RIAA Tracking Songs by MD5 Hashes

aSiTiC writes "Apparently RIAA has obtained some technical experts in their prosecution of file swappers. Currently they are tracking traded mp3 files from the Napster network by matching MD5 hashes. This seems quite interesting but I was under the assumption that identical hashes could be created with identical rips and id3v2 tagging. Now may be the time to update your illegal mp3 file MD5 hash sums."

Comments

gee?

[Comsn]

The RIAA, the trade group for the largest record labels, said it also found other hidden evidence inside the woman's music files suggesting the songs were recorded by other people and distributed across the Internet.

ya think? and here i thought it was the magical mp3 fairy who put mp3s on my hd...

Re:gee?

[squiggleslash]

To put this in context, the RIAA was responding to the impression "Jane Doe" gave that the MP3s were rips of her own CDs:

The disclosures were included in court papers filed against a Brooklyn woman fighting efforts to identify her for allegedly sharing nearly 1,000 songs over the Internet. The recording industry disputed her defense that songs on her family's computer were from compact discs she had legally purchased.

Of course, the wording of the latter is ambiguous - it could mean nycfashiongirl meant she had downloaded MP3s of pieces of music that were also on CDs in her possession. A lot of amateur lawyers on Slashdot (ahem) claim this is fair use, and given it's non-commercial and wouldn't have an impact on the ability of the artist to make a sale, that may well be true.

(This wouldn't, though, be a defense for the central problem that she made all of these MP3s available for download by millions of anonymous strangers without the consent of the copyright holders. And assuming her identity is revealed and she is sued, if the "ambiguous" claim's alternative interpretation is correct, she'll be able to show the CDs to the Judge.)

Re:gee?

[TedCheshireAcad]

It would still be possible for her to have music with an md5 hash the same as a file on the Napster network. If they were ripped with the same encoder/bitrate/id3 tag as the Napster version, it's possible for md5 to be the same.

This may actually be an interesting legal test on the security of md5 itself. I can see lawyers arguing over collisions in the algorithm, and how a collision can help a defendant escape conviction, or simply invalidate md5 as a hashing algorithm that's "court friendly".

Re:gee?

[laird]

It's true that two different people could generate RIP's of the same track with the same MD5 hash, but the odds are low: they'd have to use exactly the same encoding settings, and enter exactly the same ID3 tags with exactly the same values. (Counterpoints: they could be default settings, and CDDB/Gracenote metadata, which would improve the odds a bit) And since we're talking about large music collections, the exact matching would have to have to happen across hundreds of tracks. And if the ID3 tags had notes like "ripped by so-and-so" that'd kinda blow the case. So while it's certainly true that MD5 hashes don't completely uniquely identify a particular RIP of a track, I think that when compared for large numbers of files, it'd be a pretty good indicator of file copying.

Re:gee?

[GigsVT]

But I thought that case was a pure Due Process challenge? Is that a different case I am thinking of?

Re:gee?

[InsaneCreator]

Unfortunately, the magical mp3 fairy does not exist. Also, they've canceled Christmas... and the Easter Bunny is dead!

Re:gee?

[nearlygod]

About this interpretation of Fair Use: I agree that downloading mp3's of CDs that you have purchased should be fair use. I am in a similar situation. A couple of years ago I lost 90% of my CD collection in an apartment fire. I had about 20 of these CDs ripped at the time and since then, I have downloaded many of the others to replace what I had paid for. In some cases, I re-purchased the CD because I wanted to have an original for some of my favorite artists but I didn't mind the mp3 mastered replacements for many of the CDs. Would this fall under Fair Use? I would think that it does since the RIAA seems to think that we are only purchasing a license to listen to the music. However, if I had to present the original CDs to a judge to prove that I do/did own the physical CD, I would be SOL.

Re:gee?

[Anonymous Coward]

You mean 128 kbps with no ID3 tag? Gee, I don't have a lot of files like that, or anything.

Re:gee?

[Anonym0us Cow Herd]

It would still be possible for her to have music with an md5 hash the same as a file on the Napster network. If they were ripped with the same encoder/bitrate/id3 tag as the Napster version, it's possible for md5 to be the same.

It is also possible that, as someone else suggested, the magical mp3 fairy left those files behind on her hard drive. In fact, I would propose that the mp3 fairy theory is even more likely.

The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit.

It is not possible (okay, unlikely, but unlikely enough for me to say not possible) to have two different files with the same MD5 hash. And definitely not likely by accident.

If even one single bit of the file is changed, then approximately 50 % of the bits of the MD5 hash will change. What cryptographers call "good diffusion properties". Good enough to trust for digital signatures, secrets, etc. You sign the MD5 hash of a document, because nobody else will have a document with the same hash.



To preempt one of the inevitible replies let me state: yes I know that you could have two different files, in theory that have the same MD5 hash. After all the files are much larger than the MD5 hash of 128 bits. Multiple files hash to the same value.

But the whole point of the design of MD5 is such that you can never create or discover any two such different files that hash to the same value.

If you were to examine 2^127 different files, then you would have a 50% chance of one of them giving you the desired MD5 hash. Do you know how large 2^127 is?

I would say that there is better than a 2^127 chance that the mp3's were left behind by the magical mp3 fairy.

Re:gee?

[bomek]

Even if everything is the same, i doubt that md5 would still be the same... The original CD can have scratch, and so long. there is too much stuff...

Re:gee?

[squiggleslash]

It is a due process challenge as I understand it. But right now there's a "Well, it's obvious she's a pirate", "Oh no I'm not, besides pirates say "OOoah" and swash their buckles, they don't copy stuff", "Oh yes she is, look at these MD5 sums, oh and by the way get a dictionary on that pirate thing" thing going on. My comments are in response to the latter.

Whether the RIAA's case that she was engaged in copyright infringement has a bearing on the case I don't know. Usually due-process would involve the RIAA giving this evidence to a judge, and the judge saying "Looks like prima-facie evidence to me" and issuing a warrant. The RIAA seems to be saying "It's ok the DMCA lets us do this without a judge, we're using prima-facie evidence anyway, which means it's still due process and it's how the DMCA is supposed to work", but, not being a lawyer, I don't know how that would play out.

Re:gee?

[Oddly_Drac]

"The RIAA, the trade group for the largest record labels, said it also found other hidden evidence inside the woman's music files suggesting the songs were recorded by other people and distributed across the Internet."

Sh*t! Now they can read ID3 tags!

Is there no end to their devilishly mad PC skillz?

Re:gee?

[Crayon Kid]

OK, then here comes the other side of the issue: what's stopping people from simply changing a letter in the mp3 info tag (the trivial approach) or a bit or byte somewhere in the file? Good luck matching my file to anything.

Re:gee?

[arth1]

This wouldn't, though, be a defense for the central problem that she made all of these MP3s available for download by millions of anonymous strangers without the consent of the copyright holders.

Unless she had an OC-48 or two going into her home, she didn't make the files available for download by *millions* of strangers. When the resource is limited, the magnitude of the crime is likewise limited. If you offer a stolen watch on the streets of New York, you can't be charged with trying to sell it to MILLIONS of people, cause there's only one watch. Likewise, in this case there's only enough bandwidth for a certain number of potential downloads, and speaking of millions here is plain misleading.
If the people who downloaded files from her spread them further, that's THEIR crime and not hers, much as the guy who sold a stolen watch won't be found guilty for the watch buyer illegaly selling it to someone else.

And in this case, it's even less severe, as it's not a theft, but a copyright violation.

Regards,
--
*Art

Re:gee?

[Anonym0us Cow Herd]

what's stopping people from simply changing a letter in the mp3 info tag (the trivial approach) or a bit or byte somewhere in the file? Good luck matching my file to anything.

Well there are several things that could stop you. You could get the latest MISD (Microsoft Internet Social Disease), etc.

But if you don't, then short of other things stopping you, such as getting run over by a truck, you merely need to change one single bit in the file to have a very different MD5. That bit does NOT need to be in the ID tag. You could just decode one single mp3 frame, randomly selected from the file, alter one bit of the sound, and then re-code that single mp3 frame.

It is even possible that someone might be inspired to write a tool to do this. It would defeat a lot of the previous Slashdot discussions about using MD5 to indicate "good" downloads before you download them. But maybe trust relationships of the P2P swappers themselves, using private keys, is a better idea than trusting the download file.

Re:gee?

[Anonymous Coward]

There might be....

Re:gee?

[sinergy]

Why on earth would you destroy the quality of your mp3 by decoding/re-encoding the music when all you have to do is change something in the IDv.x tags? Someone could, more easily, write a program that adds a random letter to the "Comments" field of IDv3.

Re:gee?

[EvilFrog]

Scratches on CDs don't affect the audio. They can make the audio skip because part of it is unreadable, but if that happened you would get an error while ripping the track. So a flaw on the CD would not affect a rip.

Now, if there was a little blip in the ripping process (caused by the computer, not the CD) you would still end up with two different files.

One other thing to point out- it is technically possible for two unrelated files to have the same MD5. Just very (very) unlikely.

Re:gee?

[gozar]

This is pretty common at least with iTunes. Most of the people will not change the default settings, so each cd rip will be identical, all using the same id3 tags.

Re:gee?

[3terrabyte]

But none of the cases have anything to do with downloading illegal mp3's. It has to do with distributing mp3's illegally.

The laws that the RIAA has purchased only mention 'illegal distribution'. All this crap we're hearing about "illegal downloading" is just crap spewn to the media. FUD FUD FUD what? FUD FUD FUD

Re:gee?

[Anonym0us Cow Herd]

Why on earth would you destroy the quality of your mp3 by decoding/re-encoding the music when all you have to do is change something in the IDv.x tags? Someone could, more easily, write a program that adds a random letter to the "Comments" field of IDv3.

I didn't say to destroy the quality of your mp3.

Decode one single 11 byte frame. Alter one bit. Re-encode it. In fact, as I understand things, the sound is stored as the sums of frequencies (FFT) or something like that. (Not an expert on this.) You could probably just alter one bit in the correct frame such that you add a new blip of a frequency at an imperceptably low amplitude.

Another possibilty is that there may be "zero" or "unused" bits in some header fields. Hypothetical example, in some bit field, 3 bits are not yet defined. Simply define tham as RIAA bits. But this gives limited possibilities to obscure the hash.

Another possibility is to alter or add one frame of "silence" at the beginning or end. If there is already a frame of silence, then alter that in an imperceptable way.

There may be other kinds of imperceptable alterations that can be made to mp3's.

Two consecutive frames may indicate the same set of frequencies being played at this moment in time, but at slightly different amplitudes. Swap the two frames. Or alter by one bit the amplitude of one of the frequencies that is least audible, such as deep bass. Or alter the start time of when a particular frequency starts or ends by an iimperceptable amount.

I'm talking about changes such that even if you have a 10th generation copy that has had 10 random alterations done, each by one person in the chain of handoffs from the person who originally ripped it, you have a "perfect" quality mp3, as far as mp3 "quality" goes.

Re:gee?

[3terrabyte]

Excellent point. The "magic number" system the RIAA uses is astounding. 52X burners count as 3 cd burners? $750 to $150,000 damages PER song is crazy.

I thought I remembered seeing something about how you have to have a certain $$ amount before getting a felony. $2000? ANyway, they then said each song was worth about $200. I think it was something like $20 per song, times 10 people. 10 people being the gestimate of people you magically distributed it to, because obviously more than one person can download a song from you. Anyway, 10 songs and you're a felon.

Anyway, these numbers don't add up. The RIAA likes to paint a screen of terror by saying that your one song you shared, can then be shared exponentially after that. Sure, it's true. You share it to 2 people. They share it to 2. By the end of the day, 1,000,000 people have it. But why would you be responsible for the 2nd thru 20th level of distribution? You only gave it to 2 people. And if it's "worth" $1 on iTunes, why isn't the damage $1 per song per download?

It's this magic number system the RIAA counts by that causes them to sue 4 students for 47 billion dollars. It would have taken the RIAA 5 years of GROSS profits to hit 47 billion dollars. How can a search engine running for a couple months on a campus amount to 5 years of GROSS profits?? It doesn't...make...sense.. you must acquit.

Re:gee?

[MattRog]

Yeah, but editing the bytes/re-encoding/etc. is an overly complex solution to the problem. As the parent said simply add/change a character in the comments field of the ID3 tag; this is something that any user can do without complex tools and without risk to the data.

Obviously if *all* the fields are filled to the brim (very, very unlikely) with 'good' data then there's a chance that you could introduce inaccurate ID3 tag data, but I have yet to see anything mission-critical relying on the ID3 tag.

Re:gee?

[nearlygod]

First they went after the software/servers. Now they are going after the people sharing the files. Do you beleive that they will stop there. Secondly, it is my understand (perhaps I'm wrong) that the laws deal with the "copying" of copyrighted material. Since a digital copy is made when I intiate a download, I have no doubt that downloadding will soon fall into the sites of the RIAA. The person sharing the files may be making them available to copy, but the copying in happening in the download step.

Re:gee?

[Anonymous Coward]

fuck all that, dumbass its so much easier to change a letter in the id3 tag

Re:gee?

[Anonymous Coward]

(Off topic, hence AC)

You know, I thought you were trolling with the .sig, but Google brought up this.

Well I never. If that doesn't explain the attrocious direction of GNOME I don't know what would.

Re:gee?

[MattRog]

Of course, if they do some sort of method to de-couple the MP3 data from the ID3 tag data *then* compare MD5 checksums then yes, you could have a problem.

However I doubt that they will go to such trouble -- if they have access to your files you're pretty much caught red-handed. A different MD5 checksum won't get you off of the hook here.

Re:gee?

[mfrank]

OTOH, of the dozen or so people who download from her, most will share with others, and so on, and so on. Whoever first puts a pre-release copy of a new CD on Kazaa will disseminate plenty of copies of their rip, even if only a handful of people actually get it from his machine.

Re:gee?

[mrkrause]

But the whole point of the design of MD5 is such that you can never create or discover any two such different files that hash to the same value.

Right...but that's not what your parent is saying. I agree the point of MD5 is that different files ==> different hashes; same files ==>same hashes.

However, suppose we all rip using the same encoder/settings and add the same id3 tags. We should all produce identical mp3 files (assuming the CDs aren't horribly mutilated, the encoder doesn't use any sort of pseudorandom stuff, etc), since it's deterministic.

Those files, being identical, should have identical hashes. There's no need for the mp3 fairy.

Re:gee?

[Anonymous Coward]

She isn't claiming she ripped all of the files, she is claiming she owns the CD's those songs came from. She should then still be OK, since she is using music on her computer that she owns.

Re:gee?

[3terrabyte]

Do you beleive that they will stop there

No, I don't think they'll stop at anything, obviously. But you can't get ahead of yourself. You can only deal with the facts as they're presented. The fact that all the laws (and lawsuits) specifically state distribution is significant in itself. It's possible that they haven't sued any downloaders now because THEY KNOW it's not illegal to. Thus, the point of my conversation.

but the copying in happening in the download step

Actually this has been brought up before, and it's not true. To make a copy of a file, you must first have a copy to begin with. Thus the person who is uploading is doing the copying. Obviously the downloader doesn't have the original copy, thus can't be doing the distributing.

Buying drugs and selling drugs is 2 different things, and gets you 2 different penalties in the law. Sorry for the bad analogy

Even in the NET ACT, we see the same thing. The NET ACT is important to know because it redefines the criminal definition of "for profit". It states that the term "for profit" includes getting other copyrighted items in return. Thus, it was specifically designed to criminalize trading. (To close the loophole that only people who sell bootlegs for money as criminal. Now just trading can bump you up to criminal suits, instead of civil suits) The point is though, that leeching off a service like Kazaa falls outside this realm again.

Re:gee?

[squiggleslash]

Analogies comparing theft and piracy are always a little dangerous, but nevertheless I disagree with you on both counts. The fact she didn't have an OC3 going into her home isn't really relevent as she was using a network based on mirroring and redistribution. As long as there are tens of millions of users of Kazaa, putting a file up for download means that that file has the potential to be obtained by millions of others, and if it's a popular work, that it probably would be.

To use the theft analogy, which as I said is dangerous: consider that someone steals a thousand watches, and then has nine hundred and ninety nine people help her hawk the watches on the streets of NYC. Do you think that this will be a thousand people getting very light slaps-on-the-wrists, or do you think that, while most - those who were not major figures in the operation - would still get that, some of that thousand will be treated as being part of a major criminal operation? Would a bank robber get a more lenient sentence because he had accomplaces?

To use a more useful analogy, if she'd copied one copy onto her ISP's Usenet server, could anyone reasonably suggest that she hadn't made it available to millions of people on the grounds that she'd just posted it to one place?

The very reason networks like Kazaa are considered problems by groups such as the members of the RIAA are because a single person joining the network can initiate the unauthorized transfer of copyrighted content to millions of people. The RIAA appears to have determined that the "king pins" in this network are those who put the largest amount of content up to download, as opposed to those who post copies they've made of their CDs, etc. It'll be interesting to see how this pans out.

Re:gee?

[Anonymous Coward]

The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit.

Wrong, MD5 dosen't calculate all of the file after the first 300Kb.

Source

Re:gee?

[anthonyrcalgary]

>> "It is also possible that, as someone else suggested, the magical mp3 fairy left those files behind on her hard drive. In fact, I would propose that the mp3 fairy theory is even more likely."

For loose definitions of "fairy", yes. eg child, friend, etc

>> "The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit."

Try the following: Install some CD ripping/encoding software. Leave it at the defaults. Use CDDB to generate the ID3 tags. Unless something gets corrupted, that *will* produce an identical file, down to the last bit.

Re:gee?

[Anonymous Coward]

go back to your crypto text looking for words like 'collision' and 'birthday attack'.
Making another file with the same sig is easy, we did it as an assignment at school with text files instead of mp3s, but the point holds.

Re:gee?

[Anonymous Coward]

WHY WOULD THEY USE THE ID3 TAGS?
WHO IN THEIR RIGHT MIND WILL USE THAT WHEN IT CAN CHANGE SO OFTEN?

How about they just start from the beginning of the actual audio track and calculate the checksum for the first one minute. This will provide a much more consistent result.

Re:gee?

[nearlygod]

I see your point, but I am not clear on the definition of copying in this context. As a downloader, I am initiating the copying so to me I am making the copy. I can borrow your CD and copy it. Are you saying that you are breaking the law because you let me borrow it or I am because I am duplicating it?

Re:gee?

[los furtive]

If you use CDDB when ripping, then there's a good chance the ID3 tag will be identical. You are correct about the 'ripped by so-and-so' part, but again, a lot of people leave the defaults on there.

Re:gee?

[Anonym0us Cow Herd]

You point out a very real danger.

If you just alter the ID3 tags without altering the mp3 content, then they can nail you. If simply altering id3 tags becomes commonplace because everything thinks it is the easy, trivial implementation, then they will nail you by checking the hash of the content. Identical content with trivially altered ID3 tags is a very good argument that you got this file from the thousands of other people who have the same hashed file with trivially altered ID3 tags.

I'm proposing a non-trivial, but not that conceptually complex alteration to the content that alters it in an imperceptable way. In fact, whether the alteration seems complex to you is irrelevant. After all, it is just a command line tool to you anyway, just like altering ID3 tags. You don't care how it is done. Run this tool on your mp3 file, it randomly affects an imperceptable alteration to one of the gazillions of 11-byte frames in the file.


However I doubt that they will go to such trouble -- if they have access to your files you're pretty much caught red-handed. A different MD5 checksum won't get you off of the hook here.

They might have access to your files if you are sharing them.

I think the original argument is that Jane Doe was sharing files. Jane claims the sharing is unintentional. Jane claims that the mp3's on her hard drive are her own rips of CD's she owns. The MD5 hash proves otherwise. This sub-discussion is about altering mp3's so that hashing is now useless at tracking the source of where you got an mp3 from. In the Jane Doe scenerio, a comples mp3 alteration to foil the MD5 hash would actually be useful.

Merely altering the ID3 tag such that the RIAA can also alter the ID3 tag back to what it is in the wild, and get identical MD5 hashes is a very strong argument against Jane Doe.

Re:gee?

[Anonymous Coward]

Ooops, I meant this.

Re:gee?

[Anonym0us Cow Herd]

It depends on what you mean.

Let's clarify terms.

RIP: we'll use this term to mean running, say, cdparanoia to "rip" the track from a CD into a WAV or AIFF file. (lossless)

Encode: we'll use this term to mean transforming a lossless audio format into an mp3 format.

If everyone had the same WAV file, then you are correct. Same encoder, same settings, same ID3 tags ---> same MD5 hash.

But everyone won't start with the same WAV file. If you run cdparanoia twice to rip the same track you will get different WAV files. This does not seem intuitive, but it is apparently true. There are apparently a bunch of complex factors that affect the ripping process.

I suppose an easy test of this would be to rip the same track twice and compre the MD5 hash of the two WAV files. (Don't bother encoding with mp3.) Then you would prove or disprove what I am saying. Sorry I don't have any references on this.

Re:gee?

[tmark]

What if your CDs were simply lost ? Would you still expect to be entitled to fair use of those CDs ? Would you expect that the person who found your CDs would *also* be entitled to fair use ? What if the CDs were stolen ? What if you lent the CDs to your friend who lost them ? What if you sold the CDs but, if you were ever prosecuted, planned to claim they were stolen in order to claim fair use ?

I think the wide opportunity for abuse makes the only practicable interpretation of fair use to rest with physical possession of the original media.

Re:gee?

[Anonym0us Cow Herd]

Try the following: Install some CD ripping/encoding software. Leave it at the defaults. Use CDDB to generate the ID3 tags. Unless something gets corrupted, that *will* produce an identical file, down to the last bit.

You may be right. I'm not sure. I have some doubts about the ripping process being as exact as you say. I agree that the mp3 encoding process is exact. Same input file, same settings, ---> same output file.

Re:gee?

[3terrabyte]

I can borrow your CD and copy it.

Beats me. We've always been "allowed" to make tape copies and lend tapes/cd's to friends, etc. Some of it protected under Fair Use, some of it just ignored by the RIAA. But with the event of digital and millllllions of p2p users... now they think it's a problem and trying to kill it all.

Even though it's legal to own a VCR and tape shows, let's not forget the MPAA tried to make it illegal back then!

The RIAA would like to crush fair use completely by pushing a SDMI (or DRM) technology and implement a pay per play. They'd be rich. Err... Richer.

You raise good semantic questions about the definition of Copying. I don't know the answer. I think we can agree on logically the correct answer, but logic hardly has anything to do with laws nowadays.

Distribution seems to be the key word. "Making available to others". For instance, if a rogue radio station that didn't pay ASCAP royalties to the RIAA started playing music on the air... The listeners are not responsible or liable. Only the rogue radio station. I would imagine (logically, heh) that downloading mp3's excuses you, but not the distributer. Someone also mentioned that it'd be hard to prove in court that you knew what you were downloading exactly. But the distributer would be liable to know.

Remember the RIAA honeypots on Kazaa? Servers with fake songs... Well nothing came of that except songs that said "quit stealing" and message being sent to downloaders saying "we know you downloaded mp3's!". But these honeypots are not being used for the subpoenas or warrants. Only people distributing them. Personally I think it's significant.

Re:gee?

[nearlygod]

Valid points. But the burden of proof should be on the RIAA is those cases. Just because their are many possible situations where the right to fair use could be extorted, that should not mean that I no longer have the right. I am able to make backup CDs because I could lose them in a fire, they could melt in a hot car or even be stolen or lost. If I am no longer allowed to use my backups, then what is point of backing them up. Especially if they are stolen, am I supposed to through out the backups because suddenly the theif has the right to listen to these songs instead of me. The theif is the one who is breaking the law since he has no "license" to listen to the music. That still belongs to me with my backup copies.

Re:gee?

[Anonymous Coward]

A scratch on a CD may or may not result in a different MP3, depending on the software and drive used to make the rip. I have some MP3s in my collection that I had ripped from scratched CDs and the typical "clicking" sound resulting from the scratches is encoded right into the MP3.

So indeed, even small scratches on a CD could produce a very different MP3 than a perfect CD.

Re:gee?

[anthonyrcalgary]

>> "I'm not sure. I have some doubts about the ripping process being as exact as you say." ...yeah, me too. Hence my "unless something gets corrupted" disclaimer. But it's mostly the same, I think most differences have to do with length, so there aren't all that many different possibilities.

Re:gee?

[elmegil]

The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit.

So let's see. You rip a song from a CD (where every copy of the CD has an identical bit-for-bit copy of the song). You compress it with a particular codec at a particular bit rate, which is deterministic and produces the same compressed output every time. You add id tags, very likely compiled from the same source--cddb--and therefore letter-for-letter identical down to capitalization & punctuation. Where exactly are these "different bits" going to come from?

It sounds to me like it is quite reasonable to assume that two people ripping the same song off their own legal copy of the same CD are very likely to have files which are bit-for-bit identical, if they rip at the same bit rate. Even moreso if they use the same ripping software. Given the millions of people using ripping software, I'd say that I'd be amazed if this DIDN'T happen regularly.

Re:gee?

[Anonymous Coward]

Couldn't you: echo z >> supercoolfunky.mp3 and get the same effect?

Re:gee?

[AJWM]

I have some doubts about the ripping process being as exact as you say.

So did I, so I just ran the experiment:

al% cdparanoia -d /dev/hdd 1 pf.wav
cdparanoia III release 9.8 (March 23, 2001)
(C) 2001 Monty <monty@xiph.org> and Xiphophorus

Report bugs to paranoia@xiph.org
http://www.xiph.org/paranoia/

Ripping from sector 0 (track 1 [0:00.00])
to sector 17511 (track 1 [3:53.36])

outputting to pf.wav
(--stuff omitted due to lameness filter--)

al% cdparanoia -d /dev/hdd 1 pf2.wav
cdparanoia III release 9.8 (March 23, 2001)
(C) 2001 Monty <monty@xiph.org> and Xiphophorus

Report bugs to paranoia@xiph.org
http://www.xiph.org/paranoia/

Ripping from sector 0 (track 1 [0:00.00])
to sector 17511 (track 1 [3:53.36])

outputting to pf2.wav

(-- stuff omitted due to lameness filter--)

al% md5sum pf*wav
fd8ddaf41fd482a6aa1a492915a3e788 pf.wav
fd8ddaf41fd482a6aa1a492915a3e788 pf2.wav
al%

Looks like under identical conditions (same drive) it'll rip consistently. Ripping off a different drive might give different results, that's more hassle than I want to try right now. If anyone wants to compare, the disc/track I ripped is Pink Floyd's Dark Side of the Moon, Capitol's catalog # CDP 7 46001 2, DIDX 226. (Different recordings will almost certainly give different results.)

Oh, and to make RIAA happy:

al% rm pf*wav
al%

;-)

Re:gee?

[geekoid]

al% rm pf*wav
al%

ha nice try, we know the only way to delete something is to highlight it and click delete, and then empty the trashcan!

You can't fool us!

Re:gee?

[Zigg]

Scratches on CDs don't affect the audio. They can make the audio skip because part of it is unreadable, but if that happened you would get an error while ripping the track. So a flaw on the CD would not affect a rip.

Well, except that most decent rippers these days use paranoia or something similar, using algorithms to interpolate the corrupt stuff. The interpolation is going to sound good but it's almost certainly not going to be the same bit-for-bit. And bit-for-bit is what matters.

Re:gee?

[JoeBuck]

Excuse me? If you and I both have Red Hat 9, and we both fire up grip to create ogg files for the same track on the same CD, we'll wind up with bit-for-bit identical .ogg files, which will then have the same MD5 sum.

And only an idiot would put "Ripped by laird" in the ID3 tag.

Re:gee?

[KoshClassic]

"...but the odds are low..." Jack, a novice computer user, downloads a program for ripping CD tracks to MP3 files. He inserts his favorite Rolling Stones CD, rips track 3 using the default settings. Or, lets give Jack a little credit - he's smart enough to know that the default data rate of 96k/sec is too low, so he bumps it to 128. The ID3 tags are populated for him automatically by the program that connects to CDDB to learn the artist, album, and song titles on the CD prior to ripping track 3.

Jill, another novice computer user, goes through the exact same steps as Jack with the same legitimate CD.

Result? At least in theory, two IDENTICLE files. Their MD5 hash will be the same. Their CRC will be the same. A bit by bit comparison will reveal them to be the exactly same.

While this is no defense for sharing the files, it certainly shows that the RIAA's "tracing" methods are flawed, at best. DNA testing this isn't.

Re:gee?

[Anonymous Coward]

i don't know anything about your setup, so i can only speculate, but what you've just described is EXCEEDINGLY unlikely to occur in general. take a look at the cdparanoia FAQ on this subject for an explanation. on any of the three linux boxes i've used (one brand-new compaq and two older dells with yamaha and toshiba drives), i get different MD5 hashes from successive rips of the same track on the same drive. your drive must be extraordinarily consistent compared to the vast majority of drives out there if what you describe happens regularly. as many posters on this thread have pointed out, the "bit spread" in hashes such as MD5 is designed to be very, very large -- that is, if even one bit in the source file flips, about half (64?) of the bits in the hash will flip and the result will be totally different.

-fp

Re:gee?

[Zigg]

Different drives, with the same disc, and identical software, certainly do give different results. Just tested. Identical versions of cdparanoia live on both systems.

I also ran lame with default settings (makes a 128K CBR) on both WAVs and got different sums there as well.

No tags involved.

Re:gee?

[pod]

But then you're assuming everyone will get identical, perfect rips, which are not possible with many CDs.

Re:gee?

[AsparagusChallenge]

With Picture Perfect Morning/Edie Brickell (the first disk I had to hand) I performed the following operations:

$ cdparanoia --version
cdparanoia III release 9.8 (March 23, 2001)

$ cdparanoia 1
$ mv cdda.wav cdda.wav.bak
$ cdparanoia 1
$ md5sum cdda.wav
e4b3334b8f63601fa6f337ba4faa14e8 cdda.wav
$ md5sum cdda.wav.bak
e4b3334b8f63601fa6f337ba4faa14e8 cdda.wav.bak

I don't know what factors would make cdparanoia change the checksum but in this case that didn't happen. Of course, to consider this a valid test we need another user of the same cdparanoia version with Picture Perfect Morning (same edition) to verify the results.

Re:gee?

[Theaetetus]

Identical content with trivially altered ID3 tags is a very good argument that you got this file from the thousands of other people who have the same hashed file with trivially altered ID3 tags.

Point of order - could just be that you used the same encoder/settings (i.e. iTunes on a default of 128k or 192kbps). Then the content would be exactly the same as someone else who legitimately ripped a copy on their computer in the same way.

This still doesn't clear you of the distribution part of the infringement, but certainly can clear you from the claim that you must have downloaded from them.

If I say 2+2=4 and you say 2+2=4, did you cheat off of me? No, we could easily and legitimately (and probably even) have arrived at the same answer independently. That's the point here.

-T

Re:gee?

[Anonym0us Cow Herd]

A single bit difference gives you a vastly different MD5 hash.

Re:gee?

[Anonym0us Cow Herd]

I'd say that I'd be amazed if this DIDN'T happen regularly.

I'd be amazed if it DID happen at all.

The mp3 coding process is exact, as you speculate. The CDDB process is probably exact.

I believe that the cdparanoia (i.e. ripping) process is not as exact as you think. An easy way to confirm this is:
1. Rip the same track, same CD, twice into two WAV files.
2. MD5 hash each of the two files.

Do you get the same MD5 hash? If not, then although the two WAV files may sound the same, they aren't actually the same bits.

I think the ripping process has a lot of variability. Sorry I don't have handy any references for this. But I believe I have represented it correctly.

Re:gee?

[Anonymous Coward]

I don't know of a single MP3 ripper anymore that doesn't error-check the data as it is ripped.

Heck, I've taken unplayable CD's, run them through cdparanoia and gotten songs with no (audible) skips.

I challenge that is in fact *very* easy to end up with two computers producing two identical MP3's with the same hardware/software combination.

Re:gee?

[Anonymous Coward]

I did the same thing with both my CD drives.

8b24f4f77034299b716cae19d687e807 icp2.wav
11d92db3509d53f40c62837e4d65f64e icp.wav

Also, I removed the second, then duplicated the first file and ran oggenc on both copies. This is the md5sum output.

8652995a3dbc5ff9888b0f2bab583959 icp2.ogg
56241131ffcc27e44a950bc8fac7b866 icp.ogg

I doubt very much that any VBR encoder produces the exact same output twice. Thanks for listening, and yes I did remove both copies afterwards.

Re:gee?

[tantlerur]

And if we had gone to read the CDParanoia FAQ, we would have learned that MD5 hashes of MP3 encoded songs are only good for tracking THAT PARTICULAR RIP and not the SONG itself. Different rips of the same CD on different drives/computers will almost certainly result in a different hash. From the FAQ:

Why do the binary files from two reads differ when compared? The problem is the beginning point of the read. Cdparanoia enforces consistency from whatever the drive considers to be the starting point of the data, and the drive is returning a slightly different beginning point each time. The beginning point should not vary by much, and if this shift is accounted for when comparing the files, they should indeed turn out to be the same (aside from errors duly reported during the read; scratch correction or any reported skips will very likely also result in different files).

Re:gee?

[Anonym0us Cow Herd]

I also ran lame with default settings (makes a 128K CBR) on both WAVs and got different sums there as well.

This part is not at all surprising. Even one single bit difference in two files would give radically different MD5 hashes.


Different drives, with the same disc, and identical software, certainly do give different results. Just tested. Identical versions of cdparanoia live on both systems.

This part is the really interesting result. Two different rips, same software, same CD, give different results on different drives. I think cd paranoia says something about "digital jitter" whatever the heck that means?

Re:gee?

[elmegil]

I think the ripping process has a lot of variability. Sorry I don't have handy any references for this. But I believe I have represented it correctly.

I think the moon is made of green cheese, but don't ask me to prove it.

Re:gee?

[elmegil]

I'd have to say that the problem with this approach is that it's easily reversable. I suppose "easily" is perhaps the wrong sense, when you're talking about the RIAA having to reverse all the possible ways it could be done, but the fact remains, if they suspect it's the same file, it doesn't strike me as too hard to write a tool that ignores the ID3 tags and does an MD5 hash on just the "data payload". And then you're back where you started.

Re:gee?

[Anonym0us Cow Herd]

could just be that you used the same encoder/settings (i.e. iTunes on a default of 128k or 192kbps). Then the content would be exactly the same as someone else who legitimately ripped a copy on their computer in the same way.

Very unlikely. See other posts here. Some have even conducted the experiment I suggested and gotten the results I expected. While the mp3 encoding process may be exact, the cd-ripping process is not. Same CD. Same Drive. Same Softare. Different WAV files resulting.

Re:gee?

[anthony_dipierro]

This wouldn't, though, be a defense for the central problem that she made all of these MP3s available for download by millions of anonymous strangers without the consent of the copyright holders.

True, but that could have been an accident. Perhaps she just happened to be sharing her "My Music" folder.

Re:gee?

[elmegil]

I think the Cow Herd thinks everyone has crappy CD drives with lots of jitter :-)

Re:gee?

[Anonym0us Cow Herd]

After I posted this, some have already tried the experiment. Some get the same result, others do not. Someone even pointed out that the CD Paranoia FAQ makes it clear that you cannot expect the same results of ripping the same CD even on the same drive!

My point is that I am not making wild assertions.


I think the moon is made of green cheese, but don't ask me to prove it.

Of course, you are entitled to your opinion on this just as you are entitled to believe that ripping the same CD on the same drive with the same software gives the same WAV file.

Re:gee?

[elmegil]

If you had bothered to cite some evidence (as those others have) instead of saying, as you did "I don't have a reference I just think this way" I would not have ridiculed you. If you're going to make assertions which don't make sense to those you're addressing, you have to back them up. Otherwise don't flippin waste our time.

I will acknowledge that some CD drives do appear to have enough jitter to produce different files on subsequent tries; personally, I think those are likely the cheap ass ones. It's also obvious that some people are getting the same results every time. What's really germaine here is what the likelihood is of two different CD drives producing the same WAV.

Unlike you, now that I see there is room for doubt in my position, instead of simply continuing to assert I intend to actually do some research before I make further assertions. I have 3 or 4 easily accessable CD drives at home, and intend to check them out (with the Pink Floyd track from earlier so I can also compare to those results).

I suspect that drives that can consistently provide the same file time and again have a reasonable likelihood of providing the same file as a different, similarly stable drive. Which leads us back to a high likelihood that Jane Doe's files are indeed her own. But that's clearly only a working hypothesis; I'll get back to you when I have real results.

Re:gee?

[kimba]

Wrong, MD5 dosen't calculate all of the file after the first 300Kb.

Wrong, MD5 does. Kazaa doesn't.

Re:gee?

[Zigg]

This part is not at all surprising. Even one single bit difference in two files would give radically different MD5 hashes.

Right, but I figured, maybe the bit differences might disappear in the encoding, some wacky things you can only determine empirically :-)

Two different rips, same software, same CD, give different results on different drives. I think cd paranoia says something about "digital jitter" whatever the heck that means?

Not sure about "digital jitter" myself, but I do know that pretty much all discs have errors all over the place (I backup my audio CDs with cdrdao, which tells me just how many CRC errors it had -- not seen a disc with less than a hundred yet), and the difference probably lies mostly in error correction strategies employed by the drives themselves. I don't know this for sure though.

Re:gee?

