - to do with intellectual property. And unlike you, your congresspeople probably understood this. Items that ship with a software component must somehow establish a boundary between what the users can see and what they can't. The fact that Tivo may not do a great job establishing this boundary doesn't justify the mindless drivel we are seeing stating that everybody should give their intellectual property away. Geesh. And do you really believe that the entire Tivo is your property? Are they open source now? Double-geesh. So my judgment is that you chose a useless analogy to make an irrevalant point. But you did succeed at going ad hominem against another poster and the entire Congress. Congratulations! But if ad hominem is your native tongue, then let me add that you sound like just another mindless technothug. Next time maybe you should take the time to understand issues a little better - unless you really want to just spend your time posting shallow nonsense and advocating intellectual property theft under the guise of freedom. Triple-geesh.

Re:hmmm.... is this redundant?

[b_pretender]

Dude, I'm sorry to be a typical nitpicky slashdot guy. When are you going to take your timewarp.org live? Is it based upon Rocky Horror PS?

Re:hmmm.... is this redundant?

[JabberWokky]

Yup, and I'm trying to work on it this weekend, but I just got sidetracked with the work that pays my rent. :/ Ah, well. I had wanted to get tw.o up by Halloween, but I'll have it within the next two weeks. It'll blow pretty much every fan site for any genre out of the water, I think.

--
Evan

Re:hmmm.... is this redundant?

[LarsG]

I'm not saying the bike analogy is good, so let's discard that

It is hard to make valid analogies for software and software/hardware bundles like the TiVo. It is both a physical tool, a copy of a copyrighted work and a service.

1) You bought the tool - you have physical ownership of the hardware, and can do whatever you like with it.

2) You either bought or licensed a copy of the copyrighted software running on the hardware.

3) You are buying a service, with software updates, etc.

If you ignore (3) and the courts consider (2) as a sale, then (1) and (2) combined makes a book analogy valid - you own the physical book, and you can do pretty much anything you like with the copyrighted contents of the book (sell the book, pick it to pieces, make comments, etc) as long as you don't give other people copies of it or distribute modified versions.

And I should be able to take my TiVo and reprogram it into an alarm clock if I want. Sure, it voids the warranty - but it shouldn't be illegal.

No argument there. The right to reverse engineer and the right to pick to pieces anything you buy is important. As long as there is no illegal redistribution of a copyrighted work, and the software changes you make is not done in order to break other laws (say, like service theft) then I have no problem whatsoever with 'hacking' the TiVo.

Felten has got the right idea - the freedom to tinker is very important and we have to be very careful not to restrict that freedom.

Re:hmmm.... is this redundant?

[BluBrick]

Dude, it is live. It's just that the link takes you back to last week. You'll have to wait until next week to get this week's content from timewarp.org

Re:hmmm.... is this redundant?

[ryanvm]

If there is a legitimate reason to cracking it, then can someone point me to some literature about this subject,

They are cracking the login password for telnetting into your TiVo. There are a number of reasons why someone would do this, but mainly it has to do with wanting to customize your TiVo's functionality.

The "backdoor" password is basically like Ford welding your hood shut. You've bought the product, if you want to get in there and fuck around with it, why should you be prevented from doing so? Customizing your TiVo has absolutely no effect on the TiVo corporation.

Personally, I think TiVo is fucking up. The TiVo hacker community is amazingly bright. They may not shave, and they may smell funny, but believe me, you want these guys on your side. Up until now, the TiVo hackers have exhibited amazing restraint with respect to TiVo's intellectual property. They could have released HOWTOs on hacking TiVo's encrypted file system long ago, but TiVo's been nice to them. Who knows what they'll do now.

Re:hmmm.... is this redundant?

[MrFredBloggs]

"I'm just confused, sounds like this is cracking, and last time I checked thats a pretty illegitimate thing to do, even advocate."

You should`ve stopped at "I'm just confused" -the rest of your sentence makes it look like you don't understand the difference between legal and moral, or between necessary and fun.

Explain to me again why this is a good cause?

[mumblestheclown]

• corporations are evil?
• individuals or companies that attempt any sort of security should be shown that all their base, does indeed, belong to us?
• business models that involve selling a piece of hardware below cost to make money on additional software or services are the work of satan?
• because hackers can do something means that they should do it. laws and conventions do not apply to them because it is unlikely that they will get caught.
• if there's one thing the world needs, it's more TV.
• information deserves to be free. other people's information, that is.

Re:Explain to me again why this is a good cause?

[Anonymous Coward]

You seem to keep forgetting that michael is a slimeball Commie.

Re:Explain to me again why this is a good cause?

[Anonymous Coward]

business models that involve selling a piece of hardware below cost to make money on additional software or services are the work of satan? That's it. That's the one.

Re:Explain to me again why this is a good cause?

[0xdeadbeef]

individuals or companies that attempt any sort of security should be shown that all their base, does indeed, belong to us?

Um, yes? Anything I purchase does, in fact, belong to me.

You're abusing the word "security". How does this password enhance anyones security?

Of course, security is an issue, as it is always a good idea to peek inside the gifts of the untrustworthy. There is a famous myth that demonstrates that concept.

There is a trend toward turning physical devices into EULA enforcing, fair use destroying, home-phoning, mysterious black boxes, so any attempt to thwart those schemes is a Just Cause, even if the target is generally on our side. If they don't like it, then perhaps they should sell us devices without backdoors or purposly restricted capabilities?

Re:Explain to me again why this is a good cause?

[cheekyboy]

shut up, we know your shares have lots 70% value... we dont care. We are consumers!

People tinker their cars too, people buy cook books, they dont make resteraunts bankcrumpt.

Yes its a good cause, coz we are free to do what we like.

Re:Explain to me again why this is a good cause?

[hexx]

IDOAT (I don't own a TiVo), but I need a further explanation - someone please help.

Here's my quandry. If I buy a TiVo, I believe I should own the hardware and the software if that's what TiVo says I own at the time of purchase. If they say I own the hardware, but they own the software - so be it (don't buy it if you don't like the terms). In the latter case, I do NOT have the right to access parts of my TiVo software that TiVo does not want me to access - I don't own it.

Now, did TiVo change their terms of ownership?

For example, if (and this is an if - I don't know too much about the situation) I bought a TiVo when the terms of service were "I own the hardware and software", and now TiVo says "I own the hardware, they own the software", then I should be able to choose to upgrade or not. If I choose to upgrade, I can surrender my rights to tinker with the software. I should be able to choose not to upgrade, and still run the TiVo as it was. Can I?

What's the deal here? What exactly does TiVo say about ownership?

Why figure out the password?

[phr2]

Why not just hack the code directly, to make it not bother with the password?

And when are we going to stop giving a damn about consumer gizmos running embedded linux, as long as the actual interesting functions are in some closed application running in the box? The interesting gadgets are the ones that are fully hackable, so the application code comes with source and is easy to customize. Freevo might be a start at a hackable PVR.

Re:Why figure out the password?

[Anonymous Coward]

That apple 22" widescreen monitor might come in handy after all........

Re:Why figure out the password?

[mountain_penguin]

actually mythtv is a lot better than freevo for most jobs
it has recording channel listing live tv pausing mp3 player games box and gallery veiwer
they are allready working on heuristics which sort of works and re encoding down to normal divx
its quite hackable and is developing very well i use it at the moment for my tv watching needs
www.mythtv.org
But i do agree that it would be better for all if people devoted there time to projects like these

Re:Why figure out the password?

[johnburton]

Because with the code anyone with a tivo can use it to do a few extra things. Hacking the code would at best require you to take the tivo apart and modify the code on your machine. Not quite to simple.

Re:Why figure out the password?

[rufo]

This is (sort of) possible. What you say can't be done literally on a Series2. TiVo has started checking hashes on everything in the Series2 units, so it's very difficult to hack the code on the TiVo. The kernel is signed with TiVo's private key, which the TiVo firmware checks on each bootup. Inside of the kernel is an initrd ramdisk, which contains to hashes to all the files on the TiVo's ext2 filesystem. (There's another filesystem called MFS that contains all of the TiVo video files and other critical data which isn't checked, but there's no executable code in there unfortunately.) Since the ramdisk is inside of the kernel, if you attempt to modify the ramdisk you ruin the signing, which means the firmware won't boot it. So until somebody hacks either the firmware, the private keys that the kernel is signed with, or manages to find a collision with the SHA-1 hashes, hacking the executable is out of the question. This also means all other fun forms of TiVo hacking are right out, such as TiVoWeb, yac/elseed (caller ID programs), e-mail notification systems and whatnot. (This is why I traded a friend a brand-new Series2 for a Series1 which he wasn't going to hack.)

Now, what you can do is modify the backdoor code hash itself, which is stored on the MFS file system. However, there's one big problem with that: You have to crack the case and pull out the hard drive, which has one of those lovely "Warranty Void if Removed/Damaged" stickers. True, many people are going to crack them open anyway to add a second drive, but there's also lots of people who won't. The backdoor codes can be entered without voiding the warranty; it's just a charachter code you enter on a certain screen. Voiding your warranty just to get into a few extra features via the backdoors code isn't something many people are willing to do.

And as for Freevo: Yeah, it might get somewhere sometime, but then again, it might not. Until it's as reliable, stable, and easy-to-use as my TiVo, I'm not planning on using it. I realize other people might have different tastes and prefer something majorly hackable, but I'm not one of them. :)

Re:Why figure out the password?

[gozar]

TiVo has started checking hashes on everything in the Series2 units, so it's very difficult to hack the code on the TiVo. The kernel is signed with TiVo's private key, which the TiVo firmware checks on each bootup. Inside of the kernel is an initrd ramdisk, which contains to hashes to all the files on the TiVo's ext2 filesystem. (There's another filesystem called MFS that contains all of the TiVo video files and other critical data which isn't checked, but there's no executable code in there unfortunately.) Since the ramdisk is inside of the kernel, if you attempt to modify the ramdisk you ruin the signing, which means the firmware won't boot it. So until somebody hacks either the firmware, the private keys that the kernel is signed with, or manages to find a collision with the SHA-1 hashes, hacking the executable is out of the question. This also means all other fun forms of TiVo hacking are right out, such as TiVoWeb, yac/elseed (caller ID programs), e-mail notification systems and whatnot. (This is why I traded a friend a brand-new Series2 for a Series1 which he wasn't going to hack.)

So, is this more secure than the method used to protect the Xbox? And could this technique be used to create a secure Linux gaming machine (like the Indrema)?

Because you're entitled to use your own hardware

[phr2]

You paid for it, it's yours, and you should be allowed to do whatever you want with it.

If some vendor decides, rightly or wrongly, that giving hardware away is a sensible business model, that doesn't in any way entitle them to any control over what you do with it once you take it home. Think of the stupid CueCat bar code wands from Radio Shack. The "legitimate" application intended for those things is long dead, but people continue to do useful things with the wands using software based on reverse engineering them.

Source code only cracking

[LinuxGeek]

No Win32 executables, then most of the crunching will probably be done on Linux. Makes me wonder how many Windows boxen have a C compiler.

