Slashdot Mirror
Open Source DRM
Clyde writes "The different worlds of DRM and Open Source have come together under OGG-S, a project that just recently went to beta with their Open Source DRM toolkit. The project license in GPL and uses OpenSSL for its encryption engine. It will be interesting to see if this project helps to spread the acceptance of Ogg Vorbis."
How could you prevent people from modifying the library to let them use other people's keys? What would stop people from pirating the keys at easily as the music?
Open Source DRM is an obvious ploy by the Illuminati to spread "acceptible" DRM to the resistant open source community. Once they have us eating out of their palms their world domination plan will advance another great step forward.
Where's my tin foil hat?
Trolling is a art,
I can already see thousands of rabid open source fanatics imitating Gollum over this...
"It isss OGG, so it isss good! Yes!"
"Nooo! DRM! Hateful it is!"
etc.
The only way to prevent this is for users to boycott Digital Restrictions Management technologies. As such, anything which makes it easier for DRM technologies to integrate with any software is a bad thing.
This project may comply to the letter of Open Source, but it entirely contradicts the spirit of open technology.
Because the code is probably something closer to:
DecryptMusic(Key);
Can't do squat without the key.
However, preventing you from changing it to
DecryptMusicAndSaveAsMP3(Key);
is a lot harder, if not impossible. Of course, it does guarantee at least one sale to get that key. Not enough to make it worth it though.
part of the appeal of Ogg was because it didn't have DRM?
Do it yourself rape!
Breaking your leg for dummies!
<really fast>Only $29.95</reallyfast>
So close and yet so far from the world's perfect ID number
From the FAQ:
"If OGG-S is open source, how can the encryption be secure?
If a company wishes to use OGG-S to protect their content, SideSpace Solutions highly recommends purchasing a binary distribution license. Under this license, any modifications to OGG-S (such as a change of encryption engine or private keys) do not have to be released."
OK....
Under GNU, do you have to release any private encryption keys you may have used with the code?
Encryption keys would seem to fall under content/data and not code. It is my understanding of the GNU license that you must redistribute the source code, not any data that your created and feed into the application. As long as you provide sample data (in this case another encryption key) to allow the application to run properly when compiled.
I don't see how they can force people, under the GNU, to release any private keys.
Someone please explain.
I don't see how they can
I am sorry if our page is not that clear, but all OGG-S work is released under the GPL. If YOU would like to release a binary-only version of OGG-S (that contains zero Xiph code and 100% SideSpace code) then all we ask is you pay us a one-time charge of $50.
I hope that is not unreasonable, and you understand this cost only subsidizes our development tools and web hosting.
Plus, we will give 10% of your purchase to the EFF to help protect everyone's digital rights online.
It's not that it's just technologically impossible; it's logically impossible. A billion years of technological advances can't change that.
Upon analysis, this will either be shown to not really work, or it will turn out to just be "mostly" open, but with at least one opaque component.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
DRM isn't bad. Big Media/MS is bad. If DRM becomes mandated, it will be better to have an open-source implementation than not. This will reduce the plausibility of the likely MS argument that since there is no DRM on linux or mac, these systems should be excluded outright from certification.
It's like an arms race. If everyone's got it, nobody is at a disadvantage. "Keep your friends close, but keep your enemies closer." The same is true of TIA, btw.
You are all so quick to want to outlaw a technology because it has an application you dont like. But if someone else feels the same about a tech you do like, you all get up in arms over it.
How many think xbox mod chips should be legal, because just because they can be used for piracy, they have other legal uses?
Now, how many think DRM should never be implemented, because it can be used to restrict what you can do with a CD you bought?
To me its the same issue. Technologies arent inherently evil, it's the uses they're put to.
DRM technology with SSL strength security has some good uses.
A content producer can have all his stuff locked tight with DRM while it's still in production, or use it on the screener films he sends to reviewers. If it isnt for sale yet, you have no right to any of it. It's merely protecting a trade secret.
It can also be used to verify the authenticity of footages, lets say the doctored photo in Time magazine yesterday.
It could be used to prove that the footage you see on TV is what was filmed by the digicam.