[Anonymous Coward]

Actually I think the odds are very high. The reason is that there are only ever a few currently popular rip-and-encode apps in use. If person A in Reykjavik runs NiftyRip v1.2 on their store-bought CD and NiftyRip uses the CDDB to construct an ID3 tag, any other person using the same ripper will get the exact same file (assume NiftyRip uses overlapping reads to produce an exact copy despite any so-called CD "jitter"). And if NiftyRip is actually just a shell that uses reasonable defaults around a commonly available encoding engine (say LAME version something), even other apps on other OS platforms may come up with the same thing, if they construct the same tag and use the same defaults. Most people never touch the defaults, which is why there are so many godawful 128kbps MP3 files out there. In fact the main reason files might differ (other than encoder idiosyncracy like null padding) is when apps add their name and version as an ID3 comment. Older files often lack that, however, or lack a tag altogether.

MD4 and MD5 aren't 100% unique, no, but they're so close that we can assume every mp3 is uniquely identifiable. P2P networks that rely on them to download from different sources wouldn't work very well otherwise.

Re:gee?

[elmegil]

So if the difference is the error correction strategy, then what about two different drives that are the same model, same manufacturer, same firmware level? Hurm. Way too many variables to control reliably.

Re:gee?

[Anonymous Coward]

The main reason for methods like that isn't to overcome scratches, but to get an exact rip when the drive hardware doesn't support it (due to a vagary of the CD audio spec). There's no interpolation needed to do that, just multiple overlapping reads.

Some ripping libraries can also deal with scratches, but in reality most CDs don't have any that matter.

Re:gee?

[Anonym0us Cow Herd]

Unlike you, now that I see there is room for doubt in my position, instead of simply continuing to assert I intend to actually do some research

You need to seriously lighten up.

I had read my facts somewhere reliable before. I just don't remember where. Now it is clear that it was the cd paranoia faq.

I did express doubt in my original assertion.

Re:gee?

[shotfeel]

I don't think the courts are quite stupid enough to believe a magic fairy left the files there.

OTOH, if you say a virus did it...

Re:gee?

[Anonym0us Cow Herd]

Right, but I figured, maybe the bit differences might disappear in the encoding, some wacky things you can only determine empirically

I wouldn't expect two different WAV's that sound exactly the same to give the same mp3. But I wouldn't have bothered to test it either.

As I think about it, your theory is interesting. Since mp3 compression is based on the perception of audio, or getting rid of everything that you don't perceive, then there is some argument that two very similar WAV bit patterns that sound identical might actually be closer after encoding to mp3 than you might think. Of course an MD5 hash of the two mp3's is not a good indicator of this, as one single bit difference in two files radically alters the MD5 hash.

Re:gee?

[Hanzie]

If I'd still had yesterday's points, I'd have given you +1 funny.

Re:gee?

[WeeLad]

I think even if you try ripping the same track twice on the same machine, you'll get two different MD5 sums. Try it.

Re:gee?

[MattRog]

They might have access to your files if you are sharing them.

That's true, they could download a sampling of your files and then generate the hashes. I don't see the RIAA doing that, though. The checksums are only interesting in this isolated case - namely that the defendant is claiming that the MP3s were legally obtained (and could, presumably, provide the source media).

Going through thousands of MP3s and changing the data to change the checksum is the simplest way to make this claim - however since the MP3 process (rip-n-compress) is inherently lossy (given all the posts on this thread so far indicating that it is difficult to produce identical MP3s from the *same source*) you would need to prove that your file's flaws are only coincidentally identical to the commonly-stolen one (since you obtained it from a P2P source, after all).

So, you'd need to change enough of the data to remove ripping/encoding flaws that someone else made. Can you still do that and not destroy the MP3?

In short, I don't see that modifying the checksum is of any use. If you are sharing MP3s you are stupid and most likely will get caught and find yourself in court. People seem to think that they can get off on a 'technicality'. Are you even thinking that the RIAA isn't going to still file a subpoena because your hash doesn't match theirs? The RIAA smells blood - the best advice is to steer clear and not steal MP3s.

Re:gee?

[ianezz]

I ripped is Pink Floyd's Dark Side of the Moon, Capitol's catalog # CDP 7 46001 2, DIDX 226.

There's something strange going on here: I repeated your test just for the sake of it using a CD that according to the codes you gave should be the very same, and for the same version of cdparanoia.

# cdparanoia 1 pf2.wav
cdparanoia III release 9.8 (March 23, 2001)
(C) 2001 Monty <monty@xiph.org> and Xiphophorus

Report bugs to paranoia@xiph.org
http://www.xiph.org/paranoia/

Ripping from sector 0 (track 1 [0:00.00])
to sector 17834 (track 1 [3:57.59])
...

Please note that the ending sector is not the same as yours (tried also with option -T with no effect). As I said before, the CD bears the same codes as the ones you specified, and is clearly labelled "Made in USA" (I live in Europe). I also tried on another CD-reader, and the results are the same (ending sector is 17834). I'd expected that at least the TOC entries would be the same...

For further checking, here there is the output from cd-discid, if you want to check with yours:

# cd-discid /dev/cdrom
7d0a0e09 9 150 17985 34107 65972 87500 116192 151455 166880 184167 2576

Re:gee?

[eric76]

I wonder if their MD5 hash library uses just the song minus the tags. If they include the tags, the slightest change to the tag would change the hash.

This does bring up a possibility for blowing the MD5 hash library out of the water by writing and using a simple utility. I bet it wouldn't take long to do something like:

1) Remove the tags, or at least remove any identifiable information from the tags.

and

2) Modify an insignificant bit of information at several random points in the song. Chosen properly, the changes should be imperceptible,

and

3) Add a randomized fraction of a second of silence or impercptible background noise to the song.

Just run the utility against any file you download and the MD5 hash would be different from any other other MD5 hash for the same song.

Re:gee?

[eric76]

It would be trivial to identify the same versions of a song but with different tags.

Just strip the tags before doing the MD5 hash.

Re:gee?

[laird]

Actually, because of variations been CD's (error that the drive automatically recovers from) and between CD drives (sensitivity to errors, recovery algorithms, etc.), even ripping the sale CD with the exact same settings will usually result in slightly (inaudibly) different files. Even ripping the same CD with the same drive two times in a row can result in different files. Thus, different MD5 checksums. So a matching MD5 hash is a pretty good indicator of a file being a copy. Hundreds of matching MD5's between two file collections is a very good indicator of file copying.

Re:gee?

[Nucleon500]

It depends on your CD drive. Some older drives, the ones that jitter with cdda2wav, don't seek exactly. You can get jitter-free recordings with cdparanoia from those drives, but the start position will vary by a few bytes. But most new drives I've seen don't jitter even with cdda2wav, and do consistently rip absolutely identical files.

Interestingly, two Vorbis encodings of the same file will be different, because of the randomly generated stream serial number. And with MP3 or Vorbis, you could easily add "salt" to your own music collection to make it look original. This would screw up swarming downloads, though.

Re:gee?

[Nucleon500]

Unlikely or not, it does happen consistently on 3 of my CD-ROM drives. Many newer drives can seek with perfect accuracy, even when doing CDDA.

Re:gee?

[AJWM]

Well, the drive I tested with is a DVD drive, not a CD drive. Even though it's a low cost (unbranded, but IDs as Toshiba) DVD drive, the higher tolerances it needs to read DVDs may make it more consistent for ripping CDs.

Let me try it again now that the drive has been baking in my computer for a few hours (it hadn't been on long when I tried it earlier)...

(rip omitted)
al% md5sum pf3.wav
fd8ddaf41fd482a6aa1a492915a3e788 pf3.wav

...yep, same MD5. Somebody else want to try the experiment with a DVD-ROM drive?

I'll try it with my CD drive (a LiteOn R/RW burner -- it was busy before)...

al% cdparanoia -d /dev/sr0 1 pf4.wav
(...stuff omitted...)
Ripping from sector 0 (track 1 [0:00.00])
to sector 17511 (track 1 [3:53.36])

outputting to pf4.wav
(...more stuff omitted...)
al% md5sum pf[45].wav
9447cacef0a33a6cbd1a58caf8596cdb pf4.wav
9447cacef0a33a6cbd1a58caf8596cdb pf5.wav

Okay, different MD5s than from the DVD, but identical to each other. (In all cases these were clean rips, of course.) Although again, the tolerances on a burner may be better than on a plain CD-ROM drive.

Re:gee?

[AJWM]

Here's the output I get from cd-discid:

# ./cd-discid /dev/cdrom
6c0a0c09 9 150 17662 33730 65635 86820 115675 150852 166290 183597 2574

Despite the ID numbers, the discs are obviously from a different pressing, from a different disc master. The numbers are very close, but not the same.

Re:gee?

[Anonym0us Cow Herd]

This would screw up swarming downloads, though.

Not if the swarming block sizes were not arbitrary block sizes, but were blocks of even numbers of mp3 frames.

I read somewhere that an mp3 files is a bunch of 11 byte frames. Even including the header, ID3 tags. Everything.

If this is true, then swarming downloads of some block size which is a multiple of 11 bytes should still work.

Re:gee?

[Anonymous Coward]

Except if you use CD drives that supports the commands that lets you make a perfect rip (which a lot of drives do nowadays) and software like Exact Audio Copy that compensates between drive differences.

I can and have make identical rips with different manufacturers' drives with this method.

Re:gee?

[0111 1110]

Agreed. I don't understand why they are bothering with this since they are suing her for sharing RIAA owned files, for uploading them, not for downloading them. I don't see how showing that her files have a particular md5 hash helps their case at all. Whether she actually owns the CD or not, they can still (try to) nail her for uploading them.

Although it's pointless in this context, embedding a message like "RIAA sucks" or "Boycott RIAA labels" with steganographic mp3 encoders like stego-lame or mp3stego should alter the MD5 quite significantly. I seriously may start doing this.

Re:gee?

[Anonymous Coward]

Just in case you don't believe him, one should keep in mind that audio CDs have less error correction than CD-ROMs (after all, the goal wasn't bit-for-bit reproduction of the original data). This is the reason for the "jitter" correction built into all modern CD ripping software. For purely mechanical reasons, you'll end up with lots of erroneous bits (but they won't make it sound different). However, it will change the digital data, and hence the MD5 sum.

Incidentally, it's mathematically possible to have two different files with identical MD5 sums. There are even plausible attacks you can make on MD5 sums, and MD5 sums are no longer used in certain cryptographic applications for that reason.

Re:gee?

[Anonymous Coward]

Look under "Offset Technology" in this Exact Audio Copy documentation. Not sure if this is the same thing but it explains difference between drive models, even if both can give perfect rips.

This is correctable in software, so you can consistently get the exact same rip with different drives.

Re:gee?

[Phanatic1a]

If you are sharing MP3s you are stupid and most likely will get caught and find yourself in court.

Given the immense numbers of people currently sharing MP3s, and the relatively very very small number of people who have been supoenaed, I think you're working from a definition of "most likely" that's rather different from the one the rest of us use.

Query: Kazaa currently shows 4 million users online. Let's say the free-rider problem is a severe issue, and only 25% of them are sharing mp3s. What number of the remaining 1 million users would have to be taken to court for the chances of a random user to be caught to qualify as "most likely," and is that number greater than the number of cases it would require to bring the court system to a screeching halt?

Re:gee?

[Black Hitler]

So all 128kbps rips are exactly the same?

Re:gee?

[jishak]

Why would different drives/software affect the md5 hash though? Assuming it is really digital (A premise the RIAA depends on to count file sharing as piracy and thus different from tape copying), every cd [ being that in mass production are probably stamped rather than burned ] should be identical.

For example, take a iso of your favorite distro. If you burn the iso and then re-hash the new cd it should be equal to the original image. This is not a sign of uniqueness.

Meaning that if you take an MD5 Hash of the iso of the whole cd should be identical. Then in order for cd rom drives to be considered iso 9660 compliant, they must follow the same spec and read the disc the same way.

In addition, if you have the same software on different machines, it should still rip it the same way. The only difference should come from the bit rate you choose to rip at and whether you alter the name/tags. If you choose a common ripping program (Say MP3 Strip-It-Digital on Windows), an iso 9660 compliant drive (Like my Lite-On 52X), and CDDB meta tag generation (Which MP3 Strip-It-Digital does for me automatically) then it should be possible for different people with the same cd and different cd drives/software to generate the same md5 hash sums.

If they are not generating the same hashes, then the RIAA can not argue that the copies are truely digital quality (sorry for the side argument) and it should still be legal. However, if the hashes are coming out equal, then you truely can't say that the files are unique.

Am I missing something here?

Re:gee?

[elmegil]

I did express doubt in my original assertion.

And continued to assert that it was the facts as well.

Unfortunately, I have no way to mind-meld with you through slashdot to tell whether you had "read your facts somewhere reliable" or were just making shit up. I don't know you from the wild man of borneo, why would I trust completely unsupported statements you made were likely to have any reliable backing, especially when they didn't make sense? If you wanted to assert that, you could have taken 15 minutes to go google for some facts.

Now that there are some facts behind your assertion, I see how it does make sense, though I still don't buy that it is as unlikely as all that to have two CD drives come up with the same data from the same source. But we shall see what happens after some testing.

Re:gee?

[laird]

I don't disagree that it's *possible* for different people to RIP the same track and get exactly the same MP3 file. My point is that because of the issues people have pointed out here, you can't assume that all RIP's of the same track, even with the same settings and pulling the ID3 tags from CDDN, will generate identical files. Other posters in this thread have even documented that they've ripped a track twice in a row with the same software, same drive, same CD and the same computer have generated different MP3's. Because of this, if you see two collections of music with many files that are bit-for-bit identical, it's a good indicator that the files were copied, not all generated independently.

Re:gee?

[rpresser]

You don't even have to do that much. If all you're concerned with is the MD5 of the whole file, just add a space (or better, a space and two or three random characters) to the end of the Title in the MD3 Tag. The file is now different.

This is essentially what spammers try to do to escape MMP detectors. Of course it doesn't work well, because the MMP Detectors stop MD5'ing the entire message and instead (I presume) use something like the rsync algorithm to compare differences. Which is what the RIAA will advance to...

Re:gee?

[instantnoodles]

If tricking the system is so easy, I won't be surprised if there will soon be a program that will slightly alter all your MP3s. Shouldn't be too hard to write and it wont have legal troubles.

Re:gee?

[RzUpAnmsCwrds]

You used CDParanoia, which is designed to work around read errors and rip the same every time. Not every CD ripper is so precise.

Re:gee?

[Nom du Keyboard]

she made all of these MP3s available for download by millions of anonymous strangers

Not true and overblown hype. Nobody could have supported millions of downloads through a home cable or dsl connection. At most a few dozen people might have managed to download any individual song -- probably less.

And making available means very little if no one downloaded them at all. (The RIAA doesn't count.)

Re:gee?

[eric76]

If I were trying to determine versions of the files, I would look at the files both with and without the tags.

If the only hash they use is of the song including the tags, then they are not using the available information very well.

A hash of the song including the tags can help identify a particular subdistribution of the song. For the actual distribution, you're going to have to look at the whole song without the tags.

Re:gee?

[BulletMagnet]

I too am in a similar situation. I had my entire CD collection in transit when my car magically disappeared one night (and found stripped 5 days later) My auto insurance capped @ $200 for possessions in the car and that would have covered 1/8 of my collection. At least I have the list I presented to my insurance company of my lost CDs and have the empty jewel cases for 95% of my music stored somewhere.

Where's that fit under fair use?

Re:gee?

[anthonyrcalgary]

Right... but let's say that most differences are a result of reading beginning and ending at different points, which as I understand it is what leads to slightly diffferent rips. I'm assuming that the rate of actual misread bits is low, which is supported by the dude that did the experiment that resulted in identical rips on the same equipment.

Now, let's say the error on either side is plus or minus half a second... that's one second on either side, two seconds total, 44100 samples per second, 88200 samples total.

That's 88200 different MD5 digests for a given song. The individual hashes are vastly different but there's a small number of them. When you get a suspect file's MD5 digest, you just check it against all likely digests.

Who cares if it takes a few hundred terabytes of storage to store all the likely digests for all songs you're looking for? That'll cost less than the laywers.

That's one reason short passwords are insecure. The digest is not reversible, but the digests for common passwords are known. That, of course suggests the solution... add salt like they do with stored password hashes. The watermark technology pioneered by the RIAA could add salt pretty easily.

Re:gee?

[Zigg]

That's an interesting thought. I wonder if I could get the two rips to match if I stripped samples off both ends until they matched.

Of course, this is all far too much work. :-)

Re:gee?

[Anonymous Coward]

Am I missing something here?

Yes - the degree of error correction for data tracks is much greater than for audio. For data, even a single incorrect bit is fatal; for audio, it's not. That's why rip programs like cdparanoia have their own handling for read-errors.

Re:gee?

[eluusive]

And you ran it through a lossy compression codec at what point during that test?

Re:gee?

[Anonymous Coward]

So someone write a 'plug-in' for Kazaa (etc..) that randomly changed one bit in all MP3's it downloads.

THis will acomplish 2 things:

1) CHange the Hash, and help get RIAA off our backs

2) Very slowly degrade the MP3, meaning it can't be copies TOO many times. This would actually HELP RIAA.

Re:gee?

[OolonColluphid]

You won't if you're using a ripper with decent error checking, unless the disc is damaged. However, if you rip the same disc on different drives using a program that doesn't account for offset will result in files with different MD5 sums. BTW, I say drives meaning drive models, although there is also some variation among individual drives. And yes, I've not only ripped a file multiple times and gotten the same MD5 sums, I've also burned it and ripped the burned copy and gotten the same MD5 as the original.

Re:gee?

[Anonym0us Cow Herd]

Let's suppose as you suggest that there are fewer than 100,000 possible variations of a WAV file that results from ripping a particular CD track.

The mp3 encoding process is exact, so there are a fixed small (< 100,000) number of possible mp3 files for the same song.

Well, everyone who has an mp3, even legitimately, will have one of these MD5 sums of their mp3 of that track. So the MD5 is now meaningless. Jane Doe's MD5 hash would then proove nothing. She could, indeed have ripped and encoded it herself, even though it matches the MD5 hash of other people's mp3 file. That doesn't mean she downloaded it.

Of course, the larger the number of possible MD5 hashes of a given track, the harder this argument is to make.

Since for any given WAV file, there are numerous ways to encode it to mp3, and numerous encoders (some floating point, some integer, differing implementation details that might have different 1-bit roundoff conditions, etc.) there are likely a larger number of possible MD5 hashes of an mp3 file.

Re:gee?

[elmegil]

Initial results of testing. Since I do not have the same drive in both machines, there's more to look at. However, it's interesting that despite the fact that some results from other people show different reads every time on the same machine, I get consistent results every time when I use the same software on the same drive:

PC #1
Ripper: AudioGrabber
Drive: Pioneer DVD-ROM DVD 106 1.22 Both rips identical: c4461f79faab359238d461e78656ee7f
Drive: Plextor CD-R PX-W8432T1.09 Both rips identical: 8a5389b272d8c926b37b0cd07563ba22
but obviously different from each other.
Ripper: Buzzsaw
Drive: Pioneer DVD-ROM DVD 106 1.22 Different from AG but both rips identical: 3a9eca5be5a22f84edace9682b7bf8df

PC #2
Ripper: RealOne Player
Drive: Toshiba DVD-ROM SD-M1402 Both rips identical: 4fbb0a29effe52a444cb517f69f3122b
Ripper: Buzzsaw
Drive: Toshiba DVD-ROM SD-M1402 Different from RealOne, but both rips identical: 927b5068c6070c564f9a7c8f4cfe9845

This was the first track from Dark Side of the Moon, though I forgot to verify it was the same version used by the previous poster. At some point this long weekend I will have an opportunity to swap a DVD drive to the other machine so I can see if the difference is "just" the drive, or the drive and the machine together. But it seems to me that the "jitter" issue is probably particular to specific drives. The final question is, will the same drive with the same software on different machines get the same results? I'm certainly not as confident as I was, but I won't rule it out until I see it....

P.S. Yes, these are running windows 98SE, so sue me. My linux boxes are in pieces strewn across my work area for completely unrelated reasons, and were not handy.

Re:gee?

[Anonymous Coward]

Have you heard of Kazaa?

It's a system whereby you post a file and then millions of anonymous strangers can download it. It uses a system whereby once a person downloads it, by default, they also mirror it. As a result, someone with a cheap 14.4 V32bis modem can actually distribute a single file to millions of anonymous strangers.

Of course, this was pointed out earlier in the thread, earlier in the day, but I don't expect you to read the thread before posting! This is Slashdot, after all!

Re:gee?

[AJWM]

And you ran it through a lossy compression codec at what point during that test?

Short answer: When I ran "md5sum" -- a very lossy compression algorithm.

Long answer: Are you seriously suggesting that even a lossy compression algorithm will produce different outputs for identical inputs?

I wasn't aware that any codec grabbed input from /dev/random. (Even calls to rand() will return the same sequence of pseudo-random numbers in successive runs of the same program unless the seed is changed.)

Re:gee?

[elmegil]

The ISO format has error corrections in it that are not/may not be in the CDDA spec. You're right, a data CD must be the same every time. That's not true for audio, a few bits here or there aren't that big a deal, at least as spec'd. It's clear from the testing done by various people in this thread that same software, same machine different drive leads to different rips. The real question is whether same software, same drive, different machine leads to different rips. If not, then there's still a high likelihood of two independant rips out of millions having the same hash. If so, I will have to join the Cow Herd in questioning how likely it really is that two people doing independant rips could have the same hash.

As for "not truely digital quality", I think you're going to have a hard time selling that, since it's still digital quality on playback from the same machine and different drives. There may be enough difference to affect the MD5 hash, but that doesn't take much. If there isn't enough difference to hear it, their argument still holds water.

Re:gee?

[elmegil]

I got consistent results on my old-ish Plextor CD-R as well, so it's not just DVD precision. I spose argument could be made that CD-R is more precise as well, but I'd expect it's more likely that there are simply brand differences in amount of jitter.

Re:gee?

[anthonyrcalgary]

>> "She could, indeed have ripped and encoded it herself, even though it matches the MD5 hash of other people's mp3 file. That doesn't mean she downloaded it."

Correct. But if she's sharing it, one can be reasonably sure of what it is.

>> "there are likely a larger number of possible MD5 hashes of an mp3 file."

A larger number of possible hashes. Not a larger number of likely hashes. Most encoder programs use a library by someone else, and there's only a few of those that are popular.

Re:gee?

[Anonymous Coward]

I posted this already in a different thread but I'll say it again here. I ripped a song three times, all on the same computer with the same settings (EAC secure mode and Lame). The first two rips had an identical md5 hash, I swapped out the CD/DVD drive for a different model (laptop so quick change out) and the same song produced a different hash. Bottom line is different model drives treat audio (offsets, error correction, caching etc..) in different ways.

Re:gee?

[elmegil]

Bottom line is different model drives treat audio (offsets, error correction, caching etc..) in different ways.

Yes, I pointed out the exact same thing by doing two different drives in the same system.

Among the millions of CD Rippers sharing their music, how many different model drives are there, after all? If the machine itself *also* changes the rip values, then the likelihood is that a given MD5 hash does uniquely identify a particular rip by a particular individual. However, if it's just a function of the drive + the software, independant of the machine, then the likelihood of finding two seperate rips with the same hash is reasonably high; certainly among a population of millions....

Re:gee?

[IWX222]

until i set up a batch job in my audio editor to add exactly 0.01 seconds of silence at the beginning of every track and 0.001 seconds of silence every 15 seconds thereafter

Re:gee?

[tricorn]

Among three CD drives I have (one a DVD drive), only the CD burner consistently reads the same audio data every time.

Re:gee?

[Snowdrake]

I'm going to operate on the assumption that the rip/burn/rip you're talking about involved no more significant intermediate treatment of the data than lossless compression (important to note since my definition of "rip" anymore tends to incorporate "encode").

As for MD5 collision, I can't see it as a very workable defense, even under a "reasonable doubt" standard. By the most simplistic approach (IANAstatistician), the odds of collision are 1:2**128 (assuming full hash and no unobtainable values - I know no way to prove the latter but my math is weak), which I must imagine would be legally indistinguishable from being impossible. Add more checks (say, hashes of the first and last 8K or some kind of tolerant waveform analysis) and the odds only get slimmer. This really makes the use of hashes little more than a footnote, and honestly something I expected since RIAA's been using "fingerprints" of files (which I always figured for hashes) for blocking since the Napster suit.

I'm not saying that I like the fact that they're using this technology, only that it's difficult from a defense POV.

Re:gee?

[laird]

Perhaps it's true that 'And only an idiot would put "Ripped by laird" in the ID3 tag' but fairly often people do sign their RIP's with a handle of some sort. I'm not sure why, since it's not like RIPping a CD is an amazing technical feat...

Now what?

[Anonymous Coward]

We will have to create a honeypot that spoofs md5 hashes as well. IANACS, so i don't know how.

Re:Now what?

[utlemming]

No, we need to create a honeypot farm. You remember that article way back when on Slashdot? It described how to implenent a whole farm. Then we strictly prohibit scanning of the networks for MD5 checksums. Since RIAA is using bots, they won't read the warning and fire off the subeona. When you get a subeona, then you slam them with a computer crime lawsuit. See, you can still get rich from RIAA. But how do you get illegal MD5 check sums with out possesing the files? If you wanna screw with RIAA you have to be damned sure that you right.

Re:Now what?

[Anonymous Coward]

Just create an mp3 consisting of nothing but noise, and adjust its length until its checksum matches that of "Oops, I did it again".

That should guarantee some courtroom fun...

B$

Re:Now what?

[The Evil Couch]

But how do you get illegal MD5 check sums with out possesing the files?

easy fix, buy the appropriate CDs for the files that you want to host the bogus files with the checksums. you'll have the legal right to have backup copies of the music, which will just so happen to take the form of the mp3s that the RIAA is in search of.

post the bogus files with the checksum that you lift from the illegal files, which are legal to you.

hell, you could even make it more convincing by giving it a file name like "Metallic - Fuel has the same checksum as this file"

Re:Now what?

[Pinball Wizard]

Umm...people sharing files on Kazaa aren't carrying separate MD5 checksum files. The RIAA checksums the MP3's after they download them off your computer. That way, they have your IP address, and a copy of the file that was on your computer to use as evidence. The checksums are used to prove that you illegally copied your file from someone else on Kazaa. This checksum, combined with your IP and userID, is enough evidence for the RIAA to go after you.

Furthermore, the RIAA is only checking files that you publicly share. I don't see how this honeypot idea could possibly work.

Re:Now what?

[zasos]

Are they going after those on Kazaa network only? What about other networks like edonkey and dc++?

btw, page1one rulez!

Re:Now what?

[gotscheme]

I wish it was this easy. You may be engaging in a form of entrapment only permissible to law enforcement if you try going after them on criminal grounds if and when they hit you with a robot (side question: why may law enforcement entrap people?). You better talk to a lawyer and have some money if you plan to engage in such behavior since the courts, as far as I know, have not established the legality of honeypots in such cases.

To answer your question about obtaining MD5 sums of illegal files, I am not familiar with the checksum mechanism in open source file sharing apps, but if they use MD5 sums, you could probably rewrite the code to get that information for you--not easy, but possible. Maybe somebody here knows more about that sort of thing.

Re:Now what?

[number11]

But how do you get illegal MD5 check sums with out possesing the files?

Not a problem. When you do a search on the file sharing network, the responses tell you what the hash is. This is used for 1) error checking, and 2) so that you can download from multiple sources (that have the same hash) simultaneously, secure in the knowledge that all the pieces will fit back together into a single file that replicates the original Or just go somewhere that has a library of hashes, like Bitzi or Sharereactor and collect hashes there.

MD5-hashes

[Code-Cheetah]

As far as I know, you will get indentical hashes from identical files with the same ID3. How can they track files with the help of MD5-hashes?

Re:MD5-hashes

[guile*fr]

by stripping id tags before the md5sum?

Re:MD5-hashes

[whaley]

I'm not sure what you mean, but they don't track mp3s by generations, they just look at the mp3 hash and compare it to the known hashes of files they found on the internet, so they 'know' you didn't rip the mp3 yourself.

Re:MD5-hashes

[Mor Griv]

Why do they need MD5 hashes at all. It is much more efficient to compare (diff) the files themselves (with or without ID3 tags) Instead of computing the MD5 hash and then compare that.

Re:MD5-hashes

[ShadeARG]

Normalizing would alter the waveform, causing the MD5 to change. Bitrate also causes change. I suspect imperfections on a CD do the same as well.

Re:MD5-hashes

[Anonymous Coward]

If they were to store all of the mp3s for comparison purposes, that would require a huge amount of space, verses saving a hundred byte hash or so.

Let's assume average MP3 size is 3 Megs or 3,145,728 bytes. Also, assume a moderate 1 million songs. You are up to 3,145,728,000,000. That's 3.1 terabytes. Now, assume they store a 128 byte hash. 128 * 1 million is 128,000,000. 128 Megs is a lot easier to store than 3.1 terabytes.

Re:MD5-hashes

[3terrabyte]

If both ripped the mp3 perfectly by using EAC.. and both used the best mp3 encoder (LAME 3.92 -aps) and both used a retagger (grabbing the id3 tags from CDDB or freeDB) then wouldn't the MD5 tags be the same?

Also, what about the other articles we're reading where we hear that the RIAA is able to spoof MD5 hashes? I can't remember exactly, but i think it had something to do with eDonkey, and that it only used hash functions on part of the song.

Is the RIAA using MD5 hashes on the full song?

I wonder how many of my 2,000 albums I ripped back in 1998 are circulating out there?

Re:MD5-hashes

[Anonymous Coward]

I do believe RIAA can afford 3.2gb harddisk.

Re:MD5-hashes

[hkroger]

Think, if there was 400000 mp3s in the internet:
It's faster to compare 400000 md5sums to each other than to compare 400000 files of size 3 megabytes to each other. rough estimation of amount of data to process would be (400000*32)^2 = 1.6 * 10^14, which is very much less than (400000*4 megs)^2 = 1.4 * 10 ^ 24. I know that calculations are not totally correct but they represent the magnitude of data processed and the idea why to use md5sums instead of complete files.

Re:MD5-hashes

[whaley]

> If both ripped the mp3 perfectly by using EAC..
> and both used the best mp3 encoder (LAME 3.92
> -aps) and both used a retagger (grabbing the id3
> tags from CDDB or freeDB) then wouldn't the MD5
> tags be the same?

guess so... but audio cd rips are hardly ever perfect.

> I wonder how many of my 2,000 albums I ripped back
> in 1998 are circulating out there?

Call the RIAA ;-)

Re:MD5-hashes

[Gherald]

> This proof of RIAA is as good as the SCO evidences of greek language or bsd firewall code against linux

Uh, actually this is irrefutable proof. It will miss a lot of songs, but it is virtually guaranteed to not give false positives. This is much more solid proof than SCO had.

To think a month or two ago when SCO was insisting on an NDA many on /. were clamoring for some MD5 sums instead...

Obviously the RIAA's technical experts know what they are doing... its time to alter a few ID3 tags like the story suggested.

Re:MD5-hashes

[Anonymous Coward]

It is tera, not giga. Not that 3.2 is not affordable for the RIAA, though...

Re:MD5-hashes

[nolife]

I just did some consecutive rips of an audio track and compared the md5 checksums.

I did the same song three times. The first two times, all things were equal including all settings. The MD5 checksums were the same.

I swapped out my DVD/CD player for a different model. Reripped the track on the same computer with the same exact settings and the MD5 was different.

I am using Exact Audio Copy in secure mode and Lame for the encoding. The ID tags were recieved the first time and the same tags used for all three attempts (EAC remembers the disk).

I'm sure I could try many things like changing the read speed, comparing the wav files and not just the resulting mp3 etc.. but I do not have the time for more analysis.

Re:MD5-hashes

[pVoid]

Not really. All I have to do is modify a single byte of each of my mp3s (that's not hard given even the simplest perl script), and there, none of my MD5s will match.

Even further: most mp3 encoders aren't deterministic from what I understand... not in a general sense at least. I'm pretty sure the output of 2 different codecs on the same input file will yield ever so slightly different results...

No false positives, but very easy false negatives.

It's like a wanted criminal going to the airport and passing undetected because he's wearing shades instead of clear glasses.

Re:MD5-hashes

[Gherald]

Your analogy (criminal with shades) is hardly aplicable IMO, but you are correct in saying there will be "very easy false negatives."

As I said, it "will miss a lot of songs."

Re:MD5-hashes

[3terrabyte]

but audio cd rips are hardly ever perfect.

I agree. But there are guides out there (UberNode) that detail how to use EAC to make perfect rips.

Call the RIAA ;-)

I'm sure they're sending a subpoena to slashdot to get my IP number.

Re:MD5-hashes

[arkanes]

Untrue, actually - it's much faster to diff the files. You're forgetting the overhead of calculating the MD5 itself.

The main reason people use MD5s for downloads and such is to ensure that your local copy is the same as the remote copy. This is a savings because you download the MD5, not the whole remote file to compare to your local one. I'm with the parent here - it'd make more sense to diff the actual files, unless Kazaa exposes MD5s of local files or something (which would make some sense, I suppose - I know some P2P networks work this way).

Re:MD5-hashes

[henele]

If you read places like CDFreaks you'll see that extracting CD Audio is a mix of science and voodoo.

Theres issues of offset values (as with CD audio it is difficult to hit an *exact* location on the disk), plus the way the reader deals with C1 and C2 error correction, as well as how different extracting software interfaces with the hardware.

It would almost be safe to say two mp3s with the the same MD5 are one file copied twice (as opposed to two individually created mp3s), but that doesn't mean they are illegal...

Re:MD5-hashes

[pudge]

No, MD5 is much faster. Yes, it is true that comparing file A to file B is faster with diff. But you are not doing that. You are comparing file A to thousands of other files, then file B to thousands of other files, and so on. So you compute the MD5 of each file exactly once, and then compare those against a known list. Much faster.

Re:MD5-hashes

[pVoid]

I don't know how you consider the criminal analogy not applicable... maybe you're suggesting that swapping files isn't criminal or something.

I was just expressing how there really isn't any security at all if false negatives are so easy to obtain. Or in this case, the procedure is hardly effective at finding the searched files.

Re:MD5-hashes

[Anonymous Coward]

Well let me point you to the most likely problem:

The "offest".

If you use EAC you will see there is a tab where you can correct your drive's offset value.

Now if you do that (or atleast 'sync' them) you should get the same result on both drives if the disc is good enough. (Ofcourse all your other settings should be set properly too) (If your disc is bad, EAC can correct those errors by re-reading a dozen times and then using the most often occuring result, but if your disc is a little too bad on a specific part, EAC won't be able to return the same result each read)).

I know this because I have ripped discs on *three* diffrent cd-roms one 2x old HP burner, one el cheapo 36x drive and a toshiba laptop drive (also a burner).
Granted I compared wave files, but I guess that if you feed the same wave file to the same encoder with the same settings you should get the exact same result.

note:
Offset: When your cd-rom reads a position on the disc in audio mode it often misreads, ie say you tell it to read position 0, then it will read position 4. Normally this doesn't matter since offsets are measured in milliseconds so you won't hear a diffrence, but for ripping bit-perfect rips, it does matter.
You ccorrect it by finding out what offset your particular cd-drive has (every particular model number has a particular offset, few drives that are of the same brand and model have diffrent offsets)

What I mean by 'syncing' is not correcting the offset but making it the same between drives.
For example, burn a offset cd in EAC (use a cd-rw if you must). this disc will have the same offset of your cd-WRITER.
Now 'correct' the offset in all your drives (including your burner, 'cause burners have a diffrent offset when writing than reading) with this disc.
It won't be perfect, since now all your drives have the same offset, namely the write offset of your cd-burner.
BUT now the rips will be identical, since they will all have the same offset.

NOTE: I think the RIAA doesn't hash the ID3 tags, only the music.
That way the same mp3 with diffrent ID3 tags will still be identified as being the same.
Thats btw what Kazaa does if i'm not mistaken.

Re:MD5-hashes

[Gherald]

I am not suggesting anything about whether it is criminal or not.

Putting on shades is not a good analogy to MP3 files being off by a few bits.

Re:MD5-hashes

[BigBlockMopar]

Not really. All I have to do is modify a single byte of each of my mp3s (that's not hard given even the simplest perl script), and there, none of my MD5s will match.

Yeah... I think what I'm going to do is create a script to change the ID3 tags, since that will not require a recompress.

We have to be careful about this sort of stuff. I can imagine a whole bunch of people writing scripts to decode and then re-encode their MP3 collections. With the generational losses of each encode/decode cycle, that would really reduce the sound quality of the new MP3s.

Solution? Command-prompt program capable of changing ID3 and Vorbis tags, since those don't require a recompress. I think I'll automatically append a random number from 0-9 onto the end of one of the tags.

Of course, new hashes will mean that swarm and resume features won't work too well in Kazaa and other apps. For the most part, however, audio files are small, so the damage to the peer-to-peer community should be minimal.

Even further: most mp3 encoders aren't deterministic from what I understand... not in a general sense at least. I'm pretty sure the output of 2 different codecs on the same input file will yield ever so slightly different results...

Also would depend on the libraries installed on the machines. The biggest ones are the math libraries, whether in *nix or Windows. The codecs do a hell of a lot of Fourier transforms, which becomes a lot of Really Big Math, all of which is performed to arbitrary precision. Let's say one version of a library comes up with 0.34534543341 and another version of the same library comes up with 0.34534543342, then the hash would probably be completely different... Or processor rounding - different steppings of a processor on an otherwise identical system might have different results...

Re:MD5-hashes

[Anonymous Coward]

ah.. gotcha =)

good critique well appreciated. -pVoid

Re:MD5-hashes

[wirelessbuzzers]

Uh, actually this is irrefutable proof. It will miss a lot of songs, but it is virtually guaranteed to not give false positives.