Re:Source code only cracking

[Anonymous Coward]

open the release folder you id10t

No Offense

[jchawk]

Why are people still buying these devices if they don't offer the features they want or expect out of the box?

- This is a serious question, mod as such.

Re:No Offense

[Anonymous Coward]

cause there simply is no alternative. 90% of all consumers are totally in the dark about anything that involves technology. So business run flashy ads and salespeople move the product. It simply is not economically sound for these companies to appease this small percentage of technologically literate consumers. So in the end it is the people who really will use the device to its fullest extent that get the shaft.

Re:No Offense

[Anonymous Coward]

"The fullest extent"? Oh the glorious potential of... watching TV! Get the fuck out of here

Re:No Offense

[evilviper]

I have heard, it is due to the Tivo having features no other PVR does (nor PVR software). I'm not a tivo owner, nor do I ever intend to be (due to extra charges, and the lack of control over it). But that should answer your question.

Re:No Offense

[wsloand]

Why are people still buying these devices if they don't offer the features they want or expect out of the box?

For the same reason that people buy cars then modify them. For the same reason that people update the software on their computers. For the same reason that people get accessories for or modify anything that they own.

Re:No Offense

[AaronGeek]

"Why are people still buying these devices if they don't offer the features they want or expect out of the box?"

Probably the same reason that people buy cars and add aftermarket accessories or upgrade their computer. Not everything you buy has all the features out of the box. Alot of people, myself included like to upgrade, update, add new features to things they buy.

Re:No Offense

[jafac]

And therin lies the rub.

90% of what people bitch about here on slashdot is the direct result of 90% of all consumers being totally in the dark about anything that involves technology. (Man, that would make a great .sig if it weren't for the wimpy length limit).

There are a few potential solutions to this problem:

1. Education - all children should be taught critical thinking, the scientific method, electronics and computers right next to reading, writing, and 'rithmatic. (yeah, like that's ever going to happen in this world - most people in the world are functionally illiterate, because their governments don't fund public education, etc. - in the US, we're lucky if some districts cram creationism down our throats - and between security checks for guns and bombs, drug dealers, gangs, football, etc - Education, will never ever happen).

2. Technocracy - Establish a ruling class of technologically savvy people (who rightfully deserve it!) to lead the unwashed masses into a glorious enlightened future. (this will occur moments after the current monied establishment all keels over from a deadly virus spread by contact with $100 bills - ya, right).

3. This is reality, society has reached a stable equilibrium with the ultra-rich running things, and making sure the ultra-stupid stay that way so that they can be kept as cheap, willing slaves and captive consumers of crippled goods.

Sorry to be such a downer, man.

Re:No Offense

[grumling]

However, all these plans fall apart when a good looking woman walks into the room.

Re:No Offense

[Anonymous Coward]

I think some probably buy it with the expectation that it can be hacked, and then when Tivo "updates" it, it is no longer the item they purchased.

Re:No Offense

[seligman]

Why are people still buying these devices if they don't offer the features they want or expect out of the box?

Hi. I'm Scott Seligman, the "Windows" link.

I can only speak for my motivation in doing this. For me the back door code is more of a toy than anything else. Some of the settings can be fun to experiment with. For the most part though, I'd still be a happy TiVo user without the back door code.

Heck, I personally own a DirecTiVo, so I'll never even get the version of the software being dealt with, though hopefully the same sort of system can be applied to whatever version I do end up. Mostly, it's a "the mountain was there" sort of challenge. I just wanted to see if I could do it. When I started work on the original version of the Windows port, I expected that the code would be found long before I had a working version.

Re:No Offense

[tswinzig]

Why are people still buying these devices if they don't offer the features they want or expect out of the box?

Weird, I didn't see "HACK YOUR TIVO WITH AWESOME BACKDOOR CODES" printed on my TiVo box anywhere.

These are perks, above and beyond what was advertised or claimed, and fun hacks that people have done. My TiVo would still kick ass without any backdoor crap. In fact, since the 3.0 software update, I haven't bothered to enter the backdoor.

Re:No Offense

[Max Coffee]

Good point, but I couldn't help but play devil's advocate to it, if only because I love a good debate :)

Why do people buy TiVo? Why are most people satisfied with it post-purchase? Simple. It does what the manufacturer claims, and people make the value judgment on that basis.

You happen to know the TiVo is actually a Linux-based computer, and that it's technically capable of more than the manufacturer claims. And yes, I agree you should be allowed to mod it, and that the TiVo company shouldn't undo your mods once they've been made, except with your permission. But I submit it's not fair to dismiss the satisfied customers as clueless. They weren't ripped off. They got exactly what the manufacturer claimed, and that's all they wanted from that particular device.

Personally, I don't own a TiVo, but I've been considering getting one (or some other PVR perhaps). If I get one, I won't bother modding it. Why? I'm not clueless; quite the contrary. It's just that I watch less than 1 hour of TV per week on average, and I don't really need that much functionality. I'd rather do something else with my time. Different priorities, that's all.

Re:No Offense

[ez76]

90% of all consumers are totally in the dark about anything that involves technology

I disagree. Awareness of new technology increases in proportion to its usefulness and in inverse proportion to its expense.

People aren't in the dark about technology, they're in the dark about unuseful or economically impractical technology.

Re:Because you're entitled to use your own hardwar

[mumblestheclown]

False.

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound. Yes, it's your hardware, but rules exist to further a public good--a (relatively) pollution and noise free environment.

Similarly, laws exist that say that you cannot circumvent pretction mechanisms such as that on the tivo.

Why? because, again, there is a public good involved, but this one is subtler. It's the public good of a business climate where companies make products and services using a variety of business models and people buy them and use them in a manner consistent with widely-held notions of fairness.

the alternative is a world where prices are higher / options are fewer because companies would have to hedge against unauthorized uses.

of course, for some businesses, it turns out to be beneficial that there is a user commuity that likes to hack around. but it's up for the company to decide whether that is, indeed, the case as far as it is concerned.

Blind at 5am

[LinuxGeek]

The Win32 executable is in the archive, ignore previous post....

From the forum...

[Jeffv323]

Yikes!
Is there any way to contact /. and ask them NOT to run that post? I suspect that as soon as the post hits the front page, both tivocommunity.com and all of the pages associated with TivoCrack will be brought down by the load.

Too late! Now go watch your servers burst into flames...

Re:From the forum...

[TarpaKungs]

Well, the server has 788 active IP's and it's still up and ploughing through the work.

The answer to checking for forged results is to double the workload and submit each workset to two different machines as far away from each other as possible. If the answers agree, accept, otherwise recompute the worksets on more machines and take a majority vote. I thought Seti@Home did something like this?

Looks like /. did them a favour in terms of providing more computing power.

Re:From the forum...

[Sazarac]

Hee hee. It would seem the little engine is not multi-threaded, but I discovered you can run two of them and they will run on separate processors.

-Sazarac
"He who joyfully marches in rank and file has already earned my contempt. He has been given a large brain by mistake, since for him the spinal cord would suffice." --Albert Einstein

Re:From the forum...

[Anonymous Coward]

It looks like the list of numbers will be done in a little under two days now because of the slashdot effect. Nothing like having 2000+ computers join in to try and break the code.

Stupid question

[Anonymous Coward]

why can't you use the gpu in most people machines to crack these things. It seems to me that they would work just as well as normal processors in cracking codes. Why not use both cpu and gpu processing power to crack these things.

Re:Stupid question

[Anonymous Coward]

tivos don't have graphics processing units, they have mpeg decoder chips, totally different

and 1 hr on a 1ghz pc = about a weeks worth of processor time for a fast tivo

Re:Stupid question

[anonymous cupboard]

When you don't run a games, your PC's GPU is doing very little. Simple 2d window management as with Win or X does not require much from the processor.

Running a distributed client on a GPU is an interesting idea, as it is esentially a very fast processor Optimised for 3d-math but with some general capabilities. OTOH, it would be difficult because it is hard to work directly on the GPU as the driver translates the instructions and GPUs very a lot (NVidia, Radeon, etc., and then the individual models). Also, the GPU would tend to run hotter as it would have to do more work (hard-gamers tend to ensure that their graphics card has additional cooling).

Re:Stupid question

[sabNetwork]

On an unrelated note, this is exactly what Apple has implemented in OS X 10.2 Jaguar. Their propreitary "Quartz Extreme" feature uses the GPU to render the Aqua UI when not in use.

It would be interesting to see other applications utilize this technique.

Re:Stupid question

[otis wildflower]

It would be interesting to see other applications utilize this technique.

It's rumored that M$ Longhorn will be stealing this idea from Apple.. Wouldn't be the first time :p

Re:Stupid question

[Whammy666]

It's not stealing... it's innovation.

Re:Stupid question

[Anonymous Coward]

Even without reading the article, I'm almost certain they're not doing the cracking on their Tivos, but on their PCs...

FreeBSD port?

[BitHive]

I'm sure someone out there can whip up a FreeBSD port without too much trouble...or at least some precompiled Linux binaries that I could run on my FreeBSD boxes...

Re:FreeBSD port?

[Gandalfar]

read the http://www.tivocommunity.com/tivo-vb/showthread.ph p?threadid=80657 thread. There instructions inside what to change to get it running on *BSD

Re:FreeBSD port?

[Anonymous Coward]

ianabsdu (im not a bsd user), but you could try compiling it (with make) or get a linux binary and run it in compatibillity mode. It should work on any sane *nix.

Re:FreeBSD port?

[Magnus Reftel]

I don't have a FreeBSD box to test on, but to compile the client for MacOS X (which should be similar enough), it's enough to add -Dsocklen_t=int to the line in the Makefile that compiles source files, and -lcrypt to -lcrypto in the line that links the executable.

So, change line 8 in the Makefile from
$(CC) -o dclient $(DCLIENTOBJS) -lssl -lcrypt -mhash
to
$(CC) -o dclient $(DCLIENTOBJS) -lssl -lcrypto -mhash
and line 12 from
$(CC) -c $<
to
$(CC) -Dsocklen_t=int -c $<
and it should compile.

Re:FreeBSD port?

[Anonymous Coward]

To get it to compile on FreeBSD, you just need to modify the includes slightly. Add the following to httppost.cpp and tivocrack.cpp:

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <net/if.h>
#include <netinet/in.h>

Also, as mentioned in previous comment, you'll need to change -lcrypt to -lcyypto in the Makefile.

Re:Because you're entitled to use your own hardwar

[Andy Smith]

I wish I could mod your comment up but I can't at the moment so I'll just say that I think you make good points and you make them well. I also agree with what I believe were the underlying points of your original comment.

+1 Insightful

Re:Because you're entitled to use your own hardwar

[DNS-and-BIND]

God-damn independent people...doing whatever they want to with their own property. This must be stopped!

DMCA?

[Russellkhan]

Is this a violation of the DMCA? Are the project and its participants likely to be prosecuted as such?

Please note, I did, follow the link and read the linked discussion, but saw no sign of this information.

Russ

Too many...

