Slashdot Mirror
Open Source DRM
Clyde writes "The different worlds of DRM and Open Source have come together under OGG-S, a project that just recently went to beta with their Open Source DRM toolkit. The project license in GPL and uses OpenSSL for its encryption engine. It will be interesting to see if this project helps to spread the acceptance of Ogg Vorbis."
Tell me, Open Source DRM: is it a Good Thing or a Bad Thing?
How could you prevent people from modifying the library to let them use other people's keys? What would stop people from pirating the keys at easily as the music?
Open Source DRM is an obvious ploy by the Illuminati to spread "acceptible" DRM to the resistant open source community. Once they have us eating out of their palms their world domination plan will advance another great step forward.
Where's my tin foil hat?
Trolling is a art,
I can already see thousands of rabid open source fanatics imitating Gollum over this...
"It isss OGG, so it isss good! Yes!"
"Nooo! DRM! Hateful it is!"
etc.
by limiting other people's freedom and trying to create an artificial scarcity in one of the very few areas of our lives where we live in a world of plenty.
And on top of that they try to create good emotions for their products by basing it on other people's work and calling it "open source". The only catch is that you have to pay them to distribute binaries?! WTF? Neither openssl nor ogg nor vorbis require this, why do they?
This smells very bad to me.
Is it safe to say that these people are in no way associated with the Ogg/Vorbis people? I can't see how this is a good thing. The whole point of Ogg formats is that they're open and free. Do we really want a version of Ogg/Vorbis that is saddled by use restrictions?
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
but doubtful. It would seem to me that any DRM where the source is available would be easily hacked. Maybe I'm wrong.
What is to keep me from going into the source and changing:
if(hasRights) {
decryptMusic;
}
to:
if(true) {
decryptMusic;
}
It will be interesting to see if this project helps to spread the acceptance of Ogg Vorbis
Yeah, WE SLASHBOTS LIKE DRM NOW.
Because it's in ogg.
Psst. It doesnt matter if it's open source, it still makes it harder to steal your n'sync songs.
royalty ridden mp3 or drm ogg ... ... probably ogg since mp3 will probably be getting drm ...
as if a million slashdotters all cried out at once.
I predict a cockfight between the people that actually endorse open source and those that just don't want to pay for anything. I would love to be proved wrong, though.
... now DRM will be good, now there is open implementations of it?
The only way to prevent this is for users to boycott Digital Restrictions Management technologies. As such, anything which makes it easier for DRM technologies to integrate with any software is a bad thing.
This project may comply to the letter of Open Source, but it entirely contradicts the spirit of open technology.
part of the appeal of Ogg was because it didn't have DRM?
What's stopping someone from modifying the source so as to have access to a given *.oggs's DRM settings? Either we or they are overlooking something...
Who doesn't like free music?
According to the linked page,
Please note that OGG-S is neither affiliated with nor endorsed by Xiph.org or Ogg Vorbis.
Don't expect this to become anything big any time soon.
Orange
Open Source DRM - isn't that like the ultimate digital oxymoron?
Do it yourself rape!
Breaking your leg for dummies!
<really fast>Only $29.95</reallyfast>
So close and yet so far from the world's perfect ID number
Right at the bottom of the page: "Please note that OGG-S is neither affiliated with nor endorsed by Xiph.org or Ogg Vorbis."
It's funny how these folks claim to care for people's fair-use rights (see the FAQ on their site). Protect fair use rights by establishing obstacles to fair use? Riiight.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
To bad openSSL has a license that is incompatible with the GNU GPL. While an exception can be made by them, I would be wary of their legal knowledge. I would think you would want to have a particularly competent legal staff to pull off a product like this.
If OGG-S is open source, how can the encryption be secure?
If a company wishes to use OGG-S to protect their content, SideSpace Solutions highly recommends purchasing a binary distribution license. Under this license, any modifications to OGG-S (such as a change of encryption engine or private keys) do not have to be released.
Know the truth: There is no such thing as a remote trusted computer. Encryption has nothing to with DRM.
I'm hopefully... but doubtful also.
Forget the whales - save the babies.
One of the main reasons corporates seem ready to trust DRM is that the software that can decrypt the DRMd media is relatively immutable..
If one were to release a new single using an open sourced DRM technology, there is simply no reason to believe that the software is "acting in good faith" according to the general idea of DRM.. One could easily adapt such an open-source DRM player so that instead of playing the file, it does something else with the decrypted data. Such as saving it to an un-encrypted version off the ogg file.
Such a file could then easily be put on your favourite peer-to-peer network.. And once one or two people have it, that's it. That one un-encrypted instance can get anywhere and everywhere..
From the FAQ:
"If OGG-S is open source, how can the encryption be secure?
If a company wishes to use OGG-S to protect their content, SideSpace Solutions highly recommends purchasing a binary distribution license. Under this license, any modifications to OGG-S (such as a change of encryption engine or private keys) do not have to be released."
OK....
Under GNU, do you have to release any private encryption keys you may have used with the code?
Encryption keys would seem to fall under content/data and not code. It is my understanding of the GNU license that you must redistribute the source code, not any data that your created and feed into the application. As long as you provide sample data (in this case another encryption key) to allow the application to run properly when compiled.
I don't see how they can force people, under the GNU, to release any private keys.
Someone please explain.
I don't see how they can
open source / DRM
how worse COULD it get?
Um because no one put it there. If you have KaZaA, you could put it up.
a war on terrorism? How can we end a war on a method?
It's not that it's just technologically impossible; it's logically impossible. A billion years of technological advances can't change that.
Upon analysis, this will either be shown to not really work, or it will turn out to just be "mostly" open, but with at least one opaque component.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Comment removed based on user account deletion
DRM isn't bad. Big Media/MS is bad. If DRM becomes mandated, it will be better to have an open-source implementation than not. This will reduce the plausibility of the likely MS argument that since there is no DRM on linux or mac, these systems should be excluded outright from certification.
It's like an arms race. If everyone's got it, nobody is at a disadvantage. "Keep your friends close, but keep your enemies closer." The same is true of TIA, btw.
Isn't that like OpenSource Windows?
.000124611 XPD (Palladium Ounces) worth.
So let me get this straight:
This is a project that is part of a free intellectual property movement which is designed to protect intellectual property from being used by people who have not liscensed it?
What the hell?
Okay, so it's going to be released under a liscense which allows anyone to modify, copy, and distribute the source, as long as they DO distribute the source. And the point of it is to make it impossible for someone to modify, copy, or distrubute the source, whether you paid for it or not...
I'm not getting anywhere here, but I think it sucks.
Just my
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
You are all so quick to want to outlaw a technology because it has an application you dont like. But if someone else feels the same about a tech you do like, you all get up in arms over it.
How many think xbox mod chips should be legal, because just because they can be used for piracy, they have other legal uses?
Now, how many think DRM should never be implemented, because it can be used to restrict what you can do with a CD you bought?
To me its the same issue. Technologies arent inherently evil, it's the uses they're put to.
DRM technology with SSL strength security has some good uses.