No. If two people rip+encode the same song with, say, the default settings in iTunes, with the same model of drive, they're pretty likely to get the same mp3, and hence the same MD5sum.

The MP3 output should vary with the drive, ID3 tags, ripper, and MP3 encoder+settings, but many people use the same rippers and encoders, and keep default settings and ID3 tags. The chances are not too low that she did that.

Of course, we all know she's still guilty. The songs have "ripped by" tags set to some random guy on KaZaA, so she didn't rip them anyway. And with 900 songs, the odds do get pretty strong against this sort of luck...

Re:MD5-hashes

[hkroger]

This was exactly what I was after.

Re:MD5-hashes

[herbierobinson]

> It will miss a lot of songs, but it is virtually guaranteed to not give false positives.

Nope. Anybody who wants to try to collect reverse DMCA fines from the RIAA can generate files full of random numbers and then alter the last N bytes to generate the desired checksum. Of course, this won't trick the RIAA if they actually listen to the files before firing off a subpoena, but I'll bet they are lazy enough to get caught at least once. If not, then listening to full scale white noise is really annoying... heh heh

Re:MD5-hashes

[Gherald]

Who is going to bother doing that? That is right, no one. If the RIAA is able to MD5 a file, they are also able to listen to the file and tell what size it is. MD5 is just a way they can compare a large amount of files with perl scripts and get some idea of how many are pirated, instead of listening to them all one by one.

When you are asking $15000 or so per .mp3, you can afford to miss 60-70% of them and still have a workable case.

What if...

[moehoward]

What if I own the CD but got files off the Internet because I was too lazy to rip them? Would I still be expecting to be sent to the prison camp?

In other news, all songs produced by RIAA artists in the last 10 years all have the same MD5 hash anyway, because they're all the same.

Re:What if...

[DrEldarion]

Yes, because for them to know that you have the MP3s, you have to be sharing them, which is the illegal part.

-- Dr. Eldarion --

Re:What if...

[Anonymous Coward]

In all seriousness, just the other day I wanted to rip an old CD of mine, but could not due to media damage. So, I went the net and got myself an mp3 of the track.
Is that illegal? Am I a fellon?

-- A.C.

Re:What if...

[91degrees]

Yes.

Just like if I decide to borrow your car to drive home because I'm too lazy to walk to the other side of the carpark.

Re:What if...

[3terrabyte]

No offense, but think of the children.

I'd rather put up with your crippled post and your slight pain of re-editing your post, than put up with 100's of ALL-CAP newbie posts.

Re:What if...

[abiogenesis]

Then what's the point to track the songs back to Napster (using MD5 etc)?

Re:What if...

[gsegelk]

So if I do not share any songs and I continuously download all of the songs on thier 'hitlist', they could not come after me? But if I share songs that I have paid for, they will (or it is a possibility) come after me?

That seems very strange, but then again....nevermind. I guess that is the point.

Re:What if...

[Asprin]

OK, well met, it's called the "lameness filter" for a reason, but you have to admit that there are occasions where stuff like ASCII art and all caps are useful, don't you? Besides, my original version wasn't even all-caps, it was only, like 50% caps at best.

A while back, somebody suggested changing the karma system to allow you to circumvent the lameness filter for individual comments at a cost of karma. Something like my all-caps infraction would cost, say 2 points if I still wanted to post it. If I wanted to post a ASCII-art map of Canada or maybe some math equations to make a point in some discussion, that would cost me 10 or 15 karma. Maybe this feature is disallowed altogether for people who have less than 25 karma. I think the prices should be high, but still give you some breathing room.

I mean, hey, I'm not using my karma for anything. Once it's maxed out, it's pretty useless, right?

Re: What if...

[FoeNyx]

In some european countries, until now, it is not illegal :
If you own the original CD you can have one backup copy.
(applies to all digital contents : music / movies / software / games / ebook)

So you can share it provided that the downloader owns an original of the same CD too ...
But it's almost impossible to check, so you have to be greedy to be safe.

Re:What if...

[Anonymous Coward]

What is so strange to you that distributing copyrighted material without consent on the copyright holders is illegal?

I mean, come on, are you that thick?

Re:What if...

[IpalindromeI]

you have to be sharing them, which is the illegal part

Actually that's not true. They only care about the sharing because it leads to what they really care about: people listening to music that they didn't pay for. If everyone who shared mp3s had bought every CD of the songs they downloaded, no one would care because they would have already paid to listen to those songs. The problem is that most people don't own all of the CDs for the songs they download, and the RIAA doesn't like it when you try to wriggle out of their money trap. If the actual sharing was the problem, the distribution itself, then we wouldn't have radio stations playing music either, because that also lets people listen to music they didn't pay for, but it's a bit different because you don't really get a choice of what you hear. But now if you go and start recording songs you hear on the radio, so you could listen to them whenever you wanted, you're getting into that grey area. Of course the RIAA doesn't really care about that because they know that radio quality is shit, so there won't be widespread radio recording anyway.

Re:What if...

[3terrabyte]

I agree with you. I'm sure there's a fine line between the coders on slashdot's sense of sanity, and adding stupid features.

At some point, you just get burned out and say, come on... the site works, can't people enjoy using it now? What, you want to change the default colors to your liking...ARGH! :)

Re:What if...

[NixLuver]

ROTFLMAO!!! That's funny!

But seriously, folks ...

Come on; this is at the heart of the entire issue, isn't it? Whether or not IP can *really* be compared reasonably to ... ("Real Properties"? "Physical Properties", whatever you choose to call them.)

Here's the difference. When you purchased your car, you purchased a unique item with a physical presense and value; if I 'borrow your car and drive home', I have deprived you of its use, i.e, its value. If I download your MP3 file, I have not *taken* anything from you. I have deprived you of no value.

Whether or not the pundits and legal beagles decide that it is legal for me to possess a piece of intellectual property from a unique source other than the physical piece I purchased (i.e., a downloaded mp3 rip of a different, identical CD to the one I purchased), the distinction is pointless. You can't have it both ways; either I purchased a physical object (The CD), which I then own and can do with /that copy/ what I wish (think software non-transferrable licenses, etc), or I purchased a license to use that property. If I purchased a license to use that piece of IP, then my copy of an identical IP is legal, provided I don't use (or allow to be used) both at the same time (The backup copy argument, etc... )

Complex or not, the question is MOOT to a reasonable person who's not blinded by the rhetoric of an industry based on deception and begging the government to pass laws protecting them from obsolescense. If I have paid for a copy of the song, does it really matter where the copy I'm listening to *came* from?

Copyright was never intended to allow an individual or corporation to build a multi-million dollar industry based on a single piece of IP; it was intended to allow a creator to obtain reasonable compensation for intellectual innovation, whether it be aesthetic or technical, for a reasonable and limited time. Does the heart surgeon that repaired your father's ticker get paid every time dad's heart beats? Does the builder that constructed the house get paid again every time someone walks through the door? Are IPs at all similar to Physical Properties?

I would LOVE to see the artists get paid. Unfortunately, a ridiculously small sum of my money actually goes to the artist.

As a one time musician myself, I tell you honestly that I would rather see 100 artists making $100k/year doing something they love than 1 artist making $10,000,000/yr doing what the Marketriods push them to do and push us to buy. It's in the 'Recording Companies' best interests to limit the number of artists they distribute and sell as many cds as possible (the more unique products, the higher the average production cost per CD, the lower the profit margin); Innovation and diversified offerings are anathema to our current system, in simple economic terms.

Re:What if...

[Rovaani]

Intellectual property is not physical property.
Everyone stop using inaccurate analogies that don't hold up even a superficial inspection.

(Your .sig said nothing about answering...)

Re:What if...

[fleck_99_99]

What is this, the Slashdot MMORPG?

Re:What if...

[pboulang]

I wouldn't say so, be you are a terrible speeler ;)

Re:What if...

[Anonymous Coward]

Pay attention: The RIAA is not going after "fair use" here (wisely). They are going after the individuals who illegally *distribute* their stuff. You could have a server room full of mp3's and no one would touch you or ask how the files got there so long as you don't try to pass them on to someone else. If you pay for your music, fair use enables you to make various copies over various media for yourself, but it does not entitle you to "share" a copy with someone else.

Re:What if...

[renehollan]

Sharing them?

Not necessarily.

Look at this for example. It is a compiled discography of most of my, my wife's, and our children's music, with interesting links to .pls playlist files for xmms.

Of course the /media/music root of all the referenced .shn files won't resolve except on my home LAN, or a machine with a secure tunnel to same. I am not sharing these files.

It would not be a stretch to have included other meta-data, like ID tags, so others could compare if their copy of Handel's Messiah was likely the same version as mine (i.e. recorded by the same orchestra and choir).

The bottom like is that, while ID tags might lead to a reasonable suspicion that I had, and may still have, the associated audio files, they don't necessarily mean that I am sharing those files. A human could verify this quite easily, but I doubt the RIAA's bots are sufficiently sophisticated to make that determination.

On an interesting side note... when I returned to Canada from the U.S.A., I took essentials, like my computer, with copies of all our music, with me, with other stuff to follow later, including all the original CDs. Making copies for personal use of digital media is legal in Canada, AFAIK, though, if push came to shove, there would have been a short period of time when I could not prove I had the original CDs from which the copies were made. Even if I could, would the fact that I was not in immediate possession have been a legal problem? I think not, but they way this witchhunt is going, one can't be too careful.

Re:What if...

[leviramsey]

Think about it this way: they're creating a massive leech-fest for the P2P apps. If enough people who are sharing large amounts of music from high-speed connections decide (possibly after getting sued) that this isn't worth it and set KaZaa to not share anything, guess what happens: you get the same number of people trying to download from fewer sources, which means slower downloads and increases the hassle factor.

Although FastTrack is reasonably resistant to attack and decentralized, the same does not necessarily follow on a network using that protocol, if you hit a case where a small portion of the nodes are doing much of the work (even if they self-organize and all that); take a decent portion of them out of play and you bring the network to its knees.

Re:What if...

[Scarblac]

If the actual sharing was the problem, the distribution itself, then we wouldn't have radio stations playing music either, because that also lets people listen to music they didn't pay for, but it's a bit different because you don't really get a choice of what you hear.

As far as I know, copyright law doesn't prohibit having copies of a song. It restricts distribution; making copies, if you will. Compare to the GPL (since this is Slashdot); it can't give rights to use and the code, since you already have that right, it just grants you distribution rights under certain restrictions.

And the radio stations have distribution rights, since they have to pay for each song they air (or have been given the rights in some other deal). You do not have that right.

Perhaps in the US just downloading is also not allowed (through some other law than just copyright law), but in the EU downloading is perfectly fine legally, sharing is not.

Re:What if...

[Neurotoxic666]

And what if I used a tape-recorder to record a song that was playing on my friend's audio system, from a CD he bought? Is this recording also copyrighted? It was made for myself, and I actualy did not copy anything, and did not violate any copyright. I merely recorded music that was playing. Do I have to pay to listen to that? The sound quality I get is not as good as the CD's and when you buy an album, you expect a minimum quality, which you pay for. What would the RIAA think of that?

And what if artists started recording songs using ASCII caracters instead of magnetic tapes and/or digital equipment? And what if they released their albums in ASCII caracters? Now, would it be legitimate to claim copyrights over the music files I own on my computer because the ASCII caracters are the same? Perhaps so...

Now my point is, the thousands of MP3 files I own were downloaded from the internet, and I don't own all the CDs. BUT, the mp3's do not offer me the same quality of sound as the CD - hence I don't see why I should pay for it. Stealing a CD from a store would be illegal and thieving.

But listening to a song that was playing, and which was converted to a computer file - I don't see the RIAA's legitimacy here. I have so called "audio" files on my computer. Yes. But open them in plain text format, and there's NOTHING in there that is copyrighted. No artist ever created that large ASCII file, and I have never listened to what the artist actualy recorded - and what the RIAA expects me to pay for.

If I remove or modify the ID tags and the headers inside the file (or whatever makes this file "audio", appart from the extension and the title), what is illegal? Can't we share ASCII files anymore?

Re:What if...

[Veldcath]

You do pay for songs on the radio.

You listen to the radio. The radio station plays songs and advertisements. Advertisers pay money to the radio station for that. The radio station pays money to the RIAA/Labels according to how big their listener base is.

You've just paid for the song. Unless you turn your radio off every time a commercial comes on, at which point you're a "pirate", listening to something you didn't pay for.

You pay with taking a few seconds off the length of your life as you listen to (or probably as likely - ignore) the advert they're playing.

Re:What if...

[Jah-Wren Ryel]

No, you are demonstrably wrong. The RIAA cares about sharing because it means loss of control for them. The RIAA is all about controlling distribution channels and sharing disintermediates their existence. Make no mistake, if they could come up with a way to sell you the same song twice, they would (ever try to get a cracked 3-year old CD replaced? They won't do it, you gotta buy a new one even though you already "own" the music.

Now here is where it gets good - the downfall of mp3.com was exactly because of sharing. They put together a system where you could buy a CD online, have it shipped to you, but also immediately have it available online as an MP3 through a password protected account that only allowed a single simultaneous user. They also provided a method to "upload" your previously purchased CDs - you stuck your CD in your cd-rom drive and ran their program that verified that the CD had the same contents as the released one (so either you had a legit copy or a perfect rip&dupe, either way you *already* had the music) and then that disc was also made available in your private mp3.com account.

The RIAA freaked and sued and won. They won on the premise that mp3.com was making copies without permission (from the RIAA) and then sharing them. Never mind that the only people who had access where those who had proven they already owned the music to begin with. They won big too, something like $25M per RIAA member company. That used up a *lot* of VC and IPO cash.

Re:What if...

[legality]

Funny laugh I had today- It's also illegal to have the songs without a license, usually through the purchase of a copy of the original CD. Does the RIAA have licenses for all the songs they download? Given they have an access/control licenses of most kind for some of the music. I wonder if someone might sue the RIAA for downloading or having a representative downloading music on their behalf that they do not have authorization to. Can they run MD5 checksums remotely? Are they built into file sharing applications?

Re:What if...

[91degrees]

Okay, it was just a glib remark,and I missed a key element that I assumed you wopuld have access to my car. The point is that assuming all cars arer equal, nobody has lost out. I have a car, you have a car.

The point being that just although both actions have the same net result, one of them is legal, the other is not. It may or may not be the same situation on the case of copyright infringement, but one should't make assumptions.

Re:What if...

[HardCase]

Actually that's not true. They only care about the sharing because it leads to what they really care about: people listening to music that they didn't pay for. If everyone who shared mp3s had bought every CD of the songs they downloaded, no one would care because they would have already paid to listen to those songs.

True, in a painfully worded way.

The problem is that most people don't own all of the CDs for the songs they download, and the RIAA doesn't like it when you try to wriggle out of their money trap. If the actual sharing was the problem, the distribution itself, then we wouldn't have radio stations playing music either, because that also lets people listen to music they didn't pay for, but it's a bit different because you don't really get a choice of what you hear.

The radio stations play the music because they pay a licensing fee to be able to play them. In other words, they have a distribution agreement with organizations representing the record labels that allows them to distribute the music over the airwaves.

But now if you go and start recording songs you hear on the radio, so you could listen to them whenever you wanted, you're getting into that grey area. Of course the RIAA doesn't really care about that because they know that radio quality is shit, so there won't be widespread radio recording anyway.

It's not a gray area at all. It's perfectly legal to record broadcasts off the airwaves. This was addressed by the Supreme Court years ago! Now, if you want to take that recording from the radio and turn around and start giving or selling copies of it, then you are probably going to be in trouble (legally speaking).

-h-

Re:What if...

[el_gregorio]

...and with the way playlists are today, you could record off the radio all day and still only have 5 different songs.

Re:What if...

[BrynM]

You've just paid for the song. Unless you turn your radio off every time a commercial comes on, at which point you're a "pirate", listening to something you didn't pay for.

Actually you're wrong, which is a common mistake with this subject. There is no real evidence that people are listening to the radio on a particular station at a particular time, which is how the advertising is sold. Sure there are ratings, polls and station events, but radio is a one-way medium and the numbers generated by these measurements are subjective at best and completely baseless at worst. They are never truly accurate. There is no way to track who is listening or how many of them there are.

If you hear a commercial and go buy the product, THEN you are paying for the advertisement. Otherwise you are just leeching off of an advertiser supported medium. The idea behind the advertising is not so we can listen to ads, it is a way to prompt us to lay down our cash where the ad tells us to..

The modern radio business has been built on decades of these kinds of assumptions, incomplete data and inuendos when it comes to measuring populartity and advertising penetration. This is why some advertisers will say something like "and mention you heard it on K-RIAA" so they can try to verify the stations projections of how many potential customers are listening and correlate them to some real life metric.

Incidentally, television advertising is better off than this because of cable and satellite. They can actually tell what you are watching and even if you flipped the channel when the commercials came on in real time (yes, this does happen). This is one of the reasons that there is an industry push for satellite radio to become a standard while there is a fight against ad-free satellite radio.

I personally would rather just pay for my radio directly and have some actual input as to the content than encourage the ad sales shell game.

Re:What if...

[Anonymous Coward]

Ummm... mp3 quality is also shit, as far as I am concerned. I download mp3's mostly to try out new bands, but I'm not about to go through the effort of finding out 1st: what tracks are on Ja Rule's new album. 2nd: find all those tracks. 3rd: listen to all those tracks to make sure they are not chopped or totally shitty. 4th: convert the mp3's to .wav format. 5th: burn me a CD that is less than "CD Quality". Why do all this?!? I'm just going to borrow the CD from someone and copy it. 2 steps: Rip. Burn. Viola- a perfect copy.

Re:What if...

[Danse]

Actually that's not true. They only care about the sharing because it leads to what they really care about: people listening to music that they didn't pay for.

Actually, you're wrong and he was right. The act of making those files available to other users is illegal, just as he said. Period. That is what will get you slapped with a lawsuit. You have no way of knowing who is downloading those files from you or whether they own the CD or not, so what you're doing is illegal.

Re:What if...

[Rovaani]

Despite being a longtime /. reader I'm still not an expert on USA laws (or what ever place we are discussing). Is it legal to record music from radio broadcasts over there?

I'm asking because here in Finland it is. By the same law it is also legal to download songs from Internet. Only _distributing_ without proper permission is illegal. As it should be.

Basically, what I'm trying to say is that it might be completely legal for me to take your car for personal use, provided that you still have access to that car :)

Everyone, read your copyright laws and court rulings, or preferably check with your local EFF. They should have the answer already.

What happen if

[Anonymous Coward]

you just normalize or edit the begining or the end of the song? Does the MD5 Hashes still works?

Re:What happen if

[whaley]

Changing something to the file after download (edit the id or alter the sound) should indeed change the checksum. Just use a tool that updates the id tags in batches..

Re:What happen if

[l1gunman]

Any modification, to ANY bit of the file covered by the hash, will change the MD5 hash (that's how hashes work). If you assume the hash includes the ID3 tag info, then simply editing the info (putting something in the notes field, for example) would change the hash.

On the other hand, if I were the RIAA attempting to identify common files in this way, I might be inclined to exclude the ID3 tag from the MD5 computation since it is so easily modified.

Any changes to the actual content, though, will ripple into the MD5 computation.

Short answer: "normalizing" the file for volume, or even chopping off a few seconds of trailing silence with something like CoolEdit will certainly change the hash and make it distinct from whatever their baseline hash value is.

Re:What happen if

[3terrabyte]

I agree with your circumvention techniques. And by all means do it. However, the RIAA hardly needs to do any exclusion, since 95% of the people they're looking at don't bother.

Since the RIAA is most likely automating most of their fishing expedition, I'm sure they don't care about the 5% of the people who are using PeerGuardian, retagging, etc. If they ran across someone like you, I'm sure they'd dump and move on.

If, for some reason, they personally wanted to get you, then yes I'm sure they could manually bulid a case anyway. You'd have to be a special case, though. Like a known seller. Or maybe if you're leetHAXORjoe with 40,000 songs shared, and they wanted a big headline.

Re:What happen if

[1u3hr]

Short answer: "normalizing" the file for volume, or even chopping off a few seconds of trailing silence with something like CoolEdit will certainly change the hash

If that's all you want to do, much better not to use Cooledit, which has to expand and recompress the file to MP3. Use something like MP3Trim which can chop off any given number of MP3 frames, or normalise the volume, by operating on the MP3 directly. Much much faster, and no expand/recompress quality loss.

Re:What happen if

[theTerribleRobbo]

"...The RIAA is suing a morally-corrupt child-eating pirate today after finding four hard-disks stashed away in his den of villainy:

'These disks could potentially be used to store copyright-infringing material! We must stamp out these pirates before they starve honest artists of their income!'"

Etc?

Re:What happen if

[AdEbh]

On the other hand, if I were the RIAA attempting to identify common files in this way, I might be inclined to exclude the ID3 tag from the MD5 computation since it is so easily modified.

The article seemed (to me at lest) to be implying that they were doing this as it made a separate reference to examining metadata.

- Alex

Re:What happen if

[St. Vitus]

Just use a tool that updates the id tags in batches..

A quicker way might be something along the lines of

for i in *mp3
do
echo -n 0 >> $i
done
...which probably won't cause mp3 players to choke. It can be easily reversed as well.

Re:What happen if

[Anonymous Coward]

This is almost enough to prove the RIAA's point for them. Here we are, gleefully sharing tips on how not to get caught breaking the law. Can't we think of a better way to undermine our efforts at opposing the RIAA?

Re:What happen if

[Anonymous Coward]

MP3 DirectCut is better.

MD5 Cannot stand up in court.

[Organized Konfusion]

The md5 hashing algorithm has been proven to contain flaws allowing two files to produce identical md5 sums.

Re:MD5 Cannot stand up in court.

[Libor Vanek]

ANY hash can produce same result on two different files since the amount of information in hash is amount of information in files.

Re:MD5 Cannot stand up in court.

[l1gunman]

The chances of this happening with a sophisticated hash like MD5 (and its 128-bit output) is statistically insignificant.

A weakness has been found in MD5 and is still being assessed, but it is still extrememely strong, cryptographically speaking. It has been estimated that our sun will have long since gone nova before you could find two different files that have the same MD5 hash.

I believe this will stand up in court as well or better than any DNA evidence statistics.

Re:MD5 Cannot stand up in court.

[guile*fr]

i think that the flaw is that under some circumstances you can deduce the actual data from the md5sum

Re:MD5 Cannot stand up in court.

[Urkki]

A bit of clarification is in order I think.

First of all it's very clear that two files can give same MD5 checksums. After all, MD5 is only 16 bytes (2^128 different possible). So if you have just 17 byte files (2^136 different possible), it's clear that on average every MD5 sum matches to 256 of all possible files.

It's just damn unlikely to get 2 files with same MD5, and if you wanted to brute force it, you would have to try average 2^64 different files before you found one with identical MD5 to another file. And this would take a long time (actually not that terribly long, a few years at most, and it parallelizes perfectly).

The page you link to implies that it's possible to "easily" fabricate a file that produces a given check sum, so instead of months of processing time, only days or hours would be needed to get a MD5 hash collision.

So all P2P users / software makers need to do to circumvent this, is to agree on a specific MD5 sum, then patch every file so that they produce this same MD5 sum :)

Of course the obivious solution for RIAA would be to use a more secure hash algorithm, with more bits. Unbroken algorithm with enough bits can't be faked, as it would take more than age of the universe to brute force it.

Though the basic problem with this RIAA method remains. If you rip with same software from identical CD digitally, and there are not bit errors at ay point, then you should end up with identical file, and therefore identical hash no matter how secure the algorithm is...

Re:MD5 Cannot stand up in court.

[radish]

Though the basic problem with this RIAA method remains. If you rip with same software from identical CD digitally, and there are not bit errors at ay point, then you should end up with identical file, and therefore identical hash no matter how secure the algorithm is...


True, but how many people trade WAVs? Given that mp3 compression is lossy, every different encoder will produce a different compressed file given the same input. Obviously the settings (bit rate, stereo mode etc) will also completely change the file which is generated. So this approach of fingerprinting will be able to say that person A and person B both have identical files, and that it was almost certainly generated from the same original track, with the same encoder and the same settings, and the same ID3 tag info. What it can't say (as far as I can tell) is that they are copies of the same original mp3.

Re:MD5 Cannot stand up in court.

[Dr. Blue]

The md5 hashing algorithm has been proven to contain flaws allowing two files to produce identical md5 sums.

Well of course. In fact, you might even say that's part of the entire point of hash functions (being that they map things into a smaller set). However, despite the "flaw" concern, it's really not a real-world issue. Notice that this warning was from 1996 --- 7 years ago. And yet, do date, no one has been able to find a single MD5 collision (two different files with the same hash value).

That aside, I'd recommend to anyone looking for a hash function now to use SHA1 or the longer 256-bit version. But I sure wouldn't lose any sleep of MD5 being used.

And as for the subject line, MD5 can and does somewhat regularly stand up in court. It's a standard computer forensics technique for vouching for authenticity of data.

Re:MD5 Cannot stand up in court.

[Anonymous Coward]

You extract 5 million bytes from a few bytes? That's a *BIG* flaw then...

Re:MD5 Cannot stand up in court.

[Kjella]

ANY hash can produce same result on two different files since the amount of information in hash is amount of information in files.

Somehow I don't understand what you're trying to say. Yes, two random files will have the same hash with a probability of 2^128:1 against, more than enough for "reasonable doubt" (which is the requirement for a criminal case, civil suits are far less strict).

The issue here is if, given a known hash, it is possible to construct another file which will produce the same hash. A typical example is a checksum - 1234 can have a checksum 1+2+3+4 = 10. But I can easily constuct data 3+2+1+4 = 10, giving the same hash.

If you can arbitrarily do that, any hash evidence is null and void - it does not in any way prove which data the hash belongs to. On the other hand, that would also make hashes for tamper security worthless (it still has other uses, as a checksum as well as protect e.g. passwords so that they are not stored in plain text).

Kjella

Re:MD5 Cannot stand up in court.

[Urkki]

To correct myself:

actually not that terribly long, a few years at most, and it parallelizes perfectly

Actually isn't true. I was mixing it up with cracking unix MD5 passwords, which is easy because the password lenght often is relatively short, like just 8 chars, so you can actually go through the entire password space by brute force quite fast until you find a password that generates the MD5 sum you know. Going through the entire MD5 hash space by brute force would take ages.

OT:
So either use long enough passwords (10 chars minimum for a random one) or change yours every month. Even 8 char totally random password is cracked in months with single computer, let alone if you can harness a bunch of windows machines on the net to chomp through a captured password file with many passwords...

Re:MD5 Cannot stand up in court.

[Urkki]

Imagine two people using same ripper with default settings, and getting tags and stuff from same online database.

Above is not very far fetched, now is it? And result should be identical files.

Re:MD5 Cannot stand up in court.

[ComaVN]

Not to mention one hell of a (de)compression algorithm

Re:MD5 Cannot stand up in court.

[Anonymous Coward]

Yes but the RIAA secret is that there are always bit errors, quite to the contrary of what we were told when CDs came along.

Re:MD5 Cannot stand up in court.

[Urkki]

(it still has other uses, as a checksum as well as protect e.g. passwords so that they are not stored in plain text)

No. If you can easily generate a password that gives this hash, then that generated password will be accepted even if it's not the same as original one.

So storing insecure hashes of passwords is no better than storing plaintext passwords.

Only real use for insecure hash is detecting data errors, and obfuscating data that is so unimportant that nobody will go to the trouble of cracking it even though it is possible.

Re:MD5 Cannot stand up in court.

[GigsVT]

An 8 character password has a huge brute force space.

Considering that MD5's can only be cracked at a much lower rate (maybe a few hundred a sec? It's been a while since I tried last) than the old crypt hashes, it would still take years to break an 8 character random password

Assuming 26+26+10 for upper/lower/numeric, that's conservative since a strong password has symbols too.

62^8 possible passwords = 2.18e14

Assuming you can do 2000 cracks a second, it would take 3400 years to go through the whole space.

Re:MD5 Cannot stand up in court.

[radish]

I never said it was. In fact I implied the opposite, in that the RIAA's aim of using this to trace the sharing of the same original file doesn't hold water. That isn't however the same as the original poster's suggestion that every copy of a given track would have the same hash, which is not true.

Re:MD5 Cannot stand up in court.

[sheetsda]

Yes, but AFAIK the only technique for doing so is brute force (might be wrong here, if I am someone call me on it). So you'd have to just happen to randomly generate the mp3 file, or some other file that hashes to the same thing.
There was a flaw in Blackboard around 6-10 months ago that allowed to retrieval of arbitrary MD5 hashed passwords, the only problem with that was you could brute force a password that hashed to the same thing and authenticate as the user of that password.

Re:MD5 Cannot stand up in court.

[Mechanik]

So all P2P users / software makers need to do to circumvent this, is to agree on a specific MD5 sum, then patch every file so that they produce this same MD5 sum :)

That would totally pooch clients such as E-Donkey that use MD5 hashes to actually figure out which clients have a particular file (whether just a portion thereof, or in their entirety), irrespective of how each individual client may have renamed it.

And trust me, there are fringe benefits to the hashing as well, such as making it apparent when someone is trying to masquerade a file as something that it's really not.

E.g., consider the following scenario...

1. You are searching for Red Hat ISOs.

2. You find a match called "Red Hat.iso" shared from one user.

3. You notice that there are 50 other users sharing the same file.

3. The other 50 versions are named as "Goatse.cx guy and tubgirl together at last.mpg"

4. Therefore, something is very very rotten in Denmark... :-)


Mechanik

Re:MD5 Cannot stand up in court.

[MoZ-RedShirt]

Of course MD5 will produce identical sums for some files. That's just because there are about 3,4e+38 possible MD5 sums (16^32) and I bet there are (or at some time in the near future will be) more files on the planet than this.

It is highly improbable but not impossible to find two files with the same hash. But I doub't anyone will be able to find two mp3s both about 3 to 6 MB in size with the same MD5 hashes.

RedShirt

Re:MD5 Cannot stand up in court.

[semanticgap]

MD5 (or any other secure hashing algorithm such as SHA) allows for identical hashes to be produced by definition, so that's not really a flaw.

IIRC the flaw is that it is supposed to be extremely difficult to arrive at a specific digest/signature by altering input, and MD5 has been shown to be a lot more predictable than was originally thought.

But I don't see how any of this applies to RIAA - using hashing to identify sound or video files is a retarded idea since slightest alterations in the files will produce radically different signatures (that's what secure hashing is), while my ear doesn't really care if one bit is off somewhere, it will sound just as good.

Re:MD5 Cannot stand up in court.

[TheRaven64]

From Core PHP Programming Second Edition:

`The md5 function produces a hash as described by RFC 1321. The function takes a string of any length and returns a 32-character identifier. It is theorized that the algorithm for the md5 function will produce unique identifiers for all strings.'

I couldn't stop laughing when I read this.

Re:MD5 Cannot stand up in court.

[Urkki]

It's much shorter time than that.

Say 6 bits per letter, total 48 bits,
-> 2^48 different passwords.

Assume 256=2^8 clock cycles to caclulate one hash (imagine hand-optimized routine using MMX instructions or 64 bit processor).
-> 2^56 clock cycles needed *total*.

2GHz processor, 2^31 cycles per second
-> 2^25 seconds
-> 388 days

Split to 10 computers (parallelizes perfectly)
-> 6 weeks

And this cracks every 8 char password in a password file, not just one.

Re:MD5 Cannot stand up in court.

[Troed]

Start at guessing at about 4000000 "cracks" a second for usual implementations.

NetBSD did ~700000/second in Aug 2000 (Dunno the hardware)

Re:MD5 Cannot stand up in court.

[unperson]

It's just damn unlikely to get 2 files with same MD5, and if you wanted to brute force it, you would have to try average 2^64 different files before you found one with identical MD5 to another file. And this would take a long time (actually not that terribly long, a few years at most, and it parallelizes perfectly)

Actually, 2^128 possibilities dictates that you can expect to try 2^127 different files (assuming pure brute force and the law of averages). This would take *signifigantly* longer than 2^64...in particular, about 2^63 times longer.

Quick calculations will show that this would still take a billion computers (running a billion md5sums per second!) over 5 trillion years. I think we can say that the possibility is nil.

Re:MD5 Cannot stand up in court.

[Patrick]

It's just damn unlikely to get 2 files with same MD5, and if you wanted to brute force it, you would have to try average 2^64 different files before you found one with identical MD5 to another file. And this would take a long time (actually not that terribly long, a few years at most, and it parallelizes perfectly).

The page you link to implies that it's possible to "easily" fabricate a file that produces a given check sum, so instead of months of processing time, only days or hours would be needed to get a MD5 hash collision.

There's a difference between finding two files with the same hash and finding a file with a specific hash. The former is an example of the Birthday Paradox and "only" takes 2^64 tries (perhaps a few months). The latter is truly brute-forcing the hash and would take 2^128 tries (a billion billion years or so).

To put it another way, if you get to generate both files, it's moderately difficult. If you have to generate a forgery for someone else's signature (an existing MP3 or ISO file), that's impossible.

So all P2P users / software makers need to do to circumvent this, is to agree on a specific MD5 sum, then patch every file so that they produce this same MD5 sum

That's a particularly strange request. For a small number of files, you get to control all of the files, so it's around 2^64. For a large number of files, you have to brute-force each one independently, so each file is 2^128. I think the actual expected time to make N files produce the same checksum is (N^N)/N!*2^64 or N*2^128, whichever is less.

In sum (pun intended), if two files have the same hash value, they almost certainly have identical contents, even if they are not of the same origin.

Re:MD5 Cannot stand up in court.

[AdEbh]

which is the requirement for a criminal case, civil suits are far less strict

It is a civil case.

- Alex

Re:MD5 Cannot stand up in court.

[Urkki]

MD5 hashes of parts of file would still be different, even if hash of entire file was duplicate.

But anyway, using MD5 allows anybody to masquerade an entire file if he has a quick way to create MD5 hash collision, and no way to prevent it (other than not using MD5, but something better instead).

Re:MD5 Cannot stand up in court.

[Anonymous Coward]

After all, MD5 is only 16 bytes (2^128 different possible). So if you have just 17 byte files (2^136 different possible), it's clear that on average every MD5 sum matches to 256 of all possible files.
It's just damn unlikely to get 2 files with same MD5, and if you wanted to brute force it, you would have to try average 2^64 different files before you found one with identical MD5 to another file.

Since when doesn (2^128)/2 = 2^64 ? --- don't trust it "because it's on Slashdot"

Re:MD5 Cannot stand up in court.

[leviramsey]

I wish I could find the website of some idiot college student in Canada who thought that, since he was using one of the BSD's that he was a genius. He was seriously proposing to compress data using the MD5 algorithm...

Re:MD5 Cannot stand up in court.

[Jagasian]

I rip all of my CDs to FLAC, which is the PNG of audio. It is an open free lossless compression audio format. Google it, you will like it :)

Re:MD5 Cannot stand up in court.

[radish]

I already use it :)

Re:MD5 Cannot stand up in court.

[uhmmmm]

Actually, I believe edonkey uses MD4 hashes, not MD5.

Re:MD5 Cannot stand up in court.

[ssimpson]

"The md5 hashing algorithm has been proven to contain flaws allowing two files to produce identical md5 sums."

You missed two important words at the end of the sentance "in theory".

Whilst MD5 is theoretically insecure (and it's use in most situations where the birthday paradox applies is frowned upon by cryptographers) I don't believe that a collision in the full hash function has been shown in practical terms. Besides - is it a good use of a few hundred days of horsepower on a few hundred machines to fake an illegal song?! ;)

I've got an old (but still relevant) description of the MD5 flaw here.

The trivial fix for RIAA is to use SHA1 as a hash.....Or just produce a business model that makes sense...

Re:MD5 Cannot stand up in court.

[Libor Vanek]

The main point is you can have easily (OK - not so easy, but easy for NSA etc.) database of all password-hash pairs. Thats why Linux uses so caled "salt" which can change system to system which causes that you'd had to have password-salt-hash triplets which is HARD to have ;)

Re:MD5 Cannot stand up in court.

[Organized Konfusion]

No I mean if you have one file and it's MD5 sum you can engineer another file to have the exact same MD5.

Re:MD5 Cannot stand up in court.

[ssimpson]

And how will you do that? It will take 2^127 steps of effort.

People have found collisions in the compression function, not the complete hash function - it has never been shown how create a new string/file that hashes to the same value as an existing MD5 hash.

Re:MD5 Cannot stand up in court.

[prator]

So its possible that a Britney Spears mp3 and an mp3 of me raking my fingernails across a chalkboard might have the same md5...

Now that I think about it, those two things actually sound alike also. :P

-prator

Re:MD5 Cannot stand up in court.

[Fweeky]

These two people will also need to be using the same drives, and a good quality CD and/or secure mode ripper (EAC), and drive offset correction or the same drive. Pre-scratched ("Copy Protected") CD's are even more hairy, because they break the error correction and detection codes, making it difficult enough to get two identical rips using identical setups; never mind two entirely seperate systems.

Two different people using different drives with different offsets are really relatively unlikely to come out with identical files, especially ripping in burst mode (like most do).

Of course, those who use offset correction and secure mode ripping (i.e. clueful users) are *much* more likely to produce identical rips. But then these people are also more likely to tag files uniquely (%DISC% vs%DISK%, %SINGLETRACK%, %ALBUM ARTIST% vs %VARIOUS%, etc), apply ReplayGain/WavGain/mp3Gain, and so on, which counteracts this somewhat.