[syylk]

..."think about a Beowulf cluster of these" posts floating around.

This effort is actually a loose application of those posts.

So this post shouldn't be funny at all! :)

Soooo... Ummmm...

[NeuroManson]

What are these maaaaagical "features" anyway? From the forum, all they seem to be covering is the decrypting aspect, but what else does it do beyond removing the rating system?

Re:Soooo... Ummmm...

[vanguard]

Sorting the todo list (list of things that will be recorded)
Changing skip to tick (15 min increments) to 30 sec fast forward
Entering preferences (which shows you like)

Mostly little features that people find useful. Some of the changes you can make (I can't name them) would allow you to break the unit. Personally don't mess with them, I like the stock tivo.

Vanguard

Re:Soooo... Ummmm...

[NeuroManson]

Seems kind of overcomplicated, which is why I stick with VHS (mainly to transfer archived videos to my computer), and use the computer with PowerVCR to record it (surprisingly good PVR software). Dunno what good a Tivo would be for me, since I can easily build my own for about $400 or so, without having to phone home every time I watch TV. TV Guide's website (or schedule on digital cable) helps with figuring out when something's coming on too).

Re:Because you're entitled to use your own hardwar

[simontek2]

whats a cuecat bar?

Re:Because you're entitled to use your own hardwar

[JohnFluxx]

You can if you don't disturb anyone, and its your own property.

Try to think of an example where

a) You own something
b) But you aren't allowed to do something with it, even in your own property, and it doesn't affect anyone else.

I wonder ...

[dJOEK]

OpenBSD releases 3.2 ...
TiVo releases 3.2

coincidence ?

Works fine on Mac OS X

[benh57]

Compiles fine on Mac OS X. Just add:
typedef int socklen_t;
to the top of SSocket.h
and change:
-lcrypt
to
-lcrypto
in the Makefile.

-Ben

Re:Works fine on Mac OS X

[Anonymous Coward]

shrug, no go on freebsd 4.5

Re:Works fine on Mac OS X

[Malic]

Not completely true. On Jaguar, I get:

ld: tivocrack.o illegal reference to symbol: _RIPEMD160 defined in indirectly referenced dynamic library /usr/lib/libcrypto.0.9.dylib

After the changes suggested here.

Re:Works fine on Mac OS X

[Megane]

Note that if you download the Mac OS X version that's on page 12, and uncompress it with Stuffit Expander, when it finishes uncompressing, you won't see it anywhere. That's because the root folder in the archive is ".", which gets changed to "..1", which is helpfully recognized as an invisible file under Unix, and you don't see it under the Finder. Or even with a normal 'ls' comand.

This took me 15 minutes of head scratching before I figured it out.

And just for the record, the command to run it (as shown on page 12) is:

./dclient http://eolson.dyndns.org/dtc/getwork.php username

Re:Works fine on Mac OS X

[MightyYar]

I had openssl installed through FINK, and had a similar problem. I had to change the includes in tivocrack.cpp to reflect where fink stuck them:

#include "/sw/include/openssl/sha.h"
#include "/sw/include/openssl/ripemd.h"

Re:Works fine on Mac OS X

[Megane]

Looks like the pre-compiled dclient in that .zip file works fine. Since I have one of those new dual 1GHz "speed holes" models, I'm running two copies of it, keeping my CPU utilization nicely pegged at 100% for both processors. And it's all otherwise wasted cycles, so I don't (yet) notice any loss of performance.

Re:Works fine on Mac OS X

[otis wildflower]

Weird, my jaguar installation had no issue... Are you fully patched?

uname -a

Darwin Paranoid-Android.local. 6.1 Darwin Kernel Version 6.1: Fri Sep 6 23:24:34 PDT 2002; root:xnu/xnu-344.2.obj~2/RELEASE_PPC Power Macintosh powerpc


ls -l /usr/lib/libcrypto.0.9.dylib

-rwxr-xr-x 1 root wheel 927252 Aug 9 22:11 /usr/lib/libcrypto.0.9.dylib

Re:Works fine on Mac OS X

[otis wildflower]

in the CC line in makefile, you may wanna append (from tivocommunity):


-mdynamic-no-pic -mcpu=XXX -mmultiple -faltivec


where XXX is your PPC type (750, 7400, 7450 most likely) and -faltivec if your system is a G4.. Dunno how much this should help or hurt, but it could be handy..

Re:Because you're entitled to use your own hardwar

[0xdeadbeef]

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound.

You can't bludgeon someone to death with a Tivo either, but that doesn't make it any less a specious analogy.

No one has a right to a profitable business model, and the power grab by content manufacturers has no more or less moral authority than the resistance of people using piracy. They rationalize that behavior because the corporations themselves are already trampling on the "widely held notions of fairness".

Technical info

[Otto]

First off, if you really want backdoors enabled, that thread on tivocommunity.com details how to do it by changing the hash yourself. You can change the hash it's checking on the disk and voila, no problem.

So this search is basically pointless, but again, it's only for the hell of it.

How it works:
1. Tivo changed the backdoor code in 3.0 to be an SHA1 hash. So when you input the backdoor code, it hashes it, compares the hashes, and enables backdoors if it matches.

2. The hash for 3.0 was reasonably simple to crack. It was short (6 characters) and so was found quickly. 3.2 is longer (everything up to and including 8 characters has been searched already). That's really all there is to it and why it's now a distributed client.

3. The slashdotting I now expect will probably take the server down. I really wish this hadn't been posted. In any case, too late now.

For more info about Tivo backdoors, see here.

For more info about the 3.0 hash crack (the easy one), see here.

Re:Technical info

[autocracy]

OK, this is almost certainly a really dumb question - but why can't we just put our own hash into the system?

Re:Technical info

[gimpboy]

OK, this is almost certainly a really dumb question - but why can't we just put our own hash into the system?

well based on what the parent to your post said:

First off, if you really want backdoors enabled, that thread on tivocommunity.com details how to do it by changing the hash yourself. You can change the hash it's checking on the disk and voila, no problem.

i would assume it is possible.

Re:Technical info

[autocracy]

Yep, that'd make it stupid... *sigh* gotta wake up before reading /.

Re:Technical info

[seligman]

Yes you can. It's mentioned in the thread being linked to that you can drop in your own hash (or more precisely, the hash from the last software rev), and use that code.

Re:Technical info

[Megane]

OK, this is almost certainly a really dumb question - but why can't we just put our own hash into the system?

Because you would have to take the hard drive out and connect it to a PC, which means you have to open the case, which voids the warranty.

But if you don't mind voiding the warranty on a brand new $600+ unit (apparently only the 80 hour units right now have 3.2), and have the technical savvy to do editing of data on a strange filesystem, it's easy to install the old 3.0 hash.

busines for IBM

[abhikhurana]

Now I know why IBM wants CPU time to be a metered utility... all the TIVO consumers have to do is buy some CPU time on IBM supercomputers, and voila :-)
I can now see why IBM's business will succeed.

From the forum...

[Anonymous Coward]

"-Quote-
Is there any way to contact /. and ask them NOT to run that post? I suspect that as soon as the post hits the front page, both tivocommunity.com and all of the pages associated with TivoCrack will be brought down by the load.

Instead of helping, posting might actually slow down the effort since the servers serving the blocks surely aren't setup to handle that load.

-

Well, I think we need the help. I pray to god no one cheats it. Perhaps we should change the version numbers now so we know the "pre-slashdot" contributers. Those would be the one's we could presumably trust the most.

Seti@Home has had big problems with cheaters lately. Slashdot ran a story about it Yesterday.

I think It may be wise to take the stats offline. Store them and publish them at the end or something. It will stop the cheaters."

There you have it. Play nice, dont ruin this game too please.

Re:Because you're entitled to use your own hardwar

[TarpaKungs]

Good argument, mumblestheclown. But I disagree concerning the freedom to employ unstable business models.

I agree, it wouldn't be very nice to set fire to my Tivo and throw it through your window. Conversely if I rip the silencer off my motor, it would be perfectly OK to drive it around on private land (with permission) 20 miles from the nearest inhabitant (in the UK at least).

One reason I may want to mod the box is this: consider that maybe I want to use and pay for the Tivo service but I also want to add some random feature. That would be in the same league as installing an amp in my car or whatever. I do not expect to have to ask the manufacturer's permission to disassemble my dashboard.

The other reason I may want to crack the unit is that it's my box - I paid for it, I own it, it's on my property.

I take on board your argument supporting varying business models - but I hold that the business model is flawed. Sell the box at a profit and discount the service. In a way Tivo's business model is basically parallel to the "loss-leader" trick employed by supermarkets. They offer something at an attractive discount (actually with a negative profit margin) in the hope that I will buy other products. However, it is perfectly reasonable for me to isolate all the loss leaders and buy them and nothing else, thus making a loss for the company. That's the risk they took. On average it works out well for them (or they'd stop doing it).

I'm sorry - if Tivo want to guarantee that I will buy their service, they shouldn't sell the box on it's own. Or they shouldn't at least sell it at a loss. I can buy a phone without a phone line or rent a phone line without a phone. It would be silly, but I can do it and it doesn't cause the telco or the phone makers any problems.

I generally subscribe to the view "What I own I can take the lid off and poke around" as a starting point. I am very much against any business model which is so flimsy that it needs laws like the DMCA to support it.

All of which is why I've added 2 machines at home to the cracking pool :-)

Sod the DMCA and everything like it in Europe!

Best, Timbo

Re:Because you're entitled to use your own hardwar

[photon317]

Wrong. I *can* do whatever I want to a 2003 ford mustang. I can remove the muffler, modify the camshaft... hell I can strap a rocket on the back if it pleases me. Obviously the manufacturer won't honor my warranty once I cross certain lines, and obviously because of laws for the common good, I won't be able to legally drive it on public highways after a certain point as well. But at any stage in whatever process, Ford will be more than happy to supply me all the technical data and help I need when it comes to how their car is designed and built - although some of the more advanced manuals come at a reasonable cost.

If TiVo were the same, then they should allow me to turn the box into a linux unreal tournament machine or an X.10 controller or whatever the hell else I want to do with it, and provide specs and documentation as neccesary to boot. They would of course void my warranty and/or tech support when I open the case or make invasive software changes - and at some point down the mod path they may no longer allow me to subscribe to their services, and may even disclaim to me that it's no longer legal for me to hook my TiVo up to a cable/satellite network (however dubious that may be) - but they wouldn't stop me from doing whatever I wanted with the hardware in my own home.

Re:Because you're entitled to use your own hardwar

[Fnkmaster]

Sorry dude, you are 100 miles off target. You aren't allowed to remove that muffler because it affect the PUBLIC GOOD, not because it adversely affects Ford's bottom line. There is massive gap between laws regarding use of your possessions in a manner contrary to the manufacturer's bottom line, and laws regarding use of your possessions to infringe on other individual's rights to life, liberty and the pursuit of happiness (and no, a corporation itself or a business model do not have rights).