A content producer can have all his stuff locked tight with DRM while it's still in production, or use it on the screener films he sends to reviewers. If it isnt for sale yet, you have no right to any of it. It's merely protecting a trade secret.
It can also be used to verify the authenticity of footages, lets say the doctored photo in Time magazine yesterday.
It could be used to prove that the footage you see on TV is what was filmed by the digicam.
It can be used in court to prove that the security footage from the 7-11 hasnt been altered in any way.
It can be used to keep your nephew from stumbling across your pr0n collections.
It already exists anyways. Noone stops anyone from streaming a netradio over an SSL tunnel, or archiving their files with a password.
In short, preventing consumers from excersizing legitimate rights to use something they own is bad. DRM is not 'bad', DRM is a technology.
I don't need no instructions to know how to rock!!!!
From the site:
Purchase of this product enables you to modify OGG-S decryption or encryption code and release your binary modifications to your users.
April Fools was two days ago guys...
// file: mice.h
#include "frickin_lasers.h"
and after looking at the corporate types in the pics on the sideshow.bob frontpage I realise it is. pictures of (token ethnic) users grinning at laptops like braindead morons is something I expect to see on microsoft's DRM page.
It seems that the marketing drones have finally imposed themselves onto the 'open source' bandwagon. Welcome to our world, please drive carefully and no - you can't park there - you are causing an obstruction.
Aside from it being bundled with Lindows for people who don't know better, who want's DRM really?
The question of whether this is good or not is really the question of where the balance of power between the artist and the consumer should be.
On the one hand, artists should be compensated for their work. So an ideal music format would make that happen.
On the other hand, the consumer should be able to "try before they buy", make backups, cross formats, lend it, print it out and feed it to their dog, apply stupid filters in Cool Edit, and generally play with it however they want. An ideal music format would make this happen as well.
Can any format offer both? It seems not. To offer the user freedom, the file has to get unlocked at some point, and then P2P ensures it will get copied. Many artists will prefer the "get money" option, and the paying customers will be out of luck.
So, maybe the solution is to do something to P2P. This usually meets howls of protest, but there may be another way. Shazam. This is a neat service for when you hear a song and don't recognise it. Call them, point your phone at the speaker, and you get a text message back identifying the song. I think their tech could have other uses...
So, we have a Napster-like model with central servers, only your music now must pass the not-an-existing-tune test before being added. Record companies can supply the tags before a song is released, legitimate files get through, everyone's sort of happy.
Although you might prefer un-crippled files and un-crippled P2P, the Deep Pockets are going to try their hardest to stop you. Is this halfway position the best you can expect?
I'm scared of numbers that can't be written as a fraction. It's an irrational fear.
Heh. I'd put it up there, except I don't want my bandwidth to vanish for a week or so.
Besides, you should give them money. It's not like it costs very much to get the early download rights.
I only object to paying for data under the following conditions:
1) when it's a sucky overpriced product that I'm forced to use because some other jackass bought it and keeps sending me fricking documents.
2) when I hate the company that produces it, and I want to see them DIE DIE DIE.
3) or when they, in the slavish hunt for every last penny of possible revenue, implement some draconian copy protection scheme, which only serves to piss off people like me, and abuse old people and simpletons.
If none of these things apply, I have nothing against shelling out the money. I even kind of like it sometimes; I feel like I'm supporting something worthwhile. I'd just blow the money on smack and hot women anyway. =)
Just my opinion.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Hopefully, this will be the impetus necessary to make Linux relevant on the home desktop front, as content providers will be able to deploy their music and video without having qualms about the ease with which their material could be distributed ad infinitum. It's good to see the technology maturing to the point where it's admitted that not everything can be or should be free.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
- "Ogg's Goodies Gavel-Slammed"
- "Ogg Gets Gonads-Suckage"
- "Oggs Get Gut-Sliced"
But of course you can do better.I worked for a startup that was researching DRM heavily (I was doing streaming-media stuff, others were doing DRM, and the company rightly failed promptly), and have done a lot of thinking about the issues.
Basically, OSS and DRM are mathematically incompatible. The purpose of DRM is to keep the user from being able to make a copy of the media in question. In order to do that, it must use encryption keys to hide the 'plaintext', and carefully control those keys. This is the core of what DRM is.
In order to plug the equivalent of the 'analog hole', all existing DRM implementations are binary-only, and carefully control and conceal the data path between the encrypted data and the finaly output hardware, so that it's 'impossible' for the user to get the plaintext.
As soon as you go Open Source, *anyone* can take the code appart, take the decryption routine, and get the plaintext right out of that. There is nothing 'forcing' the data directly into the hardware. At that point, the plaintext can be distributed, and the DRM has failed.
More important than that even is the fact that open-source licenses guarantee that you can redistribute your modifications. It will be a grand total of about 2.37 hours between initial release of the software and someone releasing a version that will export the plaintext. Guess how popular the original release will be?
No, I think the results of this little experiment will be mixed good and bad:
Good: it will prove that DRM is mathematically impossible
Bad: it will 'prove' that the industry *must* use binary-only distributions of such software in order to make it work
It remains to be seen which of these will take effect first.
GStreamer - The only way to stream!
Me thinks you missed the whole fraggin point! One of the ideas behind ogg is that it DOES NOT support DRM, Thats like a machine dependant java its a contradiction.
-troy
As bad as DRM sounds, maybee it's a blessing in disguise. No one like the product activation in Windows XP or Office XP, but at the same time product activation makes piracy less workable and forces users to face the high price tag Microsoft has placed on these products. When it's a choice between $200 for Office XP or $0 for OpenOffice rather than $0 for pirated Office 2K or $0 OpenOffice...if nothing else, the pricetag drives home the point that you need to at least TRY the alternatives.
Maybee the same will be true for music...that once every commercial song comes with a pricetag, listeners will finally begin to see Creative Commons/Open Audio License/Public Domain music as a better value. Once the audience is there, musicians will surely follow.
...that the open source DRM solution will quickly prove to be the best, most effective implementation of DRM?
As it stands now OGG is almost a synonym of unencomberd and vicarious quality. Please do not allow these people to poision it's reputation and destroy the headway allready gained.
How does the client prevent piping of the decrypted output? Without that, you might as well skip the encryption. With that you get right back to the nasty non free world of files you can't write and someone else owns your computer.
DRM is an attempt to prop up and extend the whole dead tree publishing model that has no place in the digital world. Trying to force the restrictions of old technology on new is evil. Creating restrictions that older did not exist in older technology is even worse. DRM seeks this and is an abomination. A new revenue model must be made and people should be encouraged to share their information as well as create it. Obscuring information so that permision is required for each and every read, and that's what this can do, is even more restrictive than printed work which is durable and human readable.
GPLing this code is like making a dagger out of gold.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
How does thier technology prevent this?
This whole DRM field is fool's gold. The obvious truth is that business models need to change. Get over it.
See Felton's discussion of threat models
jabber: johnynek@jabber.org
A look at the source doesn't mean that you can simply defeat the encryption. Just like you can't r00t someone's ssh server by looking at the source of their version of OpenSSH.