But... none of this really helps anyone. If you come out with identical MD5's, all it shows is two users have the same rip. It doesn't mean one got it off another; maybe they just have the same drives, same setup, or just got lucky. Maybe they even used a ripper which compares checksums with other rips.

Identical MD5's do not mean they're both from one sharing user; differing MD5's do not mean they aren't. Now, someone please go tell the lawyers.

Re:MD5 Cannot stand up in court.

[jjjefff]

Of course the obivious solution for RIAA would be to use a more secure hash algorithm, with more bits. Unbroken algorithm with enough bits can't be faked, as it would take more than age of the universe to brute force it.

Everybody's getting all up in arms about the finer points of MD5 hashes, but the article doesn't actually say "MD5" anywhere. Maybe they are using a more secure hash. I know I would if I were programming for them.

Re:MD5 Cannot stand up in court.

[jimfrost]

But I don't see how any of this applies to RIAA - using hashing to identify sound or video files is a retarded idea since slightest alterations in the files will produce radically different signatures (that's what secure hashing is)

That's exactly why what they're doing is such a good idea. Hashing is a great way to rapidly compare two files for equivalence. They can easily build up a database of content that's out there and quickly compare new content to existing content to determine probable relationships. It's not perfect, a match doesn't necessarily indicate a direct copy or even the same content, but it's going to severely reduce the amount of stuff they have to manually sort through.

It's particularly good since minor differentiations in file content -- such as errors during the ripping process -- will alter the hash result. These differntiations allow you to easily track different versions.

Where the RIAA will have issues is that, hash or no, two people can use the same ripping/compressing tool with the same settings, same song database, and enforce clean data extraction in which case the resulting file will be identical. In that case it'll be difficult for the RIAA to prove provenance or any other relationship, which is probably why they said that it can "sometimes" be used.

I would not be terribly surprised if "sometimes" works out to be "more often than not." It will depend a lot on how much effort people put into getting a clean rip. I don't know about you, but I want fast rips more than I care about clean rips (the idea being that if it's too terrible I can re-rip individual songs with lower error tolerance). I'd guess that a pretty large number of my files would have unique identifiers due to minor read errors. If that's the case then tracking isn't going to be terribly hard. It would be a neat research project to rip a couple of different copies of the same CD on different computers with the same software and default settings and see just how often you get mismatches.

But sometimes you don't even have to rely on errors. In the case they're talking about there were specific tags in the file to identify the source. While it's still possible for the woman to have inserted the same tags, used the same tools and settings, and used the same song database the combination of these things is pretty unlikely. And it becomes more unlikely the more such disparate tags or encoding mechanisms are found in her collection. If I were to make a bet I'd bet that she loses and that's why. Moreover, this issue is likely to be the bane of a lot of people who bear the brunt of an RIAA lawsuit.

And, frankly, I don't see why she and people like her don't deserve to lose. Do you file traders really believe it's your right to get this stuff without paying for it? Simply because the RIAA is charging too much? It's hard to see why such copying is either legally or morally justified.

While I strongly support the right for people to burn their own collections (clearly fair use) it really is theft to download these things. While I am not sure the penalties are appropriate ($150,000 per infringement is way out of line with the actual value of many tracks; that's more appropriate for wholesale CD duplication) some penalty seems in order in cases where bulk copying (as opposed to pre-purchase sampling) can be shown.

The good thing about P2P is it is putting pressure on the music industry to break out of the box of supplying only CD media, particularly at over-inflated prices made possible only because they have an effective monopoly. They're trying the legal approach to curbing P2P now, but that's untenable in the long term. They have to find a new business model that allows them to leverage the same technologies that make P2P possible to produce revenue without pricing things such that the risks associated with P2P (possible legal action) outweigh the benefits (free music) for users.

I think we can liken that to the movie industry.

Re:MD5 Cannot stand up in court.

[GigsVT]

Why does John the Ripper only get 3800/sec on my Athlon 1500?

Re:MD5 Cannot stand up in court.

[poot_rootbeer]

The md5 hashing algorithm has been proven to contain flaws allowing two files to produce identical md5 sums.

You mean that an algorithm for distilling an arbitrary-large data stream m into a far, far smaller number n has a possibility of hash collisions? Noway!

In order to create a truly, globally unique MD5 sum, the size of the sum would have to be identical to the size of the source file.

Re:MD5 Cannot stand up in court.

[GigsVT]

Maybe I'm just ignorant, but my shadow file has 256 bit long hashes in it.

Re:MD5 Cannot stand up in court.

[El Cubano]

E.g., consider the following scenario...

1. You are searching for Red Hat ISOs.

2. You find a match called "Red Hat.iso" shared from one user.

3. You notice that there are 50 other users sharing the same file.

3. The other 50 versions are named as "Goatse.cx guy and tubgirl together at last.mpg"

4. Therefore, something is very very rotten in Denmark... :-)

Of course, those other 50 people should realize that it is not polite to dupe someone into downloading a RedHat ISO. Clearly they are part of RedHat's plan to take over the entire desktop computer market.

Re:MD5 Cannot stand up in court.

[Copid]

This is true, but that doesn't mean that text passwords could generate 2^256 different combinations. If you have only 8 characters of 8 bit ASCII, you get a max of 64 bits. Many of those characters (like \a) aren't valid password characters, though, so 6 bits per usable ASCII value is probably valid. In effect, it's really only about 48 bits. Sure, it's possible to generate a string of bytes that will hash to every one of the 256 bit long hashes in your shadow file, but the vast majority of those are not valid passwords (they have non-printing characters in them or they're more than 8 bytes). Most of that 256 bit hash space is wasted on 8 character passwords. Crackers work by generating all possible 8 character passwords, hashing the results, and comparing the hashes. That's fast. The other option would be trying to generate a string that has a particular 256 bit hash. That's a much nastier task.

Re:MD5 Cannot stand up in court.

[Anonymous Coward]

Hmm, I haven't heard anything about finger prints and DNA becoming inadmissible in court.

Re:MD5 Cannot stand up in court.

[Anonymous Coward]

eDonkey does not use MD5 hashes. It also doesn't use just one hashm plus the file sizes must match, making the creation of a dupe file with the same hash very unlikely. Donkey hashes each file block. Watch ed2k_hash (http://users.aber.ac.uk/tpm01/ed2k_tools/) in action sometime.

Re:MD5 Cannot stand up in court.

[eric76]

Some of my passwords are between 90 and 100 characters long including upper and lower cases, numeric, and special characters.

Re:MD5 Cannot stand up in court.

[RedWizzard]

Actually, 2^128 possibilities dictates that you can expect to try 2^127 different files (assuming pure brute force and the law of averages). This would take *signifigantly* longer than 2^64...in particular, about 2^63 times longer.

You're both wrong. This is basically the birthday problem on a grand scale. Using one of the approximations for P2(n,d), it looks like 2^97 files would give a 63% probability of a collision. It's still not practical though.

Oh, and there is no "law of averages".

Re:MD5 Cannot stand up in court.

[Exousia]

When the amount of pirated works is over certain amounts during a certain period, there are criminal penalities. Only the worst offenders are eligible. See U.S. Code Title 17, Chapter 5, Sec. 506 [cornell.edu] for the offenses and Title 18, Chapter 113, Sec 2319 [cornell.edu] for the penalties.

Re:MD5 Cannot stand up in court.

[Exousia]

You *could* do this if with a big enough dictionary appended to the hash. But that would be really, really stupid. :)

Re:MD5 Cannot stand up in court.

[GigsVT]

Crackers work by generating all possible 8 character passwords, hashing the results, and comparing the hashes. That's fast.

Then why is it so slow?

The way people talk here, crackers should be several orders of magnitude faster than they are. John gets about 4000 guesses/sec on my machine, which is an Athlon 1500 or thereabouts.

I'm not really disputing their theories, since I don't really know enough to rebut them properly, but my rubber-hits-the-road experience shows that something is wrong with their logic. I find it hard to believe that the authors of John wouldn't have taken advantage of something that would make their cracker 1000 times faster.

Re:MD5 Cannot stand up in court.

[nosf]

Actually you would expect to on average test 1/2 of the keyspace to find a match - since the space is 128 bits, or 2^128 combinations, half of it is 2^127 (or 1.7 * 10^38). That's a lot longer than a few years even if you do parallellize it.

Added to that, each attempt is more expensive computationally (you are trying to create a several mb file that has an md5 collision and hash it) than something simple like RC4/RC5.
IIRC, MD5 takes about 80 cycles for every 64 bytes - that's about 5 million cycles per mp3 to be conservative, never mind generating a file. So expected time for a match would be 1.7 * 10^38 * 5 * 10^6 CPU cycles = 8.5 * 10^44 cycles.

Assume a 1ghz cpu that has a single ALU with ideal pipeline for this and no memory overhead - 10^9 cycles/sec. 3.1*10^7 seconds/year. So 2.7*10^37 CPU years.

In other words, a very conservative estimate of a billion PCs taking 10^28 (ten billion billion billion) years to find an mp3 file whose MD5 hash collides with another. If you have a set of N files and you are looking for a collision with just one, divide above number by N.

Re:MD5 Cannot stand up in court.

[Copid]

When I said "fast" I didn't mean exhausting the whole keyspace or doing the MD5 calculation. In fact, as you note, the MD5 calculation is quite CPU intensive. Here's what makes cracking a machine fast:

We have agreed that 6 bits per character is reasonable. So, the size of the keyspace is 2^(6*8) = 2^48 = 281474976710656. To totally exhaust that space at 4000 keys/second will take you 2331 years (might as well wait 3 years for a faster computer and cut that time in half, no?).

The trick is this: How many words are there in the English language? Better yet, how many are there in the average person's vocabulary. Let's (generously) say that the number is 35,000. How many are over 8 chracters? Let's (generously) say 30,000. Your machine can search that key space in under 8 seconds. Let's allow for a person to add number from 1 to 1000 after the password (ignoring the fact that this reduces our English word selection to those that are 4 characters or less). We're still under 3 hours.

Add to that a clever algorithm that puts words that are hard to type (like stewardesses) at the end (people hate passwords that are hard to type). Add to that the fact that there are usually a few accounts in the passwd file. Eight accounts means 8 times as many chances for a hit. Basically, you can't explore the whole keyspace without a really good algorithm and several really good computers, but you can easily explore the small portion of the keyspace where most of the hits will be.

The result? We wasted our 256 bit hash by hashing 48 bit values. We wasted our 48 bit keyspace by using only a small subset of it. The bottom line is, if you have weak passwords, john or crack will find them in short order--not because they're brilliantly fast (although they are optimized for this sort of thing), but because they're clever about what order they search a small keyspace in.

Re:MD5 Cannot stand up in court.

[GigsVT]

Yeah, I understand that aspect of password cracking, but you are taking this in a completely different direction from the original assertion, that an 8 character random string is trivial to crack when MD5'd.

That was the assertion I was responding to, but if you want to take it up another level, the start of this thread was that MD5 was too weak to stand up in court, when applied to several MB files. DNA evidence stands up in court, even though their is a chance of collision, MD5s chance of collision is probably even smaller.

So far I haven't seen any convincing arguments to the contrary, only some very strange logic that doesn't seem to make sense. I'll admit I may just be too ignorant to understand the implications, but it doesn't seem quite like sound logic.

Re:MD5 Cannot stand up in court.

[Copid]

I think that some people are confused about the likelihood of a collision with MD5 hashing. The probability of any two hashes in a given set colliding isn't all that bad compared to the probability of finding a string of bytes that will collide with another given string. I think you're right on this point. An often cited example of this confusion is birthdays:

In a classroom with 30 students in it, the probability is better than 0.5 that two of them will have the same birthday. (I believe that the number of events required to produce a probability of greater than 0.5 given n possible outcomes for that event is soemthing like 1.2 * n ^ (1/2), but I could be wrong.)

However, given one particular student, the probability that another student in the class shares that student's birthday should be 29/365 (or 366). People sometimes use the first statistic to confuse you on an issue when the more accurate analogy is actually the second (looking for something whose hash collides with a particular value). There are analogous situations in cryptography for both of these examples, but I believe that password cracking is more of the latter. The book _Applied Cryptography_ should clear up any confusion about this. As for me, it's late and I'm a bit foggy. ;-)

Re:MD5 Cannot stand up in court.

[crapulent]

Christ, anything's possible, but that doesn't mean it's probable. The probability that two files are both valid MP3 formats and contain something that remotely resemble music and still have the same MD5 hash is -astronomically- small.

And futhermore, copyright infringement is not a criminal case, it's a civil matter. That means that you don't have to show "beyond a reasonable doubt", rather it comes down to a "preponderance of evidence", i.e. you have to show that it was more likely than not, subject to jury's interpretation of course.

So while fingerprints and DNA and whatnot will always be questioned in criminal cases because there's "always a chance of an error", the discussion is meaningless for a civil trial because all that's required is to show that the possibility is very unlikely (which is is.)

own rip identical to download

[whaley]

Could be possible, but I think there will be a big chance of there being a difference in rips made by two different people. Audio rippers aren't always perfect AFAIK.

Re:own rip identical to download

[Asprin]

Audio rippers aren't always perfect AFAIK.


... or even competent! How many rippers can't get the tagging right when the song and artist ARE PRINTED RIGHT THERE ON THE LOUSY CD COVERSLIP! Sheesh! Learn the difference betwenn Meat Loaf and Leo Sayer for cryin' out loud!

Re:own rip identical to download

[malf-uk]

Aww crap. /me cancels download of Leo Sayer and Celine Dion - Dead Ringer For Love.mp3

Re:own rip identical to download

[Anonymous Coward]

How many rippers can't get the tagging right when the song and artist ARE PRINTED RIGHT THERE ON THE LOUSY CD COVERSLIP!

This is actually the perfect solution to the problem. I found that most napsterites had lousy naming and tagging schemes. Even adding a single space to the end of one ID3 field will kill MD5 matching.

Of course there's also post processing, pop elimination, noise reduction, normalizing, etc will all modify the resulting hash.

Re:own rip identical to download

[MyHair]

Sheesh! Learn the difference betwenn Meat Loaf and Leo Sayer for cryin' out loud!

And also please realize that Weird Al Yankovic is not the only artist who does parody and other funny songs! Every freakin' funny song it seems is labeled "Weird Al".

(Not that I've ever used P2P or anything. . . .)

Napster?

[Anonymous Coward]

Go ahead and let them try to track down as many files as they want on the Napster network...

It will keep them occupied while everyone else uses Kazaa.

MD5 Hash

[fruey]

This seems quite interesting but I was under the assumption that identical hashes could be created with identical rips and id3v2 tagging.

The only way for two files to have the same MD5 hash is for them to both be encoded with the same encoder, from the same WAV file, with the same bitrate and all advanced options, and to have exactly the same ID3 information, the same filesize, and to be identical to the last bit.

Otherwise, the MD5 will be nothing like the same, for two perfectly identical songs where one has a spelling error in one field of the ID3 tag. I imagine for any one song, there are many many different MD5sums out there, although perhaps one or another good quality version would exists on hundreds of different PCs...

Re:MD5 Hash

[Dog and Pony]

You could improve on it slightly if the encoder ignores the tags, and just go for the data. This means that any file shared could then be tracked around even if someone changes the tag info...

Even so, it sounds really impractical... unless they are trying to prove that "you got this file from that guy, that got it from that guy"...

Utterly useless in tryin to prove that any mp3 is in fact this or that song, without listening to it.

Re:MD5 Hash

[gl4ss]

you mean like use a ripper with default options that gets the id3 tags it uses from a database like most consumers are expected to do?

-

Re:MD5 Hash

[kzinti]

The only way for two files to have the same MD5 hash is for them to both be encoded with the same encoder, from the same WAV file, with the same bitrate and all advanced options, and to have exactly the same ID3 information, the same filesize, and to be identical to the last bit.

If two people used the same ripping software set to all its default settings (as many unsophisticated users do), got a perfect rip off the CD, and relied on CDDB information for tagging the song, then it's possible that they got mp3s identical down to the last bit, and thus identical MD5 hashes. BUT to make this a plausible defense, you'd have to show that your rip was in fact perfect. In other words you'd have to be able to recreate the mp3 independently. If the old Napster mp3 had any ripping errors, then it would be hard to claim that the later rip just happened to have the same errors - assuming errors are essentially random.

Re:MD5 Hash

[91degrees]

The only way for two files to have the same MD5 hash is for them to both be encoded with the same encoder, from the same WAV file, with the same bitrate and all advanced options, and to have exactly the same ID3 information, the same filesize, and to be identical to the last bit.

There are only a handful of popular encoders used. Many people will produce a file by ripping straight from a CD, which , given the same CD, will result in an identical source file. Almost everyone encodes at 128kbps. Most people set the advanced options to the defaults. The ID3 information is often generated automatically by software, with information downloaded automatically from a public CD database.

If two people use the same software to rip the same CD, the MD5 has will be the same.

Re:MD5 Hash

[squaretorus]

Stick a CD into my laptop, fire up Windows Media Player, hit Record CD, pick MP3 from the options, allow it to grab the track info etc...

I'm willing to bet that that will be being repeated tens of thousands of times for any one track - especially mainstream pop-crap like the lovelyiciouis Beyonce. Surely an identical MD5 comes out at least x% of the time!

Re:MD5 Hash

[the Man in Black]

unless they are trying to prove that "you got this file from that guy, that got it from that guy"...

That is exactly what they're trying to prove. They have MD5 sums from files traded over the Napster network, and they are sneaking around comparing people's files to those. If you have a file that matches, then that means you have one of the files that was traded on Napster, which means you're going to JAIL. YOUR ASS = MEAT

My problem with this is the assumption that any file traded over the Napster network is illegal, but who asked me?

Re:MD5 Hash

[szemeredy]

In other words, every lazy user that downloads lame with a frontend or some other encoder without modifying default settings and that leaves the ID3 tag alone (most use CDDB/Gracenote or freeDB to generate an ID3 tag, resulting in identical tags) will end up with the same MD5 hash when compared to someone else who did the same thing with the same CD. The only ways you're going to get a different MD5 checksum from an MP3 file is by: A) using a different encoder B) using a different version of an encoder C) modifying the ID3 tag D) deleting the ID3 tag E) changing the file name F) modifying the file in an audio editing program Don't forget that the RIAA is probably also using CRC checksums to identify specific albums, as many encoders also support inserting CRCs into MP3s by default (and these will be identical for rips coming from the same album regardless of bitrate)

Re:MD5 Hash

[Ambush]

Oh right, so you haven't heard of CDDB (freeddb)?

If I buy a CD, and so does Fred 2000 miles away, and we both rip it with audiograbber (or any other common Windows ripper) using default options (incl *ddb), why would they not have the same MD5 hash?

Maybe I'm way off mark here, but I figure most people use the one O/S (even slashdot readers, no?), the same ripper, and default options on both.

Re:MD5 Hash

[stripes]

then it would be hard to claim that the later rip just happened to have the same errors - assuming errors are essentially random.

But are they? Or are they tied to defects on the CD (scratches on the same place, or a bit error in the glass master?) Or are they tied to the model of CD-ROM used to read them? Or just plain random?

If it is tied to the CD-ROM one could argue that you ripped that CD with the same model CD-ROM as that other guy over there, but when the CD-ROM broke you got a new one (and it could even be true). (this isn't a claim I'll be needign to make, I actually ripped all my own MP3's, it's hard to find a good rip out there...and besides I'm on dial-up)

Re:MD5 Hash

[IRandom]

Yes, but note that just changing the ID3 tag isnt enough since when you calculate the MD5 hash value you can just ignore it and then you will be able to find matches.

Although i wonder, if the WAV files on 2 CD of the same album are identical, the only thing you can prove from the fact that the hashes match is that you made the mp3 file using the same bitrate.
I cant say this is enough information.

BTW: A way to move around having the exact same copyit is by introducing small amount of random changes. one bit is enought the fool the hash

Re:MD5 Hash

[Danathar]

Instead of people saying "what would happen" has any of you bothered to ACTUALLY see if what you say comes true? I took a CD, used the same ripper, same encoder, different PC's, same default settings and created two MP3's and calculated MD5 sums. Guess what, they are NOT the same! Yes, they have the same ID tags and as far as I can tell ALL the options are identical.

By the way the same thing happens if you try it with other encoders as well. So before you start spewing your theories as true, why don't you test it? Especially if it is one that is EASY to test!

Flame off

Re:MD5 Hash

[holgie]

But if the CDs are clones to start with and you use the same everything-in-a-box software that retrieves info from the internet, AND you just use the standard settings...
THEN it is pretty d... likely that your mp3 files will be exact copies and then so will your md5 sums be.

However - if it says "ripped by the playboy ripper" - then your butt is toast ;-)

Artificial Intelligence is the study of how to make real computers act like the ones in movies.

Re:MD5 Hash

[CausticWindow]

If the ripping produces a bit-for-bit identical copy, yes. But due to error correction when reading cdda, this is quite unlikely.

Re:MD5 Hash

[GregWebb]

CDs have inbuilt error correction data so no, scratches would have to be pretty severe for them to affect this.

I still think it's implausible, but not quite that implauisble.

Re:MD5 Hash

[azzy]

> Surely an identical MD5 comes out at least x% of the time!

Yes. You are correct. However x may or may not be 0.

Re:MD5 Hash

[holgie]

you'd have to show that your rip was in fact perfect

No no no, THEY would have to prove it

Re:MD5 Hash

[Anonymous Coward]

They're looking at files that people are "sharing" on said networks. If you're offering up copyrighted material on a p2p network for any one to grab, then you are breaking the law. There are no assumptions there.

Re:MD5 Hash

[Anonymous Coward]

this seems to be where her defence team screwed up.
assuming the same software was used by the 'illegal' ripper from the same store-bought cd and that the same default settings were used, the hashes would indeed be identical.
even the id3 tag would be auto-generated identically in this scenario.
maybe she needs better lawyers.

Re:MD5 Hash

[3terrabyte]

I don't think you could prove that there weren't errors in the mp3. EAC's whole 'perfect digital rip' relies on ripping it twice and checking for errors, no?

Without the source to compare to... you have no idea if the mp3 you have contains errors (besides the major jitters, etc)

Re:MD5 Hash

[91degrees]

has any of you bothered to ACTUALLY see if what you say comes true?

Umm. It's not that easy for us to test. One of my machines runs Linux, the other runs Windows. I can't get the same software for both. Plus they happen to be about 3 miles away right now since I'm at work. And I have no CD to try.

So when do you get different results? Are the rips produced from the CDs the same? If not, how do they differ?

Re:MD5 Hash

[squaretorus]

Never make an untested assertion that can be proven wrong! That's my motto!

Well - actually its not - my motto is really "sleep first - then quake/sim city/monopoly/drinking guinness [delete as applicable to time of year / mood]"

Re:MD5 Hash

[Anonymous Coward]

I just used two different PC's using the latest version of Windows Media Player to rip the exact same song of the exact same cd.

the size of both of these files is exactly the same 3,248,949 bytes. How would I go about checking to see if the MD5 hash matches (in Windows)?

If someone else knows how to do it I can send them the files.

Re:MD5 Hash

[laird]

The point isn't that the file was originally traded on Napster in particular, but that the file didn't originate on the defendent's computer but was copied there (illegally).

Re:MD5 Hash

[3terrabyte]

Many people will produce a file by ripping straight from a CD, which , given the same CD, will result in an identical source file.

No!! That's definately not true. Making a perfect rip is something you have to WORK at, which not many rippers do. Especially years ago. Check out ChrisMyDen's Uber Network on a detailed guide on how to make the 'perfect mp3'.

You need to use something like EAC's secure mode. It rips the cd twice and compares for exactness. Only then can you be assured your wav file has no errors.

Even if you can convince people to use the best mp3 encoding techniques (LAME 3.92 or LAME 3.90.2 -aps) I have still seen people refuse to use EAC, instead enjoying cdex, audiograbber, or (gasp) jukebox due to 'ease of use'. These ripper DO NOT make perfect rips, and will almost always make a different wav file each time due to the way it tries to make error corrections. Most people will not ditch their source either, even if there are errors. And everyone has a different scratch on their cd's.

Almost everyone encodes at 128kbps

This isn't true anymore either. Considering most of the lazy people out there download mp3's instead of make their mp3's, many of the rippers today do care about quality, and will rip in VBR or at 192. Release groups (where I would imagine most of the new stuff originates nowadays will rip at 192, 224, 256, or 320)

Re:MD5 Hash

[azzy]

Never confine yourself to just one motto! That's my motto!

Re:MD5 Hash

[CynicTheHedgehog]

What if they just hashed the ID3 values? Then it doesn't matter how the MP3 was encoded, since there is a reasonably good chance that most MP3s of the same song will contain the same ID3 tag information, especially given that a lot of rippers use CDDB and FreeDB. You could also extend the likelihood of a match by trimming extra whitespace and making all text lowercase before hashing.

If I were the RIAA, that's how I would do it. It's like a filename search, but less prone to false positives like "Usher.mp3". And lets face it, if your ID3 tags match then it's probably the MP3 they're looking for, and it probably shouldn't be publicly accessible from your PC.

Re:MD5 Hash

[blackeye]

If this is true, I'm confused... If I'm converting a longer string of bits to a shorter string of bits, how can there not be duplicates? There's just not enough shorter strings to cover all the possible input, right?

Re:MD5 Hash

[dbs_flac]

As far as I know, you would also have to use the same mp3 encoder as different encoders produce different results, therefore different files/md5sums. I'd also like to throw in flac as that uses a fingerprint, so even if the id3 tag changes, the hash doesn't.

Re:MD5 Hash

[91degrees]

given the same CD, will result in an identical source file.

No!! That's definately not true

Okay - This suprises me. Considering that perfect data is a requirement for data CDs, I would have thought audio CDs would also be bit perfect.

Almost everyone encodes at 128kbps

This isn't true anymore either.
Okay. It's an overgeneralisation. Still, the bitrate will be one of a small number of possibilities, usually an integer multiple of 56 or 64. The multpiles of 56 are less common now as well since hardly anyone is still on ISDN.

Re:MD5 Hash

[3terrabyte]

Okay - This suprises me. Considering that perfect data is a requirement for data CDs, I would have thought audio CDs would also be bit perfect.

One thing to keep in mind is that Music CD's and CD players were MADE to play with errors. Unlike data files, where one bit could screw up a Word Document header making it completely worthless, if that same bit was wrong in a music cd... what are we talking about? One small pitch of music in a nano-second part of the song? No need for the cd to quit playing music. Just ignore it, jitter correct for it (guess) and keep playing the music. Our human ears won't even notice it.

The same techique was used in most rippers, because how annoying would it be to try and rip your CD collection back in 1999 and have it stop just because there was a small scratch on the CD. A scratch that was so tiny, and can't be heard by your ears. And could easily be guessed at what the bit was suppose to be...

Okay. It's an overgeneralisation.

I probably shouldn't have even brought that up. I think what's more important here is the sheer number of different encoders out there, not to mention different software versions of the same encoder. Bitrates look downright common when compared to encoder version.

Only due to recent development of the absolute best encoder (LAME) have people even started moving to a common encoding technique. But even then, there are two versions worth using 3.90.2 and 3.92, and different extensions to use:
-alt set standard,
-alt set extreme,
-alt set insane,
and the new -Z suffix one could add.

I digress. I just wish TB sized hard drives were a nickel, and I could just go with FLAC, and everyone set up a eTree.org type MD5 checksum database, and traded perfect-sourced FLAC's instead by snail mail DVD-R's.

Re:MD5 Hash

[Anonymous Coward]

I was under the impression that the RIAA would distribute unique mp3s that cannot be produced by encoders avialable to the public. Once they seize your computer, they can check the checksum of the raw audio part (non-id3 portion) and claim that it is not a backup, but a piracy. I would do that if I were them... it will be like those cops that dress as hookers to lure innocents into an arrest!

Re:MD5 Hash

[leviramsey]

There's no guarantee that even two rips from the same CD in succession will be bit-identical.

CDDA has error-detection that's unbelievably minimal (since it doesn't have to be bit perfect); IIRC, it's barely above the level of a parity bit. Toss in jitter and so forth and you've got different WAVs every time. The question then becomes how much of each flaw is lost in the encoding process to a lossy medium. However, even then, I would be willing to bet that, in the vast majority of cases (vast enough to meet the "preponderance of probabilities" standard of a civil case), you would get a file that was different in at least one bit. One bit's difference would generate a different MD5.

Re:MD5 Hash

[leviramsey]

Try 2 successive rips of the same track, on the same computer. I'll lay better than even odds that they'll be different WAVs and result in different MP3s or Vorbis's.

Re:MD5 Hash

[Anonymous Coward]

But the whole reason the RIAA is complaining about MP3 and not tapes, are that MP3s are "perfect digital copies", where as tape is lossy.

(Yeah I know, their argument stinks, but they can't have it both ways).

Re:MD5 Hash

[Anonymous Coward]

CDs have inbuilt error correction data...

do they? i was under the impression that audio CDs don't contain any sort of error correction at all, that the data was streamed from the disk in real time. hence the need for programs like EAC and CDparanoia to get an "accurate" rip...i could be mistaken though...

Re:MD5 Hash

[Fweeky]

Sure? How much do you bet?

Track 1
Filename E:\R.E.M\Automatic for the People\R.E.M. - Automatic for the People - 01 - Drive.wav

Peak level 100.0 %
Track quality 100.0 %
Test CRC BA3F09B2
Copy CRC BA3F09B2
Copy OK

Track 2
Filename E:\R.E.M\Automatic for the People\R.E.M. - Automatic for the People - 02 - Try Not to Breathe.wav

Peak level 99.9 %
Track quality 99.9 %
Test CRC 75724FD5
Copy CRC 75724FD5
Copy OK

[...]

Track 11
Filename E:\R.E.M\Automatic for the People\R.E.M. - Automatic for the People - 11 - Nightswimming.wav

Peak level 91.7 %
Track quality 100.0 %
Test CRC 08FAC415
Copy CRC 08FAC415
Copy OK

Track 12
Filename E:\R.E.M\Automatic for the People\R.E.M. - Automatic for the People - 12 - Find The River.wav

Peak level 98.5 %
Track quality 99.9 %
Test CRC DAE684EF
Copy CRC DAE684EF
Copy OK

No errors occured

Every CRC matched. What about an old CD I got off eBay? This one was very dirty when I got it:

Track 1
Filename E:\Garbage\Garbage\Garbage - Garbage - 01 - Supervixen.wav

Peak level 100.0 %
Track quality 100.0 %
Test CRC 6B6CBCE4
Copy CRC 6B6CBCE4
Copy OK

Track 2
Filename E:\Garbage\Garbage\Garbage - Garbage - 02 - Queer.wav

Peak level 100.0 %
Track quality 100.0 %
Test CRC 2AD23A98
Copy CRC 2AD23A98
Copy OK

[...]

Track 12
Filename E:\Garbage\Garbage\Garbage - Garbage - 12 - Milk.wav

Peak level 99.9 %
Track quality 99.9 %
Test CRC FD2885B2
Copy CRC FD2885B2
Copy OK

No errors occured

See, not a fluke. I can show you plenty more, too. Now, what were those odds again?

Re:MD5 Hash

[squaretorus]

Mine too!

Re:MD5 Hash

[pclminion]

BUT to make this a plausible defense, you'd have to show that your rip was in fact perfect. In other words you'd have to be able to recreate the mp3 independently.

Where do you get that idea? At least to my knowledge, there is still a concept of "innocent until proven guilty." It seems to me it would be the burden of the prosecutor to show that you could not recreate the MP3 in that way.

You never have to "prove" your own defense, it is the prosecutor who must disprove it.

Of course, civil court is different...

Re:MD5 Hash

[kzinti]

At least to my knowledge, there is still a concept of "innocent until proven guilty."

It sounds like the RIAA is going to assert that the defendant's mp3 file was downloaded, and not ripped from her own legal CDs as she claims. To refute that argument, she will need to show that a file with the same MD5sum could be created independently.

"Innocent until proven guilty" doesn't mean you can just sit in the court room without offering any arguments in your defense, unless, I suppose, the case against you is incredibly weak. Identical MD5 hashes sounds like a strong case to me, unless she can show that those values are a coincidence.

Re:MD5 Hash

[GregWebb]

No, about 20% (from memory - check the link for corroboration, I'm a little busy to check) of the data stored on a CD is error correction data. Otherwise, data CDs would be absolutely useless in very short order.

A quick Google has just turned up http://www.disctronics.co.uk/technology/cdbasics/c d_frames.htm if you want more information. Hope that helps!

Re:MD5 Hash

[Anonymous Coward]

i thought they were both illegal (tape and mp3). riaa's going after mp3 because that's more popular.

Re:MD5 Hash

[Anonymous Coward]

Well, if they have the MD5 hashes from Napster, one would logically assume that they have the filenames and size sizes, and any other metadata that Napster stored, no?

Re:MD5 Hash

[Anonymous Coward]

You've obviously never heard of the pigeonhole principle. If you put n+1 pigeons into n pigeonholes, at least one pigeonhole must have at least two pigeons. There are 128 characters in an MD5 checksum, and the files are much larger than the number of characters, so at least one checksum has at least two pigeons (and probably all checksums have many files that resolve to it). Go take a discrete math course, d00d.

Or Perhaps...

[Joel Carr]

Now may be the time to update your illegal mp3 file MD5 hash sums.

Should that read: "Now may be the time to stop cheating people and start paying for your music!"

---

Re:Or Perhaps...

[Anonymous Coward]

And pay for "copy protected" CDs? No thanks.

I have plenty of money to buy my CDs but since the assholes decided that I can only play the CDs I bought on a dedicated CD player and not in my car or on my computer (unless I'm willing to install Windows and play the disc with the special software found on the CD). Fuck them.

I'll get my music from the net from now on.

Re:Or Perhaps...

[Anonymous Coward]

Nope. If I translate your translation back it states "We demand you guys/girls stop sharing, and pay the price we conjured up, so we can keep our fat asses in our comfortable, high-payed chairs."

What gave you the idea that the price that should be payed is actually for the *music* ?

I don't mind to pay *the artist* for his/her music. It's the other part of the price I've got problems with :-)

Re:Or Perhaps...

[perly-king-69]

Ummm, I paid for a CD the other day but I want to listen to it on my MP3 player. The CD is copy protected. I run linux. The only way I can listen to it via mp3 is to, yup, download an 'illegal' mp3! Whoever thought that up was a fscking genius.

Re:Or Perhaps...

[Katravax]

Great. Then get your favorite artist to produce his own CDs and make them available. Until then, if you're using the system, you have to pay for the system.

Re:Or Perhaps...

[Petronius]

Or perhaps it's time to start pricing CDs to reasonable amounts, like for instance this $9.99 re-edition of Neil Young's classic instead of the usual $18.99 for the usual crap.

Re:Or Perhaps...

[DoctorPepper]

Then why don't you return the CD and demand your money back, because the CD is obviously "damaged".

As long as people keep paying for copy protected CD's, the industry will keep making them that way. If you want the freedom to play YOUR music when and where you want, then you need to heed the following advice:

Vote with your wallet.

Re:Or Perhaps...

[Anonymous Coward]

"sure thing...people SHOULD pay for music! Its the only MORAL thing to do..." said the AC downloading 16 episodes of Star Trek simultaneously off KaZaA...

Re:Or Perhaps...

[jettoblack]

And as long as you don't share that 'illegal' mp3, you won't get caught as you've done nothing wrong... for now that is.

Re:Or Perhaps...

[Anonymous Coward]

It's not that they didn't think of it. It's not that they didn't plan enough. The plain and simple fact is that the RIAA doesn't care. They've chosen to favor desperate methods of "protecting" their property over consumer satisfaction. The only real way to do anything about this is to let your wallet do the talking.

Re:Or Perhaps...

[Anonymous Coward]

I haven't had trouble with any of the 'copy protected' CDs, or rather, 'play protected'. They don't play worth shit, but I've had no trouble ripping them without any errors. Strangely enough, Type O Negative CDs, even though I don't believe are copy protected, are a bitch to rip, and many tracks are impossible, they always come out with glitches, no matter what drive or software I use.

Re:Or Perhaps...

[Anonymous Coward]

So don't use Linux. Duh.

Re:Or Perhaps...

[Lost Race]

I bought a Delerium CD mail order and when it arrived I noticed the dreaded "this is not a CD" sticker on it. Sure enough, cdparanoia couldn't rip it. So I had a look at the data side of the disc and noticed two separate bands with a narrow gap between them: a multi-session CD. Cdparanoia was looking at the second session, an ISO9660 image containing about 50 megabytes of data. Since those data consisted of some worthless WMVs and EXEs, I took a Sharpie pen and blacked out that part of the disc (everything within about 8mm of the outer edge). Tried cdparanoia again, and it ripped all 12 music tracks just fine.

Does this message violate the DMCA?

Re:Or Perhaps...

[luekj]

And you have to listen to it 'via mp3' why?

Plumper porn

[Anonymous Coward]

I only trade plumber porn pics. Should I be worried?

Re:Plumper porn

[martinthebrit]

Is that pictures of men with pipes?

No, don't tell me, I don't want to think about it. It could involve builder's cleavage and everything.

Re:Plumper porn

[Anonymous Coward]

plumber porn pics.

You trade pictures of hairy, gassy guys who smell of sweat and crawl on all fours so that their buttcrack shows and you call them to "fix your pipes"?

Yeah, you should be worried. Get some help!!

Oh, but did you mean to say "plumper pics"? Well, in that case... oh no, wait. What am I thinking? Of course you should get help!

but will they target aol/tw?