A better example might be buying a 2003 Ford Mustang, ripping off the exhaust and installing an aftermarket exhaust system for 2003 Ford Mustangs. If Ford says "but we sell our Mustangs at a loss, the EULA says you will buy parts and maintenance from Ford" you would tell them to go fuck themselves. Likewise when a hardware or software maker tells me what I can do with a product I legally purchased.

Re:DMCA?who cares....

[cheekyboy]

is that a stumbeling block, ahahahahhaha

Outside USA people just go, "DMCA? run dmc? what...."

*continues cracking...*

Re:Because you're entitled to use your own hardwar

[Zeinfeld]

Why? because, again, there is a public good involved, but this one is subtler. It's the public good of a business climate where companies make products and services using a variety of business models and people buy them and use them in a manner consistent with widely-held notions of fairness.

I find it amazing that Tivo appologists fall for this type of tactic. The only reason they do is that they have not woken up to the fact that Tivo is not the only maker of PVRs.

I do not expect Tivo to survive. The clueless business model only works if there is no competition. There is plenty of competition in the space and that is only going to increase. Nobody succeeds with a razor and blades business model (the Tivo subscription) when there is a cheaper option flat fee.

Every one of the clueless 'I just want 0.01% of every transaction on the net' payment schemes failled miserably.

But every time we have a Tivo story the Tivo heads rush in to explain why everyone should pay twice the going rate for the technology. It is as pathetic as the Apple appologists, 'Macs are fastest, speed is what matters, buy a Mac, oops they are no longer fastest, well it isn't just CPU power that matters, its benchmarks, no its the pretty case'. Apple's price gouging and constant interface changing games to make old peripherals obsolete should be criticised as much as if not more than Microsoft's tactics. But they get away with it.

I don't want the video to decide what to record, I do that. I want a recorder with a removable disk so that the thing is not always full. There is an interesting port on the back of my DishPlayer PVR, anyone know what it does?

Dumbass

[Anonymous Coward]

Mufflers have nothing to do with pollution.

The reason mufflers are required is because without them they would bother other citizens and stop them from enjoying peace and quiet.

How does hacking your own Tivo that you bought and paid for stop you from enjoying your peace and quiet?

Answer: It doesn't.

You have a weird twisted view of the world where just because a corporation says something must be terrible than its true.

But in the real world, corporations exist to be servants, not masters.

And no, I'm not. I'm a registered Republican. But I'm not stupid, like apparently you are.

Re:Because you're entitled to use your own hardwar

[Fnkmaster]

It would be appropriate to note that this "crack" doesn't allow you to obtain free service, and that this has never been about free service. It's just about the ability to modify your Tivo, install cool things like TivoNet cards and so forth. Tivo keeps making this more difficult with every release. And each time it wears away a bit of community goodwill, which is sad because its this thriving community on which Tivo has built a business.

Good point, bad analogy.

[mindstrm]

I am free to remove that muffler if I wish. Ford cannot sue me for removing the muffler. Ford cannot prevent me from doing it.

I can do whatever I want TO it, but laws regulate what I cna do WITH it.

Local noise bylaws are what prevent me from driving around with no muffler; it's rude, inconsiderate, and directly affects the peace of mind of others in my community.

If I buy a tivo, I am also free to do whatever I want TO it. IF I decide to walk out on the street and bash your head in WITH it... there are laws against that.

What laws are those? THe public good of a business climate? People come first. Unauthorized use? What unauthorized use? Copyright law permits me to make copies of those tv shows I'm recording, as many as I want, provided I'm not distributing them.

The DMCA covers technical copyright protection mechanisms; but the mdeia being recorded onto a tivo was not protected in the first place, so it's doubtful the dmca could really be brought to bear.

Good cause

[k4m3]

pitch in some CPU time for a good cause

Since when cracking a TV recorder for fun is a good cause ? Better use wasted time for folding@home or "screensaver lifesaver".

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

RC3105 - can't log in right now for some reason...

quote:Ford will be more than happy to supply me all the technical data and help I need when it comes to how their car is designed and built :

not true, Ford & most of the other big manufacturers are hoarding technical info so that you are forced to take the car to the dealer for svc. say you buy a 2003 mustang, a month later the check engine light comes on. neither bob's garage down the street or the guy who changes his own oil can query the computer to see what's wrong. you're out $65 to find out the computer remebers when you accidently left the headlights on last week and had to get a jump.

SOME information SHOULD be free, some shouldn't. the line needs to be drawn based on what's reasonable not what's best for one specific company's bottom line or who's got the best lobbyists.

--
Riley

All you Tivo apologists...

[mindstrm]

let me ask you this.

You are all talking about how cracking this seems "wrong" and whatnot...

Has Tivo complained? No?

Shut up.

Yay man

[Anonymous Coward]

You should get in touch with those guys who are taking the hard route... distributed whatchamacallit?? Encrypt how? What good's that for?!

tivo is cool? meet cocoon

[Anonymous Coward]

I also saved Cocoon on tivo. Such a nice story, with the old folks and all. Also good, is *batteries not included.

Thank you much time.

Re:Is it updated via modem?

[MikeLaw]

The effort doesn't relate to the stuff that is downloaded from the modem. It is an attempt to decrypt a password whose encrypted form is known which is used to activate "backdoor" features. Therefore, there is no way to attack it from the tty stream -- it is never used there.

Re:Because you're entitled to use your own hardwar

[romco]

"You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound. Yes, it's your hardware, but rules exist to further a public good--a (relatively) pollution and noise free environment."

Yes you can... removing your muffler is totally legal. You are are only breaking the law when you drive it on public roads. You can take it to a race track and drive it all you want.

If someone converts a Tivo into a hacking device AND uses it to break into computer networks, that would be illegal. You could also break the law by hitting someone over the head with your Tivo, no modifcations required.

Cracking and modding your Tivo is, and should remain, totally legal.

And the password is....

[ArsonPerBuilding]

Who wants to bet 2000 years of computer time will yeild a password "password"?

Re:And the password is....

[Max Coffee]

They should try Saddam's password. You never know!

Re:And the password is....

[numark]

Nope, they're already on nine-character passwords. Good idea there though ;-)

Not really needed, just for fun

[Antity]

From a post (from "Otto", discussion forum, 10-31-2002 08:14 PM):

As has been stated already, this search is essentially for fun. If you want to get the backdoors on your S2 unit, it's already been stated how to do it. Load up the drive in a computer and change that code to the other one. Voila. This power search is just out of boredoom's sake, and to see if we can do it. I'll be cool to find it, but it's not actually going to give us access to anything new, okay?

So, people: Relax. And: If you want to join Just For Fun[tm] (like I do), do it.

Re:Not really needed, just for fun

[Stubtify]

I agree its a great cause and I'm running it too, but its not all just for fun.

I know that I wouldn't want to crack open my tivo, void the warranty, load the disk in my PC and change the code and then have to put it all back together.

Finding the code will allow pretty much anyone who has an affected tivo to run the backdoors, not just those uber-tivo users who can handle what is needed from them to change the code.

Or you could just ditch the tivo

[Anonymous Coward]

I mean really, what is tivo doing that you can't do with a modest PC + software? Instead of hacking away at propritary code, you could be spending your time building something better.

Ad-skips

[anonymous cupboard]

There is some controversy about the use of the Tivo to skip advertisements. As you suggest, this gives "plausible deniability" that the feature is readily availble.

Re:Ad-skips

[merlyn]

The code to enable 30-second skips is "select" "play" "select" "3" "0" "select", and does not require the "master back door enable" code referenced by this thread. The "master back door enable" code opens up about two dozen other codes. See the Tivo backdoor page for details.

Re:Is it updated via modem? if so, tap your own li

[Kazymyr]

Yes the updates come by modem (or more recently encoded in some "paid programming" shows on Discovery channel that the TiVo automatically tunes to and records), but that doesn't change anything. The software updates come in "slices" which are encrypted themselves. The TiVo has a hardware crypto chip that is used to decrypt those.

Password cracked... over 30 characters long!

[(H)elix1]

"!seineew era sreenigne VTetamitlU"

I know!

[user no. 590291]

How about making an open solution that isn't subject to feature disablement and removal with every "upgrade" of the software?

Re:Because you're entitled to use your own hardwar

[TarpaKungs]

Indeed.

Now, if the story were about hacking the Tivo to obtain free service without due payment, then I would have said that the crime is in the use of deception to obtain goods or services. Busting the Tivo unit's guts is ancilliary and does not constitute any crime in itself (ignoring the DMCA and whatever equivalent crap we have under UK law [1] ).

I actually have a lot of time for Tivo the company. I don't even have a Tivo. I'm thinking of getting one (and subscribing) because they had a good idea and made (by all accounts) a good product, backing it up with a good service. However, I am still going to rip the lid off the box, after about 6 months, when I feel the unit has burned in and I don't mind voiding the warrenty. They have a rather suspect economic model but that doesn't nullify their achievements.

To be honest, I'm not sure that, even if Tivo opened the spec's to the box, that they would lose much. Tivo hackers are likely to remain a special interest minority. Most people I would wager are happy to have another AV black box on their shelf and pay for the Tivo service without wanting to fiddle with everything because what Tivo offer is exactly what they want.

Best, Timbo

Note [1] : I confess to being largely ignorant of my own coutry's and/or the EU's recent DMCA-like rulings. I am aware that President Blair is selling us down the swanny, but I plan to display total civil disobediance towards anything which in my view is so utterly stupid and ill conceived. Besides, if they bang me up, I might be able to get Lord Archer's autograph. hehe

Re:Because you're entitled to use your own hardwar

[nolife]

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound. Yes, it's your hardware, but rules exist to further a public good--a (relatively) pollution and noise free environment.

First of all, you CAN remove your muffler and drive around at 3AM. You can do anything you want to that car. You just can not drive it on public roads legally after the fact. If you do this in your own property or a place like a track and no one complains about the noise it is 100% perfectly legal. Have you been to a race track on a test and tune night? By the way, removing the muffler does not increase your emissions levels, removing the catylatic convertors does, and yes, you can buy off road pipes (meaning no convertors) from thousands of companies for just about any vehicle.
Modifying a TIVO in no way shape or form bothers my neighbors or is a nuisance to the general public.

the alternative is a world where prices are higher / options are fewer because companies would have to hedge against unauthorized uses.

So when your business has a model that can not make money, the governmant should change the law against the public good (to use your own words) to help you make money? Are you on someones lobbying payroll? Did you ever think that maybe if a company made these hidden options available or added more options that maybe they could sell more units? The consumer would have MORE choices.

the alternative is a world where prices are higher / options are fewer because companies would have to hedge against unauthorized uses.

No, the alternate is where companies compete on the quality and usefulness of thier products. Not trying to squeeze every last penny from a product that is not really exactly what someone may want because a government handout let them keep making it for a profit on it.

All your Tivo

[Anonymous Coward]

are belong to us.

also... the client is a cpu hog! it should only kick in when i'm idle!

almost there already

[hambone_p]

80.67 % done as of Sat, 2 Nov 2002 09:40:00 -0500. From the Linux client's page of Real-time stats.