Of course you could trojanize the source and try to get a limp version of the binaries to proliferate, but the chances of that working are very close to zero. If I were a publisher I'd test whether the encoding and DRM encryption worked before I were to sell my media to the world.
Learn from the mistakes of others. There isn't enough time to make them all yourself.
Even binary-only implementations are vulnerable. Binary code may be hard to understand, but it's still understandable. Open source DRM is similar to the current implementation of Windows Media DRM in that it's software only, which means it may be broken by discovering the decryption key and algorithm. Only something like TCPA would make this very difficult.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Great, open source DRM! At last!
My big issue with M$'s DRM solutions is the fact that they are closed source. This means that I can't check what happens to my personal information or whether the system contains any hidden "features" that I don't like.
Open source DRM enables digital publishing for profit AND the user gets the peace of mind that there is NO SPYWARE or other fishy stuff going on in the background.
Learn from the mistakes of others. There isn't enough time to make them all yourself.
Open source digital rights management? What?! It's not still April 1st, is it?
Cyde Weys Musings - Scrutinizing the inscrutable
Much like GPG keys, the source can be in the open because with a big enough pool, you still can't easily break it even knowing the source! From an Open Source business standpoint, that is the final step in creating a fairly secure system end-for-end.
The benefit is that being Open Source it's optional to add. You might need it to aquire content, but that could be a good thing. After all, for Linux to succeed the world must learn to work in pure source! Think of what Nvidia and ATI could do if they knew they could send out encrypted source files and what architecures not yet concieved could be developed. You could retarget to new systems by creating source modifications, but not actually seeing the source! Linux also has all the mechanisms [think gentoo] to verify, and passout the keys via a trusted system.
The best part is that being Open Source there can be multiple trusted authorities online! Each distro could be a trusted source as well as individual vendors online sites. The only thing missing is certified ISPs that can prove you're you connected to their network. The phone Co already does this, it just needs minor work to be useable on such a grand scale. It also cuts the other way in that you personally can choose your own degree of certification and your own vendors to keep the keys! No one vendor can dominate the market as the entry fee is only $50!
Its good.
Why? Because it would be implemented in, obviously, an open manner with publically defined protocols and specifications. Therefore, anybody who wanted to build an infrastructure to support DRM could do so without locking people into a single vendor or implementation.
Somebody asked why couldn't you just change the libraries to let you bypass it? Well sure, if you can change the code on the machine, you *may* be able to bypass protections, depending on what they are. For example, if the file (text, sound, media, etc.) is encrypted and requires a decrypt key, mucking around in the code isn't going to help it decrypt itself.
Now.. what about extracting the protected media after the decrypt step? Well, thats a bit harder. In fact, that was how people broke Microsoft's first WMP protection.. they wrote a null sound driver that just dumped the output to a file. Works pretty well. Don't think that they didn't notice, when all of their drivers need to be signed these days..
Anyway.. there are different parts to Digital Rights Management. Step 1 is access.. can you access a file or not. Crypto protects that, and no open or closed source will change that. Step 2 is decrypted control. Who can manipulate the decrypted bytes of the media? That is up to people to implement and protect as they see fit.
Remember that an OSS DRM solution could provide an open source platform for building closed source clients and devices.. You have the advantge of an open standard combined with actual devices using it.
The Internet Streaming Media Alliance has released a spec for DRM that is vendor-neutral and involves no royalties.
Not truly open source, but perhaps better than Windows of Real DRM,
nuclear iraq bioweapon encryption cocaine korea terrorist
Both Linux (proprietary modules tainting the kernel) and GCC (the GNAT frontend can check for source code license violations) already include DRM. But these DRM systems are advisory, and not compulsory.
I think an advisory DRM system, combined with micropayment would be a nice thing, especially for free software. For example, your mail user agent could ask, "You are about to send this song to a friend. The artists suggest you donate them $0.50. Do you agree?". Too far-fetched? Maybe. But it's much more realistic than all the other DRM proposals I've seen so far.
Ubiquitous deployment of DRM just does away with the opportunity of anyone to vote with their (virtual) wallet. It gets us in a position where we have no choice.
Ditto ubiquitous deployment of "trusted computing" in hardware. First get it in everybody's hands, then in a few years start using it, then in a few years start requiring it. See also 'copy-protected' CDs.
First, while software released under a free license, like the GPL, has to be redistributed under specified terms, the data such software processes does not (in general -- there are a few exceptions where output of a GPL program contains GPL code, thus restricting redistribution of compilation of that code without the rest of the source -- which usually comprises the input to the initial GPL program in the first place -- think parser generator). This is the entire basis for openssl and similar code: you can keep the keys secret.
Thus, if the keys involved are kept secret on a secure processor, and that processor only runs code signed with other secure keys, said code can be completely open!
Of course, you lose control over what this processor does (since it can't execute arbitrary code), but you can examine the code that it does execute. Furthermore, such a processor could also execute unsigned code, but not provide access to the keys it protects. If the processor is limited to decoding encrypted entertainment data, the fact that one does not have control over it is no worse than not having control over a remote server to which one connects over the internet -- it's not like your whole general purpose computer is locked up (and the biggest problem with TCPA -- it locks the whole machine, not just some remote part, and encourages laws making the possession of unlockable machines illegal).
This does raise the whole issue of key management and distribution, of course, but fair use creation of archival copies of encrypted content, and storage in different forms now becomes possible: you just need a decryptor at the end. No one ever complained about needing speakers to listen to music or a TV to watch, er, TV.
The problem of "fair" DRM then reduces to one of establishing a trust hierarchy that producers of decryptors, copyright content producers, and consumers can all accept. I argue that problem is solvable, at least in the mathematical sense. The question is: "Is it economically viable?"
I think the answer is yes, particularly with a U.S. government push to "secure the internet".
You could've hired me.
The open source movement needs initiatives like this to distinguish open source from freeloading. A DRM solution tells RIAA and their minions that there are alternatives out there to make DRM work without resorting to obscene violations of privacy.
Almost everybody I know that uses MP3 or other formats want to pay for their music, what they don't want is unfair restrictions and obstacles to interrupt their enjoyment of the music once they purchase it. I even spent over a year using encrypted windows media music at work to prove to the network admin the music was for my own enjoyment and that I was not sharing it. It worked really nice but it was ackward, plus the files became useless once I left that company.
Pedro
----
The Insomniac Coder
--I don't see this as being inline with "art" per se, those sorts of artists who are into that would use what is already available, if they went that route, and it's already quite controversial in that respect..quite....
Now I CAN see an immediate practical use for this, distributing digital audio/video/stills of a political and sensitive nature. And like perhaps that example the other day, the doctored war photo that got that guy fired. Well, bad example because he did it HIMSELF, but along those lines. Say the original photographer or videographer, transmitting the image(s)or audio from a remote place, he could use this, to make sure his work wasn't altered by someone else, as in get intercepted, doctored, and then used for an agenda of some sort.
God, this sickens me to no end. I thought the OSS culture was smarter than this. It's not that I hate DRM, its the fact that DRM is a logcial fallacy. Spending time on DRM is like spending time trying to prove 2+2=5. You'll never succeed. Never!