[Comsn]

The RIAA has said it expects to file at least several hundred lawsuits seeking financial damages as early as next month. U.S. copyright laws allow for damages of $750 to $150,000 for each song offered illegally on a person's computer, but the RIAA has said it would be open to settlement proposals from defendants.

will they start sending subpeonas to aol/tw customers this time?

Re:but will they target aol/tw?

[corkhead0]

will they start sending subpeonas to aol/tw customers this time?

What, and start suing thier own customers? That would be insa... oops, nevermind.

:P

from the Napster network?

[powerlord]

Gee ... I would have thought that most people had moved on from Napster to BitTorrent, KAZAA or eDonkey/Overnet

Re:from the Napster network?

[Anonymous Coward]

How do you search BitTorrent?

Re:from the Napster network?

[the_Bionic_lemming]

Gee ... I would have thought that most people had moved on from Napster to BitTorrent, KAZAA or eDonkey/Overnet


Why? Myself? I'd stick with ftp sites - PTP software is too public right now to be safe.

Re:from the Napster network?

[wpmegee]

You did read the article, right?

The RIAA started doing all this 3 years ago in May 2000, which sounds just about right for Napster.

Re:from the Napster network?

[discogravy]

especially since napster still hasn't started up again...

Re:from the Napster network?

[hype7]

Gee ... I would have thought that most people had moved on from Napster to BitTorrent, KAZAA or eDonkey/Overnet

they have. that's the point. they've taken their music with them to the new services. the checksums on the mp3s don't change, however.

either everyone is using the same encoder with the same settings, or there must be quite a large element of piracy going on here. If the RIAA are getting joy from using checksums, then it means that a small number of files are being distributed a lot, as opposed to lots of people buying their own and ripping a new version (hence seeding lots of versions of the same song).

this does bring up one interesting issue for the RIAA though - what happens if the woman downloaded the song, went out and then went out and bought it. she may have still left the song available for download for others, but it would make for a nasty case for them PR-wise if they're trying to ping someone who actually does own the music.

-- james

Re:from the Napster network?

[Anonymous Coward]

But they're not going after these people for having the mp3s... they're going after them for distributing them on the p2p network, which is, and damn well should be, illegal.

Re:from the Napster network?

[abiogenesis]

eDonkey network automatically creates the MD4 hashes for every file. So it is actually easier to track ;-)

Re:from the Napster network?

[k98sven]

this does bring up one interesting issue for the RIAA though - what happens if the woman downloaded the song, went out and then went out and bought it. she may have still left the song available for download for others, but it would make for a nasty case for them PR-wise if they're trying to ping someone who actually does own the music.

Not really an issue.. AFAIK the RIAA hasn't yet gone after anyone for downloading music. Rather they've been going after folks who have been distributing music on P2P networks.

That's where the money is: For downloading, the damages you incur is simply the retail cost (=$X) of the
music you've downloaded. If you distribute on the other hand, the damages are X*N where N is some number of people who've downloaded the music from you, which the RIAA can exaggerate in court.

Time for a new WinAMP Plug-in

[GreenKiwi]

I think that it's time for a new WinAMP Plug-in that changes the Hash number to a random value every time it's played.

Re:Time for a new WinAMP Plug-in

[Gaijin42]

Uh, its not like the hash is in the file. Its computed from the file. You could write something in winamp that randomly changed bits in your music, and that would change the hash, but it would also slowly corrupt your music until you had static.

If the hash is using ID3 tags, you could change some unused field in there, but there would be a much smaller number of permutations available (although probelby still enough to be useful)

Re:Time for a new WinAMP Plug-in

[Anonymous Coward]

That would ruin your bit torrent's if you played something while it was uploading/downloading still.

Re:Time for a new WinAMP Plug-in

[lxs]

weel, you could just append a few bytes to the file and fill them with random bits

Re:Time for a new WinAMP Plug-in

[Locky]

Has there ever been a better reason to use OGG? I wonder if the RIAA even has OGG on their radar, to them it may be about as incriminating as a .doc file.

Re:Time for a new WinAMP Plug-in

[mindriot]

You could write something in winamp that randomly changed bits in your music, and that would change the hash, but it would also slowly corrupt your music until you had static. If the hash is using ID3 tags, you could change some unused field in there, but there would be a much smaller number of permutations available (although probelby still enough to be useful)

You could sure do that. If you simply add random characters to the ID3 comment every time you re-share a file, you change enough... the md5 will be a totally different one, that's the point of md5. But then you defeat the file-sharing scheme, since people can not simultaneously download their mp3s from several people of everyone has different md5 sums. Which is what the RIAA wants, and from a law standpoint, it's their perfect right in many cases...

Md5 hashes are also used for....

[shione]

hmm Isn't that how k-sig, built into Kazaa Lite K++, works, by tracking MD5 hashes so ppl get exactly the file they want.

Changing MD5 hashes on songs to avoid RIAA would also lessen the effectiveness of K-SIG. Trading hashes of know working files was one of the ways ppl on P2p avoided downloading those fake RIAA files.

Re:Md5 hashes are also used for....

[t_allardyce]

Does KaZaa look at the id3 tags aswell? it would be better if they didnt, there would be allot more files classed as "the same" - ie more download servers :)

Maybe its time to include an erasing utility with KaZaa/K++ Lite, so when you get that letter from the RIAA you can securely delete all your pirate music with one click..

Re:Md5 hashes are also used for....

[per11]

Actually, K-SIG uses a UUhash, which is easily spoofable as only the beginning of most files are hashed.

Re:Md5 hashes are also used for....

[shione]

ta. as I said I wasn't too sure.

But I do remember reading the developer posting on a forum saying that he chose what he did because it was relatively fast to generate and compare file with.

Re:Md5 hashes are also used for....

[3terrabyte]

I was thinking the same thing.

I'm not familiar with k-sig (i'm checking it out now) but the lossless community definately keeps track of their MD5 hashes so that people know they're getting perfect rips. Such as E-Tree

I kind of wish someone would do the same for non-boots, but then that would be "illegal" activity.

BBC Link

[L-s-L69]

http://news.bbc.co.uk/1/hi/entertainment/music/318 7695.stm Just in case anyone is interested.

Condoning illegal activity???

[Kombat]

Now may be the time to update your illegal mp3 file MD5 hash sums.

I sincerely hope this is tongue-in-cheek. For all the self-righteous, pompous sabre-rattling that goes on in here about how good Slashdotters only possess MP3's that are ripped from personal collections, I would certainly hope that we wouldn't stoop so low as to blatantly and openly be trading tips on how to avoid getting caught doing illegal things.

What's next? A HOWTO on setting up an encrypted file system for our child porn?

Re:Condoning illegal activity???

[L-s-L69]

Sorry but an encrypted file system may be used for other reasons than that mentioned. I would welcome a HOWTO on encrypted file systems, especially due to the RIP act in the UK.

Re:Condoning illegal activity???

[geeveees]

http://yro.slashdot.org/comments.pl?sid=76405&ci d=6812698

FYI,

earlier -test kernels had some corruption problems with cryptoloop.

All is fine now: [gvs@aeolus:~]$ uname -a
Linux aeolus 2.6.0-test4-mm2 #2 Thu Aug 28 15:04:45 CEST 2003 i686 unknown
[gvs@aeolus:~]$ sudo losetup /dev/loop0
/dev/loop0: [0302]:98315 (/dev/hdb1), encryption aes (type 18)

Re:Condoning illegal activity???

[iMMersE]

So you are admitting to having child porn, both in the parent, and in your resume, under hobbies ("# Amateur photographer"), and in the same document your provide your work and home address?

You sir, are a dick.

Re:Condoning illegal activity???

[sjwt]

I download MP3s to replace the use of my dead and dieing vinal and tapes, and even cds..

why shouldnt i be able to download then or share then to someone else in the same boat..

Re:Condoning illegal activity???

[PontifexPrimus]

Well, if that's what you're interested in: try this link.
Knowledge in itself is neutral. But it can be used for good or evil purposes. You might want to try, just as an exercise, to imagine five positive and five negative uses of encrypted filesystems or altered MD5 sums.

Re:Condoning illegal activity???

[Anonymous Coward]

I would certainly hope that we wouldn't stoop so low as to blatantly and openly be trading tips on how to avoid getting caught doing illegal things.

Yea maybe its illegal. But imho its NOT ethically wrong. Its kinda like back in time when you had to pay customs for crossing bridges.
For what do we pay the RIAA again? We pay them for maintaining a huge organisation which is dedictated to copy and distribute music. But, eh, we can do this by ourself now...!?

The RIAA was needed before mp3 and there was no other way for artists to become popular blablabla.. they needed the RIAA.
They still do to some extend but only because its the only way to get into the mainstream.

<RIAA> You want to share your songs over the internet? We wont play your songs on MTV then :P

(err, tell me, who causes artists to starve again?)

So i should pay the RIAA for playing stuff in the tv i dont even watch? I dont think so.

And dont tell me all artists will starve. (Ok, Britney Spears would maybe. But I dont give a fuck.)
Artists can still get money from concerts, merchandising etc. - thats where most (non-top10-) artists get most of their money from anyway.
Most of *their* record-sales-profits go to Robbie Williams, Britney Spears & co.

The RIAA is getting obsolete - we know it and and they know it. Now they are trying to survive by all means.

P.S.: Yea, my english sucks ;)

Re:Condoning illegal activity???

[Anonymous Coward]

When you "share" them on a p2p system, you're not sharing them with people who are in the same boat. You're sharing them with everyone. If someone downloads them from your computer, you are distributing copyrighted works! You are not allowed to do this. What the hell is so hard about this concept, really?

For a bunch of bright people, and so many lawyer wanna-bes, many slashdotters sure are dumb and ignorent of the law.

Re:Condoning illegal activity???

[Kombat]

I'm obviously being trolled, but lest someone actually take this guy seriously, of course I don't have any child porn. The last comment in my post above was blatant sarcasm. Well, blatant to anyone with average reading comprehension levels. As for how you made the leap from "Amateur photographer" to "child pornographer," not even I can explain that leap. Whatever. As a Slashdot troll, I'd give you an 'F', but you actually managed to provoke a response from me, so that's gotta be worth at least a 'C'.

Re:Condoning illegal activity???

[Anonymous Coward]

"For a bunch of bright people, and so many lawyer wanna-bes, many slashdotters sure are dumb and ignorent of the law."

No they aren't ignorant. They choose to simply not give a fuck. Like its been pointed out a thousand times, you can't put the genie back in the bottle. Free music and its sharing are here to stay regardless of copyright. Feel free to call everyone theives or point out why they're hypcrites if that makes you feel better. I'm sure that will make all the difference *shrug*

If you don't like how music has become free for everyone move to another planet.

Re:Condoning illegal activity???

[bahamat]

It's not condoning illegal activity. It's perfectly legal for me to rip my own cds to mp3. Given 2 computers using the same software, same options, and same hardware you'll end up with the same hash. Wanna try it? Rip a song, rename it and then rip it again. Check MD5. Oh, it matches? Duh.

Oh, and stop and think for a minute...Kazaa uses MD5 hashing to ensure that the file you're downloading from 8 different people is actually the same file on each of those 8 different sources.

Too many people can be falsely targeted by hash matching. Now pay attention everyone. If you stole your MP3's don't change the hash so the RIAA can come get you, ok? Now for everyone who ripped them yourself legally, make sure you change those files to give a different hash just for your own safety and privacy.

And just in case anyone wants to store their MP3s (or whatever) on an encrypted file system here's Abe's Linux Encrypted File System Howto.

Have a lot of fun!

Re:Condoning illegal activity???

[iMMersE]

A 'C', wow!

I wasn't intending to be a troll, it was purely intended to be humourous, and I certainly intend anyone to take the message seriously.

I nearly went over the top and actually post your address and stuff in the message. In the end, I didn't even link to your resume, even though it doesn't take a great leap to go and find it.

Sorry for any offense, if you took any. It was probably still a bit over the top ...

Re:Condoning illegal activity???

[Anonymous Coward]

Kazaa does not hash the entire file, that much should be obvious to anyone who has their files shared in Kazaa. They may very well use MD5.

The way Kazaa hashing works is that it grabs the first n bytes and hashes. Then skips n bytes and hashes the next n. Then skips n*2 and hashes n bytes. The distance between hashed blocks is doubled every time. This allows for many corrupt files on the network. Trash the bytes that are not hashed, and the has is still the same.

That's also what their hashing patent was about, not the concept of hashing which is a mathematical fact, but a specific implementation. Couldn't tell from reading /. though.

Re:Condoning illegal activity???

[smoondog]

We pay them for maintaining a huge organisation which is dedictated to copy and distribute music.

I am not particularly fond of the RIAA, but in their defense, the RIAA is as much an investor in music as it is a distribution channel.

-Sean

Re:Condoning illegal activity???

[0111 1110]

What's next? A HOWTO on setting up an encrypted file system for our child porn?

rubberhose would be a good piece of software for this. Bestcrypt containers are also good for plausible deniability. Freenet or GNUnet are the way to go for distributing it.

Re:napster?!

[Comsn]

the point is that they tracked an mp3 that was circulating from back when napster was around. ah the power of digital media to survive lawsuits.

What!?

[winstarman]

Some people have entirely too much time on their hands. sheesh.

So are the hashes the RIAA is tracking bigger than normal MD5 sums? In RIAA numbers I probably have somewhere around 572,947 hashes on my computer. I'm a bad boy.

Job opportunities

[Rosco P. Coltrane]

Apparently RIAA has obtained some technical experts in their prosecution of file swappers. Currently they are tracking traded mp3 files from the Napster network by matching MD5 hashes

After all, in these dot-bust days, it's still possible to get a nice highly paid job and be called an expert by putting the right spin to strcmp() in your resume ...

Re:Job opportunities

[ms1234]

The same kind of experts SCO hired from MIT? :)

hashes are kinda pointless

[truffle]

It is generally believed amongst file traders that it is legal to download an mp3 for a song, when you own the CD. In other words, you don't need to rip and encode songs from your own CD. However, this may not be true (I am not a lawyer).

The RIAA is using MD5 hashes as a basis for proof that the individual in question downloaded the files they are sharing, instead of ripping them from their own CD collection. This is supposed to show the individual is a willing participant in stealing and distributing music, instead of someone who is just sharing what they already own. But, see above.

I think this is mostly just a FUD tactic. They can talk to the media about how their MD5 hashes prove so-and-so is a big mean pirate hacker. MD5 hash certainly sounds scary, especially when the technology is described by the media as a tool used by hackers.

Re:hashes are kinda pointless

[Scarblac]

The RIAA is using MD5 hashes as a basis for proof that the individual in question downloaded the files they are sharing, instead of ripping them from their own CD collection.

What's the point? It's the sharing that is illegal (you are not allowed to distribute the songs). It doesn't matter how you got the mp3, does it? It's just extra evidence.

Re:hashes are kinda pointless

[Anonymous Coward]

MD5 hashes prove so-and-so is a big mean pirate hacker

You forgot thief

Re:hashes are kinda pointless

[truffle]

It's mainly a PR thing I think. It's to combat the idea of the innocent college kid who doesn't really know what the hell he's doing, and suddenly he's in court.

"This is not an innocent college kid", the RIAA will say. "Check out these MD5 hashes. This kid has been downloading music from pirate Web sites, and illegal services like Napster, for 3 years."

"There is no way to measure the number of illegal music files this crimelord has distributed. We estimate our economic damages from him personally at 3.2 billion dollars. Just look at these hashes you're honor, they're scientifilicious. This one dates back to the stone age, proving our theory that people can steal music before they are born."

Re:hashes are kinda pointless

[3terrabyte]

It is generally believed amongst file traders that it is legal to download an mp3 for a song, when you own the CD. In other words, you don't need to rip and encode songs from your own CD. However, this may not be true (I am not a lawyer).

In multiple articles over the years, RIAA spokepeople have mentioned that this IS illegal. (To download mp3's of songs you even own)

However, you can't believe their FUD at face value.

It has (obviously) been mentioned that downloading copyrighted works is illegal. However, I have yet to see a link to a law that mentions this! The only links out there, and the only lawsuits we've seen have pertained to DISTRIBUTION of said copyrighted work.

It's something to think about.

I completely agree with your assessment that their MD5 hash FUD is just used as PR. They are just combatting the lady's claim that they were her innocent mp3's from her own collection. For the media, you will see this stuff. But in the courtroom, the only thing they'll bring up is that she was distributing this stuff to the world. (And whether she owned the CD or not doesn't even matter!)

Re:hashes are kinda pointless

[ratboy666]

Actually, it IS legal to download an mp3 for a song -- whether or not you own the CD. Or a movies, or (with certain limitations) anything else you want.

What is illegal is COPYING the material. In other words, you may not upload. Or (seemingly, by current RIAA interpretations) facilitate uploading.

Downloaders are not breaking ANY laws. What I find interesting is the spin that the RIAA has put on this ("downloading" is somehow wrong).

To put this into perspective. If I copied an entire book to give to my students, stripping out the copyright, and we are discovered, *I* am liable for the copyright infringement. The students (who used the copied material) are not at all liable. To be liable, the student must also violate copyright (by further copying the material). Of course, there is now no indication of copyright -- indeed I may have falsly claimed copyright, and assigned that copyright. In which case the students violation is even less severe.
(should be limited to a warning to not continue).
On the other hand, in this scenario I should be hit REALLY hard.

Ratboy.

Re:hashes are kinda pointless

[Cyno]

Computers are a tool used by hackers.

And Americans are really dumb.

I wonder what the RIAA will come up with next.

Re:hashes are kinda pointless

[sckeener]

It is generally believed amongst file traders that it is legal to download an mp3 for a song, when you own the CD. In other words, you don't need to rip and encode songs from your own CD. However, this may not be true (I am not a lawyer).

I'm not a lawyer either, but you also got to question the impartial nature of their information collection. I bet the reason the RIAA keep settling cases rather than taking them to court on criminal charges is because the police would have to collect their own evidence.

Comparing it to the real world, the arson investigator is supposed to take the word of the business owner that the evidence from their burned building is real and their customer is guilty. Mean while the business owner collects the insurance after 'proving' the customer is the guilty party.

Re:hashes are kinda pointless

[HardCase]

I think this is mostly just a FUD tactic. They can talk to the media about how their MD5 hashes prove so-and-so is a big mean pirate hacker. MD5 hash certainly sounds scary, especially when the technology is described by the media as a tool used by hackers.

I think that this paragraph cuts straight to the chase of the RIAA's case at this point. They are pursuing a few high-profile cases and using them as a springboard to keep attention focused in the areas that support their position the best.

Waging a war of press releases and FUD doesn't do diddley for them in a court case, but it does keep the issue alive in the minds of the (concerned) masses. By keeping the issue alive, slanted the direction that they desire, the RIAA can use the publicity to shape public opinion in a manner that portrays them in the best light and supports their positions and theories that they have proposed.

When it comes down to it, the actual court cases will probably be anticlimactic, much like the previous cases. The dollar damages that the RIAA can claim are so irrationally high that defendants are almost guaranteed to settle early to avoid the possibility of being on the hook for a small fortune. But the real win for the RIAA is that the teeming masses will see them as a victim of a concentrated effort to "steal" music from their clients.

-h-

Re:hashes are kinda pointless

[Anonymous Coward]

In some countries is legal to download a song (or any copyrighted material expect computer software) even if you don't own the original.

Re:hashes are kinda pointless

[jafac]

what's to stop a "leecher" from simply flipping a few bits in his MP3 files? Sure, he'd have to know a little bit about the file format, but I'm sure that there are plenty of bits in your typical MP3 one could flip without having any significant impact on the music quality. From what I know of MD5, one bit ought to be enough to throw the dogs off the scent.

Re:hashes are kinda pointless

[truffle]

Modern P2P clients rely on hashes for efficiency. For example, the EDonkey network (see EMule for an open souce spyware free client) allows you to download from multiple clients simultaneously, it's a lot like bittorrent. Changing the MD5 checksum would make these networks less efficient.

Re:hashes are kinda pointless

[Anonymous Coward]

In multiple articles over the years, RIAA spokepeople have mentioned that this IS illegal. (To download mp3's of songs you even own)

To compute the MD5, the RIAA would have needed to download the entire file from the user in question. Therefore, using your logic the RIAA has broken the law simply by downloading this file to determine its digital fingerprint. What if "nycfashiongirl" was just downloading these files to analyze their didgital fingerprints just as the RIAA is doing?

Also, when the RIAA downloads this file from "nycfashiongirl", how is it possible that they immediately move this file from their shared folder so that the rest of the world can't download it.

I have been bothered by the RIAA's involvement in P2P. If "nycfashiongirl" is guilty of anything, then so is the RIAA. Not that I think that file swappers are pedofiles, this could be considered somewhat analagous to Pete Townshend's "research" into kiddy porn.

Re:hashes are kinda pointless

[3terrabyte]

There have been NO cases or laws that say downloading mp3's are illegal. So the RIAA downloading songs isn't illegal. Not to mention (the F*@#$ obvious) that they already represent the copyright owner, and ARE allowed to do what they want with them. So what the hell are you smoking?

It's like a burglar saying that he's innocent of breaking into my house, because I'm guilty of entering my house every day.

Also, when the RIAA downloads this file from "nycfashiongirl", how is it possible that they immediately move this file from their shared folder so that the rest of the world can't download it.

My condolences to you for obviously never ever having run a P2P app. You can easily set your "download to:" folder and set your "shared folders:" properties to keep you from sharing. Before you even download. Amazing huh.

Nearly?

[Anonymous Coward]

The disclosures were included in court papers filed against a Brooklyn woman fighting efforts to identify her for allegedly sharing nearly 1,000 songs over the Internet.

Wow... 1000 songs! That's almost 5gb of music to have sitting around! Who does she think she is... trying to listen to music played in accordence with the pythagorean scale which has been around for centuries! It's a good thing every song put out on cd by an RIAA member sounds so different!

Re:Nearly?

[Anonymous Coward]

The RIAA is not just the major labels, you know. Most indie labels are also represented by the RIAA. So, yeah, there actually is some variety.

Hmm. Easy to hide then

[melevitt]

I suspect this case will depend on whether people have a right to download music they already have on CD or if only copying it yourself is legal.

Given that the RIAA keeps implying that I don't "own" the music, just the right to listen to it, then surely once I've bought it in one format, I have the right to possess it in another format. I guess that means I'll never have to buy the White album again...

Re:Hmm. Easy to hide then

[514x0r]

agreed
if you don't like the laws of a society, you have 3 choices

• change the law
• leave the society
• deal with it

breaking the law you don't agree with, but benefiting from the society isn't an option

that said, i break a few of the laws of the society from which i benefit. sorry.

Re:Hmm. Easy to hide then

[3terrabyte]

No it won't.

The RIAA may bring that stuff up for the media. But in the courtroom, they are only going to bring up the fact that she was DISTRIBUTING said copyrighted works.

The reason? Every law pertains to the illegality of distributing copyrighted materials without the copyright holder's permission. It has nothing to do with acquisition.

Don't get me wrong, I don't want to go to court and find out if acquisition is legal. But every lawsuit so far is only about distribution.

Pity the RIAA

[heironymouscoward]

They are really fighting a losing battle.

Exchanging music is not about piracy, it is about exchanging culture, just like when my grandfather leant me some old Jazz records and said, "here, you might like this".

Today culture moves at the speed of light and the RIAA believes it has the right to tax this movement. It cannot succeed except by destroying the Internet.

I'm starting to believe, watching this debate evolve over many years, that the file traders are right, for the wrong reasons.

Human culture depends on exchange of ideas and information, and music and films are a large part of this in today's world. No album, no movie scene, no written text is a personal creation, they are all taken from the pool of common culture, modified, and redistributed.

Seeking all means to do this faster than ever - and ignoring the barriers, such as "ownership", that stand in the way - is the prerrogative of today's world. We simply can't put the genie back into the bottle and start exchanging pieces of paper and vinyl discs again.

The debate is huge, but the results already seem clear: any laws designed to stop the process from continuing will be further and further ignored until they are seen by a majority of people to be useless vestiges of a material-obsessed past.

Re:Pity the RIAA

[Asprin]

Exchanging music is not about piracy, it is about exchanging culture, just like when my grandfather leant me some old Jazz records and said, "here, you might like this".

The first time I read that paragraph, I misread your grandfather saying "here, you might need this." with great enthuisiasm.

(Sigh)...

That says it all, doesn't it.

Re:Pity the RIAA

[Anonymous Coward]

Well put,

In time, hopefully in our lifetime, but certainly sometime. Wish it were before our time so this was the time.

Re:Pity the RIAA

[dave-tx]

Exchanging music is not about piracy, it is about exchanging culture, just like when my grandfather leant me some old Jazz records and said, "here, you might like this".

A well-intentioned, but flawed analogy. The problem that the RIAA faces is more analogous to your grandfather simultaneously lending out his records to 1000's of other people, and never needing them returned, because he's still got his copies.

Re:Pity the RIAA

[Anonymous Coward]

> ignoring the barriers, such as "ownership", that stand in the way

I will be right over to pick up your car and computer. Please don't be a "barrier" when I get there, I will just ignore you and your door anyway (or perhaps the window would work better?).

Re:Pity the RIAA

[Big Bean]

It cannot succeed except by destroying the Internet.

They have a team of experts now, maybe this is the new plan!

Re:Pity the RIAA

[dave-tx]

That's not my point. I understand the concept of the increase in velocity. However, the fundamental problem is that in addition to the multitudes being able to simultaneously borrow from the same person, there's no need to return the original product after the "evaluation" stage. Saying that it's just lending on a larger scale is inaccurate. It's no longer lending at all.

Re:Pity the RIAA

[3terrabyte]

You still have the right to go spend your money on acquiring this "culture" on CD from the stores.

You can also go to the library and check out any of those old jazz cd's that you want

This idea that we have the 'right' to do it faster doesn't really make sense, since the world was able to survive 10 years ago, 50 years ago, without Kazaa.

You're barking up the wrong tree. But there are plenty of trees to bark up to. RIAA & MPAA are well known to crush technology in pursuit of their own profits. That is wrong. Being able to buy off congress to make their own laws. That is wrong. Making artists into indentured servants, wiping out alternatives to radio, monopoly of distribution, the list goes on.

Re:Pity the RIAA

[Oddly_Drac]

"I will be right over to pick up your car and computer. Please don't be a "barrier" when I get there, I will just ignore you and your door anyway (or perhaps the window would work better?)."

Cool, just make sure that you leave my originals where you found them after you duplicate and dust your footprints off the window sill.

Re:Pity the RIAA

[Overly Critical Guy]

Exchanging music is not about piracy, it is about exchanging culture, just like when my grandfather leant me some old Jazz records and said, "here, you might like this".

Do you realize how ridiculous you sound? Exchanging music is about exchanging culture, not piracy? What kind of hippie, flower-eyed world do you live in? People download entire albums left and right without paying for them. Do you think they reason that they're "downloading culture" or that they're obtaining the latest CD for free?

Today culture moves at the speed of light and the RIAA believes it has the right to tax this movement. It cannot succeed except by destroying the Internet.

It's not about culture. This is the most bullshit thing I've ever heard. It's about paying for music that took money to make. The artists whose "culture" your taking from expect you to pay them for the effort they put in to it. Did they give you permission to contribute their mp3s to the "culture" on Kazaa?

I'm starting to believe, watching this debate evolve over many years, that the file traders are right, for the wrong reasons.

They are wrong. If you wrote something, be it music or software or whatever, and sold it for retail, and then found out it's been traded all over the Internet, would you be excited with glee at the "exchange of culture," or realize that the way you make your living is being cheated from you because there are people out there who are so used to the convenience of downloading whatever they please that they have justified it to themselves to get rid of their guilt?

Human culture depends on exchange of ideas and information, and music and films are a large part of this in today's world.

Right. This exchange depends on the trade of money in return to keep all that nice culture funded. If people don't have the money to pay for the studio or the instruments, there won't be culture-makers. You're just freeloading.

No album, no movie scene, no written text is a personal creation, they are all taken from the pool of common culture, modified, and redistributed.

They are all personal creations. They have influences that they may share, but the beauty and intent of our system is that you can own your creation without people just taking it from you to do whatever they please. People like you are freeloading.

Seeking all means to do this faster than ever - and ignoring the barriers, such as "ownership", that stand in the way - is the prerrogative of today's world.

Listen to yourself. "Ownership" of my music is a barrer to you? Of course it is, because you'd trade it all over Kazaa! And I wouldn't get money in return for my work. You have decided how to present my art without my permission, all in the name of a bizarre pet theory worldview you have. Your head is in the clouds.

Did you steal your computer? That's a device for "exchanging culture." What about your clothes? They're culture. How about your car? Your DVDs? Your house? How much would you take without paying for it because it's "culture?" Is it simply that downloading mp3s is convenient, and so you have formed and entire worldview around it to justify your illegal distribution? Because, let's face it, there is no other way to look at it from a moral or legal standpoint--on either of those fronts, it's wrong. So you have to create oddball excuses like this.

Of course, here comes the point where you chime in with how you're not really "stealing" anything because you're just making copies. How things are suddenly magically different because you can make copies of the files instead of taking them. Which, of course, doesn't change a thing because you still didn't pay for it, which is the actual issue. But freeloaders love to get hung up on semantics because it's the only point they can really argue. They can't argue the rest because the simple truth is that they're wrong on all fronts.

The debate is huge, but

Re:Pity the RIAA

[Overly Critical Guy]

And now the value of your car and computer is diminished to nothing when it is freely traded with people. Why? Because it was obtained without paying for it.

People love to get hung up on "stealing" versus "copying," when it doesn't matter. The issue is not paying for it.

Re:Pity the RIAA

[chihowa]

This is not exactly in line with what you were saying, but it is something that I've thought about lately...

From a historical perspective, we know everything that we do know about ancient cultures (even only slightly old cultures), from the artifacts and records that the left behind. It's interesting to think that in the future (not necessarily too distant), there will possibly be very little usable historical records available.

If the push for universal DRM is sucessful, our times will likely be seen as a period that left massive amounts of plastic and no knowledge behind. It's already been pointed out that DRM protected material will never enter the public domain, but it will also be unavailable to the future as well.

After reading some truly ancient pieces of fiction and marvelling at the differences and similarities between our times, it's sad to think that our times will likely be historically remembered as a "dark ages" of sorts, because we left no usable information behind.

Re:Pity the RIAA

[Oddly_Drac]

"It's about paying for music that took money to make. The artists whose "culture" your taking from expect you to pay them for the effort they put in to it."

Perhaps a compromise, then? That they allow people to listen to the album tracks before paying for them and possibly even just allow for the payment of the single tracks that they want.

That way people could avoid the padding that the record companies foist onto people as part of an album with say, two decent tracks.

Of course, I can't see the record company being happy with that amount of choice, but it neatly dismantles the idea of people wanting to steal stuff out of pure nihilism and the ramblings of the music industry apologists who seem to think that a cartel is a good thing.

Further to this, we could actually _give_ the copyrights back to the artists, which would make your frothing condemnation slightly closer to reality, after a certain amount of time and allow them to do what they want with the music.

Re:Pity the RIAA

[Anonymous Coward]

Wrong - the car and computer still have value, because they're useful items, freely traded or not.

Re:Pity the RIAA

[Anonymous Coward]

First: Knowledge/information/music/art doesn't want to be free, just like a rock doesn't want to roll.

Second: Art/music/books/t.v./film are all the undeniable creation of someone or some group of people, not the pool of common culture. Look at a statue sometime, it was once a big hunk of stone (common culture) and after much effort becomes Michelangelo's David (a personal creation). To argue otherwise suggests... You didn't really say. This part of your argument needs a little more thought, why isn't it a personal creation? Saying it isn't doesn't make your point.

Third: You're right that laws will be ignored, but look at how they're being ignored. Bombs are being dropped (on your pool of common culture), Corporate Executives are stealing money (from your pool of common culture), thieves are taking material things (out of the pool of common culture and selling them to people who, like you seem to want, ignore laws designed to stop such processes from continuing.

The big problem is a scarcity of resources. In some cases it's artificial (diamonds and CD prices) and in some cases it's unavoidable (land) and in most cases it's just hard to redistribute the resources (food, energy, water). You're either being terribly idealistic or horribly naive if you think ignoring "laws designed to stop the process" is an ideal state.

Would we need such laws if "the pool" was able to respect each other's property?

Re:Pity the RIAA

[Improv]

Do you realize how ridiculous you sound? Exchanging music is about exchanging culture, not piracy? What kind of hippie, flower-eyed world do you live in? People download entire albums left and right without paying for them. Do you think they reason that they're "downloading culture" or that they're obtaining the latest CD for free?

It is, of course, both. Music is part of culture.
And yes, people do download entire collections
without paying for them. We're all doing it, apart
from a few people who either don't know how, or
are morally opposed to it. Of course, they're not
CDs we're getting.. CDs are physical objects, and
can be owned. What we're doing is getting
information, and information, like air, cannot
be owned (of course, by our philosophy. Yours
may differ)

It's not about culture. This is the most bullshit thing I've ever heard. It's about paying for music that took money to make. The artists whose "culture" your taking from expect you to pay them for the effort they put in to it. Did they give you permission to contribute their mp3s to the "culture" on Kazaa?

It doesn't matter what the artists expect. They
can expect what they want, and we have no
philosophical obligation to obey. Hell, what if
a bunch of people (who obviously had no taste)
decided to copy the way I dress? Well, if they
really want to do that, there's no way I could
stop them, even if I did spend spare afternoons
figuring out exactly how to make my overall dress
style unique. Even if I told people they can't
dress like me without shelling out dough, quit
my job, and were determined to live off the
proceeds, there's no way I could create an
obligation to them to pay me. It's simply an
unrealistic expectation.

This exchange depends on the trade of money in return to keep all that nice culture funded. If people don't have the money to pay for the studio or the instruments, there won't be culture-makers. You're just freeloading.

People are creative because of inclination, not
because they think they can make money. Having
known many artists, I can tell you that most of
them live paycheck to paycheck, often in deep
debt. Like the open source movement, and like
much else in life, we do it because of what we
are, not what we want. We take the money we get
from our jobs, and buy the instruments of our
creativity, whatever that may be, so we can
share.

They are all personal creations. They have influences that they may share, but the beauty and intent of our system is that you can own your creation without people just taking it from you to do whatever they please. People like you are freeloading.

That's somewhat questionable historically, but I'm
not one of the strict constitutionalists who
cares that the original intent was not to create
another property system. What matters is what
should be, and IP should not be. Property is for
physical objects, not for style, not for ideas,
not for anything like that. Information shall be
free. Attempting to dam the flow of information
is like trying to stop the tide. Futile,
stupid, and greedy attempts to do so will just
cause the rest of us to give you an extra stomp
as we stampede, free of your old-fashioned
shackles.

Re:Pity the RIAA

[neura]

Hmm, you mean like the samples that most CD ordering sites have? You can get an idea if the CD is decent or not even just by the first few tracks.

And maybe you were talking about Apple's music store or AOL's new store, where you can purchase individual tracks or the whole CD, downloadable and burnable.

Or maybe you're just clueless about current technology and should refrain from criticizing someone's comments on the matter.

Re:Pity the RIAA

[obsequious23]

No one is stealing music. That can't be done. You can call this a semantical debate, and I'll call your dismissal a reductive fallacy. Theft implies the removal of property. When something is copied, the owner still retains the original. Their property is still intact. All that has occured is the devaluation of the original copy. Is devaluing something against the law, or morally wrong? No, of course not. This sort of thing occurs all around us. If devaluing things were illegal, a boycott would be illegal. Advertising for a competing brand would be illegal. So, saying music sharing is theft is preposterous. The purpose of copyright law was not to make artists rich. The purpose was to make culture rich with art. When works of an artist could be produced and sold without paying the artists, there was no incentive for artists to create. People were profiting off of the artist's work while the artist remained poor. Copyright laws should be in place to prevent people from wrongfully profiting off of someone else's work, not to prevent someone from enjoying the art. Music sharing helps art flourish. It increases awareness of art and music, while also creating a more level playing field for less known artists. The current infrastructure encourages superstars rather than encouraging innovation, which is culturally harmful, IMO. Money can still be made, but it will require investors to reassess their marketing strategies. Many businesses have to reassess their marketing strategies due to uncontrollable trends on a regular basis. An auto repair shop will order less airconditioners in the winter, for example. Change occurs and is unavoidable. In the case of music being more accessible, I think the change is positive. I can do without rockstars.

Re:Pity the RIAA

[ryanwright]

And now the value of your car and computer is diminished to nothing when it is freely traded with people

No value at all? Really?

So, if you spend $40k on a new Lexus, and your neighbor uses a Star Trek replicator to make an exact copy when nobody is looking, the value of your Lexus is now zero?

So you can't drive it anymore, or what?

Re:Pity the RIAA

[tre4lien]

I believe you sum up the Devil's Advocate position well. In fact these superficial comments are the only ones I've ever heard actually "defending" the RIAA. For the benefit of the hard-of-thinking, I'll quickly distill out the points you make through conspicuous absence of mention.

1. Yes, they always try to discount the underlying moral issues, but at the end of the day, people should not replace morals with law.

2. The highest moral at stake is the need to protect the human capacity to evolve. Continuing the drive towards shared experience is top priority.

3. Recording industry and Music industry are not the same, or even very closely connected. Mucisians have made livings for thousands of years. There was a brief period in history during which sound duplication & distribution could only be done by large corporations. This period did change the Music industry. Thankfully, that period is over.

(From here on out, its a discussion of corporate planning, not morals, so the last 2 points are sort of moot.)