I'm still curious..

[NoMercy]

The forums come with lil things saying NOTE...No talk of any type of service theft or video extraction is allowed. Well I can agree that service theft is wrong, but video extraction?

Re:Because you're entitled to use your own hardwar

[walt-sjc]

Kinda like a Mounds bar, but more crunchy.

Re:Because you're entitled to use your own hardwar

[zillyorg]

You paid for it, it's yours, and you should be allowed to do whatever you want with it.

Exactly...which is why TiVo should change their business model if they want to keep customers out of their boxes. My cable provider supplies a digital box as part of my monthly fee. They own the box and can easily justify any service agreement clauses keeping me from fiddling with it.

If TiVo really wants to retain control over the hardware, they need to retain ownership of it.

Pointless but fun

[p3d0]

They say repeatedly this is just for fun. They have already found that, if you are willing to put the TiVo disk in your PC, you can patch the binary to use the old backdoor password. If you want to enable backdoors, that's how you do it.

They have already tried most of the 9-character space to no avail, and every additional character makes the search take 37 times longer. And, as was said numerous times, when they find it, TiVo will just change it again and tack on a couple more characters.

Plus, there is no verification of results, so surely someone will cheat a la SETI@Home just to inflate his score by returning a bunch of bogus results, and the results will be invalid. Worse yet, a truly malicious person could return bad results for a whole lot of valid usernames, and it may be impossible to separate the good results from the bad. (I don't know if the server tracks IP addresses, but those can be spoofed too.)

So, this is kind of futile, but it looks like they're having fun. :-)

Re:Because you're entitled to use your own hardwar

[Pepebuho]

I will let the judge answer you.

There has grown up in the minds of certain groups in this country the notion that because a man or a corporation has made a profit out of the public for a number of years , the government and the courts are charged with the duty of guaranteeing such profit in the future, even in the face of changing circumstances and contrary public interest. This strange doctrine is not supported by statute nor common law. Neither individuals nor corporations have any right to come into court and ask that the clock of history be stopped ,or turned back, for their private benefit. ---The Judge in Life-Line

Because

[Psykechan]

The TiVoCommunity Underground is unofficially approved by TiVo (in fact some posters are employees) and they don't want any problems with networks like Turner's or the MPAA.

I mean, TiVo has supported hardware network card hacks with newer versions of their software. Contrast this to other hardware manufacturers and you'll see why we respect TiVo's wishes and don't discuss certain topics.

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

(and no, a corporation itself or a business model do not have rights).

According to the Supreme Court, corporations are entitled to the same freedoms as individuals.

Re:Because you're entitled to use your own hardwar

[grumling]

So don't buy one... Let's see what other choices you have... Replay TV - $300 more (assuming a lifetime Tivo subscription), not easy to find, and the company is being sued. Roxio media machine - cool tech, where can I get one? Oh, I can't because they'd rather wait for cable companies to buy them. Why would a cable company buy this $500-$1000 box, maintain it, warehouse it, and attempt to collect their investment when you take it with you when you move out (and sell it at a flea market for $20).

I tried to roll my own with an ATI all in wonder. It never really worked right - sound being the biggest problem. I couldn't put big fonts on their menu screens, so I had to pick programs on my desktop box using netmeeting remote desktop. Tivo's software works much better. It controls my cable box without any problems, and is much quieter (no PS fans).

If ATI would actually look at what Tivo is doing (and hire some real programers), maybe they could get a useable product. The main advantages they have are price and video capture quality.

Re:Because you're entitled to use your own hardwar

[mumblestheclown]

Modifying a TIVO in no way shape or form bothers my neighbors or is a nuisance to the general public.

False! If modifying the TIVO leads indirectly to buying less software or services or whatever follow-on they are trying to sell is, then your individual actions HAVE outside affects, even if the actions themselves are restricted to your basement.

Now, we can argue whether or not a business model is a public good (I would clarify--I don't believe "a business model" as in "tivo's business model" is a public good, but I do think reasonable restrictions on use of products in order to facilitate innovative business models in general is a good thing / a class of public goods.) That is, I think our society would be worse off if companies could NOT sell hardware as loss leaders, because the sale of hardware as loss leaders has positive externalities of getting people into technical items WHILE remaining a sustainable state in that companies can profit from it)).

Again, we can argue over whether i'm right as far as public good goes all night, but don't try to tell me that people modifying TIVO's at home, in aggregate, has no external effects.

Re:Because you're entitled to use your own hardwar

[Datoyminaytah]

> ...if the story were about hacking the Tivo to obtain free service without due payment...

Actually, that could apply to cases of "hacking" hardware to enable "hidden" features. Maybe not in this specific case, but it's not unheard of to make one set of hardware with a full set of features and only enable each feature as it is paid for.

For instance, you might be able to hack your cable modem to "uncap" its bandwidth limitations, but you can bet you'll have your account cancelled pretty darn soon.

As far as Tivo and Tivo-like devices, I can imagine a time when a "commercial skip" feature is something you would have to pay extra for. The money for it would probably go to advertizers to shut them up about complaining that you aren't forced to watch their commercials. :) Not that I think that's a good idea.

Re:Because you're entitled to use your own hardwar

[spinkham]

Actually, there was a recent law passed that automobile makers have to provide that information to the public. They don't have to give you a free code scanner, just like tivo wouldn't have to give you a lan card or larger hard drive, but they are legally required to give out the diagnositc information you speak of.
Also, if you have an import car like I do, all you need to do the same thing is a paper clip to short out 2 wires, then count some blinkin lights and look up the result in your manual.

2000 yrs of computer time?

[Anonymous Coward]

well, considering that the project clocked 1 yrs worth of cpu time in the last 4 hrs & the rate of increase is still increasing I'd say it won't take long to to see who would have won that bet

--
Riley

Re:Because you're entitled to use your own hardwar

[Datoyminaytah]

I like that quote. Who said this? Who's "The Judge in Life-Line"?

"a good cause"!?!?

[Anonymous Coward]

pitch in some CPU time for a good cause.

Not to sound crabby, but how in the world is this a good cause? Get out of the house and volunteer helping the needy and homeless for fucks sake, its getting colder outside and help is always needed. American Red Cross and the Canadian Red Cross volunteer sites.

If you need an excuse, sure download the clients that crack the TiVo code and leave your system so that its idle time is maxed out and your free to help the homeless and needy...

You're all missing the point

[dprior]

The effort is for fun, really. We've (subuni, anyway) already found ways to take the drive out of your tivo, throw it in your PC, and change the code to a known hash. This is more to say "Hey, cool, we did it."

So take a pill folks. Simmah down!

Re:Because you're entitled to use your own hardwar

[Vilim]

getting into a secret menu on your tivo and pissing off the neighbours with your muscle car are completely different. When you get into the seret menu on your tivo there is nothing to affect anyone else, you are the only one to get hurt since you are the one who just voided your warrenty. If you take the muffler off you mustang you piss of the neighbours and everyone else on your block.

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

I do not expect Tivo to survive. The clueless business model only works if there is no competition.

A couple of years ago in an interview with Ted Koppel, the CEO of TiVo said that they did not want to sell hardware. They only wanted to sell the underlying service.

He also said that when their video format was hacked, they would get out of the hardare business, and just sell their scheduling service.

is that Microsoft Technocracy(tm) XP professional?

[Cid Highwind]

2. Technocracy - Establish a ruling class of technologically savvy people (who rightfully deserve it!) to lead the unwashed masses into a glorious enlightened future.

Isn't this exactly what Microsoft is trying to do, and what most slashdotter are fighting tooth and nail against?

Re:Because you're entitled to use your own hardwar

[Dr. Evil]

Think of stuff like drugs, suicide, fictional pornography, and you'll have lots of laws which can get you arrested for doing things in the privacy of your own home. On the other hand, I like to think that the actions are only criminal if you get caught which means, by definition that you are no longer affecting only yourself.

However... I have a theory about this. As an armchair political theorist, I will make the broad statement that capitalism is anti-democratic. In the eyes of government, the will of the corporation has long outweighed the will of the people.

International government power is found in economic well-being and competativeness. Corporations provide that power and are thus more important than citizens.

So if a corporation says "we can be more competative if you support digital-etcetera laws", the government is compelled to assist them. Why? Because if your country slips in the capitalist system, you loose international power.

From this perspective, the Microsoft case was one where the government was torn between defending the internal free market, and defending a great international economic power. From the microscopic perspective... hurting the corporation could do more damage to domestic jobs than could be recovered by a healthy domestic marketplace. A battle between the tangible and immediate (jobs) and the abstract (healthy internal economy).

So do you use government might to empower Disney, Warner Bros and other domestic corporations? or do you risk loosing those corporations in the interest of personal freedom. That is, do you preserve your healthy and powerful global industry at the cost of individual liberties?

What could the people gain by the government supporting individual liberties?

Re:Because you're entitled to use your own hardwar

[The_Sock]

Chrysler made it even easier. You just have to turn the key to the first position (not starting the car) then to off 5 times (leaving it in the first position on the last one (again, not starting the engine, just one click forward)), and count the blinks of the engine light. 5 blinks then 5 blinks is end of codes and hopefully the only one you get if your car seems to be running fine.

Fords and GMs, you short out a connection and count the blinking lights. That isn't an import only thing.

Also, you don't get all the information possible from those codes. I believe those have always been documented and available in domestic and imports. It's information from when you hook it up to the computer, the extra diagnostic information from there, that was rendered useless when auto companies stopped providing information on what meant what (imports and domestic alike).

Re:Because you're entitled to use your own hardwar

[Genom]

Think of stuff like drugs, suicide, fictional pornography, and you'll have lots of laws which can get you arrested for doing things in the privacy of your own home.

If you commit suicide, you don't get arrested, you get enbalmed (or cremated, I suppose, depending on your wishes).

Unless, of course, you screw up.

Same with drugs, really - unless you're either in public (maiking an ass of yourself), distributing, or get caught while buying, you're pretty much safe doing them in the confines of your own home. It's generally the periphery effects of drugs that get people caught (committing crimes for money with which to buy the drugs, or going into public whilst blasted and doing something equally stupid).

And the password is...

[jo42]

0linux1blows2chunks3x9

Re:And the password is...

[Max Coffee]

"BillGatesIsMyHero"

Easy to guess, but how many of you could actually type it in?

If anyone wants to speed this up

[thogard]

SHA is a stream hash. That means you can do 4 bytes worth, save the state and then cycle through the next 5 bytes much faster. When doing the same thing with md5, you can pre calculate all but the last two bytes and then cycle those real fast.

MD5 uses a table of sine values that it uses. If someone were to make slight changes in thouse tables, then this kind of crack wouldn't work unless the hash as verified. I suspect the same is true for SHA but I haven't looked at that yet.

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

According to the Supreme Court, corporations are entitled to the same freedoms as individuals.

That's b/c the Supreme Court is a bunch of fucktards.

Re:Because you're entitled to use your own hardwar

[nolife]

but don't try to tell me that people modifying TIVO's at home, in aggregate, has no external effects.