If I can read it, see it, or hear it. I can make a copy. End of story, end of discussion. It doesn't matter how much you encrypt something, eventually it will need to be unencrypted for a human to read/see/hear it. At that point, it can be copied. Maybe it won't be a copy of the exact bits, but it will be a copy. For example, I could buy an e-book with heavy DRM. I load that e-book into my DRM e-book reader so I can read it. I then begin to transcribe the book into my word processor. Sure its tedious, but it only takes one person to do this and all the DRM in the world can't stop it.
When will people learn that DRM is a complete and utter waste of time?!
Sheesh.
It is oronic actually, the same irony on Open Source and free software all over again. Mr RMS tries to convince us that we must be free. You believe him but you extend that to the point to say we must be free to be closed source as well.
But from the mouths of open source and free software zealots I get the point that they think they are the free ones, not the ones that use closed source.
So, they either consider freedom the open source and free software or nothing.
So, I get your point, I get their point. What's the conclusion?
Nothing. The same irony all over again. The same circle that goes round and around and around all over again.
But I think. I think, you're the smartest. Not that you said it as it is, but you're closest to the truth.
The truth is, it doesn't matter if you're with open source, or free software, or closed source. What does matter is what you create, what help you give to other people who want to create something like this you created, and how usefull it is that thing you created after all.
So, let's please be more open to what people create, and what help they give to their users and developers that are interested in what they are doing, and less concerned on what licence they distribute it with.
So, this is exactly the same problem with OpenSSH, and how anyone can decrypt a SSH session because the source is open... erm oh wait, it's not that easy. Just to throw in a phrase well all hate, but is applicalbe here... Please think OUTSIDE the box.
is this a good thing or a bad thing??? really??
Actually, in both cases the encryption is wanted, by the people who have the right to encrypt it.
You have the right to encrypt anything on your machine, in the name of privacy.
You also have the right to encrypt anything you make before giving it to other people, then choosing when and how they can unencrypt it. This is called "DRM."
If an artist doesn't want his music sampled, well, sucks to be him. He's going to make fewer sales, and won't earn as much money. DRM protects a savvy user's authority. It doesn't protect idiots from themselves.
What's this Submit thingy do?
As soon as you go Open Source, *anyone* can take the code appart, take the decryption routine, and get the plaintext right out of that. There is nothing 'forcing' the data directly into the hardware. At that point, the plaintext can be distributed, and the DRM has failed.
That's a good point. But if you had some secure hardware like TCPA, open source DRM could work. What would happen is that the hash of your open source application gets reported to the remote system, using the secure hardware. If the hash is different from what it is supposed to be, then the remote system won't send you the data.
Also, the open source application can save the data encrypted so that it can only be unlocked when that same application (unmodified) is run. So after downloading, if you hack your app, you can't unlock the data.
That's the theory, anyway. Now one problem is that Open Source is supposed to encourage modification, but a mod will change the hash, so the remote system has to know and approve all the "good" versions of the software that are floating around.
But the point is, if you're going to use something like TCPA at all, wouldn't you rather use it with an Open Source application so that you know *exactly* what it's going to do? Rather than a closed app which cloaks its activities with encryption so you don't have any idea what it's doing?
Demand Open Source when you use Trusted Computing technology!
mod 1.
(2+2)mod 1 = 5 mod 1
I'm writing a (rather long, rather detailed) article arguing against DRM-enforced copyright, as a matter of public policy.
It's available here in workping-paper form.
Fixing copyright
No one like the product activation in Windows XP or Office XP, but at the same time product activation makes piracy less workable and forces users to face the high price tag Microsoft has placed on these products.
Ok, so it's mostly Microsoft who spreads this one, but even some Slashdot users fall for it.
You think product activation stopped XP piracy one iota? Think again. Cracked copies were floating around before it even hit retail shelves. Service pack 1, you say? Once again, within days of that debacle, a workaround even my parents can handle was available.
People get their warezed XP the same way they got their warezed 2000, ME, 98, etc. Kazaa and its ilk are making it even easier.
Know who product activation hurts? Not pirates, that's for sure. It hurts those of us who do anything more than install XP once, on one system, ever. Want to mirror your desktop's contents onto your laptop? Sorry. Have to re-install Windows? Sorry. Bought a new computer? Sorry. If you're lucky, you're only forced to upload some data to Microsoft. No internet? Hope you don't mind sitting on hold for a while. Past what Microsoft considers an acceptable amount of re-installs? Oh well, hope you have another $300.
The University I attend gets free copies of Windows and Visual Studio for its CS students. I can get as many license keys as I want without paying. But, I still have to deal with Microsoft's insane activation scheme if I want to use XP. Instead, I just use 2000. One CD, and *I* get to choose how I use it.
Know what most students are doing, to get around the hassle of activating XP so many times? That's right, downloading the cracked version. Guess what they're going to do once they're out of school and want the latest version of Windows?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
If the breakage is really the licenser saying "screw you" to those who accepted and followed the license, then don't use content from that licenser.
What if the licensor is The Walt Disney Company, and the licensee is a mother of children who are still too young for school? "Just say no to Di$ney" would probably not click too well with little kids.
Will I retire or break 10K?
I actually think this is a good thing. It will help Open Source Software gain acceptance many places it is accepted yet. This will also help to develop a more bulletproof DRM technology which could help safegard the movement from the attacks of Hollywood....
There is also another benefit to open source DRM. If the current content providers continue to aggressively lock their material down, it may provide an option for those of us who want to see Free (as in Speech) content develop and become a viable model. If we are clever, this could create an opertunity for open content of music as well as documentation and software.
LedgerSMB: Open source Accounting/ERP
Until somebody invents a selective layer X-Ray machine with OCR that is! :) (thus making scanning in books reallly easy, heh)
Either that, or just adapt the sheet-feeding mechanisms from inkjet printers to turn the pages automatically, and then scan and OCR two-page spreads.
Did I just violate the DMCA with this comment?
Will I retire or break 10K?
Good:
OGG - a patent and royalty free means of sharing music.
Bad:
OGGS - a patent and royalty free means of preventing music sharing or even listening.
Really, Really Bad:
These methods applied to textbooks, technical publications and other "real" information.
Why should I "reconcile" myself to those who treat me like a criminal? No thanks, I don't need their stuff and want them to stay out of mine. For instance, indexing files on a local network is not a crime. I'm never going to buy DRM crippled stuff because it interferes with my ability to use what I buy.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
How about an offline machine that can't tell some rinky dink server that I'm listening to music right now.
You're referring to one of the drawbacks of Circuit City's DIVX system, that it required a telephone connection. But now that wireless continues to grow more widespread, how about legislation to require 802.11 cards in all PCs sold with digital media playback software?
Will I retire or break 10K?
So why does not RIAA/MPAA just do that; sue uploaders?
Because it's nearly impossible to find enough uploaders to make the lawyers' time worth it.
Will I retire or break 10K?
Actually since kazaa is available to people that use Windoze NOT linux. Linux is such a small percentage that it doesn't matter as far as free warez is concerned.