4. The Recording industry reduces musician income - it does not defend it. (as a musician, I can vouch for this) It slightly increases the income of a statistically non-existent group of mucicians, dramatically increases (Creates, actually) the income of recording corporations, and seriously hinders regionalized development of musicians everywhere. The musicians who are super-rich would be super-rich without copywrite laws. It's good marketing and merchandising, not recording reproduction or distribution sales that build Musician wealth. Marketing and merchandising tools work in any medium - not just the recording industry. (This I also know from successful experience)

5. As implied above, People buy artist merchandise like t-shirts, biographies, videos, & CDs to possess, see, touch, and viscerally reference. (Yes, we've come full circle to the "Culture" topic, just like the parent post did) Making audio experience shareable will never eliminate that - and the experiment/debate as to whether it increases or decreases it is still out.

Other posts discuss other valid themes to this issue, but I think this re-phrases the themes you mentioned.

Re:Pity the RIAA

[Oddly_Drac]

"Or maybe you're just clueless about current technology "

Online stores are 'technology' now?

I was referring to something across the board rather than being a few retailers that have taken the initiative and shown that the system _works_. However, this does mean an economic driven model for the music industry because all of a sudden they're having to cope with supply and demand rather than the lifestyle push model that they've relied on.

That's socialogical rather than technological, but I'm assuming that you know people outside of the glare of your monitor.

I could be wrong, however.

Re:Pity the RIAA

[Oddly_Drac]

"And now the value of your car and computer is diminished to nothing when it is freely traded with people. Why? Because it was obtained without paying for it."

I'm sure you have a point, but it's been completely lost in the relative upsides of freely available hardware.

I'm guessing that you also feel that there should be subscription model for any content produced as it's all intellectual copyright of some degree or another, but in terms of an 'omega point' of this taken to extremes, who decides what is of a quality to be paid for?

BTW, all my replies are gratis and free to view. I understand this makes them worthless.

STOP DOING THAT!

[Anonymous Coward]

WHY do people post the url without the A tag? Its a pain in the ass to copy and paste AND remove the spaces inserted by slashcode. Learn to use the A tag.

Here is a clickable link!

HOWTO: Encrypted partition

[geeveees]

modprobe loop
modprobe cryptoloop
modprobe aes

losetup -e aes /dev/loop0 /dev/hdb1
(input password)

mke2fs -j /dev/loop0

mount -t ext3 /dev/loop0 /home/kombat/pr0n

enjoy!

Re:HOWTO: Encrypted partition

[Anonymous Coward]

A logged in root user still can see your data in cleartext if the partition is mounted. So this scheme does not work in a company where administrators scan your mounted partitions.

There is currently no secure filesystem implementation for Unix that prevents root access. The most interesting thing I have found so far is FSFS, but there is no source code available.

Re:HOWTO: Encrypted partition

[MyHair]

A logged in root user still can see your data in cleartext if the partition is mounted.

I was about to argue, then realized you're right. Oops. At first I thought you were saying root could mount the encrypted partition and read it, but you're saying root can read it as long as it's already mounted.

So this scheme does not work in a company where administrators scan your mounted partitions.

In that case, use that modified KNOPPIX that can use encrypted home drives, and no one has root access to your box. Or just do all your stuff at home.

Where does it say MD5?

[eddy]

Are we sure they're actually using MD5? The article doesn't even contain the string "md5" that I can see. It mentions hashes though, but there's something called Robust Hashing which can be used to identify, or at least, compare content in a "fuzzy" way.

Re:Where does it say MD5?

[AdEbh]

They could well not be using MD5. However if your trying prosecute a case you don't want to be using a "fuzzy" hashing algorithm.

- Alex

Re:Where does it say MD5?

[Via_Patrino]

They might be using md5 because some p2p clients (like edonkey) provide that info *before* you download the file.

Re:Where does it say MD5?

[aSiTiC]

The article doesn't mention which method Napster used in the past, however with a little searching on Google you can find that Napster does in fact use MD5. Link

There are many, many methods of hashing out there and different p2p apps use different methods. The newest, and arguably best is the Secure Hashing Algorithms (SHA1, SHA2, SHA256....), that have been defined by NIST. Link

Re:Where does it say MD5?

[Anonymous Coward]

but there's something called Robust Hashing which can be used to identify, or at least, compare content in a "fuzzy" way.

That would be a pretty dumb way to prove that the file was the same as the one downloaded by napster, now wouldn't it?

Easy

[sprouty76]

Just take a random id3 field that you don't use for anything, and fill it with a random number. You can probably write a srcipt in a few seconds. Bingo, different md5.

The only problem is that a lot of file sharing software uses the fact that 2 files (from different sources) have the same hash in order to swarm the download from multiple sources. If everybody goes around intentionally making their mp3s have different hashes, swarming basically won't work anymore.

Re:Easy

[3terrabyte]

True. But then again swarming isn't that popular yet. Downloading from a single source is still popular. (IRC, NG's, FTP, most P2P apps)

Also, if we did use a non-used ID3v2 tag field, then the RIAA would just go ahead and ignore that field in their hashing technique, since it's located in a specific part of the file

The problem with letting the whole world know about a technique like that, is that the RIAA is part of that world.

Besides, this whole MD5 checking & database the RIAA may be assembling doesn't really amount to much. It's just an added extra. They can still (and will) go after people who are distributing files. MD5 doesn't matter here.

Re:Easy

[Anonymous Coward]

So the RIAA starts hashing only the sound part, not the tags. If they're not stupid, they already do this.

Re:Easy

[Anonymous Coward]

Wrong. Swarming is a de-facto feature in modern p2p apps. They are used in WinMX, Kazaa, fasttrack, BearShare, LimeWire, etc. In fact, I can't think of any p2p file sharing software in use today that doesn't use swarmed downloading (& the original nullsoft gnutella client doesn't count because no-one uses them anymore.)

Re:Easy

[Anonymous Coward]

Soulseek.

Give up

[Rutje]

Ok guys.. let's all give it up. Let's delete all our MP3's and start buying CD's now. The RIAA has clearly won!
Hail to the king!

Re:Give up

[Anonymous Coward]

I for one welcome our new Music Indrusty overlords!

Re:Give up

[QEDog]

Let's delete all our MP3's and start buying CD's now.

You mean CDRs, right?

Re:Give up

[MyHair]

Actually, I've discovered that my friends and family have quite a diverse selection of CDs that I don't have, and I can get consistent rips and naming when ripping their CDs myself.

I just got hold of a 20GiB MP3 player that acts as a USB drive. Very handy when visiting friends & family! Riiiiiiip!

And you can download the freedb database....

RIAA Propaganda

[rnd()]

I think this sums it up!

Excuse my ignorance

[Anonymous Coward]

But I always wondered how an MD5 sum can verify files in the first place. Take for example, a linux CD ISO file. This file is ~650MB with an MD5 sum of 65 bytes. So, if you say that this 65 byte file verifies that the 650MB ISO is intact, that also means you should be able to creat the 650MB ISO from the MD5 sum alone. This can hardly be the case, since we still download 650MB ISO and not just the MD5 sum. Therefore I'm lead to believe that it wouldn't be that hard to have the same MD5 sum for multiple files (especially for files of large size).

Am I right on my assumptions? And if not, can someone explain it to me??

Re:Excuse my ignorance

[solidox]

you could recreate a file with just an md5 sum, however it would involve brute forcing it. now if a 6char password takes quite a while... 650mb should take you till around about the time of the end of the universe. there would be several other combinations of bytes which could produce the same md5, the bigger the size, the more likely of two sets of bytes producing the same md5.

Re:Excuse my ignorance

[tom taylor]

Imagine, the MD5 file as a solution, and the original file as the question. The MD5 file might contain the number '5', but you wouldn't know whether the question asked was 2+3 or 4+1. You do know however that the question wasn't 3+1 or 2+2 though.

If you download the question, you can check that the solution matches the expected solution. If so, the download is good.

Note, this is a very simplified version, using a pretty poor analogy. I'm sure there's a website that explains this better.

Re:Excuse my ignorance

[Anonymous Coward]

from http://userpages.umbc.edu/~mabzug1/cs/md5/md5.html :

MD5: Introduction
MD5 was developed by Professor Ronald L. Rivest of MIT. What it does, to quote the executive summary of rfc1321, is:

[The MD5 algorithm] takes as input a message of arbitrary length and produces as output a 128-bit "fingerprint" or "message digest" of the input. It is conjectured that it is computationally infeasible to produce two messages having the same message digest, or to produce any message having a given prespecified target message digest. The MD5 algorithm is intended for digital signature applications, where a large file must be "compressed" in a secure manner before being encrypted with a private (secret) key under a public-key cryptosystem such as RSA.

In essence, MD5 is a way to verify data integrity, and is much more reliable than checksum and many other commonly used methods.

Re:Excuse my ignorance

[jacksonyee]

You're right in that it is possible to have the same MD5 sum for multiple files, but the chances of it happening is extremely small for two reasons.

The first reason is that MD5 has 128 bits to describe the file, meaning that there is a 1 in 2^128 chance that any given random bitstream will have the same MD5 sum (Of course, MP3s aren't all that random in portions of the file format, but the basic argument still stands).

The second reason is the very process of verification. In order to verify a file, you must already have a checksum of the original file to compare it to, and you have a file which you think could be the same file, meaning file names and file sizes are already identical. If those files differ by as much as one bit, then they will produce different checksums. If you're willing to try to match a file named "ISO of Windows XP" with a file size of 650.1MB versus a file named "ISO of Mandrake" with a file size of 643.8MB then you're already sure that they're not the same file by the filesize alone.

In short, possible, but extremely unlikely.

Re:Excuse my ignorance

[C0vardeAn0nim0]

MD5 is the result of a mathematical algorithm. it's just like H2G2 answer for the meaning of life, the universe and everything. 42.

but what the heck does 42 means ? no one knows, unless the right question whose answer is 42 is found.

I can think of several mathematical procedures that will result in 42. 6*7 is just one of them. now, can you imagine how many 650 MB files would have the same MD5 checksum ?

MD5?

[barcodez]

The article does not mention MD5 anywhere. So one can not assume this is the technology they are using in their proof. As the technical information in this article has more than likely gone through several iterations of "dumbing down" we can not say what technology is being used. It is quite feasible that they are comparing segments of the encoded information with files that where groked from Napster (pre 2001). Additionally as very few people change all the information contained within the ID3 tags ("meta information" from the article?) it maybe enough to show how unlikely they are to match unless the file is from the same source. For example if I insert the string "whateverbarcodezwashere" into some obscure tag with the ID3 tag of an MP3 and it arrears in an MP3 file on someone elses computer it is likely that they orginated from the same source. For the record it is conjectured that it is astronomically unlikely that two randomly choosen different byte sequences will produce the same MD5 hash.

Edit those ID3 tags...

[cplater]

and remove the creditz from your "scene" released MP3s -- Better yet, go out and get your hands on a real, physical CD, and just rip the songs yourself.

so many diffrent possibilities

[solidox]

not every mp3 comes from the same source, there must be thousands of people who all rip the same track, thus creating thousands of diffrent mp3s, most with their own unique md5sum's, then you get the people who rename the id3 tags, and the people that burn to cd which gets passed around and ripped somewhere else. oh and not forgetting borked/aborted transfers, where mp3s are missing a few bytes at the end.

"The source for nycfashiongirl's sound recordings was not her own personal CDs," the RIAA's lawyers wrote.

and what if she was the original ripper and the mp3s were downloaded by nasty nasty men with too many shoes? altho i'm not sure if that puts her in a better or worse light.

and of course, people that download tracks which they own simply because it's easier (especially when vinyl is concerned)

their idea is flawed, sounds like a scare tactic to me.

Why MD5 hashes?

[Stormthirst]

I suspect the reason they are using MD5's is:
1) MD5s are small, and if you are going to do a file compare, the MD5s are much quicker to compare than the original file.

2) If a song has been ripped, and then shared out - all the *copies* will have the same MD5's (correct me if I'm wrong someone). So the RIAA can now track how many times that song you ripped has been copied. How many of us who have downloaded a song, have made any changes to the ID tags? I would argue a very very large proportion have not, especially the less technically minded people using the 'net.

The damages that the RIAA are seeking are based on the number of times that file has been downloaded. So now they can seize machines, get MD5's of all the songs on that machine, compare it to their list of MD5's they've got already to see where you got those files from.

It's all about evidence gathering.

Traced to the source?

[91degrees]

It's possible (albeit unlikely) that this woman was the person who originally uploaded those songs to Napster, and was the original source for the pirate download sites.

Probably not a very good defence to try though. Claiming to be responsible for a vast conspiracy of glabal music piracy will not look particulalrly good for the defence.

Share this!

[dimer0]

Now, if the RIAA would share this database, I could finally have the dream product I've been wishing for: Something to point at my library of 60k mp3s (all ripped from my own collection of 9k CDs), and bashed on MD5 hash, fix my damn filenames and ID3 tags!!!

Same technique CDDB uses, just with mp3.

Ahahah loosers, easy to get around that...

[cheekyboy]

Ill just make a program that adds 2 bytes of '0xFUCKYOU' or '0xf0cu' to each mp3 file , then the hashs are different

Stupid lamers!!!

besides im not in usa prix

Re:Ahahah loosers, easy to get around that...

[Anonymous Coward]

besides im not in usa prix

We can see that

Protection

[rf0]

Just change the ID3 tag on all the files and that will break any existing MD5 checksums. Even addiing a capital will do it

Rus

Re:Protection

[Jonner]

Even adding an extra "i" would do the trick. ;)

embracing technology?

[pointbeing]

What I don't get is why RIAA doesn't just embrace the technology instead of fighting it.

They're fighting a losing battle. Corporate America can't keep up the technology - so rather than see profits eaten by file sharing, why not make the technology work for them instead of dragging a buncha people into court?

I'd pay for a high-quality digital copy of an album.

Stealing means someone no longer has it?

[Lasuuco Tulkas]

Comparing the Brooklyn woman to a shoplifter, the RIAA told U.S. Magistrate John M. Facciola that she was "not an innocent or accidental infringer"

And what, pray tell, did she steal?

Re:Stealing means someone no longer has it?

[Anonymous Coward]

Stealing involves the deprivation of BOTH capital and profit. Downloading an MP3 only deprives the company of their profit. Stealing also means, like mentioned earlier, that somebody no longer has the material in question. Peer-2-peer networks just promote 'archiving' for posterities sake.

Question

[darkstar949]

This might be a bit offtopic, but I have a quick question regarding mp3 files. I like music from foregin bands (Mostly Japan), and as such I download music from the bands and share it online so that someone else might get like it. 40$US to import a CD that costs about 10$US in the native country is a bit steep to end up not liking the band or the music, hence the downloading.

Now heres the quesion: Are US copyright laws, and as such the DMCA applicable to foregin music, or do I get to laugh at the RIAA if they come knocking on my door.

How About An MP3 Outguess?

[thecampbeln]

Lets see someone put together an app that flips bits here and there within MP3s to make each one it runs against unique enough to create a new MD5 hash!? (I would, but I can only program in a pseudo-language ;) It could even be as simple as adding in a trailing byte to all of your MP3s, though that could be easily filtered. Hell, if you can hide messages within compressed JPEGs without noticeably affecting their quality, why not do something similar to MP3s just to jack up this sort of tracking!?

Re:How About An MP3 Outguess?

[glyph42]

This is the obvious first idea, but it has a problem. Well, several problems. Main problem is that in order for everyone to have a unique file, everyone has to flip some bits. So when you download a song from the network, it has already had some bits flipped. And then your client clips some more bits. And then someone downloads from you, and flips yet more bits. After the file has been around the network a few times, it's going to sound like utter crap.

Now, if somebody could do some nifty MP3 analysis app that alters the MP3 in some reversible but randomizable fashion, then your client could first remove the watermark (hashmark?), then apply a new random one. All the MD5 sums would be different, and you couldn't tell which file generated the MD5 even though the randomness is reversible, because the MD5 itself is not reversible. Yay!

Unfortunately, the second problem then shows up: people want fingerprints / hashes so that the clients can find files to download for multiple-sourcing. If you bodge up the filename, and the meta data, and the MD5s, then the RIAA can't find it, but neither can any other peer!

Long and short of it is that there is virtually no way to tell the RIAA from any other user. Blacklisting will only go so far.

Re:How About An MP3 Outguess?

[glyph42]

Okay, just add some inaudible noise in the MP3 body, using a random seed. Then put the random seed used in the ID3 tag, so that when someone downloads the song from you, their client can remove your noise, and add their own with their own random seed, putting that into the ID3 tag. Bingo, the MP3s will get new random bits for every user who downloads them, and they won't lose quality over time because the noise is removed each time it's downloaded.

Re:How About An MP3 Outguess?

[pla]

Bingo, the MP3s will get new random bits for every user who downloads them, and they won't lose quality over time because the noise is removed each time it's downloaded.

While a technologically-viable solution, it does have one major problem - If each user can do it, so can the RIAA. They don't even need to know the algorithm to accomplish this (ie, even a highly-obfuscated binary-only distro wouldn't help), since they would only need to use a consistantly known seed to have something they can effectively compare against another known zero-seed file.

Assuming an effectively non-reverse-engineerable binary (an impossiblity, but irrelevant), with its own random number generator, this still reduces to a trivial problem - Using something like Bochs, always run the program from a known machine state, and it will always generate the same seed. It doesn't matter *what* seed (so even if it uses the file itself to generate the seed, that won't help), just that it always comes out the same.

Legal Theory

[The Famous Brett Wat]

Copyright lawyers said it remains unresolved whether consumers can legally download copies of songs on a CD they purchased rather than making digital copies themselves.

Sheesh -- what a mind-bender. The theory goes that a person can make an MP3 copy of a work for their own use if they own a properly licensed copy of the work (on CD, for example), but they can't obtain exactly the same copy from another person with exactly the same right. Ow! Ow! Damn you lawyers -- you're giving my brain a cramp!

I wasn't aware that this point was open for discussion, but I guess lawyers are lawyers, and the RIAA's lawyers are paid to make things happen the RIAA's way no matter what kind of specious legal theories need to be invented. I can see that a lot will hinge around whatever legal language grants the right to make "personal" copies in the first place.

The sad thing about this is that it's such an obviously cynical ploy -- not that anyone was expecting any different from the RIAA, but sad in any case. Technology is making it easier and easier for the public to obtain their copies of things any which way they like. The RIAA is using cynical legal theories to quash that convenience any which way they can for as long as they can.

God speed the inevitable demise of the RIAA and others like them.

Re:Legal Theory

[electric_penguin]

This is awesome. I guess if someone downloads a song enjoys it, even if they go out and buy the CD, they are still in trouble unless they delete the file from their collection.

Let that be a lesson to you.

Re:Incitement

[Anonymous Coward]

Now may be the time for you to go back to your job as "RIAA's bitch"

Sometimes the only way to get change is through illegal methods. American Revolution? Oh yeah, Americans went ahead and committed acts of blatant violence in the events leading to independence. Why? Because normal methods yielded no success. Happened/happens in other countries as well.

Normal methods will do nothing to the RIAA. Thus file sharing is a way of fighting back against the RIAA. And you know what, it is working. Now things like Apple's online music store are popping up which would never have started without file sharing. And eventually we hope that it will lead to the downfall of the RIAA, which unfortunately is still some time away.

And don't give that file sharing hurts the artists excuse. Did the Boston Tea Party hurt only the British? No it hurt the tea company who owned all that tea as well. Yet those who participated in the tea party are now considered "heroes". The tea company supported the British and were thus were just collateral damage. Same with the RIAA artists.

Court-document details the RIAA's arguments

[Anonymous Coward]

http://www.eff.org/IP/P2P/Jane_Doe_v_RIAA/RIAA-opp .pdf

Interesting reading. Short summary: Five points as evidence, not just the hash-info

1. She offered more than a 1.000 files for upload

2. She was sent twice a warning message via IM

3. the meta-tages of her mp3's were all filled with lines like (e.g. "Ripped by ATOMIC PLAYBOY 1999!"; "Uploaded by Jerome and
Rudy"; "r!p'd n up'd by Sw0rdz").

4. the hash info

5. She claims to not know about the "unshare" button, yet seems technically savy else

MD5 sums and different encoders

[Psyborgue]

Pretty much no rip is identical.

First step: the *.wav is ripped. Using libcdparanoia, which i personally perfer, i find slight variation in size depending on the machine and cdrom drive i rip them on.
Second step: encoding on different machines, with different encoders, using different algorythms, using different levels of floating point precision, on different architectures etc... produces vastly different files.
Third step: sharing. Oftentimes an mp3 is downloaded 99.8% before the connection is broken. You keep the mp3 becuase mp3 is a sequential file format and you only lose a second or two of music. The rest of the file is intact.

Their md5 searching scheme could be circumvented quite easily by changing a comment in the id3 but they could get around that by cutting out the id3 part of the file when they make their md5sum.
The downside to this is that if you are searching for music on something like gnutella by the ***sum, the content would differ and you would not get as many results. Gnutella would not download from multiple sources becuase the file would not have the same signature.
Whatever the case, it is clear that some form of file obfuscation is now needed for safety online. Or we can wait for freenet to mature.

Re:MD5 sums and different encoders

[brj]

encoding on different machines, with different encoders, using different algorythms, using different levels of floating point precision, on different architectures etc... produces vastly different files.

Forget different machines, different encoders, different algorithms, etc. I just ripped the same song to the same filename three different times and got three entirely different md5 hashes.

Re:MD5 sums and different encoders

[cmpalmer]

There you go, taking all of the fun out of arguing by doing an experiement instead of just spouting out hypotheses. What a party-pooper!

Wait Wait Wait

[YanceyAI]

What's amazing to me is that we keep talking about the hypothetical reasons why the RIAA should not be after people because they might be legitimate users, but we've yet to see any so called legitmate users get busted.

I hate the RIAA as much as the next person (feel free to read some of my previous postings), but what needs to change here is the law. These people (er, we...) are stealing, according to the law. The RIAA is defending their property.

More time needs be spent talking about redefining the law and less on bashing the (evil, petty, corporate rapists) RIAA.

Re:Wait Wait Wait

[gl4ss]

i guess somebody else will flame you too but last time i checked 'stealing' was defined as taking a physicial property from someone else, not doing an exact copy of the said thing.

.

Re:Wait Wait Wait

[YanceyAI]

Actually intellectual property, which is what copyright protects, is just as real as physical property according to U.S. law. If you don't believe me, try using Mickey Mouse without a license...or ask a musician who wrote a song if it "belongs" to her...or use your favorite football team's logo without a license....or talk to disgraced researcher who has been accused of plagiarism...or read slashdot articles on cases the RIAA has won or settled.

Whether you like it or not, intellectual property is BIG business. Music, film and book publising companies buy, sell, license, and profit from intellectual property daily. It is far more profitable to deal in intellectual property than most "physical" property, which is why Jennifer Aniston is a millionaire and you are not.

Using someone else's copyright material without permission or license, according to the law, IS stealing. And no-one flamed me, because they got the point I was trying to make, which is that the LAW needs to be re-examined.

Wouldn't they be the same?

[TheConfusedOne]

Now, if I ripped a song from a CD and you ripped the same song from your CD wouldn't they be the same? It's not like we'd be looking at analog differences in how the recording was set up. Instead we have the same algorithm being performed on the same file on two different computers. Unless there was some date-specific info then what would be different?

Re:Wouldn't they be the same?

[lynx_user_abroad]

Now, if I ripped a song from a CD and you ripped the same song from your CD wouldn't they be the same?

Potentially, even likely. We would have to be using identical copies (the same version of the same CD) and both ripping without error (or with identical errors) and using the same (and correct) encoders.

But if my ripping was flawed (for example, I had read errors from the CD, or used a buggy encoder, etc) then the file I produce may well sound like file you produce, but the MD5's would be different.

Now, if instead of ripping the file from your copy of the CD, you've downloaded a copy of the file I ripped, then your MD5 would match mine.

So the RIAA may have a list of MD5's for files which were traded on Napster which had "unusual" MD5 hashes. If you're sharing a file with one of these "unusual" MD5 hashes, then either you got the file off Napster originally, or you "just happened" to have encountered the exact same read errors when you were ripping your own copy, and you used the exact same buggy encoder, etc. If you're sharing more than one of these "unusual" files then you're almost certaintly sharing stuff you got off Napster.

People comfortable with sharing files online because they own the CD should make sure the file they're sharing is actually one they've ripped themselves, rather than one that just "has the same name as" and "sounds an awful lot like" a song on a CD they own. This is not to imply that sharing a song ripped from a CD is legal (that's not always clear). But at least people who really do own the CD have an option to re-rip it themselves. People who are only claiming to own the CD (but don't actually posess it currently) don't have the option of re-ripping from their CD.

(Then again, toggling one bit of a file will change the MD5 hash, so I could see a lot of cheating file sharers just plonking one bit and caliming it's a copy they ripped themselves...)

MD5 hash colission is not worth discussion.

Re:Wouldn't they be the same?

[3terrabyte]

People comfortable with sharing files online because they own the CD should make sure the file they're sharing is actually one they've ripped themselves, rather than one that just "has the same name as" and "sounds an awful lot like" a song on a CD they own. This is not to imply that sharing a song ripped from a CD is legal (that's not always clear).

What??? Man, are you in for a big surprise if you go to court.

Sharing a copyrighted file that you don't have permission from the copyright holder is illegal. It doesn't matter if you own the cd. It doesn't matter if your sister is Shania Twain. You can't distribute her songs! This whole MD5 should be different than their database, etc, etc, crap has nothing to do with anything. Sharing copies of mp3's as long as you own the CD? What the hell? Are people de-educating themselves as these stories progress?

Re:Wouldn't they be the same?

[lynx_user_abroad]

Sharing a copyrighted file that you don't have permission from the copyright holder is illegal.

Life is not nearly that cut-and-dried. It is legal for me to share a copyrighted file in a number of circumstances; generally we use the vaguely-defined term "Fair Use" to describe those circumstances. A court will determine if a use was "fair" on a case-by-case basis.

For example, The Audio Home Recording act explicitly allows me to make an analog copy of a song and to give such a copy to my friend. I would likely win a case in court if this is all I was doing. I would be treading into illegal waters if the copy I distribute is a digital copy, if the person I was giving it to could only loosely be described as my friend (such as is the case if I'm offering it to any anonymous person who checks-out my shares) or if I were offering the copy in a commercial fashion (in exchange for money, other items of value or traded songs, access, or to drive traffic to my site, etc.)

I would agree that most of the people who offer (or download) copyrighted material on Kazaa and the like are doing so outside the scope of fair use, and thus are acting illegally. But I refuse to surrender the act of sharing information on-line to "always clearly illegal" status. If we do that, I couldn't quote you (as I do above) when responding to your post.

Re:Wouldn't they be the same?

[3terrabyte]

I agree with your 100%, and was simply trying to curb my long post by leaving out certain things. I was alluding to the topic on-hand which was digital media trading. Your analog examples are true.

I might also bring up the point that the MPAA fought tooth and nail to keep the Fair Use clause as we know it from even surfacting (VCR's as illegal). Not to mention that p2p protocol is still under appeal. I guess nothing is 100% safe. :(

Re:Wouldn't they be the same?

[Fryed]

If fair use only covers giving copies to a friend, how is this determined? It's unlikely that a random person on Kazaa downloading from you counts as a friend, but what about other ways of sharing? For instance, what if there was a filesharing program that allowed you to require someone be on your "friend list" before they would be allowed to download from you? If someone asks to be my friend, and then I put them on my friend list, can I now legally say they are my friend?

Secondly, you mention that digital copies are another reason that Kazaa and others are illegal. Can a computer be used to create an analog copy? If, for instance, I have a wire running from my sound card's line out into its line in, and record the input, is that now an analog copy? There may be some loss of quality, but it doesn't seem like it would be much. I know that the unencoding and reencoding of mp3 files would lead to less quality, but what if the files were stored in FLAC or some other lossless codec instead?

If so, it seems someone simply needs to design a P2P program that does the two things mentioned above, and it would then be completely legal to use. After all, it's only being used to give analog copies of songs to friends. Clearly, none of the current P2P programs fit the bill, but if the lawsuits keep coming, one might soon be made that does...

Re:Wouldn't they be the same?

[lynx_user_abroad]

If fair use only covers giving copies to a friend, how is this determined?

It's determined at two places; by the copyright owner and by the courts. The copyright owner makes a guess as to whether what you call a "friend" will be viewed as a "friend" by the court, and whether it's worth their time and money to go after you. If they do go after you, you may be able to cite your "friend" relationship as a mitigating factor in your defense.

If someone asks to be my friend, and then I put them on my friend list, can I now legally say they are my friend?

You can say it, but the Court doesn't have to agree. Even if the Court agrees, they could still find you guilty of infringment.

This isn't like computer programming; you can just spot a buffer overflow and be sure it's exploitable on every system...

Can a computer be used to create an analog copy?

There's a whole can of worms just in this one little sentence. The reasoning behind the Home Recording Act was that a "analogue" of a work was, de facto, worth less than the "original". If you start making multiple generation analogues you will eventually wind up with something worthless, which makes analogues less threatening to publishers than digital copies. The infinite reproducibility of digital copies was one of the problems which the Digital Millenium Copyright Act was intended to address.

But is a song in MP3 format inherently less valuable than the same song on a CD? I think there are plusses and minuses to both. I wouldn't be surprised to see an effort by the Publishing Industry to have the HRA modified and the "analogues are okay" language thrown out once they figure out there's profit to be made in selling songs in MP3 format even if the quality is less.

If so, it seems someone simply needs to design a P2P program that does the two things mentioned above, and it would then be completely legal to use.

Not necessarily "completely legal", but perhaps it would offer more opportunities for its' users to claim Fair Use. On the other hand, if that "someone" were to create such a system because of some commercial motivation (like in order to sell it as a product, or as a way to avoid having to purchase CD's) its users would have less of a chance to claim a "non-commercial use" exemption of Fair Use, and so its use could be labeled illegal anyway.

I don't think the RIAA has anything to worry about here. The people who rely on Kazaa "friends" to supply their music are too lazy build such a system, and the people who use p2p to share non-infringing stuff either wouldn't bother, or have already figured out better alternatives.

Re:Wouldn't they be the same?

[3terrabyte]

If someone asks to be my friend, and then I put them on my friend list, can I now legally say they are my friend?

It was called Aimster.
a.k.a. Madster.

a.k.a. sued, and lost.

File sharing is the new revolution....

[Anonymous Coward]

Sometimes the only way to get change is through illegal methods. American Revolution? Oh yeah, Americans went ahead and committed acts of blatant violence in the events leading to independence. Why? Because normal methods yielded no success. Happened/happens in other countries as well.

Normal methods will do nothing to the RIAA. Thus file sharing is a way of fighting back against the RIAA. And you know what, it is working. Now things like Apple's online music store are popping up which would never have started without file sharing. And eventually we hope that it will lead to the downfall of the RIAA, which unfortunately is still some time away.

And don't give that file sharing hurts the artists excuse. Did the Boston Tea Party hurt only the British? No it hurt the tea company who owned all that tea as well. Yet those who participated in the tea party are now considered "heroes". The tea company supported the British and were thus were just collateral damage. Same with the RIAA artists.

Protection

[t_allardyce]

What good evidence destroying/hiding mechanisms are there around? Apart from deleting and overwriting the area several times? How about something that can kill the hard-drive even when the computers off? I see crime scenes on the news all the time with police carrying out computer cases for examination - it always struck me that you could fit tamper protection in your computer - any attempt to move it, open the case or anything with out proper authorisation would cause the hd to torch its-self, this could be as simple as a battery inside with enough power to boot the machine quietly and very quickly destroy the data, the police would have no time to stop it, while all this is probably illigal itself, it could be better than being sued for $50000 per song or whatever their price is?

I hope the next kazaa lite comes with file altering/deleting/anti-riaa utilities :)

As opposed to articles about ammunition?

[SuperBanana]

I would certainly hope that we wouldn't stoop so low as to blatantly and openly be trading tips on how to avoid getting caught doing illegal things.

As opposed to, say, an article about all the various types of small-caliber ammunition? :-)

Provided you have a gun permit where necessary , there's nothing illegal about owning a gun in and of itself...but the Kuro5hin article extensively covers armour penetration(including what does/does not penetrate kevlar vests), what bullets do the most damage to living tissue, etc.

Maybe the living-tissue damage stuff applies to hunting, but when was the last time you saw a deer sporting kevlar, mmm?

From the Napster Network??

[re-Verse]

From the NAPSTER network??? This is worse than i thought - it appears the RIAA has built a Time Machine! Next they will be going further back than napster andprosecuting free-thinking pilgrims who would share their newspapers.

Yikes.

Re:From the Napster Network??

[brj]

Their first use of the time machine will be to go back and kill Sean Fanning's mother before she gets pregnant with Sean. If and when that fails, they'll try again by going back and killing Sean when he is a young child.

Or she was the original source of...

[leuk_he]

Another point is that she could have been the original source of all the napster files. Since that was not the complaint here (it is not!) nothing is proven here.

Re:Or she was the original source of...

[leviramsey]

Then the RIAA files suit against her for that. At this point, she's got three choices:

1. Take the fall from KaZaa, pay big settlement and have credit ruined for a fairly long time (thanks to a bankruptcy filing).
2. Take the fall for being the source on Napster, pay a big settlement and have credit ruined for a fairly long time (thanks to a bankruptcy filing).
3. Be found to have perjured herself and spend a while in prison, with a criminal record to match (which damages any future employment prospects she's got).

3 is not mutually exclusive of the other 2 options.

A problem with this

[DrXym]

Hashing is used so you can download the same song simultaneously from multiple users. If everyone has different hash keys (e.g. by scewing with the ID tags), it defeats the point of most P2P.

I suppose that (if its possible) you would either want to swamp these guys with false positives, or distribute the hash keys and the files somehow to make it more difficult and protracted to discover who actually owns that file.

I suppose that one viable option in P2P would be a freenet model where downloading involves a number of encrypted hops between peers to search or get the data, and where peers cache popular data and indexes in encrypted form. It would be much, much harder to figure out who shared that file then.

Obviously there is a trade off going this route. You wouldn't want the sluglike performance of Freenet so it would not be as secure, but I'm sure you could reduce the number of hops and other measures and still make life massively more difficult for RIAA and their ilk to track down your activities.

Even for legal burning MD5 matches should be high!

[Ja-Ja-Jamin]

considering that most software that rips CDs points to either CDDB or FreeDB the odds of two people have the same ID3 tags are very high. Now, given the MS has a monopoly on the desktop and given the popularity of a few ripping software packages (MusicMatch, Exact Audio Copy) the likely hood that two people ripping the latest Hit CD with the same software on the same platform is actually pretty high. So wouldn't that mean that the odds of the same MD5 hash are pretty good?

Least signifigant bit twiddler

[stinkenstein]

Somebody (not it) ought to create a command line tool to twiddle one insignifigant bit in an MP3 randomly, so you could just point it at your share directory periodically to break the chain that the RIAA seems to be making a lot of hay out of. Granted, this would wreck the ability to pull from multiple sources and verify files, but war is hell.

My suggestion it to not do this in the ID3 part, rather in the content part of the file, in that it would be possible to create a tool that would MD5 the audio content separate of the header.

messing up MD5 tracking

[radoni]

how about adding a field (easy if you're an oggvorbis trader) RANDOMIZER that contains a random produced number.... would this be enough to throw off md5sum ?

a thought

If you want to be technically accurate...

[gosand]

Should that read: "Now may be the time to stop cheating people and start paying for your music!"

You mean: "Now may be the time to stop cheating a record label that has no problem cheating you, and start paying them for the right to own one copy of music that they own the rights to simply because they control the music industry and artists have no viable alternative."

Similar story on BBC

[SuperChuck69]

http://news.bbc.co.uk/1/hi/entertainment/music/318 7695.stm

New Feature for Kazaa Lite K++

[Anonymous Coward]

How about a feature that changes the least significant bit of a single random byte of every file downloaded?

I guess the proper solution is to encrypt each file before it is transferred, so the MD5 hash for each file cannot be reproduced (unless you know the encryption key).

Slashdot's lawyers went to a mail order mill

[mattr]

Duh, that should be "your LEGAL mp3 file MD5 hash sums". Or maybe "LEGAL mp3 files" is better English.. (a sum is a mathematical calculation on a physical file, hence you cannot update a calculation) ..anyway WTF?

Why leave yourself open to prosecution by mindless riaa-drones? Do you guys have a death wish or what?

Virus

[MikeHunt69]

Maybe someone should write an email virus that listens on the Kazza ports and reports back gigs and gigs of shared mp3's to anyone who asks.

Then, when people get busted, they can say "It was a virus".

Of course, this would make the search feature of Kazza useless...

No one knows

[jcsehak]

From the article:
Copyright lawyers said it remains unresolved whether consumers can legally download copies of songs on a CD they purchased rather than making digital copies themselves.

So it's still up in the air. But here's where I get confused:
For example, the industry disclosed its use of a library of digital fingerprints, called "hashes," that it said can uniquely identify MP3 music files that had been traded on the Napster service as far back as May 2000.

By comparing the fingerprints of music files on a person's computer against its library, the RIAA believes it can determine in some cases whether someone recorded a song from a legally purchased CD or downloaded it from someone else over the Internet.

Okay, how? Only way I can see is if they have a HUGE-ASS library of mp3s downloaded from Napster that they can check every file against. Seems unlikely that "nycfashiongirl's" copy of "Beat It" would match exactly with one in the RIAA's library.

The recording industry also disclosed that it is examining so-called "metadata" tags, hidden snippets of information embedded within many MP3 music files. In this case, lawyers wrote, they found evidence that others -- including one user who called himself "Atomic Playboy" -- had recorded the music files and that some songs had been downloaded from known pirate Web sites.