Can you specify an effect this would have and it be DIRECTLY relate to my modifying my TIVO?

Did you ever read the side of a Kraft Macaroni and Cheese box (or any food product instructions)? It says to mix in 1/4 of Parkay Margerine. The fact that I used store brand margerine and not Parkay will result in about the same effect I think you are refering to. I am sure that Kraft Foods would make more money if people only used Parkay and Starkist Tuna with thier M&C. Does that make it WRONG for me to use something else? Does thier business model rely on me to use it? Are they selling the M&C at a loss so the butter can even it out? Should there be a law that only allows me to use what they say on the box? Would everyone be better off as consumers if ALL products had this legal requirement and we were forced into following them? I don't think soooo..

What happens when a TIVO competitor comes around and has a completely open system that allows you to do anything you want with it? Should they be legally banned so TIVO can stay afloat? If this other competitor does make it and TIVO fails would you know why? Because they gave the consumer what they wanted and they bought it!

Re:Because you're entitled to use your own hardwar

[tswinzig]

Nobody succeeds with a razor and blades business model (the Tivo subscription) when there is a cheaper option flat fee.

1. Who's this competition giving away the service for free? I hope you don't mean ReplayTV, where the cost is built-in up-front, do you? (Likewise, you can get a TiVo with lifetime service for about the same as the ReplayTV of similar stature.)

2. You are assuming all things are equal. If the service is better, people may pay more for it. Consider the Mach3 razorblades -- far more expensive than the other brands, and far more popular! Why is that? Because the perceived quality is higher and people are willing to pay for it.

But every time we have a Tivo story the Tivo heads rush in to explain why everyone should pay twice the going rate for the technology.

Honestly, what the fuck are you talking about?

There is an interesting port on the back of my DishPlayer PVR, anyone know what it does?

I'm not familiar with the DP PVR, but if it was as popular as TiVo, you'd probably already know what that port does.

This is a good idea!

[EverStoned]

There is a big community of people using TiVo that would love to have accsess to these features, and this is a great way to use this idea of community to solve a problem. Distributed computing is such a great idea, and I'm glad too see it being used for more practical reasons.

Re:Because you're entitled to use your own hardwar

[TarpaKungs]

That's a good point. IBM (I think? I forget...) still sell Big Iron mainframes where you can pay for 1 CPU, but there are actully the full number of CPU's fitted. When you upgrade, the field engineer wanders along and enables the extra CPU's.

Now - is it reasonable to hack the box and turn on all the fitted CPUs when I paid for one?

No company would, because pop goes your maintenance contract. If I were fortunate enough to aquire such a machine, say it's being thrown out in 5 years time (take it as read I don't require a maintenance contract) - I would feel no obligation to IBM or whoever and I wouldn't have an ethical problem in enabling every feature/CPU/device on the machine. I don't really think the manufacturer would care much either.

To go back to yet another car analogy: I buy a big engined car - it probably has a computer controlled engine. Given the big engine being very understressed for the car, I could chip it for a fair bit extra power without really causing any problems (warrenty now void - I don't expect them to help me out if I blow the motor).

Now consider: the manufacturer decides to save money by using the same engine in several models of car (puts 3 litre engine in models that would have spanned 2.5-3l previously) - but they performance limit the cheaper models in the engine controller's code. So far, so good. Now suppose for much cheapness, they have all the code tables for every model in the ROM but store a model selector byte in NVRAM, setting it at the factory.

Someone finds out how to reset the code and turn the cheaper 2.5l "performance equivalent" model into the full powered 3l version. So what's the difference between that and me chipping an understressed big engine? It's just cheapness (and negligence if they actually care) on their part.

The manufacturer made my life easy by giving me the mod chip up front. I do rather feel the onus is on them not to hand it to me on a plate.

You raise an excellent point concerning cable modems. What you describe used to be possible with ADSL in the UK until recently. The main difference being, I presume that your cable co own the modem and rent it to you - so you don't own the kit. That's a clearer case. Not your box, so you definately don't have the right to fiddle with it. Even so, it's still fairly stupid of them not to throttle your bandwith at the other end.

Best, Timbo

Has anyone tried...

[sweet 'n sour]

Has anyone tried AbiWord's password?

Out of curiosity, why not disassemble the code?

[John Jorsett]

I'm not knowledgeable in these areas so perhaps this is off-base, but wouldn't it be possible to disassemble the code that accepts the password and patch it to just accept whatever you enter? That seems like a more fruitful line of attack than attempting to brute-force a password of unknown character set, unknown length, and unknown encoding.

Re:Out of curiosity, why not disassemble the code?

[TarpaKungs]

Hi John,

Having been running the cracker client all day, it appears two things are limited:

The character set involved is just: ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789

I presume that limited by what you can enter via the Tivo remote (I don't actually have a Tivo).

The experts seem to be pretty sure they are dealing with a SHA1 hash. I'll shut up now as I'm not a crypto expert. The one thing I will say is the character set is *very* limited and favours a brute force attack.

It could be doomed if Tivo used a long string like 20 characters because every extra character requires 37 times as much effort to permute all combinations as was previously required.

It's taking and estimated 3 days to cover the len=9 passwords. So 100-odd days will be needed for the len=10 case.[1][2]

But there will be a limit to the length of the string - the Tivo engineers have to type the bl**dy thing in so I find it hard to believe it's as long as it is.

You might also think that patching the code is viable - I believe you can do that. However I did see some mutterings on a webgroup that Series 2 Tivos are key-signing parts of the system to prevent tampering (so the next job for someone will be hacking the firmware :-)

Best, Timbo

Note: [1] - Assuming no short cuts are used in the scan. Seems pretty linear looking at the logs on my machine.

Note: [2] - Of course, the computing pool is growing steadily.

Re:Out of curiosity, why not disassemble the code?

[John Jorsett]

Interesting, and thanks for the info. One thing I keep hoping to hear is that some effort has started to just replace all of the Tivo code with a user-written open-source version containing all the spiffy features that people have been wanting. Don't know how likely that is, but it makes a good fantasy.

Re:Out of curiosity, why not disassemble the code?

[Kevinv]

one thing that has already been done is to substitute the old 3.0 code SHA1 into the comparison string of the password checking routine.

this works (which means the alg. hasn't changed from 3.0).

your route would work also.

however there isn't currently a known way to get to a BASH shell (or any shell) on the series 2 (which is the only model with 3.2 code to date). This means chaning the routines or the hash codes invovles dismounting the hd, mounting into another system, hand editing (until a patch is developed) the drive, then mounting back in the tivo.

kind of sucky thing to have to do to get the backdoors enabled -- which don't really hide that much functionality (all the shortcuts i use such as 30 second jump and the time code and the now playing sort order changes are available without backdoors)

kevin

Re:Because you're entitled to use your own hardwar

[Enigma2175]

You raise an excellent point concerning cable modems. What you describe used to be possible with ADSL in the UK until recently. The main difference being, I presume that your cable co own the modem and rent it to you - so you don't own the kit. That's a clearer case. Not your box, so you definately don't have the right to fiddle with it. Even so, it's still fairly stupid of them not to throttle your bandwith at the other end.

Actually, many of the cable services in the US allow/require that you buy your own cable modem. However, it still is not legal to change your quality of service with it. If you want to set up your own headend, feel free to uncap your modem all you want, but if you are using the cable company's headend then upcapping your modem is theft of service and is a criminal act.

Re:Because you're entitled to use your own hardwar

[Mike Schiraldi]

So when Gilette sells razors at a loss, and i buy them, use them to decorate my walls, and never buy the razor blades, i am doing something that should be illegal?

How about when the Wright brothers used popsicle sticks to make an airplane, instead of using them to make popsicles, as the manufacturer originally intended?

Re:Because you're entitled to use your own hardwar

[Zeinfeld]

1. Who's this competition giving away the service for free? I hope you don't mean ReplayTV, where the cost is built-in up-front, do you? (Likewise, you can get a TiVo with lifetime service for about the same as the ReplayTV of similar stature.)

I pay no more for my dishplayer satelite subscription than for either the same subscription without the PVR or for the local cable. In fzct I pay less than the cable charges. The dishplayer unit was free.

PVRs will be a commodity item in a couple of years costing no more than $250-$400 all in with no subscription.

2. You are assuming all things are equal. If the service is better, people may pay more for it. Consider the Mach3 razorblades -- far more expensive than the other brands, and far more popular!

Tivo are reselling TV timetable information which costs them nothing at $10+ per month. The dishplayer reads the satelite program guide.

The only possible leverage that Tivo has in this market is to patent the blatantly obvious and try to bully competition out of the market. That is the type of behaviour that is generally objected to on Slashdot. Tivo is an exception, Apple tends to be the other exception.

Tivo will be deservedly roadkill when the XBox II and Playstation III come on the market offering PVR technology with no strings attached.

truly open source TiVo alternatives

[xerofud]

This is why I sent back the Tivo I ordered (it was Series 2 which to my knowledge has never been successfully hacked ... yet). I don't want to be constantly locked out of my machine when some corporation decides to tighten the screws again by a forced software upgrade. In some sense, TiVo is worse than Microsoft, even though they nominally "support" open source by using Linux. With Windows, I choose when to install the Service Pack update ... at least thus far :)

Instead I bought a Pentium IV 2.4, Asus P4PE, 512 333 MB DDR, Leadtek A250 GF4 Ti4200 (which has a Conexant HDTV-capable video out ... don't buy a card with the lower quality VIVO Phillips chip) and a ATI TV-Wonder capture card. Grabbed two old 10Gig drives from another machine and I had something that cost me nothing more than the Series 2 TiVo.

What software will I run? Well, right now I'm leaning heavily toward MythTV. With this I will eventually be able to surf the web, check email, play games, as well as schedule programs and skip through commercials in TV broadcasts. A few bucks and an afternoon of tinkering will also hopefully allow me to control the channel switching on the digital cable box from the computer's infra-red port.

There is also Freevo, which I may consider looking at if I don't like MythTV, although the activity on the mailing lists indicate that this system is already quite functional for many users.

Hope this is useful to anyone out there still sitting on the fence. I reached my decision after several hours of research on the web. I hope I don't regret it!

Re:truly open source TiVo alternatives

[/dev/trash]

Freevo doesn't do recording, at least not yet.

Re:Because you're entitled to use your own hardwar

[slashhot]

Actually, many of the cable services in the US allow/require that you buy your own cable modem. However, it still is not legal to change your quality of service with it. If you want to set up your own headend, feel free to uncap your modem all you want, but if you are using the cable company's headend then upcapping your modem is theft of service and is a criminal act.

It may very well be true, but it doesn't change tha facyt that it's still absurd. It would be like a cable TV company selling you the basic service while sending all the channels to your house by simply not tuning the premium channels, and then suing you because you grabbed your TV remote and tuned them yourself. Plain stupid. The DOCSIS standard should have defined company side capping. Period.

Re:Because you're entitled to use your own hardwar

[DonGar]

You can buy a tivo, and do anything you want to hardware wise. Mine is modified to add extra disk space. Tivo even goes to some (minimal) effort to keep that reasonably simple to do.