It can be used in court to prove that the security footage from the 7-11 hasnt been altered in any way.
It can be used to keep your nephew from stumbling across your pr0n collections.
It already exists anyways. Noone stops anyone from streaming a netradio over an SSL tunnel, or archiving their files with a password.
In short, preventing consumers from excersizing legitimate rights to use something they own is bad. DRM is not 'bad', DRM is a technology.
I don't need no instructions to know how to rock!!!!
It's not really the customer's choice when content is only available under DRM restrictions, is it? As such, it makes no difference whether the DRM software is integrated or "added on", since the choice to protect or not protect the content is ultimately left to content providers.
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
Why not give the ten percent to the Xiph.Org Foundation? After all, we make the codec that makes your product remotely valuable.
While you're at it, why don't you choose a name for your DRM scheme that isn't so closely identifiable with one of our trademarks?
Emmett Plant
CEO, Xiph.Org Foundation
I assure you that SideSpace is in no way, shape or form affiliated with the Xiph.Org Foundation, who make Ogg Vorbis and other royalty-free multimedia codecs.
Emmett Plant
CEO, Xiph.Org Foundation
bad of course. it goes against everything Libre Software stands for
Hunh? What, Libre Software stands for making sure any and all content should be available without compensating the creator of the content in any way, shape or form? We use a license that restricts how your code is used, yet you want no restrictions on how the creations of others is used? *Rhetorical Question* Are you after a free ride, or Freedom?
I understand that you want fair use rights, as do we all. IMHO, if someone wishes to release thier creations with DRM, they are free to do so. I am free to ignore thier creation due to the DRM if I wish. Libre Software providing the freedom to release your creation as you want, and being compansated if you wish, is a good thing as it provides more freedom.
Until someone comes up with a viable way of compensating creators for thier content without restricing how that content is used in any way shape or form, restricted content is going to be reality, unfortunately. Using OSS tools to provide such restrictions, though distasteful, seems to be almost acceptable. At the very least, it shows that some proponents of Software Libre are sensitive to the needs of content creators, and so offers an olive branch to them. That should show we're not after a Free Ride, but Freedom.
Soko
"Depression is merely anger without enthusiasm." - Anonymous
I worked for a startup that was researching DRM heavily (I was doing streaming-media stuff, others were doing DRM, and the company rightly failed promptly), and have done a lot of thinking about the issues.
Basically, OSS and DRM are mathematically incompatible. The purpose of DRM is to keep the user from being able to make a copy of the media in question. In order to do that, it must use encryption keys to hide the 'plaintext', and carefully control those keys. This is the core of what DRM is.
In order to plug the equivalent of the 'analog hole', all existing DRM implementations are binary-only, and carefully control and conceal the data path between the encrypted data and the finaly output hardware, so that it's 'impossible' for the user to get the plaintext.
As soon as you go Open Source, *anyone* can take the code appart, take the decryption routine, and get the plaintext right out of that. There is nothing 'forcing' the data directly into the hardware. At that point, the plaintext can be distributed, and the DRM has failed.
More important than that even is the fact that open-source licenses guarantee that you can redistribute your modifications. It will be a grand total of about 2.37 hours between initial release of the software and someone releasing a version that will export the plaintext. Guess how popular the original release will be?
No, I think the results of this little experiment will be mixed good and bad:
Good: it will prove that DRM is mathematically impossible
Bad: it will 'prove' that the industry *must* use binary-only distributions of such software in order to make it work
It remains to be seen which of these will take effect first.
GStreamer - The only way to stream!
Its good.
Why? Because it would be implemented in, obviously, an open manner with publically defined protocols and specifications. Therefore, anybody who wanted to build an infrastructure to support DRM could do so without locking people into a single vendor or implementation.
Somebody asked why couldn't you just change the libraries to let you bypass it? Well sure, if you can change the code on the machine, you *may* be able to bypass protections, depending on what they are. For example, if the file (text, sound, media, etc.) is encrypted and requires a decrypt key, mucking around in the code isn't going to help it decrypt itself.
Now.. what about extracting the protected media after the decrypt step? Well, thats a bit harder. In fact, that was how people broke Microsoft's first WMP protection.. they wrote a null sound driver that just dumped the output to a file. Works pretty well. Don't think that they didn't notice, when all of their drivers need to be signed these days..