Now it's making more sense. I don't think they're using hashes at all. I think they're checking the ID3 tags for stuff like "ripped by 4t0m1c P14b0y - www.atomicplayboy.com."

So really it should read something like "Using a surprisingly astute technical procedure, the RIAA examined song files with an advanced file analysis application, iTunes, and found evidence of references to Atomic Playboy." The article of course, doesn't mention whether it was possible for them to plant the evidence, which it would've been if they were simply allowed to possess her hard drive and weren't required to make any backup copies for the judge.

Of course, if, in her defense, she counters with "well yeah, not all of them were ripped from the physical CDs, lots of times I'd want to listen to one of my CDs, and I couldn't find it, so I'd just download it -- but here is my CD collection for evidence, your honor," then there's going to be an interesting precedent set -- is it okay to download songs that you already own on CD?

Also, she's in court not so much for downloading, but for uploading, which is much more of a crime (have they even sued anyone for just downloading yet?), and it really doesn't matter where she got the songs, just that she was sharing them.

Re:No one knows

[leviramsey]

The article of course, doesn't mention whether it was possible for them to plant the evidence, which it would've been if they were simply allowed to possess her hard drive

AFAIK, the hard drives haven't been taken. The files have been gotten through the P2P networks.

Re:No one knows

[DevNova]

The way I see it, the RIAA can't have it both ways. Either we OWN the music and can do whatever we want with it (copy, distribute, freely share) or we license the music and have the right to do things like get it replaced if it's lost or destroyed, re-download it from any source, or make it available to ourselves to listen to when we like.

But this also means that, if I own the license to listen to Talking Heads '77 because I bought the album back in 1981, then I can also download a digitally perfect copy of the tracks on that album, because I bought the license to listen to that music, not that particular instance (analog vinyl) of said song.

Um, isn't the real issue

[Rogerborg]

That the RIAA are going to be able to demonstrate that the balance of probability (the criteria in a civil case) is heavily on their side? They don't have to prove beyond any reasonable doubt, they just have to show that it's more likely that nycfashiongirl is using and sharing someone else's copy.

What's especially damning is that even nycfashiongirl's lawyer seems to get that. You'd think that if she was telling the truth about these being rips made by her from CDs that she owns, they'd demonstrate that they could re-create them. But no, now that's irrelevent, it's all about the contitution. If the facts are against you, argue the law, eh?

Hmm, didn't we used to be in favor of the RIAA taking careful aim at individual sharers rather than blasting away at P2P in general? Seems to me like they're pretty confident that they've got the right target in their sights this time.

So, what's our reason to object now?

Quick Experiment....

[Anonymous Coward]

I just used two different PC's using the latest version of Windows Media Player on default (which a lot of home users would use I presume) to rip the exact same song of the exact same cd (Chateau on the second cd of the Matrix Reloaded soundtrack).

the size of both of these files is exactly the same 3,248,949 bytes. How would I go about checking to see if the MD5 hash matches (in Windows) for the two files?

If someone else knows how to do it I can send them the files. Provide you're not some RIAA moron.

Wait a second..

[Malicious]

So, the RIAA suggests they have a way to PROVE you downloaded the songs, should the MD5 tag be unique..
Ok... good for them. Now all they need is permission to access my harddrive and check.
Let me think about it...
No.

Say it with my now, IRC.

[ad0le]

Why not steal your music the old fashioned way, IRC baby, YEAH!!!

Re:Say it with my now, IRC.

[JoseffB]

I like newsgroups

You have to be realistic...

[bob670]

This is what happens when your entire economy becomes based on intellectual property. The U.S. has stopped making anything in the last few years besides ideas. Between NAFTA moving manufacturing jobs overseas and tech jobs following, the last thing a company has to cling to is ideas/intellectual property. The marketing of ideas as capital/consumer good (software licensing) and the packaging of art as product (see current state of pop music) should serve as notice.

This is just the beginning of this type of thing, more legislation, litigation and saber rattling are on tap for the near (and probably) long term future. The patenting and profiting from/of intellecutal property in the wildly broad terms accepted today, combined with a culture of litigation and the broad language of the DMCA opens doors for this kind of thing to just perpetuate itself. A serious reform of patent law and clearer definitions of what intellecutal property and fair use entails should become top priorities. Please note I am not espousing some kind of socialist utopia of/for information, I have no problem with people protecting their work and making a fair profit.

Bill Gates admitted in a couple interviews that with if the "culture of patents" that MS lives by existed when MS started, they wouldn't be here today. While I think Lessig gets a little too far out there with this stuff, him and his brood make many good points. Not just our economy but the future of our culture is at risk.

What is illegal here?

[emptybody]

If I use KaZaa to access indie artists who are
sharing their songs - as is their right - AND I
also rip my entire 1000+ CD/LP/8track collection
to the same computer AND I intellegently store
all the files in the same heirarchy.

Have any laws been broken?

KaZaa is configured to share everything in my
heirarchy so that the indie songs can continue to
be shared.

Have any laws been broken?

I go in for Jury Duty, meanwhile Another Kazaa
user downloads the indie shared files.

Have any laws been broken?

Another Kazaa user downloads the rips from my
personal collection because their 8track player
is on the fritz.

Have any laws been broken?

Another Kazaa user downloads the rips from my
personal collection because their LPs were
destroyed in a flood.

Have any laws been broken?

Another Kazaa user downloads the rips from my
collection because they want to see what the
latest Madonna single sounds like before going
out and buying the CD.

Have any laws been broken?

If any laws were broken here - who broke them?

Just because I leave the front door open does not
mean that anyone can enter and take what they
want from my house. Same as my computer.
The action of downloading is at question not
making the article available.

YMMV. Consult a lawyer.

Re:What is illegal here?

[gl4ss]

**Another Kazaa user downloads the rips from my
collection because they want to see what the
latest Madonna single sounds like before going
out and buying the CD.**

it sounds something like "what the fuck you think you're doing".

which brings an intresting point.. because it obviously was released by her/her_pr_guys_or_something, is it legal to copy it around?

.

Re:What is illegal here?

[kennylives]

Just because I leave the front door open does not mean that anyone can enter and take what they want from my house. Same as my computer. The action of downloading is at question not making the article available.

Nonsense.

To use your analogy, if you leave the front door of your house open (while you're away), you should expect that someone will come in, and if you're lucky, take something.

Your situation gets significantly worse if you have, say, a handgun under your pillow, and some random neighborhood kid comes in, finds it, and shoots himself (or someone else).

The issue here is that you've knowingly left your front door open, making you at least partially liable for the harm that occurs as a result (indirect or otherwise). Same thing if you leave the keys in your car and someone takes it and mows down a bunch of pedestrians with it. In either case, you cannot claim innocence simply because you didn't do the deed. You've made a substantial contribution in the commission of a crime, and you would be expected to pay for that crime.

Re:What is illegal here?

[jhines0042]

Lets say that you buy a book.

You then make a photocopy of the entire book.

You take that photocopy around with you to read leaving the original at home.

Now lets say that someone breaks into your house while you are home and steals your photocopy leaving you your original (it was locked up in a safe for example).

The crime in this instance is two-fold. Breaking and entering, and copyright infringement. Who is responsible for the copyright infringement? You are.

Now lets remove the breaking and entering....

You put a table out in your front yard by the sidewalk with a box of paper that happens to be photocopies of books with a sign that says "Free to a good home".

Now the crime is just copyright infringement.

If the author of the book had given you permission to copy their work, then there is no infringement.

Joe H.

Re:What is illegal here?

[Hal-9001]

But certainly his liability would be lower for the consequences of his negligence than for the consequences of actions that he takes willfully. A big problem here is that the RIAA assumes that everyone willfully shares copyrighted music, when in fact they may just have been negligent.

Re:What is illegal here?

[retards]

Same thing if you leave the keys in your car and someone takes it and mows down a bunch of pedestrians with it.

Do you live on another planet? Those aren't laws I ever heard of.

Everywhere I ever heard of there is nothing illegal with leaving keys in a car. Perhaps someone can sue you for negligence in a civil suit, but that doesn't mean they will win.

And you can ALWAYS claim innocence, even if you shot someone through the head with a tank on national televison.

You've made a substantial contribution in the commission of a crime, and you would be expected to pay for that crime.

Idiot. What about:

Trial by jury

Innocent until proven guilty

Interpretation of law

Special circumstance

Spirit, not word, of the law

There is no black-and-white rule that specifies when a person is negligent enough to be deemed guilty by default, at least not one I heard of. Except maybe anti-terrorism laws...

Re:What is illegal here?

[Sloppy]

KaZaa is configured to share everything in my heirarchy so that the indie songs can continue to be shared.

This is where you screwed up. You are responsible for Kazaa's behavior, since you are the person who chose to run it. You should set that program up to only share the files that you're authorized to share, and not the other (non-indy) ones. Running the program with this bad config isn't quite a crime yet, but it's ready to commit one. To use violent over-the-top RIAA-friendly metaphors, it's like you're blindly shooting a gun into the dark, but not hitting any poor innocent record execs yet.

When someone connects to your kazaa server and downloads one of the non-indy songs, one of your bullets-into-the-dark just hit someone.

Just because I leave the front door open does not mean that anyone can enter and take what they want from my house. Same as my computer. The action of downloading is at question not making the article available.

Your machine is listening on a socket on the public internet. This is like a sign over the doorway to your house: come in. But unlike an ftp server that just minds it own business, you're running a p2p program, which advertises itself to other machines, replies to search requests, etc. This is like having a dozen billboards all over your neighborhood, saying that anyone who comes to your house can get free beer. There's going to be a crowd at your door.

Re:What is illegal here?

[Anonymous Coward]

Now lets say that someone breaks into your house while you are home and steals your photocopy leaving you your original (it was locked up in a safe for example). The crime in this instance is two-fold. Breaking and entering, and copyright infringement. Who is responsible for the copyright infringement? You are.

this is where you are wrong. the act of photocopying a book you own is NOT copyright infringment; you have a right to make copies for personal use. if you own a book, cd, etc. you can make as many back-up copies of it as you want. its in the DISTRIBUTION of copyrighted materials that a copyright infringement occurs. since you didnt distribute the stolen copy, no infringement has occurred. now, if you make a bunch of copies and distribute them (like your later analogy) then THAT is infringement.

Re:What is illegal here?

[IthnkImParanoid]

What are you on?

There are few people I know that lock up every door and window before they leave the house (I live in a small town). I've been to rural areas where people leave their keys in their cars. In both cases, there is no expectation of B&E or theft.

If a kid enters my house, finds a gun (that's even hidden in your example), and shoots themselves I am not liable. If someone steals my car I am not liable. Negligence is leaving a loaded gun on the front lawn. You cannot be negligent just because you didn't lock down everything you own with multiple locks, razor wire, bio-hazard signs, and 6 dozen pitbulls.

Re:What is illegal here?

[IthnkImParanoid]

You are responsible for what you willingly share on P2P networks. If you do not have permission from the copyright holder to share those works, you are in violation of copyright law.

In the case of downloading indie works (which I shall assume are freely distributable by decision of the copyright holders of those works) into the same directory as your personal collection (RIAA music, I assume)- the onus is on you to not share the work that is not freely distributable. It doesn't matter that KaZaa's sharing mechanism only works at the directory level; you cannot legally share the works you do not have permission to.

It also doesn't matter if the person has purchased the album/media before, and is just downloading it to put it in digital format. It is still illegal for you to share it; see RIAA vs. mp3.com. The actions of the person downloading may or may not be illegal, but your sharing of work that you do not have permission to distribute is illegal.

Re:What is illegal here?

[Anonymous Coward]

Now lets say that someone breaks into your house while you are home and steals your photocopy leaving you your original (it was locked up in a safe for example).

The crime in this instance is two-fold. Breaking and entering, and copyright infringement. Who is responsible for the copyright infringement? You are.

Close, but no. Copyright infringement must be willful (aka intentional).

Re:What is illegal here?

[emptybody]

That would mean that musicmatch should have won their case.

They let peopel "upload" CDs to their service and access them from anywhere. The physical posession of a CD was the proof of license.

If a CD was already uploaded the new user would not have to upload it, just insert it for initial verification.

Since there were controls inplace to prevent copyright infringement, there is therefore an explicit lack of intent.

However, I believe they were shut down just the same.

I wonder...

[assaultriflesforfree]

From the article:

By comparing the fingerprints of music files on a person's computer against its library, the RIAA believes it can determine in some cases whether someone recorded a song from a legally purchased CD or downloaded it from someone else over the Internet.
... Copyright lawyers said it remains unresolved whether consumers can legally download copies of songs on a CD they purchased rather than making digital copies themselves.

So, the RIAA has been downloading illegal copies of music for years, in fact probably has a huge library of music. Simultaneously, in their broad sword efforts to completely end p2p, they're arguing that it's illegal to download songs you've already bought. So, even if the RIAA has gone through all the hoops with this library, obtaining licenses for each song they swiped off of file traders in their investigations-- which I doubt; recall Microsoft's slip ups-- they're arguing that the methods they've been using to track down illegal file traders are actually illegal themselves! In fact, the RIAA might have the largest collection of illegal music of anyone, even larger than mine! Of course, this should come as no surprise, after all of the attempts to make it legal for them to attack suspected infringers PC's, it's pretty clear that the RIAA's privilege and property makes them above the law.

Re:I wonder...

[assaultriflesforfree]

Sorry, for those of you that are thoroughly confused, here's the link to the Microsoft story I was referencing:

Microsoft Pirating Their Own Software?

corrupt the md5, not the music...

[rusty0101]

echo a random number of nulls onto the end of the file, and the MD5's will never match again. Likewise if the id3 tag editor does not strip extra spaces, add those to the end of random tags.

-rusty

Re:corrupt the md5, not the music...

[vegetablespork]

Of course, there go multiple source transfers out the window. But I guess that's the price that must be paid for avoiding the wrath of the jackbooted copyright thugs.

Re:corrupt the md5, not the music...

[TheSync]

Flipping just ONE BIT will change the MD5 hash.

MD5 exists to ensure that files are 100% exactly the same, bit per bit. If I were them, I would use a hash with a property of allowing a little more Hamming distance between inputs to map to the same hash to avoid people just flipping one bit and making it untraceable.

P2P modifying files..

[bobthemuse]

How long is it until a P2P client is created which appends a half second of noise to the end of everything you download, thus modifying the checksum?

I can see it now... "And in recent news, according to the RIAA there are over 10 billion songs being traded. The organization is quoted as saying 'We intend to sue individual users for having more songs than we've created...'"

Re:P2P modifying files..

[Anonymous Coward]

Fantastic idea. But a millisecond ought to do it. (ie, even a millisecond difference will generate an entirely different hash, and 499 more milliseconds won't make it any more "different")

Why MD5?

[azaris]

Where did the submitter pull the MD5 reference? Using MD5 to compare for similarity of two data streams is a bad idea, since very small changes will severely change the hash. It's about as useful at looking at the file size to see if the two MP3's match.

Re:Why MD5?

[naph]

i think that's the point. they can look at files on P2P networks and look at files on peoples hd's and try and match md5 sums.

they're only likely to match if they're from the same place. hence illegal copies.

ID3-tags might not matter.

[Anthet]

Since an id3-tag (v1.1 mind you) only affects the last 128 bytes it would be pretty easy to only md5 the part that has actually been ripped.Then a slight difference or spelling errors in the id3 tag wouldn matter if it was to be compared against other mp3-files.

How RIAA tracks downloaders

[$exyNerdie]

Revealed: How RIAA tracks downloaders


(Music industry discloses some methods used)

Re:How RIAA tracks downloaders

[Anonymous Custard]

Revealed: How RIAA tracks downloaders
(Music industry discloses some methods used)

I didn't rtfa, but I assume it involves lots of goat blood and circles drawn in sand made from the crushed bones of P2P felons. Oh yeah, and Hilary Rosen has to rub her ass in the bone sand, too.

Re:How RIAA tracks downloaders

[Mannerism]

Uh, isn't that just a link to the CNN version of the same story? Rather redundant to those who have RTFA.

Revealed: How RIAA tracks downloaders

[$exyNerdie]

Revealed: How RIAA tracks downloaders

(Music industry discloses some methods used)

Article has just very basic info for techies...

my half-assed idea...

[bryanthompson]

As long as you 'own' the cd, you can have the mp3s, right?

Does it matter where you buy them from? I can go to a garage sale a buy a cd and it becomes mine.

Are you only allowed to have the MP3s while you own the CD?

It'd be cool to have a place where they had bunches of cds, and when the RIAA tries to go after someone for MP3s, they could give the CDs to that person just to prove ownership of some kind. Even if the cds were bought for $.01, they'd be theirs. After the RIAA leaves that person alone, they send the cds back and it all starts over.
any good?

A failure to comunicate

[MarkusQ]

There is an interesting pattern here:

• Some one comments that the IP laws have not kept up with technolgical and social change, and that they are now impeding the cultural goals they origonally served. They may have made sense when we were limited to exchaging physical objects, but they don't make sense now.

And the responses are allong the lines of:

• But it's the law.
• I hope the RIAA gets you.
• Then I suppose an idiot like you won't mind if I take your stuff!

The respondents are completely missing the point. To see this, imagine what the discussion might have looked like if it had happened way back when:

• The rule about not eating X hasn't kept up with the times. It made sense when we didn't know about the parasites, but now that we know how to clean and cook them it doesn't makes sense.

I suspect the responses would have been along the lines of:

• But it's the law.
• I hope the gods get you.
• Then I suppose an idiot like you won't mind eating dog poop!

Every time I see this played out, my response is, "Gee, IP law really is dying, isn't it?", with the same sort of awe I had watching little bits of sand wash downstream at the bottom of the grand canyon.

-- MarkusQ

Re:A failure to comunicate

[heironymouscoward]

Thank you very much for this.

You're exactly right. The IP laws are becoming as outdated as the English bylaw that prohibits the sale of imported junkets on Sundays.

There is an African proverb: "it takes a village to educate a child", meaning that we are all the sum of a rich and complex cultural heritage. You can't price this, you can't own it, and you can't stop people from accessing it except by force.

IP laws have always been of dubious social value, and today's situation merely highlights this.

Re:A failure to comunicate

[wirelessbuzzers]

And the responses are allong the lines of:

* But it's the law.
* I hope the RIAA gets you.
* Then I suppose an idiot like you won't mind if I take your stuff!

The true problem with the "IP is dying" claim is not actually any of these. The problem is that while IP and copyright are clearly outdated, they serve a necessary function in our economy, that is, giving people an incentive to create art/useful programs.

While copyright/IP are increasingly inefficient means to accomplish this, there is no currently available substitute. Sure, there are street performer protocols, OSS funds, and other ways of earning a profit for freely distributable media, but ultimately, this is an extremely difficult problem in the free-market economy.

I, and anyone else on /., can certainly suggest plenty of protocols or economic systems to accomplish this, but none of them are particularly compelling and most of them probably wouldn't work at all.

Until there is a viable alternative on this side of communism, IP cannot be allowed to die.

Re:A failure to comunicate

[SeanAhern]

Know someone with . in their path?
echo "#!/bin/rm -f" > cat; chmod a+x cat

Yes. Me. Been consciously doing it for many years.

This should probably be: "Know someone with . before /bin in their path?"

Or else you just get:

% cd /tmp
% echo "#!/bin/rm -f" > cat; chmod a+x cat
% cat cat
#/bin/rm -f
% ls cat
cat
% which cat
/bin/cat

Pretty boring.

Re:A failure to comunicate

[wirelessbuzzers]

This should probably be: "Know someone with . before /bin in their path?"

Yes, I know this, and that makes this landmine largely ineffective. Of course, you can still make a file called "cta" or something, and hope the person makes a typo.

And yeah, putting . at the beginning of your path is pretty stupid.

Re:A failure to comunicate

[Anonymous Coward]

Some one comments that the IP laws have not kept up with technolgical and social change [...]
The rule about not eating X hasn't kept up with the times.

That's amusing, but how about comparing apples and apples next time? There was once a very good reason not to eat X, and that reason is now gone. There was also once a very good reason for IP laws, and guess what? That reason still exists.

Re:A failure to comunicate

[MarkusQ]

The problem is that while IP and copyright are clearly outdated, they serve a necessary function in our economy, that is, giving people an incentive to create art/useful programs.

According to who? If this were true, we should expect to see a derth of innovation in fields (such as recipies, fashion, mathematics, courtship, etc., etc.) that have no IP protection. Yet in fact, we see as much if not more effort being expended in these areas as we do in areas with IP protection. Arguably, most of the real innovation in computer science came before it had significant IP protection (back when it was correctly recognized as a branch of mathematics and not a convoluted form of prostitution).

I would offer that the motivation for useful innovation is the fact that it is useful and that what IP pundants are really worried about isn't the death of innovation but the death of a ready means of exploitation. In this context note how often IP "protection" is being used against people who independently developed a similar technique. It is not being used to reward innovation, but rather to punish it. But bluntly, it's rather silly to claim that "The-god-given-right-to-thump-people-who-try-to-th ink-up-something-you-already-thought-up is the mother of invention," but that's pretty much what the "we need a way to reward innovation" argument boils down to.

-- MarkusQ

Re:A failure to comunicate

[wirelessbuzzers]

Most of the innovation in fashion is done by people who sell designer clothes. They stand to profit a good deal by this, perhaps even more if others copy them.

Academics have tenure, they don't get any money for their ideas (unless they get patented, IP, etc), but rather for their teaching.

So yes, academics will still invent stuff, but that rather narrows the field, no? And digital artists would largely be screwed if copyright went away.

Re:A failure to comunicate

[MarkusQ]

You've shifted your ground. You started out saying that people wouldn't create without the "incentive" of being able to prevent others from doing the same thing they did. I pointed out that the original incentive would still be there--that by definition something that is useful has a use and therefore there is incentive to do it even if you can't stop others from doing the same thing.

Now you are saying that "digital artists would largely be screwed if copyright went away" which may be a problem for them, but has nothing to do with the original question of the need to provide aditional incentives. If you look at the facts on the ground, the vast majority of "digital artists" are screwed right now. A small fraction of them make it big, and guess what, most of them are screwed too. So why do they create? Perhaps to fill some inner need, or because it's just plain fun, but whatever their reasons there is a very good chance they would still be there; only people who are motivated by a desire to have some form of control over the actions of others need IP to provide their incentives.

The people who would loose are not the people doing the creating; the people who would loose are the ones living off their present role as middlemen and gatekeepers.

-- MarkusQ

P.S. I gather from your sig that you are not the sysadmin?

Re:A failure to comunicate

[MarkusQ]

There was once a very good reason not to eat X, and that reason is now gone. There was also once a very good reason for IP laws, and guess what? That reason still exists.

The original "very good reason" for trademarks still exists (discouraging identity theft). The reason for copyrights (encouraging the mass production of printed material) is largly gone, and the reason for patents (encouraging the small number of inventors to share their inventions) is totally gone. In both of the later cases, there are so many more people actively engaged in the fields that we are more in need of a filter than a pump.

-- MarkusQ

Re:A failure to comunicate

[dvdeug]

Some one comments that the IP laws have not kept up with technolgical and social change, and that they are now impeding the cultural goals they origonally served.

What was the original goal of IP laws? To encourage authors to create and distribute their work, instead of keeping it locked behind closed doors and non-disclosure agreements, not creating it at all. I fail to see how that has been elimentated; musicians and authors still need to eat.

Re:A failure to comunicate

[wirelessbuzzers]

No, I have not shifted my ground. My view is that for now (ie, until someone creates and deploys a viable alternative), copyright and patents are a necessary evil (evil, primarily, because they are prone to abuse).

I like patents less than I like copyrights. Only a few industries really depend on them anymore. Probably the most famous instance is the pharmaceuticals industry. Only a huge company has the resources to not only develop drugs, but to push them through trials and get government approval. Once they do that, if anyone can make the drug cheaply, the pharmaceutical company that developed it will be at a strong competitive disadvantage: it will have the same tech as the other companies, but be out in R&D.

As for copyright, this is only somewhat helpful in the printing industry, because few would photocopy a whole book; however, a publishing house could do it, which would hurt the author's profits. But copyright is more necessary to protect artists that produce digital goods (musicians, renderers, etc). If they had no protection, people would have very little to pay them anything. There's still concerts, but concerts often make little money once all the costs are taken out, and instead serve to promote the band (so that it can sell CDs).

"Digital artists would be screwed" = "There would be far less digital art." You can't pay a recording studio to get your music to CD, if you won't be able to sell those CDs. I know several bands which occasionally make a CD at the local studio; only by selling them do they recoup their costs. Some people would still buy CDs; some people would still create, but the recordings would be poorer; there would be much less of a niche for professional songwriters (many of whom are quite good, despite what the RIAA would have you think).

Software makers would be in similar trouble. Probably more trouble. You can't afford to pay programmers if just anyone can take a copy of what you create. Companies like RedHat can survive by selling services (such as tech support), but many others could not. Gaming companies in particular: they would all have to charge a fee like the MMORPGS do, or something like that.

Software companies and recording studios are paid to produce data. Removing copyright would cause a vast oversupply of precisely this kind of data, driving prices through the floor and ruining the market. Some markets just need this sort of protection. Farming does, as does the labor market (minimum wage). The world would not end if copyright wend away. But several industries, which in my opinion are worthwhile, would be crippled unless some sort of alternative were available.

Mike

---
Heh. No, I'm not the sysadmin. I don't plant landmines anyway. My specialty is in math and cs, which may turn out to be crypto and security protocols, and I think that having . in your path is a bad idea, especially if it's before /bin.

Re:A failure to comunicate

[MarkusQ]

What was the original goal of IP laws? To encourage authors to create and distribute their work, instead of keeping it locked behind closed doors and non-disclosure agreements, not creating it at all. I fail to see how that has been elimentated; musicians and authors still need to eat.

That's the same non-sequitur everyone uses (I probably should have included it in my list). You make two unrelated statements as if they lead to some conclution.

• Do we have such a shortage of creative material that we need to make special laws to encourage people to create more? I see no sign of it. What I see, in fact, is such a surplus that it can support thriving niches whose sole purpose is to stem the tide.
• Everyone needs to eat. So?
• Even if your points were related, would they lead to your conclusion? I don't see why. There is very little evidence that IP laws do anything other than enrich the promoters and gatekeepers that lobby for them in the first place. Joe working artist is much more likely to be forced to pay than to be paid on the basis of IP law. He certainly can't eat IP.

-- MarkusQ

Re:A failure to comunicate

[MarkusQ]

No, I have not shifted my ground.

I beg to differ. In an earlier post you wrote:

Until there is a viable alternative on this side of communism, IP cannot be allowed to die.

And now you write:

But copyright is more necessary to protect artists that produce digital goods (musicians, renderers, etc). If they had no protection, people would have very little to pay them anything.

Which is arguing from the principle of "From each according to his abilities, to each according to his needs." When I buy something, I pay to get what I want at the best price I can; that is capitalism. I don't (in general) buy things because the person who made them needs to be subsidized. If we all followed that logic, either by mass delusion or government fiat, the economy would colapse. (After all, the people who sell penis pills over the internet need to eat just as the farmers and recording artists do! Think of the mimes!)

Copyright is a price paid by society to get something, but contrary to all logic the price keeps rising even though the demand isn't going up and the supply is growing rapidly.

And on one point:

There's still concerts, but concerts often make little money once all the costs are taken out, and instead serve to promote the band (so that it can sell CDs).

This is just incorrect. The reason most bands play concerts is it's the only way they can make any money. The CD sales all accrue to their lables (who are pushing hard the last year or so for a cut of the concerts too, in at least one case arguing on the grounds that it was a public performance of songs to which the lable holds the copyright).

-- MarkusQ

Re:A failure to comunicate

[wirelessbuzzers]

>>But copyright is more necessary to protect artists that produce digital goods (musicians, renderers, etc). If they had no protection, people would have very little to pay them anything.

Which is arguing from the principle of "From each according to his abilities, to each according to his needs." When I buy something, I pay to get what I want at the best price I can; that is capitalism. I don't (in general) buy things because the person who made them needs to be subsidized. If we all followed that logic, either by mass delusion or government fiat, the economy would colapse. (After all, the people who sell penis pills over the internet need to eat just as the farmers and recording artists do! Think of the mimes!)

First, I am not against every form of communism, only some forms of it. Systems in which people can pool their resources for a project which benefits the group are perfectly fine by me. A music tax for the benefit of artists would be taking things too far, and this is what I referred to when I said "on this side of communism."

Price protection is not the same as communism. The goal of government protections is to ensure that a good or service which is beneficial to society can be produced when the market would otherwise not support it, and to ensure that the producers receive a reasonable proportion of the benefit. These are most often for common-goods systems or for over-elastic markets.

In common-goods systems, a single person's contribution of x returns more than x benifit to the society, but less than x to the individual. The equilibrium is therefore zero, which is sub-optimal. I hope that some day, copyright can be replaced by a common-goods system, because such systems tend to be better (in terms of efficiency) than elastic-market systems. Perhaps a system in which users pay a fee to have fast-downloading privelages from a server network would suffice, although with the bandwidth glut, this system could be unstable without some sort of contract.

In elastic-market systems, the market is glutted with suppliers, whose short-term best strategy is to keep supplying even if they are not turning a (sufficient) profit. Price protections are designed to protect those performing an important service (i.e., one which the market values highly), such as labor, so that they get a reasonable percentage of the utility which they bring to the market. If, for instance, the labor market were not protected (by minimum wage), we could easily see the return of de-facto slavery, as was present in the Great Depression. And I maintain that if the "content industries" [cringe] were not protected by some form of copyright, whether from the government or contracts with the consumer, Joe Sixpack with his CD burner and broadband connection would glut the market to the point where neither record labels nor artists could survive.

And don't even try to spring Nozickian logic on me. Nozick's theories overzealously protect fictitious rights, and benefit only those who have far too much power already.

I can't argue with your point on concerts; my information was from an old article in some magazine; I don't have time to recheck it, so I'll cede that point. If it is as you say, something should definitely be done about it, but I doubt that something is total deregulation. Cutting out the middlemen would be a good idea; perhaps this can be done with some sort of common-goods system.

Re:A failure to comunicate

[dvdeug]

Do we have such a shortage of creative material that we need to make special laws to encourage people to create more?

We have the creative material because of the laws. It's like asking if we have such a shortage of power that we need to use anything but wind power.

There is very little evidence that IP laws do anything other than enrich the promoters and gatekeepers that lobby for them in the first place.

Besides the millions of people - actors and other movie people, writers and editors, studio musicians - that make a living off IP.

Joe working artist is much more likely to be forced to pay than to be paid on the basis of IP law.

Joe Working Artist always has the option of not using others works and dumping his work out on Kazaa for free. Harrison Ford, Spielberg, Asimov, Stephen King, J.K. Rowling, Dana Hill, John Williams, Matt Groening and many others have been very happy with the IP law. I'm sure everyone trading the Simpsons via Kazaa would be real happy to hear Fox cancel the Simpsons because the IP laws got repealed and they can't afford it anymore.

Re:A failure to comunicate

[MarkusQ]

1. 
   

   Do we have such a shortage of creative material that we need to make special laws to encourage people to create more?

   We have the creative material because of the laws. It's like asking if we have such a shortage of power that we need to use anything but wind power.

   No, we have the creative material because we have a society rich enough for a large number of people to indulge in the near universal urge to create. To see this, consider that there is a wealth of creativity even in areas not aforded "IP" status; the only difference being that making it IP makes viable the promotion and marketing of the "product."

   I'm not sure where you were going with the wind-power thing.

2. 
   

   There is very little evidence that IP laws do anything other than enrich the promoters and gatekeepers that lobby for them in the first place.

   Besides the millions of people - actors and other movie people, writers and editors, studio musicians - that make a living off IP.

   I never claimed that people weren't making money off of IP--quite the contrary.

3. 
   

   Joe working artist is much more likely to be forced to pay than to be paid on the basis of IP law.

   Joe Working Artist always has the option of not using others works and dumping his work out on Kazaa for free. Harrison Ford, Spielberg, Asimov, Stephen King, J.K. Rowling, Dana Hill, John Williams, Matt Groening and many others have been very happy with the IP law. I'm sure everyone trading the Simpsons via Kazaa would be real happy to hear Fox cancel the Simpsons because the IP laws got repealed and they can't afford it anymore.

   Matt Groening (to choose just one of your examples) is paid by Fox because they make money off of advertizing. By your logic, it should be illegal (or perhaps just immoral) to go to the bathroom during a comercial break.

   Not only is the television business model independent of IP, it works just fine (perhaps even better) the less "IP" is involved--thus the push to news, reality TV, and other show with no writers (for some reason journalists aren't considered writers).

   But the biggest problem with your examples is that they are far from "Joe Working Artist"--all of them are among the small fraction of a percent that have "made it" in the game run by the IP conglomerates; just like the winners promoted by casinos, they are too few to bring up the average. Yes, there are a few thousand people around that could argue from personal experience that lotteries are good investment, but that wouldn't make it true.

I think the lottery example is telling: by your logic one could claim that if we want to have fun and games we need casinos and state lotteries, because without the big prizes they offer, no one would play games. Further, we need brothels because without them no one would have sex. I claim that this is absurd, and that people will tell stories, sing, play games and have sex even if no one makes a dime off of them doing so. Paying megacorps for the right to participate in these fundemental human activities on the mistaken belief that they are somehow causal is just nuts.

-- MarkusQ

Re:A failure to comunicate

[dvdeug]

No, we have the creative material because we have a society rich enough for a large number of people to indulge in the near universal urge to create.

What's going to pay for a $150 million dollar movie, or even the team of animators for the Simpsons? Would we really have five Harry Potter novels if J.K. Rowling had to fight to feed her son? Would Asimov have written 500 books if he had to keep a job at Boston University that considered his science fiction to be inappropriate?

consider that there is a wealth of creativity even in areas not aforded "IP" status;

Give some specific examples, please. Whatever they are, they aren't big, expensive, polished productions.

I'm not sure where you were going with the wind-power thing.

You said

Do we have such a shortage of creative material that we need to make special laws to encourage people to create more?

Arguably the cause of some of that wealth of creative material is the IP laws. It's like arguing we don't need fossil fuels because we have a wealth of power; it's ignoring the source. It's at least begging the question of the debate.

Matt Groening (to choose just one of your examples) is paid by Fox because they make money off of advertizing.

Yes, because they are the only ones showing Simpsons. If everyone were, they wouldn't get paid.

By your logic, it should be illegal (or perhaps just immoral) to go to the bathroom during a comercial break.

There's always a line between your rights and theirs. You have the right to enjoy the smell of a coffee shop for free, but you don't have the right to go in and take coffee. Putting Simpsons episodes on the net is closer to the second, while going to the bathroom is closer to the first.

But the biggest problem with your examples is that they are far from "Joe Working Artist"

Dana Hill was in that list. If you look her up on IMDB (Dana Hill (I)), she's one of many actors who few have ever really heard of, but who supported herself all her life through various minor movies and TV. Steve Jackson (owner of Steve Jackson Games, and author of GURPS) could have been, as could many of the people who work for him. They, too, get by. There's a lot of people who make their life by IP.

I don't care about "Joe Working Artist". I care about getting good material. I've checked out free roleplaying material on the net. Only one or two compare to what $25 will usually buy you from several good game companies. If killing IP means that those companies go out of business, no amount of unedited sludge is going to make it up.

I also don't understand how you help "Joe Working Artist". Fine, he can make all the Star Trek fan fics he wants, but he can never get the fame from getting one published. And if he was writing original material, then he had no legal restrictions and all he's lost is any chance to get some money for what he does; instead of trying to become an author, he has to realize that he'll be guarding open holes the rest of his life.

we need brothels because without them no one would have sex.

If you want to get a hundred soliders in, get them laid, and get them out, you need a brothel. Likewise, you can tell stories for free, but if you want to watch people fight a ten story monster or cross space to meet aliens - which people obviously do, or they wouldn't spend the millions of they spend on it - you're going to need some system where they get paid, and it should probably be proportional to how many people are watching. IP is a working capitalistic way to do that.

Re:A failure to comunicate

[MarkusQ]

1. You keep saying that you are interested in a "capitalistic" solution, yet your entire argument seems to be based on the communist principle of "from each according to his abilities, to each according to his needs." You even seem willing to go down the path that all communists eventually follow, arguing that the government should make stricter and stricter laws and (if needed, back them up with force) to make sure that your system "works."

2. You are assuming what you are trying to prove.

   You claim we need IP laws because... You claim without them people would stop creating because... You claim the only reason people create is to make money and... You claim that people can't make money without IP laws, which I am supposed to accept because... You claim we need IP laws.

I dispute 2 & 3; I hold that the urge to create is a fundemental part of what it means to be human, as is the urge to copy/immitate others.

I dispute 4 because people (such as game designers, cooks, fashion designers, etc.) make money off of goods (games, food, clothing) which are not covered by IP (excluding trademarks, as I did earlier).

I have worked in the game industry for over twenty years, and in all that time I have never seen IP laws successfully used to defend a company like SJG, but have seen several cases where they were successfully used to attack one.

[ As an aside, I was one of the people who wrote a letter in support of Steve when he was raided by the FBI years ago. ]

As for IP laws being the cause (rather than a consequence) of the wealth of creative output, consider. In a state of nature, man copies what he sees others doing. It is a basic part of our nature. In a creatively impoverished environment, there is the risk that there may not be enough templates to copy, because only a few people are innovating in any given area, and they may elect to hide their discoveries. So society offers a bargin: they will prevent the natual copying for a limited period of time, in exchange for the disclosure of new discoveries / inventions. This is the basis of all IP except trademarks.