If every reporter signs the photos he created, there would be no attempt to change a photo because the signature would be obviously broken.
Then how would the signature survive cropping, printing, and scanning, so that the subscriber can verify the signature?
Will I retire or break 10K?
Exactly. And DRM these days is much more about restricting your use of content once you get it than it is about controlling your access to it in the first place.
Encrypting the content with a key is true security. Having the key also tell the client-side app that you should only be able to play the content for 30 days, or that you should not be able to give it to your buddy or burn it to a CD is security-through-obscurity. It is this control that the media companies want, and it is something which, for obvious reasons, is impossible to do in an open source app.
What if someone built a sound card that just stores of feeds any data it recieves back to the computer through another channel?
:)
It's against the DMCA, of course.
No, YOU'VE entirely missed the point of DRM. The trouble with your analogy is that you've decided that there are certain kinds of theft that are acceptable. Theft is theft. It doesn't matter whether I've left my door unlocked, or locked, or forgotten my walkman at the fast food joint -- or set my stereo up on the sidewalk. Somebody helps themselves to my property, it's theft, pure and simple. I shudder to think that there might be judges who will rule on the basis of your twisted perception of relative morality instead of on the basis of the law.
If DRM was what you say it is, then why are the media giants going after the file-swappers? If you're right, they don't have a leg to stand on! Their music is "out in the open". Nonsense -- they're going after the file swappers because the file swappers are in breach of copyright. There is already a basis in law that allows for prosecution of ppl who illegally copy. DRM is NOT about legal protection. DRM is about CONTENT CONTROL.
pure AI will always Sublime
The appeal of Ogg has nothing to do with DRM. Ogg ensures a royalty-free codec. DRM for content is a completely different matter.
All they have to do is buy the key under a false identity, or trojan some innocents machine and steal their key.
So what if it's watermarked, it doesn't matter if the watermark can't be traced to the originater of the hack.
It makes things a little more hairy, but it won't stop the problem.
DRM isn't bad? Do you have any idea what DRM /means/? DRM requires content to be authorised by central "trusted" authorisation servers. That means that access to /your/ content is controlled by whoever controls the authentication servers. That means that you have to ask permission to view your own data!
How can that possibly be good? How can you give a mandate to something like that?
Pretending that it is an "arms race", and making sure everyone's got it would mean that DRM would become ubiquitous -- and that any data anyone produces will be placed under the dominion of the despotic maniacs behind "Trusted Computing".
Open Source should NEVER get into bed with DRM. It's laughable to think that anyone could DREAM that DRM would permit Open Source [software or content's] continued existence. Can you imagine giving someone sponsored by Bill the control over your access to the linux kernel? Allowing DRM to become ubiquitous, even tacitly supporting DRM would make that situation a reality.
pure AI will always Sublime
The problem of "fair" DRM then reduces to one of establishing a trust hierarchy that producers of decryptors, copyright content producers, and consumers can all accept.
That is total nonsense. What is a fair use is a fair use. The author can HATE that use, but it doesn't matter. It is STILL a fair use that the user can undertake.
Authors often hate parodies of their works. Or having to compete against used copies of their own works. Or having people take quotes or clips from their works. Or having people spaceshift or timeshift their works. Or importing copies of works legally made abroad that are infringing here under certain circumstances.
Fuck 'em. We get to do all of those things regardless. And as soon as the copyright term expires, we can do literally anything with it.
Unless DRM can PERFECTLY permit people to do whatever the Supreme Court would let them do under that exact same scenario, (meaning for example that the DRM will have to know what the intent of the user is), it is an abject failure.
We have to fight it at every turn.
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.
No, ultimate digital is an oxymoron though. ;)
You can't modify the source to give you access to a file you don't have the key for, but you can modify it to send the decrypted output to file instead of the sound card, which would give you a protection-free copy.
It's hard to be religious when certain people are never incinerated by bolts of lightning.
I don't quite agree with you. You can have an open standard for DRM, and therefore an open reference on how to implement that DRM standard. Now, that reference can' be released under something like the GPL, I agree. However, I don't see why it couldn't be released under a license like BSD or something similar. So, open source and DRM is okay, but GPL and DRM is not.
Sure I'm paranoid, but am I paranoid enough?
I don't even know my neighbor! I'd stuff his head in a vat of acid, if that meant I could be rich!
Yes, I am aware that one can likely bypass a DRM system.
On the other hand, what if they were able to develop a system that used a spec generic enough to be used on any type of data file and integrate it with a content management system or workflow management system? I can see a niche for something like this.
With the open source involved, this could restrict it only to places where one entity has complete control of the infrastructure, a business for example.
Server, X-11 terminals hardwired to the network, no open ethernet ports anywhere, ta-da. Ok, I'm sure there is more to it, but most businesses have full control of their networks and can create the proper environment to further enforce the DRM.
I know the medical field and government would benefit from this, yet I would prefer to have an open sourced, open standard system and know it uses a strong encryption algorithm other than a do-not-print flag set in the file enforced by the DMCA.
Could such a system be created following the open source philosophy with open standards and be secure?
If there is, don't hesitate to let me know.
I see this as a very big step forward, and congratulations to all involved. Contrary to some of the knee-jerk responses, there are valid places where audio encryption could be very useful for society as a whole.
To quote just one, audio evidence is regularly admitted in court. However, there is a significant possibility that this evidence can be tampered with. If the "source" audio was recorded+encrypted on the fly on a "closed" piece of hardware, maybe even with a GPS to capture the geographic location and time of day, it'd be possible to get an extra level of confidence that the audio was kosher and thus give it more weight in evidence.
Now I'm sure that it would be theoretically possible to tamper with such evidence, but it makes it that much tougher to do than e.g. people taking a conversation sample on cassette tape, then editing it using the appropriate tools and rewriting it to tape again.
People, take a look at this simple, polite exchange between two groups that have a disagreement over the equivalent of a trademark issue. THIS is how it should be done. I shudder to think of how many lawyers would be involved by this time had this been two corporations.
Thank you, both of you, for providing this excellent example.
Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)
kazaa released a linux client. I used it for some time. I don't know if they broke it with their nutwork "upgrades" though.
That's a good point. But if you had some secure hardware like TCPA, open source DRM could work. What would happen is that the hash of your open source application gets reported to the remote system, using the secure hardware. If the hash is different from what it is supposed to be, then the remote system won't send you the data.
This is why you don't modify the application on disk. Instead you modify it at runtime or alternatively monitor the memory address where the decrypted frames are being read before being passed to the decompressor externally.
Heck you could even build a memory bus logger if the apps are run in some sort of protected VM to get access to the decrypted frames (once you figure out the offset that is).
But this is all really beside the point. People are willing to put up with the quality of radio, movies shot in theaters by digital cameras, horribly overcompressed digital cable tv and all sorts of other inferior media products. Somehow I doubt anyone is going to notice an extra A/D conversion done down the line to bypass all this silly DRM stuff with a $5 cable bought at radio shack.
The world is neither black nor white nor good nor evil, only many shades of CowboyNeal.
i think i finally have found a useful application of dupe posts.
Free as in mason.