Anyway.. there are different parts to Digital Rights Management. Step 1 is access.. can you access a file or not. Crypto protects that, and no open or closed source will change that. Step 2 is decrypted control. Who can manipulate the decrypted bytes of the media? That is up to people to implement and protect as they see fit.
Remember that an OSS DRM solution could provide an open source platform for building closed source clients and devices.. You have the advantge of an open standard combined with actual devices using it.
Emmett,
I agree that 10% of our proceeds should go to Xiph.org; tonight I will update the web page so that 10% of a purchase will go to Xiph.org as well as the EFF. The reason this change was not done sooner was because at the time OGG-S started, Xiph was not a non-profit organization (charging for the fixed point decoder).
Also, if you believe the name of OGG-S could cause any consumer confusion please feel free to email me at rsage@sidespace.com and I will work on changing our site accordingly. Since OGG-S has been mentioned on the Vorbis mailing lists in the past, I had assumed this name would not cause any confusion.
Sincerely,
Ryan @ SideSpace
But of course, that's not how it really works.
Until someone comes up with a viable way of compensating creators for thier content without restricing how that content is used in any way shape or form, restricted content is going to be reality
What about books? They aren't 'restricted content' except in that the law prevents unlicensed copying. They are only restricted in this very limited sense.
You seem to think DRM is a 'harmless technology', just as copyright is a 'harmless law'. But while the existence of a copyright law is justified to an extent, it is being abused and extended by big media firms so much as to make it draconian. And again, while DRM perhaps has its place, publishers threaten to implement it in a way that eliminates fair use.
Libre Software providing the freedom to release your creation as you want...
No, freedom isn't about releasing content 'how you want'. The restrictions we want to have on content are ones that prevent anyone from ever taking away our access to fair use of that content. DRM threatens to do exactly this.
Sounds great, thanks!
Also, if you believe the name of OGG-S could cause any consumer confusion please feel free to email me at rsage@sidespace.com and I will work on changing our site accordingly. Since OGG-S has been mentioned on the Vorbis mailing lists in the past, I had assumed this name would not cause any confusion.
The fact that someone would package Ogg Vorbis with DRM was inevitable (and welcome, as is any derivative work based on our stuff); The only issue I have with this implementation (as I'm unaware of the technical aspects of it as yet) is that it uses the name 'Ogg.'
That being said, I would very much appreciate it if the name of this product were changed. I'd rather avoid confusion sooner rather than later. After all, 'Ogg Vorbis' was only a project codename, and was never expected to take off. :)
Emmett Plant
CEO, Xiph.Org Foundation
No one like the product activation in Windows XP or Office XP, but at the same time product activation makes piracy less workable and forces users to face the high price tag Microsoft has placed on these products.
Ok, so it's mostly Microsoft who spreads this one, but even some Slashdot users fall for it.
You think product activation stopped XP piracy one iota? Think again. Cracked copies were floating around before it even hit retail shelves. Service pack 1, you say? Once again, within days of that debacle, a workaround even my parents can handle was available.
People get their warezed XP the same way they got their warezed 2000, ME, 98, etc. Kazaa and its ilk are making it even easier.
Know who product activation hurts? Not pirates, that's for sure. It hurts those of us who do anything more than install XP once, on one system, ever. Want to mirror your desktop's contents onto your laptop? Sorry. Have to re-install Windows? Sorry. Bought a new computer? Sorry. If you're lucky, you're only forced to upload some data to Microsoft. No internet? Hope you don't mind sitting on hold for a while. Past what Microsoft considers an acceptable amount of re-installs? Oh well, hope you have another $300.
The University I attend gets free copies of Windows and Visual Studio for its CS students. I can get as many license keys as I want without paying. But, I still have to deal with Microsoft's insane activation scheme if I want to use XP. Instead, I just use 2000. One CD, and *I* get to choose how I use it.
Know what most students are doing, to get around the hassle of activating XP so many times? That's right, downloading the cracked version. Guess what they're going to do once they're out of school and want the latest version of Windows?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.