This is legal.

You can replace the software. They have made it difficult to do, but if you wipe everything (ROM and Drive) then start over, it works fine. And they don't really try to stop you. A reasonably standard flavor of linux runs on the box. Most of the hardware drivers (other than video in/out) are stock, or close enough.

This is legal.

If you try to modify the software they ship, they try to stop you. I consider that different. I'm not exactly sure if it's right, but it is a somewhat different.

I do happen to know that a significant portion of their motivation is this. They are convinced that if people find ways to record with a tivo, then extract a raw digital copy of the content then tivo (the company) will:

1) be sued out of existance (bogus reasons or not)
2) loose the right to make DirecTV receivers

They are probably right on both counts.

They are also trying to prevent people from getting the benefits of service without paying for it. I support them, when it comes to people taking advantage of the service tivo provides (copying guide data from one tivo to another, etc).

I don't particularly when it comes to people providing their own service information with no support from Tivo. As far as I'm concerned, falls under the category of "I paid for the box, it's mine".

Just use mythTV instead

[linuxguy]

At the current rate of development mythTV http://mythtv.org/ will be a better Tivo soon.

Re:Because you're entitled to use your own hardwar

[TarpaKungs]

Hmm - getting you to buy your own modem then asking you to regulate yourself is a tad daft.

Compare to getting electricity into your house. The Electricity Board own the meter and it's sealed. Ergo - no fiddling.

Imagine if they told you to buy your own meter, program it right, install it and don't lie about the overnight discounted hours - everyone would laugh. I'm not even sure they would get very far with a prosecution - not because it isn't wrong and against your contact not to fiddle your lekky meter - but because the company had been so utterly stupid in their approach.

Re:is that Microsoft Technocracy(tm) XP profession

[Jaeger]

2. Technocracy - Establish a ruling class of technologically savvy people (who rightfully deserve it!) to lead the unwashed masses into a glorious enlightened future.

Isn't this exactly what Microsoft is trying to do, and what most slashdotter are fighting tooth and nail against?

No -- Microsoft got the "Establish a ruling class of technologically savvy people" but scrapped the "who rightfully deserve it!" clause.

That said, I'm in favor of the deal, as long as one's Slashdot id directly determines one's status in the new world order -- the lower the better.

Re:Because you're entitled to use your own hardwar

[Ost99]

All well and good, but hell will freeze over before you get a XboX II to act as a PVR with no strings attached.

- Ost

Re:Because you're entitled to use your own hardwar

[Dynedain]

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound. Yes, it's your hardware, but rules exist to further a public good--a (relatively) pollution and noise free environment.

Your analogy is flawed. In this case you are talking about modifying your personal property to do something forbidden by law.

In the case of the tivo its like a VCR. The only things you can't do with something you've videotaped on your VCR is sell it or publicly display/broadcast it without permission of the copyright holder.

A better analogy with the Mustang, is if you weren't allowed to chip it, replace the exhaust system, the spark plugs, lower it, replace the spoiler, add neon lights, NOS, and everything else that rice rockets do.

The 'chipping it' option is even more appropriate. The tivo ships with options that are disabled by a password. The Mustang ships with more horsepower and torque but is 'disabled' by a computer chip. Replacing that chip to give yourself more HP is not illegal (even though it does void the warranty). So why can't someone find the password to give them the features already in the hardware?

Re:Because you're entitled to use your own hardwar

[Malcontent]

"unless you're either in public (maiking an ass of yourself), distributing, or get caught while buying, you're pretty much safe doing them in the confines of your own home."

This is an interesting point. Most young people do not do drugs at home for fear of being caught by their parents. Therefore they go outside and do drugs or drink.

Now if you are white suburburnite middle class kid you drive daddy's car into the "woods" with your friends and drink, do drugs and fuck your girlfriend pretty confident the you won't ever see a cop in the middle of the night way out there. Same situation if you live in rural farm country or in the west.

If on the other hand you are an inner city kid who is poor (ie black and hispanic) then all you can do is try to drink or do drugs in some alley. As an added bonus you live in well lighted areas that are heavily patrolled by cops especially at night. Your chances of getting caught are much much higher.

This is why there is a HUGE discrepency between the number of whites and black felons.

Backdoor features not worth it.

[Anonymous Coward]

I agree that it would be fun to crask whatever codes they used to lock down the TiVo, but is it really worth it. Sure, you can hack on whatever devices/network stuff you want onto the TiVo PVR, but if the company isn't going to support what you want to do and keeps charging you a service charge, why would you want to do that?

I think that Microsoft is taking the right approach here, and selling Software which makes it easy to do what you want (record, skip, rip, burn-DVD, etc). Of course, I could do that with my Matrox G400 4 years ago, or with an ATI All-In-1-der... But Microsoft added a remote control, and a $1500 price tag. So did Sony by the way...

So why is the TiVo so controversial, except that they are trying to get a revenue stream for charging you as a service to use the hardware you bought.

A service is something which a company provides, a product is something which once sold becomes the property of the client. The TiVo box is in that grey area. I think what people are claiming is that they feel that the TiVo should be a product like Windows Media Center based PCs coming out soon from HP and others. I'm waiting for MS to simply release an XBox/Media Center Edition, with some XBox/MCE APIs for developers. Of course, if they did, it wouldn't be sold at a loss, and it would probably go for $800. But I think it would be a giant step forward in the set top box market. That's a product I would buy, until then, that good ole Matrox G400 has significantly better quality recording than your TiVo, and I can script my second CPU time to encode the media from Motion-JPEG with CD Quality sound to DivX or WMV and burn to CD-RWs.

The point is that the technology has been available for a few years, and now you can do so much more. $250 buys you 200GB of HD storage today... You can get a spindle of 50 DVD-RWs for $50. Of course, software is always the bottleneck. With the new MS and Sony software, it makes this really easy for Joe Sixpack to do, and you don't need to buy a service. Just shell out $1500 + $50 for your 50 DVD-RWs, and keep on burning.

-Mike "Eagerly waiting the nonexistant XBOX/MCE for $500 in 3 years"

Re:Because you're entitled to use your own hardwar

[Phroggy]

Nobody succeeds with a razor and blades business model

Um, Gillette seems to be doing fine...

Re:Because you're entitled to use your own hardwar

[BitterOak]

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound.

You cannot drive it around in public places without its muffler, but if you owned a huge estate with its own network of roads, and it was large enough that the sound wouldn't reach your neighbors, you are not only allowed to drive without the muffler, but also without license plates, driver's license, insurance, registration, or serial numbers!

This is an argument frequently put forth by the anti-gun lobby: you have to license cars and drivers, why not guns and gun owners? The difference is that in the former case you are licensing the right to use the vehicle in a public road you share with others, whose safety depends on your ability to use it correctly, whereas the latter would be required even for ownership in your private home.

I think an analogy exists with consumer electronic hardware as well. As long as you are not entering or affecting a public space or other persons, shouldn't your hardware be yours to do with as you wish?

Re:is that Microsoft Technocracy(tm) XP profession

[Anonymous Coward]

yeah because you're technical ability is directly proportional to how early you decided to start reading slashdot.

Re:Because you're entitled to use your own hardwar

[Eslyjah]

In the eyes of government, the will of the corporation has long outweighed the will of the people.

This is stupid (sorry for being blunt). A corporation is a group of people.

Does it need to be a good cause?

[sllim]

Distributed computing projects must meet 3 criteria:

1. Non-Profit or I get a piece of the action. Seti@home is non-profit, I get a free gig from easynews for every 15 days I run the UD client screening for Cancer drugs. They both pass this test.

2. Tight well written prefferably small secure code. If a DC client crashes my machine once it is out the door. I hate to be overly sensitive to such issues, but if the programmers tried to keep things small they will have less problems.

3. Must get the hell out of my way without my interferance when I want to do things. I don't want to have to close it when I want to play video games. I know that this seems like a stupid thing to want, but consider what this is saying about how well written the code is?

Now once you give me a client that passes all three of these criteria then who cares if it is a good cause or not?

I mean stuff the drug companies want you to do have good cause written all over them, but why do I want to pay for there bandwith, there processor time and there upkeep if they are not willing to send a little something-something my way?

I don't know if this DC Tivo thing meets #2 and #3 yet. But it definetly passes #1 with flying colors.
And if you consider that all the people that take part in it are probably Tivo-geeks from the Tivo Community that want access to this code anyways, then who cares?

This is like the Seti thing. Are they gonna find Space Aliens? No. But the project itself, them bringing the DC format to the forfront of the networking world and what it could bring with it in the future is too exciting a prospect to pass up.

I encorage DC apps. I find it a fascinating feild. Let the Tivo-geeks have there fun.

Besides.... and I know you won't believe this. Tivo doesn't really mind. These particular geeks are a huge faction of the Tivo population. Tivo kinda has a hands off policy with them anyways.

Re:Because you're entitled to use your own hardwar

[Zeinfeld]

Nobody succeeds with a razor and blades business model

Um, Gillette seems to be doing fine...

Hmm, looks rather different when you read what I actually wrote rather than the deliberately out of context quotation:

Nobody succeeds with a razor and blades business model (the Tivo subscription) when there is a cheaper option flat fee.

Re:is that Microsoft Technocracy(tm) XP profession

[jafac]

That said, I'm in favor of the deal, as long as one's Slashdot id directly determines one's status in the new world order -- the lower the better.

I'm all for that - said I, with #1449 :)

Re:Because you're entitled to use your own hardwar

[LarsG]

hell I can strap a rocket on the back if it pleases me.

Only if you want to become a Darwin Award myth. ;-D

Re:Because you're entitled to use your own hardwar

[Lumpy]

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound. Yes, it's your hardware, but rules exist to further a public good--a (relatively) pollution and noise free environment.

I sure the hell can. If I live in a rural area, nobody cares about sound except for me and I can happily drive without a muffler. In fact it is 100% LEGAL in michigan to drive on interstates without a muffler. (Old law, still on the books) Just because YOU dont like it and it's illegal to make excessive noise (Why cant my car make 100 DB of noise yet these damned HARLEY drivers can?) in some areas does NOT make it a smart thing for the car manufacturers to weld a pan on the bottom of the car to keep people from doing it.

It's the same as welding the car hood shut... It's not ethical to do it... I dont care what your reasoning for it, it's MY PROPERTY, and I have the right to do with it what I please.

Re:Because you're entitled to use your own hardwar

[JoeBuck]

Bad analogy. The proper analogy would be if your Mustang came with the hood locked shut, so that only Ford dealers could service your car.

not anymore

[Kevinv]

that was for an 8 character password. the stats are now for an 9 character password.