A program for which you have the source, but you can not compile the (modified) source into a working program is by most standards NOT considered open source.
As TCPA would stop the modified program from working, this would make it non-opensource.
This has even been suggested as a possible way for MS to attack the GPL. Yes you can get the source, but you can not change it and get a working program out of it, if you don't pay to have it signed.
Abstractly considered, there is fundamentally no difference
between a source distribution and a binary distribution.
The practical difference that is most relevant in this case
is that a binary is more inconvenient to read. But plenty
of people spend long hours running softice and know x86
opcode tables better than their mother's face.
Whether the source is open or closed, I don't think there's
a difference with regard to the accessibility of the plain
text content, or of the private keys. Binaries can be patched
with a finite additional effort beyond that required to
modify source and recompile. Signatures can be forged on
a patched binary no less easily than they can be forged on
a compilation from source.
The difference is moot, in my opinion. Please correct my
error, if you perceive one.
-I like my women like I like my tea: green-
As soon as you go Open Source, *anyone* can take the code appart, take the decryption routine, and get the plaintext right out of that. There is nothing 'forcing' the data directly into the hardware. At that point, the plaintext can be distributed, and the DRM has failed.
The whole point of encrypting with known algorithms is that it is very hard to decrypt without the keys. I think you must have used a very weak algorithm. You don't release the keys anywhere, they must be hidden away as best you can. Of course, doing safe decryption on an untrusted platform is impossible (see below).
I don't see any mathematics in your post. So I have to ask for proof before believing you. Next time, avoid buzzwords just to be modded up..
Secondly, I believe you have some experience, but the future of DRM will not be in software.. With closed hardware, it's probably (who REALLY knows?) possible to combine Open Source and DRM. Point being that Microsoft announced they will release their sourcecode for Palladium, so that everybody can see that there is no 'evil' code in there. That it does what Microsoft says it will. The core code that runs in a hardware-protected sandbox should be perfectly safe (in theory) from tampering by other than Microsoft.
Thirdly, OSS supporting DRM is a bad move because that will validate closing up the hardware from the people. Maybe many thinks this is a good idea, but in the long run we WILL be better off defeating DRM before it becomes valid.
The people should make the decision NOT to buy DRM-enabled devices and programs. Just stop supporting DRM and all its likes RIGHT NOW. There is nothing to be gained for the people in the technology. It defeats the whole purpose of a multi-purpose device: That somebody else controls what you can and can't do on your own terminal.
For once in your life, take a stand. Have some spine! If it means you can't buy the latest N-Sync album over the net, just don't do it! Walk out into nature and meditate, you'll be much happier and better off..
http://www.debunkingskeptics.com/
Security is all about proper operation in the face of an adversary. As a result, one person's security is another's insecurity.
If I break into your colo server and use it for bad purposes, I may take steps to stop you getting in in order to kick me out. From your point of view, the box is still the victim of a security vulnerability, while from mine it is now secure.
I want hardware I've paid for be secure in my favour; I don't want it to be secure against me.
Xenu loves you!
It really does not matter if the software is open source or not (though it will be harder to crack the binary only version).
Software only DRM is security by obfuscation only. Such security measures can *always* be broken.
Public/private key security depends on the user being trusted (naturally). The problem is that in the DRM case, the trusted user is the mp3-player (but that a malicious user has complete access to the system).
in GNUin GNUin GNUin GNUin GNUin GNUin GNUin GNUSegmentation fault
The fundamental difference between SSH and DRM is that it is perfectly ok if the SSH-user knows the key used to encrypt/decrypt data. In DRM only the software must be able to find the key.
in GNUin GNUin GNUin GNUin GNUin GNUin GNUin GNUSegmentation fault
..an idea for the 21st century
You have mixed key and encryption algorithm. You "put the key" in the algorithm, then feed the message, and there comes the ciphered text. To decrypt it you may need the same key or another, it depends on the type of algorithm you are using.
You have a ton of public implementations of AES, DES, etc, as long as the full description by the authors.
Another problem though, is that no-one in their right mind would use asymm encryption for streaming media. You have any idea how much overhead is created by using asymm encryption?
SSH for instance also uses asymm encryption only for session key exchange.
Ho on earth are you going to keep your 'session' key hidden from the user??
The name of this DRM scheme seems awfully suspect to say the least.
With all the headway Ogg Vorbis has been making, it seems that this could be a veiled attempt to get those not so knowledgeable to begin associating the Ogg name with "bad" DRM. Then you get the typical kneejerk reaction of "Don't use Ogg, they'll embed DRM in it then you will be locked in" etc.
I'd suggest that Xiph.org protect their name NOW before the wrong message gets pumped out by the media. Ogg is WAY too close to saying "Ogg-S is bad" and thereby making mental association of "Ogg is bad".
Visceral Psyche Films
Not quite: the only popular system that consumers should accept should permit such fair use. I maintain that it is possible to build such a system, and still have it forbid other, "less fair" uses.
The only difficulty is not technical, but the fact that legal fair use is a shifting definition, changing with the times, and thus difficult to codify. However, short copyright intevals, and the means (and legal requirement on DRM device manufacturers) to provide upgrades that permit new fair uses, an alleviate this problem: it is not mathematically impossible to solve.
The key is multifacetted: 1) fair use needs to have a codified definition that encompasses as much of legal fair use as possible and the flexibility to accept more; 2) copyright needs to be short enough that eventually any restrictive system opens up; 3) restrictive processing that the consumer does not control should NOT be part of a general computing platform, but rather integrated into audio and video "end devices" (TVs, displays, and speakers).
You could've hired me.
The lack of proofreading aside, I get the strong impression this is the author's first application of cryptography. At the highest level, this does implement a DRM scheme (which is by definition fundamenatlly flawed, of course). The devil is in the details.
Take page 17 of the Systems Design Document, for example. The use of Low and High security levels is misguided and misleading: "This level of encryption ensures that content can only be decrypted by applications that are not malicious..." How so?
On the same page, the use of the term "PUBLICKEY" is questionable. Public key usually implies public key cryptography, but this is a symmetric key. Furthermore, what is a 1024-bit 3DES key? 3DES uses a 168-bit key.
Still on page 17, SHA1 values should not be referred to as checksums. Later, they are properly called hash values. Weak terminology is a minor complaint, but has no place in a security paper.
Overall, I hope the music industry (et al.) uses Media-S for all its DRM needs!
Problems with your key:
1) Fair use cannot be properly codified. It's a constitutional doctrine. Congress can provide its own definition of fair use, seperate and apart from the judicial doctrine, and basically has in the form of 17 USC 107 (which repeats what the current judicial doctrine is) but they cannot stop the courts from having their own.
2) While I like copyrights being of minimal duration to achieve maximal public benefit, how could DRM possibly be aware of changes in the law? Congress could wipe out copyright tomorrow if it wanted to. And of course, particular material may be determined not to be copyrighted, or may have copyrights suspended or revoked only after judicial intervention. Copyright holders cannot be relied upon to be honest; their interests are in asserting copyrights no matter what.
3) Fair use is applicable no matter what technology one wishes to employ. I can time shift and space shift with a VCR if I want to. Restrictive technology should simply never exist.
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.
One can, however, approximate its codification quite well: once limited plain text extracts can exist, and complete unlimited archival encrypted copies, what else is required? All other requirements become legal ones, and not hindered by restrictive technology. We can use the "genie out of the bottle" to our advantage here, and still severly limit the bane of copyright holders: blanket, widely distributed outright copies.
2) While I like copyrights being of minimal duration to achieve maximal public benefit, how could DRM possibly be aware of changes in the law?
Simple: the law can require that DRM software permit this, and open DRM software can be inspected to ensure that it does. It's the keys that remain secret. Of course, that does not prevent unscrupulously restrictive hardware or firmware, but then the "smoking gun" of non-complience with the law becomes quite obvious.
And of course, particular material may be determined not to be copyrighted, or may have copyrights suspended or revoked only after judicial intervention. Copyright holders cannot be relied upon to be honest; their interests are in asserting copyrights no matter what.
The corresponding judicial order would include release of any corresponding keys, or, more likely a small key set that puts an unencrypted version into the public domain.
While an inconvenience to someone who only has the encrypted version, presumably they obtained such a version in the belief that the restrictsions were valid and to find they are not is a bonus.
It does raise the issue of lost keys, however. I would argue that, with such a system, copyright should only be enforcable on material with plain text versions in government escrow.
3) Fair use is applicable no matter what technology one wishes to employ. I can time shift and space shift with a VCR if I want to.
You could certainly do this with encrypted content.
Restrictive technology should simply never exist.
I'm afraid that, as it becomes possible for code to enforce law, it will be used for that purpose. Such code can be overly enforcive, or finely tuned to the intent of the law. Open DRM implementations allow the latter (and may be a bit more lax than the law permits, relying on non-code legal enforcement for the difference). Closed ones do not.
You could've hired me.
One can, however, approximate its codification quite well: once limited plain text extracts can exist, and complete unlimited archival encrypted copies, what else is required?
Fair use can, depending on the circumstances, permit the entirety of a work to be copied. Timeshifting, spaceshifting, and parody are all examples.
If I were creating a parody of a work, I might do so by taking the entire work, and then juxtapose it with other elements. Or I might take an extremely substantial amount of the work -- the entire visual part of a movie for example, and combine it with another soundtrack.
How can any brainless technology decide what's okay and what isn't, when it can take a host of federal judges, who are pretty smart themselves, quite a lot of effort to hash things out?
Fair use is decided on a case by case basis. It makes reference to things that technology cannot possibly hope to anticipate or know, such as the economic impact of a use, or the user's intent.
Technology is not and likely will never be up to the job. Maybe if we had strong AI you'd have an argument.
Simple: the law can require that DRM software permit this, and open DRM software can be inspected to ensure that it does.
Sounds like a content-based restriction on free speech to me. Maybe even viewpoint discrimination.
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.
once limited plain text extracts can exist
Apart from all the other points that have been made, this one seems quite plain to me: Once they can exist, you can make extracts of each bit of the content and reassemble them into a full plaintext copy. Tough luck.
OK. Say the DRM system prevents me making more than, say, 10 extracts of 100 words each of an E-Book, 5 extracts of 10 seconds of a song, or something like that - and some kind of authority keeps track of this across different computers, of course. Now, I go to IRC and find 50, 100, 500 people who have the same piece of media, each makes appropriate extracts, someone collects them and reassembles them. A lot of work? Yes, but look at the lengths some warez dudes will go to just to get a cracked copy of something out - and once it's out on P2P, you lose. (Which is of course the problem with all of this - once one copy is out, perhaps even an analogue recording from line-out, all is lost.)
What I'm increasingly thinking might make sense is a kind of 'voluntary' DRM (or simple copy-protection) - leave the code completely open so that people *can* circumvent it quite easily, but tell them that it's a) probably illegal and b) possibly immoral.
Entire extracts, bit-perfect, extracts for parody? While fair use, I find it unlikely that this would be done with a lengthy work in a manner that would require perfect extracts. I'm sure you can find fair use examples that are prevented with such DRM (since fair use can't yet be codified), but such uses probably comprise a small percentage of the fair use specturm -- time and space shifting, archival backups, and minor extracts are the big issues, IMHO.
If the "industry" screams for DRM, I'd rather provide somewhat palatable DRM as a fait acompli, rather than having clearly more draconian forms shoved doen my throat which make any fair use impossible.
I can furthermore see plenty of legitimate uses for providing computing resources under the control of selected others, besides hoisting **AA's profits (just clearly not all my computing resources. Rather than a blanket data freeway to my computer, I think of it as a digital "right of way", clearly defined and limited.
Sounds like a content-based restriction on free speech to me. Maybe even viewpoint discrimination.
Sorry, I don't understand how you reach this conclusion. The notion that I have is that if DRM is entrenched in a device, and a fair use is discovered that it prevents, the onus is on the owner of the keys restricting the fair use to make it possible (or, to make the restriction requiring the keys short enough so the problem "goes away" reasonably quickly).
You could've hired me.
As to the "parallel small extract loophole", a combination of fair pricing, difficulty in coordinating extraction, and ease of identifying blatent large-scale violators, should make this less of a problem than it might theoretically be. If "piracy" were the theoretical problem with unencrypted media that it could be, no more than one CD would ever be sold, and that copy illegaly duplicated and redistributed. Of course, that never happens. Sorry, if tha **AAs want any DRM, fair use has to be a priority and they can't have something completely bulletproof.
I can, however, imagine relases that might lock out some fair uses, legitimately, for short durations after release, espescially problematic ones. I'm thinking weeks, or at most, months here, before extracts are allowed, for example. Before one cries, "lack of fair use!" the response , "You didn't need to make an extract the day before release, you can wait 3 months" is offered. For most entertainment media, this is probably reasonable, though for news (which expires quickly), delays on the order of minutes to a few hours, at most a day, might be in order.
You could've hired me.
Time and space shifting are no problem with this: a proper key escrow system can distribute "your" keys to all the equipment you own.
Sadly, it's a big problem. Rights are held by people -- not things. My VCR has no right to time shift. I have that right, whether I do so on my VCR or using someone else's. For example, if what you said was true, how would I take a cd to Kinkos to burn a copy on their CD burner, which at present I have every right to do there if I have a right to do it at all.
Entire extracts, bit-perfect, extracts for parody? While fair use, I find it unlikely that this would be done with a lengthy work in a manner that would require perfect extracts. I'm sure you can find fair use examples that are prevented with such DRM (since fair use can't yet be codified), but such uses probably comprise a small percentage of the fair use specturm -- time and space shifting, archival backups, and minor extracts are the big issues, IMHO.
It is utterly irrelevant whether it happens a lot. Copyright is intended to promote the public good, and it constitutionally required to have a fair use exception since to do otherwise would be to frustrate it's very aims. You're basically saying that copyright does not have to do what we want it to do, viz. perform a public service. That's totally unacceptable.
Furthermore, all uses start out small -- timeshifting began with the people that were testing out Sony's Betamax, and the famous lawsuit on the issue covered what they were doing; not what, eventually, tens of thousands or more people were doing.