48% complete

Re:Because you're entitled to use your own hardwar

[ralphus]

You cannot buy a 2003 ford mustang, remove the muffler, and drive around at 3am generating 100db of sound. Yes, it's your hardware, but rules exist to further a public good--a (relatively) pollution and noise free environment

umm, yes you can. it is illegal, but you can and you won't very likely be caught. Take it from one who has always had performance enhancing exhaust (n0t ricer fart pipes) on multiple cars and motorcycles. The louder pipes very often even come in below state emission (if not noise) standars. Very few places are strict about noise requirements on exhaust. It's quite a nice feeling to leave a wake of car alarms behind you as you drive your Ducati down the street at 3000 RPM's!

MOD PARENT UP INSIGHTFUL

[Anonymous Coward]

Pal 0wnz teh NSTC

Use distributed.net

[bbtom]

Why not try and get the distributed.net lot on your side? They are a bit short on encryption-related projects at moment. It would make a nice distraction before getting on with RC-5/72...

Re:Use distributed.net

[numark]

Distributed.net doesn't add new projects for free. Plus, this is just a fun little experiment, not some full-blown, large-scale project that will have some big impact on the world. It's just a neat hack that proves that distributed computing can work without Distributed.net, Stanford, or SETI. That's pretty neat, in my opinion.

Backdoor password found

[Anonymous Coward]

It was just ROT13ed.

PBJOBLARNY

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

Tivo are reselling TV timetable information which costs them nothing at $10+ per month. The dishplayer reads the satelite program guide.

Did you stop to consider that Tivo is reselling something other than just timetable information? As a Tivohead I must admit I can't remember the last time I said "Wow, I love my Tivo because it has timetable information!"

Tivo sells software. People pay for because it rocks. You're pissed because you didn't think of it and your too proud at this point to admit you could be wrong.

And just for the record, my DirecTivo gets it's guide data from the satelite, too. Not that you'd want to let pesky facts get in the way of your strongly held beliefs.

If Tivo has half a brain...

[rocca]

...and doesn't want people to be able to get the backdoor through brute-force then it's very easy to prevent backdoor attempts. After 3 incorrect attempts, require the correct password to be typed in 3 times in a row correctly (while giving the same access denied message the first 2 times) with 5 minute intervals between attempts required. Tada, brute-force rendered useless.

Re:If Tivo has half a brain...

[TarpaKungs]

Erm - I don't think they have 3090+ distributed computers wired up to one Tivo relentlessly trying to pummel it's backdoor.

What they done is rip the disk out, copied the raw hash off (which is: 96F8B204FD99534759A6C11A181EEDDFEB2DF1D4) are sending that out to the crack pool of computers.

They took their Tivo to bits so that you don't have to (maybe).

Decrypt that easy to get stuff... why not replace?

[aaron_pet]

Why can't we modify their software... and just jump over that bad code blocking? or update it with our own software...

I guess that the usable code is encyrpted? and needs to be decompressed with that that key? or... is it just the normal function branch to that software?

and btw, I feel realy stupid for saying why not just listen to it over the telephone line...

A positive /. effect for a change.

[Bob Bitchen]

I've gotten so used to going to many sites and realizing that it's been horribly /.'d but the site posting the linux client for this distributed crack is showing a large increase in activity and I have no doubt it's the positive slashdot effect. Look at this link http://www.blisstonia.com/dtc/stats.php and notice that anonymous is in the lead now. When I first looked at this page when this slashdot article appeared stansimmons was leading and the total was around 35%. Cool!!!

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

Well, actually, once a corporation is incorporated, it's a legal entity separate to its' owners. But, I think the main problem is that corporations have disproportionate power when compared to a similarly sized group of people. If ten people said "we want law X to be enacted", they would have no chance. But ten people who happen to be the owners or directors of a powerful corporation can pretty much influence government in any way they like.

Re:Because you're entitled to use your own hardwar

[cylcyl]

Huh? Ford is NOT happy to supply info about its design because you might be a competing designer. It supplies it in limited amount to mechanics, at a fee paid by the mechanics. Mechanics may have to get NDA if sensitive info is given

Maybe you can get the info if you're an authorized Tivo repairman or if you pay enough for it, like the amount of Tivo R&D for all their work so far, or just buy their company. I don't have that in my back pocket, do you? If you do, then you have the right to give it away

Re:Because you're entitled to use your own hardwar

[Zeinfeld]

Tivo sells software. People pay for because it rocks. i>

No, Tivo rents software at grossly inflated prices.

You're pissed because you didn't think of it and your too proud at this point to admit you could be wrong.

Actually the idea of the video recorder that thinks for itself is one of the things that Nicky Negroponte and Co have been talking about for years - long before Tivo existed or filed any patents.

As for intellectual jealosy, wait until Tivo has as many users as the stuff I have designed. I don't think that is likely to happen any time soon. Tivio is nothing more than incremental engineering improvement made possible by advances in disk drive technology and hardware compression. I don't do that stuff, I rarely work on a problem until after it has been called impossible.

Oh and from a business perspective, the company I helped build makes more money each year than Tivo has lost in its entire history (which is a lot).

This is offtopic!

[Anonymous Coward]

Please mod parent down as offtopic, sinse there's no ME TOO! moderation available...

Re:Because you're entitled to use your own hardwar

[Eslyjah]

In your scenario, the ten people represent hundreds of thousands of other people. Why is wrong for them to have more influence than ten guys off the street?

Re:Because you're entitled to use your own hardwar

[Anonymous Coward]

No, Tivo rents software at grossly inflated prices.

Well, we have a nice system to decide what's grossly inflated and what's not. People who think it's grossly inflated, don't buy it. People who are willing to shell out the money, do. But for me $250 bucks for a lifetime was worth it. And while $250 is not free which could pass for "grossly inflated" on slashdot, I disagree.

Actually the idea of the video recorder that thinks for itself is one of the things that Nicky Negroponte and Co have been talking about for years - long before Tivo existed or filed any patents.

Thinking about, eh? That helps me record and watch tv when I feel like it.

And did they file patents on the idea of Tivo, or the technology they developed along the way to make it work?

Tivio is nothing more than incremental engineering improvement made possible by advances in disk drive technology and hardware compression.

Very true. But they made a rock solid product that people use and love. Gee, maybe your right, I don't know what those Tivo people were thinking!

I don't do that stuff, I rarely work on a problem until after it has been called impossible.

I fail to see how this helps me watch more tv.

Oh and from a business perspective, the company I helped build makes more money each year than Tivo has lost in its entire history (which is a lot).

Great! Sounds like your in a good position to take over the PRV world. Please do so, and the instant you make a product that is better and cheaper than Tivo, I'll be the first to buy one!

Combination

[robpoe]

A A President "No!! Ok .. I'll tell you the combination!! 1"
Lackey#1: ONE!
Lackey#3: writes down 1
A A President: 2
Lackey#1: TWO!
Lackey#3: writes down 2
A A President: 3
Lackey#1: THREE!
Lackey#3: writes down 3
A A President: 4
Lackey#1: FOUR!
Lackey#3: writes down 4
A A President: 5
Lackey#1: FIVE!
Lackey#3: writes down 5
Lackey#1: so the combination is 1.2.3.4.5.
A A President: ... yes...
Lackey#3: 12345? That's the kind of thing an idiot would have on his luggage.

osx, openssl fun

[otis wildflower]

FWIW, you can compile a local version of openssl (0.9.6g), install it (in /usr/local/ssl for example) and link dclient to it.. On my OS X 10.2.1 powerbook G4/667x512MB:

(stock 10.2.1)

OpenSSL 0.9.6e 30 Jul 2002
built on: Fri Aug 9 18:28:26 PDT 2002
options:bn(32,32) md2(int) rc4(ptr,int) des(idx,cisc,4,long) idea(int) blowfish(idx)
compiler: cc -arch i386 -arch ppc -g -Os -pipe -Wno-precomp -arch i386 -arch ppc -pipe
The 'numbers' are in 1000s of bytes per second processed.
type 8 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
sha1 3489.64k 19276.59k 40169.09k 56751.46k 62737.07k
sign verify sign/s verify/s
rsa 512 bits 0.0039s 0.0004s 258.8 2652.5
rsa 1024 bits 0.0225s 0.0012s 44.4 813.9
rsa 2048 bits 0.1533s 0.0049s 6.5 204.7
rsa 4096 bits 0.9867s 0.0166s 1.0 60.4
sign verify sign/s verify/s
dsa 512 bits 0.0038s 0.0044s 263.0 228.4
dsa 1024 bits 0.0117s 0.0154s 85.8 65.1



(src built openssl, with gcc compiler options)

OpenSSL 0.9.6g [engine] 9 Aug 2002
built on: Sun Nov 3 14:06:20 EST 2002
options:bn(64,32) md2(int) rc4(ptr,char) des(idx,cisc,16,long) idea(int) blowfish(ptr)
compiler: cc -fPIC -DTHREADS -D_REENTRANT -D_REENTRANT -faltivec -mcpu=7450 -mtune=7450 -O3 -D_DARWIN -DB_ENDIAN -fno-common
The 'numbers' are in 1000s of bytes per second processed.
type 8 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
sha1 5558.21k 26157.03k 47202.04k 59470.77k 64123.09k
sign verify sign/s verify/s
rsa 512 bits 0.0034s 0.0003s 297.1 3215.2
rsa 1024 bits 0.0186s 0.0010s 53.8 1002.5
rsa 2048 bits 0.1171s 0.0034s 8.5 294.1
rsa 4096 bits 0.8015s 0.0123s 1.2 81.1
sign verify sign/s verify/s
dsa 512 bits 0.0031s 0.0038s 322.1 263.6
dsa 1024 bits 0.0098s 0.0120s 102.5 83.3


Isn't a whole lot, but it's free..

ps: to compile openssl on osx: get the source, rename /usr/lib/libssl.0.9.dylib and /usr/lib/libcrypto.0.9.dylib to something else, build the openssl-engine tarball, install, compile dclient with -L/usr/local/ssl, rename system libraries back.

Re:Because you're entitled to use your own hardwar

[photon317]

Anybody can order tech specs from Ford or GM for their cars. It may not be detailed enough to help you compete with them, but it's plenty detailed enough to do extensive repairs and modifications.

Re:Because you're entitled to use your own hardwar

[Dr. Evil]

The corporation is required to act in the best interest of the shareholders, not the best interest of the employees.

Votes by shareholders are not one-person, one-vote.

Re:Decrypt that easy to get stuff... why not repla

[sacherjj]

This has been done. Someone at the TivoCommunity forum has replaced the hash we are trying to solve with a known hash. Then entering the code with enable back doors. What we are trying to do is find the correct code, so Joe User doesn't have to pull out his drive from the TiVo and hack around just to get back doors.

Last Post!

[alpg]

I forgot to mention an important fact in the 1.3.67 announcement. In order to
get a fully working kernel, you have to follow the steps below:
- Walk around your computer widdershins 3 times, chanting "Linus is
overworked, and he makes lousy patches, but we love him anyway". Get
your spuouse to do this too for extra effect. Children are optional.
- Apply the patch included in this mail
- Call your system "Super-67", and don't forget to unapply the patch
before you later applying the official 1.3.68 patch.
- reboot
-- Linus Torvalds, announcing another kernel patch

- this post brought to you by the Automated Last Post Generator...