Ditto for people spaceshifting CDs to mp3 back in the days of the Diamond lawsuit.
Your foolish, shortsighted proposal would have the effect of forever fixing the state of fair use without a single care as to whether or not it was actually a good idea. For how can public demand ever be measured for something if it is quite impossible to get there?
Think of the way that demand had to be cultivated for a myriad of products and services, from xerox machines to tupperware. There was no articulable preexisting demand at all.
So shall it be for the next major class of fair use, I suspect. We'll never know that everyone will do it until they discover that they can, thanks to the efforts of trailblazers that are engaging in it early.
If the "industry" screams for DRM, I'd rather provide somewhat palatable DRM as a fait acompli, rather than having clearly more draconian forms shoved doen my throat which make any fair use impossible.
I refuse to compromise on it. Frankly, I feel that if any author releases any copy or edition of their work in a protected format, that we ought to revoke their copyright then and there, as well as any existing prior causes of action.
DRM is fundementally incompatable with the goals of the copyright system. We cannot forbid it, but we certainly can utterly fail to reward those who would engage in it, and generally discourage it at every turn. (e.g. not permitting DRM to be a deductable business expense for tax purposes, etc.)
Sorry, I don't understand how you reach this conclusion [that government mandating the use of DRM would be a content based restriction on free speech].
Well, imagine if the government said that anything you write has to include the phrase 'God bless America' in it? That would be totally unacceptable, because they are forcing you to say something that you do not want to say.
Likewise, if the government said that everything you write has to include a DRM system, they are ALSO mandating speech, which is a hugely bad thing to do. Particularly if you're trying to write about how awful DRM is.
In the commercial arena there's the tiniest of exceptions for certain types of health and safety information (such as ingredients in drugs) and truthful advertising, but nothing to the level of what you propose.
a fair use is discovered that it prevents
Such a fair use likely never will be discovered. There'll be no capability to get that far. Read Lessig's book 'Code' for a discussion of how the capabilities of things limit or impede our ability to perceive anything outside of those existing capabilities.
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.
All quite valid, but ultimately, I don't really see the point anymore - if you're going to trust people a bit, you might as well trust them fully.
As for 'no extracts for 3 months' - what about reviews? Special licenses for reviewers? Nice, the RIAA gets to decide who's allowed to review an album...
'No more than one CD sold' - I don't mean that everyone will get a pirated copy if one's available, but that everyone who wants to pirate can and will once a plaintext copy is out on P2P. Large-scale violators? Ordinary P2P, once it's out, it's hard to see where it originated; if the RIAA gets tougher in tracking down these people, move to Freenet.
As I said - I don't really see the point. Why not trust people for a change...
(I know, because the RIAA wants to expand their profits and control, and fair use is not compatible with that)
Unfortunately, a small minority of people are used to justify laws that make life miserable for all the rest of us. You can't trust people unknown to you. Do you?
The point is that I can see legitimate value in special-purpose computing devices in one's posession that one does not control. Think electric meter.... do you control yours? One of those forms of legitimate value is providing some kind of rights control to copyright holders in exchange for quicker, cheaper access for consumers. Just because that isn't the deal the **AA wants (having their cake and eating it too), doesn't mean it shouldn't be the line in the sand we draw. Basically, "You want DRM? This kind of DRM or none at all."
As for 'no extracts for 3 months' - what about reviews? Special licenses for reviewers? Nice, the RIAA gets to decide who's allowed to review an album...
I picked three months as an arbitrary figure. In practice one of several conditions would exist, (a) professional reviewers would have equipment that permitted extracts regardless of encoded restrictions, and clearly not controlled by content producers; (b) restriction periods would not be anywhere near three months on a CD release... a week perhaps? Let the die hards buy it unreviewed or even unheard -- there is some music I purchase that way based on band reputation; (c) An extract is not necessary for a review.
Other positive applications of such devices, which necessarily imply a public key trust hierarchy, are relatively secure communications as a matter of course. Yes, the keys are escrowed, so it isn't "secure" in the sense we'd consider it, but it is a far cry from a completely public internet, which I can't see as a bad thing. There's no stopping anyone from layering greater security over it.
You could've hired me.
Er, the same way you do now? A perfect copy of encrypted material is perfectly fine. Have you never photocopied something in a foreign language for a friend?
Your foolish, shortsighted proposal would have the effect of forever fixing the state of fair use without a single care as to whether or not it was actually a good idea. For how can public demand ever be measured for something if it is quite impossible to get there?
Think of the way that demand had to be cultivated for a myriad of products and services, from xerox machines to tupperware. There was no articulable preexisting demand at all.
You presume that the only way a fair use can be argued, defended, and, in general, identified, is if it can be exercized apriori of determination of its legal status. While convenient to demonstrate its practicality, I don't see that as necessary to imagine it.
Let those that can envision new fair uses argue their legitimacy as fair, and if they win, obtain judgements against users of DRM systems that do not respect them. This turns the whole burden around and makes DRM quite inconvenient on the copyright holder. This does not mean that it may not be a justifiable inconvenience: the trick is to constrain restriction periods to a suffciently short interval that no new fair use unduely constrained is likely to appear. This does mean copyright terms being severely reduced, of course, lest the copyright holders want to continuously play fair use catch up.
The alternative is to completely eliminate copyright as allowing any but severly defined (i.e. codifiable) fair uses, because it is incompatible with any kind of DRM, as it stands today. I can see that happening, with severe constraints on DRM-imposed restrictions.
The problem is that copyright, at present, is no longer practical to enforce without DRM that eliminates all fair uses. Something has to give, and I don't think that intellectual property law (vis. copyrights, patents, trademarks, and they are all very different), will just go away.
DRM is fundementally incompatable with the goals of the copyright system. We cannot forbid it, but we certainly can utterly fail to reward those who would engage in it, and generally discourage it at every turn. (e.g. not permitting DRM to be a deductable business expense for tax purposes, etc.)
Yes, economic boycott of DRM is a distinct possibility. But, to be a success, the public at large would have to reject the notion of copyright as a right. I don't think the average person is aware enough of the issues to take a vocal stance.
I do think that the public at large values fair uses such as time-shifting, space-shifting, etc. and has little care for other ones (parody, criticism, and new uses). Defending those is better than losing all of them, and doesn't require taking an extreme position. Furthermore, once the notion of common fair use is entrenched in the public psyche, support can be garnered to regain less common ones.
Yes, I am proposing a tactical retreat from the "oppose any and all DRM", because I don't think that argument will carry the day.
Well, imagine if the government said that anything you write has to include the phrase 'God bless America' in it? That would be totally unacceptable, because they are forcing you to say something that you do not want to say.
Likewise, if the government said that everything you write has to include a DRM system, they are ALSO mandating speech, which is a hugely bad thing to do. Particularly if you're trying to write about how awful DRM is.
Oh! I would never endorse a system that mandated DRM: content creators should be as free to exercise their right (or not) as they wish. You're arging, in effect, that if someone tried to do a copyleft aroun
You could've hired me.