As society grows larger, richer, and more diverse, the supply of templates rises rapidly. If all parties adhered to this "fair trade" and the growth arose from the IP laws (as you suggest), we should expect the price (length of IP terms, etc.) to drop as the supply increased and the demand remained relatively constant.

If, as I maintain, causality goes the other way and the natural growth of society's creative output (which has made IP increasingly lucrative is) instead driving IP laws, we should expect the price to rise--and this is in fact what we see.

-- MarkusQ

Re:A failure to comunicate

[dvdeug]

You keep saying that you are interested in a "capitalistic" solution, yet your entire argument seems to be based on the communist principle of "from each according to his abilities, to each according to his needs."

You yourself claim that these people will create no matter what. I'm arguing that good ones - as defined by the market - should have the economic freedom to do so without worrying about where their next meal is coming from.

arguing that the government should make stricter and stricter laws

I never claimed that.

You claim the only reason people create is to make money and...

No. But money gives people the ability to create instead of working at McDonalds. It also permits the mere existence of some art forms. Film: for a movie like Ben-Hur, there is no concievable way to get that many people to be filmed, that many sets to be created, and that much film all put together with some sort of creative continuity, without millions of dollars.

people (such as game designers, cooks, fashion designers, etc.) make money off of goods (games, food, clothing) which are not covered by IP

Clothing is covered by design patents; recipies and games are covered by copyright. (The abstract rules of a game are not, but the written rules and board and sometimes the pieces are.)

This is besides the point - writers and musicians don't make money off goods that aren't covered by IP, which are trivial to copy. To remove IP would be to practically remove those professions.

I have never seen IP laws successfully used to defend a company like SJG, but have seen several cases where they were successfully used to attack one.

I guess you missed the part where they stop White Wolf from using their eye in the pyramid logo.

Also, what happens if copyright gets elimenated? Every book Steve Jackson ever published gets put on www.gurpsbooks.com. People don't buy new GURPS books, instead settling for the PDF or something printed out at the game shop. Steve Jackson and crew take day jobs and stop devoting 10 hours a day to new GURPS books.

there is the risk that there may not be enough templates to copy,

Templates are cheap; Asimov always laughed at the people who called him up with ideas for him to write, expecting him to split the profits. The adaptation and creation are hard.

Re:A failure to comunicate

[MarkusQ]

Damn.

We fell for the @#!% "IP" myth. There are at least four different things that get lumped into "IP" and we may be talking at cross puroses here. To clarify (I think):

• Trademarks. The main purpose here is to prevent something akin to identity theft. I don't think either of us object to trademarks, within reason. (IIRC, this was the issue with WW & the illuminati mark, as well as several other cases).
• Copyright. If we disagree at all, I think it's here. I object to the seemingly unlimited extention of copyright in durration, scope, and interpretation. But not as much as I object to...
• Patents, which are totally out of control, and have to a large measure outlived their usefulness. Here is where I think my case is the clearest: why should society grant (and pay to enforce) monopolies that would not otherwise exist and serve no useful purpose?
• "Pure IP"; things like the ideas people used to hawk to Asimov. I think we both agree that there is no need or purpose for protection, even though it is increasingly being granted.

So restricting the topic to copyrights only, I think we differ on:

• I feel that the average creative person gains almost no protection from copyrights, if only because the cost of volating them is so much lower than the cost of finding, proving, and stopping violations. This has been true for serveral decades at least.
• I therefore do not think that copyrights have any effect on the income of the average creative person, which is generally lower than it would be if they gave up and got a real job.
• I stongly dispute the notion that copyright somehow causes creativity. That's just ballony. I know too many people who write for the love of writing, sing for the love of song, code for the rush of...well, ok, they're nuts, but the argument holds in general: these people (at least, the ones who are any good at all) are doing what they do out of love. Not only do you not have to pay them to continue, in many cases you couldn't pay them to stop.
• I do think that copyrights are of major benifit to people who systematically prey on creative people. (See Spider Robinson's rant on the publishing industry, or the Artist-formerly-known-as-the-artist-formerly-known -as-Prince's writings for an insider's perpective on how fair things really are.) The promoters are the people who are outraged by the notion of file sharing.
• I also strongly suspect that the whole issue of copyrights is a red herring. The record companies, for example, are not nearly as worried about people "sharing" material to which they hold copyright as they are about the creation of a distribution channel for material in which they have absolutely no involvement. The real threat isn't that (for example) small-time web-radio stations will play the latest hits (which, remember, they presently pay (not charge, pay) regular radio stations to play) but that they will play indie artists who can thus develop a following and do an end run arround the whole industry. From this persepective, all of their actions make much more sense; they aren't stupid, just very, very scared.

-- MarkusQ

P.S. This will have to be my last post on the thread--I'm about to *gasp* leave my internet connection for the weekend. Thanks for an enjoyable back-and-forth.

What are MD5 Hashes?

[ZipR]

What exactly are those, anyway? The linked article doesn't explaing them.

Re:What are MD5 Hashes?

[ZipR]

It does spell things better than I do, though.

It's possible

[Zog The Undeniable]

There are many different MP3 encoders, and they produce slightly different results. In addition, some shared MP3s are also imperfect in that they contain clicks and "dropouts", although this is becoming less common now that PC power has increased - my understanding is that using the PC for other activities while encoding can occasionally cause errors .

The ripping stage can also produce slightly different checksums, depending on the condition of the CD - Audiograbber actually reports "potential speed errors". Unlike data CDs, some level of read error is considered acceptable on music CDs; you don't want the player to keep re-trying a bad sector if it detects a big problem - it would ruin your listening pleasure!

Re:It's possible

[don.g]

my understanding is that using the PC for other activities while encoding can occasionally cause errors

If by encoding you include the process of reading the audio data off the CD, then yes, it could. But the process of compressing audio data with a given audio encoder with fixed settings should be deterministic (if it isn't, there's something very wrong with it).

Those poor lil Country Music singers

[CoryS0L0]

The same story is posted on CNN.com. Accompanying this article is one by Marci A. Hamilton, a chairman at Benjamin N. Cardozo School of Law, Yeshiva University. She states that going after students who illegally download media is not only OK, but is RIGHT. I wouldn't have a problem with this were it not for the reasons she supports it with. She says that a world without copyright laws would cater only to the rich and the government. When was the last time you heard of a government worker writing a song on the top 10 list? When was the last time a millionaire, (not a musician) created a song that made it to the hall of fame? My point is, without free music/media, many of the people who come up with the latest and greatest entertainment would never see any of the media that's out there. Marci claims to be looking out for the poor country music singers in her article. If they're as poor as she says, how are they ever going to be able to afford a CD at $15 a piece???

Musicians and music labels alike need to come to grips with the fact that their moneymaker, (CD sales) will need to take a back seat to actual performances by the artist. We need to take it back to the old days when music artists actually sang and performed and didn't just sit in a dark room behind some curtain tooling away on their synthesizer.

http://www.cnn.com/2003/LAW/08/07/findlaw.analysis .hamilton.music/index.html

Re:Those poor lil Country Music singers

[turnstyle]

"She states that going after students who illegally download media is not only OK, but is RIGHT. I wouldn't have a problem with this were it not for the reasons she supports it with."

So then it seems that at least you agree that "going after students who illegally download media is not only OK, but is RIGHT" and just take issue with her supporting logic?

Of course protecting copyright is good -- don't forget that the exact same copyright law protects GPL code too.

"Musicians and music labels alike need to come to grips with the fact that their moneymaker, (CD sales) will need to take a back seat to actual performances by the artist. We need to take it back to the old days when music artists actually sang and performed and didn't just sit in a dark room behind some curtain tooling away on their synthesizer."

Spoken like a man that never lugged a Fender Twin Reverb up a flight of stairs. Would you similarly say that a book author should be deprived book sales, and instead be forced to make a living from live readings?

Re:Those poor lil Country Music singers

[CoryS0L0]

I think that the GPL is only in place because of the copyright laws and therefore wouldn't need protection if those laws were more leenient or non existant. The GPL tries to do exactly what I mentioned in the previous post. It gets the code and the software out there to those who could not afford the commercial substitute or want to make their own modificatons on it. This is where new ideas come from and where old ideas get augmented and improved upon.


Do I think that the prosecution of students, (or anyone for that matter) is justified? In some ways, yes I do. But people also have to remember that in most cases people download media as a precusor to actually seeing the movie or going to a live performance/buying the CD. Hopefully without retribution from the RIAA, I can say that I've downloaded music from an artist that I was previously not aware of. After I heard their music I spoke about them to friends and went to concerts... It's the best advertising anyone could ever ask for. Most importantly, it's free.

Re:Those poor lil Country Music singers

[turnstyle]

"I think that the GPL is only in place because of the copyright laws and therefore wouldn't need protection if those laws were more leenient or non existant. The GPL tries to do exactly what I mentioned in the previous post. It gets the code and the software out there to those who could not afford the commercial substitute or want to make their own modificatons on it. This is where new ideas come from and where old ideas get augmented and improved upon."

And importantly, they have chosen to publish their work under the GPL. If the decisions of those who decide otherwise were simply disregarded, then the GPL itself would be rendered somewhat meaningless.

In a world in which some code is GPL and some is not, it is copyright that protects the respective decisions of both sets of authors. And that same logic applies to musicians.

"Do I think that the prosecution of students, (or anyone for that matter) is justified? In some ways, yes I do. But people also have to remember that in most cases people download media as a precusor to actually seeing the movie or going to a live performance/buying the CD."

I'm certainly willing to believe that you bought a CD by a musician that you first found via P2P, however I'm not in the least inclined to buy the argument that free downloads drives increased sales.

Just look inside anybody's MP3 music collection. There are tons of 'keeper' files in there that they'll never buy the corresponding CD for.

Again, if a musician beleives in the advertizing benefit of having his/her work shared over P2P, that should be his/her decision to make.

Re:Those poor lil Country Music singers

[thick-n-chunky]

In a culture without copyright, only the rich, or the government-sponsored, could be this culture's full-time creators. Poor artists such as Loretta Lynn would have to flip burgers long into their music careers -- and might even give up on music entirely.

For these reasons, imagining a world without copyright wouldn't just impoverish the musicians. It would also impoverish the museum, the culture and music itself.

Yah, who wants to listen to crap from government-sponsored hacks like Mozart and Haydn and Bach? It's amazing we even had the word "culture" before AOL/TimeWarner came along!

People like you are freeloading...

[heironymouscoward]

Interesting, since I don't actually download much myself. I have a large and rich CD collection I bought in the late 1990s, all encoded on my computers, and this is enough for me.

Nor do I download movies, since I find the cinema to be great fun.

So you may want to read my comment, not attack me for something I've not done.

Perhaps you have no culture. But I doubt that. You most certainly do, and ask yourself how you got it. Was it bought? Was it given? Was it stolen? Most likely you found it, like the air you breath, to be all around you, free and taken for granted.

Artists create, but their creations are 99% built on existing work. How can I state this?

Because since 1992 I've written free software. I've always felt the distribution of my work to be part of a distribution of culture, and it has never felt like robbery when someone took something I made, for no cost, and used it. Perhaps I'm just stupid. But I make a very good living doing other things.

You should stop insulting people (although "hippie" is a strange and contorted insult, the only hippies I know are my parents' generation, all in their 60's now), and you should think for a few minutes.

Music Hashing with musicbrainz

[ramk13]

With all this hash talk going on, I thought I'd mention that Musicbrainz uses some sort of similarity hash in identifying songs. It compares the hashes of the files you have to an existing user submitted database. If the match is good, then you can use the database tag info, which is pretty handy.

I've compared albums I've ripped myself to the database and gotten "100%" matches (along with some matches of a much lower percentage) That leads me to think that if the RIAA kept its own database like that, they could do a whole lot of comparison with similarity or quasi-unique (ala MD5) hashes. I'd also venture that, with enough work at the comparison system, they could make court-valid assertions. They can hire plenty of geeks to handle the statistics necessary to call something 'beyond a reasonable doubt.' (for criminal proof)

Brute force?

[yerricde]

adjust its length until its checksum matches that of "Oops, I did it again".

The people brute-forcing RC5 haven't even solved a 72-bit key yet; how do you expect anybody to solve a 128-bit MD5 hash?

Re:Brute force?

[Anonymous Coward]

because MD5 has certain weaknesses which can be cracked ?

Re:Brute force?

[Anonymous Coward]

cipher != hash.
from the rsa challenge page:
For each contest, the unknown plaintext message is preceded by three known blocks of text that contain the 24-character phrase "The unknown message is: "

so you are looking for a 9byte key that produces these first 24 bytes and then something in english (really ? they never stated that on the page ;) that makes sense.

in the case of a md5 hash you know the 16 byte key and need to match the data ie turn it around so the data becomes the 'key' to match the hash.

as md5 was made for speed and rc5 for security you cant really compare the two, lets just say that there are lots of windows nt password crackers out there that brute force md4 hashes.

Re:Brute force?

[Anonymous Coward]

It has certain properties that theoretically weaken it, but last I heard, no one had actually managed to crack it yet. If you're not a professional cryptanalyst, you're not likely to be the one to pull it off.

Just Like DNA...

[fupeg]

Since DNA "mis"-matches are theoretically possible, they should not hold up in court either, right? The odds of a DNA match being wrong might even be better than the odds of a MD5 checksum match being wrong.

settlement

[matticus]

From the article-
"U.S. copyright laws allow for damages of $750 to $150,000 for each song offered illegally on a person's computer, but the RIAA has said it would be open to settlement proposals from defendants."

Let's correct that. What the RIAA really meant to say was:

"U.S. copyright laws allow for damages of $750 to $150,000 for each song offered illegally on a person's computer, but the RIAA has said it would be open laughing wickedly at settlement proposals from defendants."

ooh.

Pop elimination and noise reduction?

[yerricde]

Of course there's also post processing, pop elimination, noise reduction, normalizing, etc will all modify the resulting hash.

"Pop elimination" eh? Does that delete all your Britney Spears and *NSUCK MP3s? Would "noise reduction" get rid of bad techno?

Is't it criminal of them if they tranfer mp3?

[Anonymous Coward]

How can they get the MD5 Sum? I mean they have to transfer the mp3 first right? what if this MP3 they just transfered is copyrighted, would't that be a infrigement?
I know they probably imune to infrigement on stuff copyrighted in USA, but what about some MP3 from a other country?
Is't it time to sue RIAA for copyright infrigement? Who is volunteer to set the trap?

Re:Is't it criminal of them if they tranfer mp3?

[interstellar_donkey]

Typically the RIAA has international agreements with most major record lables.

What you might be able to do, if you were an artist, is provide your own copywrited work, make sure that you put somewhere in the description that "This file is only for use for backup of an owned CD. The artist is not associated with the RIAA". If the RIAA downloads it, you then might be able to sue them for the insane amount of money they themselves value copywrite infringement at.

Of course, you'd have to have a lot of up frount money to get a lawyer to do it right.

Factorials

[fupeg]

What is this? I wake up to see factorials on slashdot. Bless my cold, mathematical heart.

Line in, line out.

[yerricde]

The only way I can listen to it via mp3 is to, yup, download an 'illegal' mp3!

Or do what I do: reproduce it over analog. The noise added by .ogg encoding overwhelms the ADC noise floor. The RIAA will never succeed in copy-protecting audio.

RIAA's going to absolutely hate me.

[crovira]

My mother's dying. I'm dealing with it, thanks.

She's got a truly impresive collection of primo vinyl (we're talking hard-to-find old jazz, blues, opera and lots, lots more,) and an old stereo system I'd put together for her back in nineteen-.

I don't need/want a multi-tentacled audio monster that can rattle the windows to my condo so its going to go into the land-fill soon after mother does the same.

I'm going to buy a Firewire A2DConverter I've already got software for my Linux box and I'm going to rip the whole collection to Ogg or AAC and put it on a 160 gigger (hope its big enough,) dedicated to serving ME MY tunes (I'll still have ALL the sources,) to MY boxen ANYWHERE in the world I can get a fast enough connection.

If the RIAA has a problem with that, they can KMMFA.

Non-ID3 Tags?

[GoodNicsTken]

I use MP3 tag tools to work on my ID3 tags of every song I own. (about 11,000) There's an option for remove all non-id3 tags that I apply to every file, and sometimes it removes some bytes. Anyone know what this is?

Re:Or Perhaps... you should try this

[Anonymous Coward]

Maybe you should try out this ripper. It works perfectly and also managed to rip all my copy-protec^H^H^H^H^H^H^H^H^H^Hbroken CDs...

Think it through

[AdEbh]

Now may be the time to update your illegal mp3 file MD5 hash sums

Is it just me or does this make no sense at all?

- Alex

Giving someone what they already have, is illegal.

[Sloppy]

It is generally believed amongst file traders that it is legal to download an mp3 for a song, when you own the CD. In other words, you don't need to rip and encode songs from your own CD. However, this may not be true (I am not a lawyer).

There was a high-profile precedent for just this sort of thing: RIAA vs mp3.com. Mp3.com's my.mp3.com service would challenge a client to rip a random portion from a CD to prove that the client had physical ownership of the CD, and if this test passed, it would make MP3 files of the songs on that CD, available to the client.

RIAA sued 'em, and it went to court.

Mp3.com lost. Sending the MP3 files to someone they knew already had the CD, was ruled to be copyright infringement.

What nobody seemed to notice.

[Awptimus Prime]

The MD5 thing isn't for tracking the same song ripped by different people. The thread on this, so far, has left me scratching my head as to why folks feel the need to restate that encoding an mp3 with different settings/software will result in a different md5. Right, this is slashdot and we all know this already.

The reason for md5 matching is so they can nail someone as the 'origin' of the ripped song, then hold them liable for all the copies of a matching md5 on P2P networks. It would be more a demonstration of "look how much damage one copy did to us!".

Re:What nobody seemed to notice.

[in7ane]

And they will know that this person is the origin how exactly? Oh, maybe the file created/modification dates are the other great technical advancement by the RIAA (c'mon that would hardly stand in court).

All hashes tell them is that N numbers of the song out there (almost certainly) originated from the same source, and you are possession of one of them. Then again 'number of sources' in Kazaa, Gnutella, eDonkey, etc. already tells me this...

Re:What nobody seemed to notice.

[|/|/|||]

But then the issue becomes the fact that the same song can be ripped by multiple people and produce the *same* md5 - assuming they use the same encoding algorithm and parameters.

Slightly OT, but I was just wondering, has anybody ever suggested having a "click yes if you have the rights to this material" notice before downloading on P2P software, as a way for those sharing content to cover their butts? I doubt if it would hold up very well legally, but it seems to be the strategy of many dubious mp3 and rom hosting web sites.

The argument then becomes, "Yes, I was sharing that song - but only for those people who already own the CD. If somebody made an illegal copy, then it's not my fault. They should have known better."

Re:What nobody seemed to notice.

[ZackSchil]

RaptorX better run for his life then. Every single person I've met with an illegal copy of "All the Things She Said" by Tatu has his copy. You know the one, it has the AIM door shutting sound at about 2:30. The RIAA finally comes up with a way to battle P2P that isn't asinine. Must be damn cold in hell.

Re:What nobody seemed to notice.

[jafac]

Hell, for that matter, someone could encode the protocol in the P2P software to flip a few insignificant bits at random upon download, so every downloaded copy will be unique, as far as MD5 is concerned.

Re:What nobody seemed to notice.

[senzan]

Excuse me if this has already been covered but if all the rips have different MD5 hashes then all are from unique users who have the disc. So is it possible to modify each mp3 to have a unique md5 hash or as unique as possibe. Thus negating the argument and problem of all copies from one user. Just a thought.

Re:What nobody seemed to notice.

[Awptimus Prime]

That's a pointless question as it doesn't relate, at all, to my point. I didn't say anything about it being a single step process to tracking down the origins.

What I did say was how it can be used for data collecting. Something that never hurts in the even that you happen upon some other evidence that puts all the bits and pieces together.

Re:What nobody seemed to notice.

[Awptimus Prime]

It's possible, but not incredibly likely. From my understanding of most CD drives, when you rip audio, it's entering the PC as analog audio, then converted to digital. I see this generating non-identical copies, especially when you work in the tiny differences of timing in cd players, CPU speeds, etc. Put all these factors together and you are likely going to get a new MD5 due to slight differences in the way it was encoded.

Re:What nobody seemed to notice.

[Awptimus Prime]

Then you couldn't leech 1 song off 15 different machines at once. These P2P programs use the MD5 to locate and send a file's parts to you after finding the appropriate matches during the search phase.

Re:What nobody seemed to notice.

[Awptimus Prime]

I've had a few of those rips before.

In my last car, I spent about $4500 on a nice audio system. It was one of the first new beetles to hit the south-east, so I fixed it up a bit to make it more of an attention grabber.

I'd put some fresh mp3's on CD, then hop in and drive to work. I'd be in the middle of a good head banging session, then comes a 'BONK DING, KASLAM' or that infamous 'UH OHHH' from WS_FTP at 93db.

On the expensive stereo thing; no, I don't listen to boom boom stuff. Usually, the windows are up and some Westley Willis (RIP buddy, thanks for the headbutts) or Black Sabbath is playing. Just had to extinguish thoughts of a stereo-typical ricer before they get started.. :)

mp3 fairy is real

[Anonymous Coward]

> It is also possible that, as someone else suggested, the magical
> mp3 fairy left those files behind on her hard drive.

Your honor, I bought that hard drive second hand on ebay. I think I made a good purchase. I expected just a drive, but received all that wonderful music!

Maybe you need to figure out what an MD5 is first

[3terrabyte]

So how are you enjoying your 100 free hours of AOL

pardon me?

[Anonymous Coward]

you are absolutely right. but your issue is not the point.

the point is, that the file will be the same bit by bit when using the same mp3 encoder and id3 tag filling scheme. and that is not unlikely.
not even the ripper has to be the same since the wave data should come 1:1 from disc.
now imagine a thousand people using musicmatch or some other common mp3 encoder. now imagine 10% of them have the same mp3 encoder / id3 settings (probably default) and -bang- they'll have the very same mp3 file produced with all the same md5 sum.

Could I have Some More Cliches Please?

[fupeg]

Exchanging music is not about piracy, it is about exchanging culture

In particular I like trading Britney Spear's "culture." It really enhances my life.

Today culture moves at the speed of light

Isn't this a line from that WorldCom commercial from a few years ago, the one with all the dudes in the office riding around on scooters?

It cannot succeed except by destroying the Internet.

The Wachowski brothers just called to inform you they are suing you for stealing the plot to their next movie.

Seeking all means to do this faster than ever - and ignoring the barriers, such as "ownership", that stand in the way - is the prerrogative of today's world.

Yeah ignore those barriers, they are soooo 1990's.

We simply can't put the genie back into the bottle

Oops, I guess you've been sharing Christina Aguilera culture...

useless vestiges of a material-obsessed past.

Yeah capitalism is so over-rated. Who needs private property? Um, in Soviet Russia the culture flowed freely?

Re:Could I have Some More Cliches Please?

[heironymouscoward]

Actually it's a cliche to assume that in Soviet Russia there was no private property. There was, it just belonged to a very small group of people.

Culture is not property, luckily. You cannot own an idea, and you cannot create an idea except by drawing on the millions of ideas passed to you.

Whatever. Make fun of my writing, it does not matter, the simple fact is that even Britney Spears represents culture, and that the ever-faster exchange of culture and ideas is not exclusive with capitalism at all, only with one particular model of capitalism. You may be surprised to discover that it's not the only one, and even more surprised to discover that the alternative is not Soviet Russia.

It is really _so_ 1950's to claim that such-and-such is communism. File-sharing is communism? Kazaa users are heralding the new Soviet Russia? Are you totally and completely insane, or just trolling? It's hard to tell.

Re:Could I have Some More Cliches Please?

[danila]

Here is some insight from the Soviet Russia (not longer soviet, though) and from a staunch supporter of communism (although not a member of any communist party). :)

First, in Soviet Russia there was a lot of private property. What was absent was private property on means of production. You could own a sewing machine, but you couldn't own a hundred of them and hire others to sew for you.

The factories and plants didn't belong to the nomenclatura either. They had some limited control over it and were well-compensated for their work (likewise Clinton was compensated for being a president, but he still went bankrupt after paying a few lawyers), but they weren't capitalists to any large extent.

And now back to KaZaA. :) It is in fact heralding the coming transition to communism, howether unlikely it may sound to you and the rest of Americans. There are other signs as well. MIT initiative, BBC initiative, abundant cheap diamonds, printers for 3d plastic objects and for integrated circuits, free software, etc. Communism will come quite soon, brought upon you by nanotechnology and AI, but don't be afraid. :) I personally think that it will provide the human societies much a few so badly needed decades of peace, abundance and prosperity, to foster coltural and moral growth and to prepare for the transition to posthumanity after some time.

Much more dangerous is anti-comminism in the form of corporate-backed totalitarian oppression and imperialism (which was rightly called the most advanced form of capitalism even before America became the aggressive superpower it is now).

Re:Could I have Some More Cliches Please?

[heironymouscoward]

... and I for one welcome our new posthuman overlords. :)

Even if they do have six legs.

Different format.

[fuqqer]

I have decided to move to the not so popular .ogg format. Will this throw off the RIAA? I'm curious just how tech savvy these chumps are.

First, if the files are different in any way at all, wouldn't it give a completely different hash? Let alone a different format. What about encoding at a different bit rate?

Second, does the RIAA know about the ogg format? If everyone moves over, how long will it take before they notice?

Third, wouldn't it be better to use an audio fingerprinting scheme like musicbrainz uses to tag your files? It's similar to hashing but uses the actual audio qualities in the file.

Seems the RIAA is not only about 20 years behind in their business model, but they are about 20 years behind in technology.

My issue with the RIAA is, why can't they just say to the courts "This guy is downloading music confiscate his computer." There are no watchdog groups to make sure these guys are actually verifying that someone has the copyrighted information.

Can you imagine the bandwith costs the RIAA have just to download the number of files they do. Just so they can check the hashes on each file? Verifying the legality of files must be extraordinarily costly. Wouldn't it be great to start flooding their network with their own fake files just to WASTE (link pun intended) the RIAA's bandwith and time downloading the junk they disseminate?

Sorry, the sig field is temporarily out of order, you will have to read whatever I write here.

Mass Re-Tag

[Anonymous Coward]

There are a number of tagging-utilities out there. Helium2 does a good job. Open up all mp3 files into program of choice, mass re-tag all the comment fields with this comment:

"Ripped by from the cd I bought at the store for $18.99"

Click the re-tag button. New MD5 hashes...

Ownership is not so simple

[ConfusedVorlon]

If you wrote something, be it music or software or whatever, and sold it for retail, and then found out it's been traded all over the Internet, would you be excited with glee at the "exchange of culture," or realize that the way you make your living is being cheated from you because there are people out there who are so used to the convenience of downloading whatever they please that they have justified it to themselves to get rid of their guilt?

You wouldn't object (or at least have any leagal right to object) if I published a portrait that i took of you around the world. Nor if I published a home video that featured you walking in a town (where I just happened to observe you).

Some artists consider the way they walk through a town to be important conceptual art. As society, we do not see fit to allow them to control the distribution of a record of their movement.

Similarly - we do not see fit to consider allowing people to control the distribution of their images (newspapers would struggle with crowd scenes)

With music - the question of how much control the artist should have is not trivial. Should they be allowed to control access to their private concerts? Should they be allowed to control who listens to them if they sing in the street? Should they be allowed to control the distribution of a recording of either of those?

As a society - we grant control to artists because we want to encourage them financially. There is an inherent tradeoff though - the control we grant them limits the access of the society.

One could argue that it would be good for society if we allowed free distribution of any recording and therefore 'forced' musicians to make their money by playing live / selling autographed CDs / being sponsored by Pepsi. This would probably mean fewer mega-rich superbands and more public performance. Probably less investment by large corporations - perhaps more investment by bands that felt they had a chance to get a piece of the pie.

Certainly cultures have existed where there was no protection of artistic creations such as songs. Rich oral traditions have evolved. Singers have gained kudos - but probably not become mega-rich!

I'm not advocating a position here - just trying to argue that the issue is less clear then it appears from within our current system!

Re:Ownership is not so simple

[heironymouscoward]

Interestingly, in cultures with pure oral traditions, singers and musicians (the good ones) are highly respected and can be incredibly wealthy. A musician's place in a culture based on oral transmission is one of record keeper, propagandist, salesman, flatterer, geneologist, and much more.
People always appreciate and reward those who contribute to the quality of their lives.
The problem is when a middleman decides to cash-in on that chain and take a large % for himself.
It does not work, never did, except when the means are tightly controlled by law and circumstance.
Those means are failing now, and it's not surprising to see the reaction of the music "industry" as one of fury (judging by the sponsored comments here today).
But again, pity is the only appropriate sentiment. Dead man walking...

Okay, once again

[Anonymous Coward]

Step 1: It doesn't matter who/what/when/where/why or how you get these checksums.
What matters is that you:

A: Have them
B: Know what files they came from
C: Know the correct filesize

Step 2: Then you create files (a bunch of zeroes if you like)
with the right size, the right name, and the right checksum.

Step 3: Share your ".mp3" files

Step 4: Profit???

I think a good idea for this type of honeypot would be to invert the function of PeerGuardian. In other words, whitelist IPs from the RIAA, large companies, Senators etc. And it'd also be smart to set yourself up as a supernode.

Who cares about MD5?

[wurp]

I don't understand why those ding-dongs used MD5. The value of MD5 is that it's hard to make a file with the same MD5 hash but different contents. If all you want to do is identify the file, CRC is much faster and just as good.

The obvious way for P2P users to circumvent this is to use a tool to modify at least one bit on all of their mp3 files randomly (thus changing the hash), so the RIAA can't see what they're trading. It's much more valuable to appear not to be doing something illegal than it is to flood their sniffers by always appearing to be doing something illegal. Not to mention, it's conceivable that it would be considered a violation of the DMCA to circumvent their detection system by reproducing the hashes they're looking for.

No matter what hash the RIAA uses, changing bits in the file will almost certainly change the hash. They need real watermarks to do what they want, and they will be too expensive to calculate on a broad basis until computers get much faster.

New feature for file sharing software

[Anonymous Coward]

I see new versions of Kazaa, Limewire, Morpheus, etc. automatically placing a few random bits at the end of every MP3 that is traded.

If you make sure every time a file is traded its hash changes, you have effectively foiled the attack.

But did your insurance pay for your loss?

[coinreturn]

If your insurance policy reimbursed you for this loss, then it most certainly is NOT fair use - even if you disagree with the depreciation amount (didn't you carry replacement coverage?).

Re:But did your insurance pay for your loss?

[Khlatu_Barada_Nicto]

No, it IS. Fair-use is determined by the purchase of an "original copy", not the current status of that copy. It would be better to be able to produce a receipt or burnt up jewel case with half the identifiable liner notes, simply for proof.

If I buy a CD, I am allowed to make copies, for personal use, of the material on the CD, regardless of the source of the copy, simply because it is identical - meaning, you and I both buy Bruce Springsteen's Born in the USA CD. I am allowed to make a tape of YOUR copy of the CD by virtue of the fact that I own a copy of it. Now, that right doesn't go away just because MY copy burned up.

Rights are rights, their validity is not determined by the degree of reaction with oxygen of physical objects.

Actually it's a litte more ambiguous

[TheConfusedOne]

Most of the copyright restrictions talk about commercial copying/distribution. Under the Fair Use extensions of the Audio Home Recording Act it is actually legal to give a copy of a CD that you own to a friend. It is also legal to create compilation tapes for these people. The first line that you can't cross is charging for it. The second line is the one that was never really defined - who qualifies as a "friend".

Now Fair Use is actually a set of affirmative defenses rather than absolute rights so they would have to be adjudged, but so far things like course books (copying sections of other text books and creating a compilation) have cleared that hurdle. Additionally, in those cases the copying company was able to charge for the expenses related to making the copies.

Re:Actually it's a litte more ambiguous

[3terrabyte]

Most of the copyright restrictions talk about commercial copying/distribution

Actually, only criminally.
These civil suits that the RIAA is pushing are civil suits, and I'm sure you'd agree that none of the kazaa users were doing this commerically. Unfortunately, the fines and penalties are nothing to sneeze at. "settling" for $12,000 + lawyer costs are the cheapest I've seen these victims get away with. Devastating if you ask me, for something that is clearly non-commercial. The guy who leaked "The Hulk" 2 weeks early got 33 months in federal prison, huge fine, and a felony on his record. Non-commercial again.

Under the Fair Use extensions of the Audio Home Recording Act it is actually legal to give a copy of a CD that you own to a friend

Analog only. Fair use doesn't cover digital as far as I can tell.

The first line that you can't cross is charging for it.

I clung to that for a while. Unfortunately that's not true anymore due to the crappy NET ACT law. This redefines what "for profit" is. Getting a copyrighted material in return is now considered "for profit". This means that trading is illegal. (I know leaching off Kazaa isn't trading, but that's another story)

copying sections of other text books and creating a compilation) have cleared that hurdle.

For copyrighted songs, isn't it 5 seconds? Maybe 30 seconds. But it's moot, because people are trading/downloading/distrib. full songs.

Re:Actually it's a litte more ambiguous

[lynx_user_abroad]

...give a copy of a CD that you own to a friend.

I can see our lawyers are going to have a field day with this one. ;-)

As I understand it, you can't make a digital copy of a CD for a friend, but you can make an analog copy for your friend. So you can copy the music off a CD onto casette tape, but you are treading dangerously to just burn a CD-R copy of a commercial CD you own.

This is where it gets fun. If you use an analog interface between the CD reader and the CD writer (pull the copyrighted material through the "analog hole") you're probably safe, although you lose a lot of the quality (which is the point of allowing analog copies). Similarly, if you make a "compilation CD" of WAV files you're living dangerously, but the same "compilation CD" with the songs in MP3 or ogg format is okay (maybe) because MP3's are analogs of the original.

Of course, if you own an MP3 of a copyrighted song, and you make a digital copy of that MP3 (the MD5 hash is the same) to give away, you're acting illegally.

Step right up! Place your bets!

[jabber01]

So, how long will it take for a utility (WinAmp plug-in) to emerge, that adds or removes a sub-second long moment of silence to/from the beginning/end of every mp3 given to it as a parameter?

RIAA: "Only hackers."
Trinity: "Hash *this*!"

Nowhere in that article do they mention MD5

[JPelzer]

I believe what they are referring to is a system that takes a sample of a song (let's say 30 seconds) and generates a 'hash' based on that... The thing about this system is that it is a loose hash, meaning that changing one bit does NOT necessarily change the hash. It is a sonic fingerprint (Not in the digital watermark sense), so that in theory if you had a direct CD-ripped wave, and an analog rip from a cassette as a wave (for instance), you could match the two files, even though they are FAR from bit-for-bit exact.

This is what they mean when they say hash. NOT md5. Obviously MD5 could not track an mp3, since changing even one character in the ID3 tag would change the whole hash.

So they probably have an automated downloader that then generates a fingerprint from the downloaded file and compares it to a db of fingerprints to determine if the song is copyrighted. I'd bet that's all.

Lost in a Fire?

[medscaper]

A couple of years ago I lost 90% of my CD collection in an apartment fire. I had about 20 of these CDs ripped at the time and since then, I have downloaded many of the others to replace what I had paid for.

Just out of curiosity...Did you have insurance? Did they write you a check for the CDs you lost in the fire? I doubt it, but if it had happened, would still feel you had already "paid for" the CDs, and simply thumb your nose at the RIAA and Big Insurance and download the files, as you'd already "paid for" them?

I promise, I'm not begging to be flamebait. I'm really curious.

Where does the line get drawn between physical property and intellectual property, and what rights do you have if you HAD purchased it, but it's gone now? I mean, I can't go to the lot and get another car because mine is destroyed in a fire. Of course, I could go take a picture of it...but I could do that anyway.

I'm curious.

Re:Lost in a Fire?

[nearlygod]

No, I did not have renter's insurance, so it was a complete loss for me. If I had been reimbersed, I would have likely re-purchased the CD's that I wanted most and forgotten about the ones that I seldom listen to. This brings up another question/issue. Before the fire, I could have made backup's of every CD that I had. Then after the fire, I wouldn't have lost anything audiable, just the physical packaging. However, after the fire, it was too late, but couldn't I have considered napster to be my backup. Since I could readily download a CD when ever I wanted, why make a backup of it?

Re:Lost in a Fire?

[Anonymous Coward]

From what the RIAA has said, this would be perfectly legal. The insurance company must only be reimbursing you for the phsyical media, because obviously your license did not burn up. (Speaking of which, if what I get is a license to listen to the music... WHERE IS THE FREAKIN' LICENSE?) If the CD is the license, then with proper documentation (A receipt) you should be able to request a new copy from the record company. Not that this would ever happen, but holding the RIAA consistent for a moment, this is what you get.

Re:Lost in a Fire?

[HopeOS]

Oddly enough, insurance companies don't always cover CD's. When my car was broken into, they replaced everything that was stolen, including an expensive HP calculator, but they would not cover the CD's.

Curious world.

-Hope

Re:Lost in a Fire?

[Vyce]

Friend of mine lost 900 CDs that were stolen out of his car. (He is a music buff and DJ), they also jacked his $8000 sound system. The insurance company made him provide proof (which he did in the form of the cases for the CDs, he only had the discs in the car in cd folders), and they will now reimburse him whenever he buys ANY retail CD up until he has reclaimed all 900. The catch is he has to purchase them first then send them the reciepts. They replaced his stereo equipment without question.

Re:Lost in a Fire?

[medscaper]

I've been reimbursed for CDs, but only in the case of house burglary or loss. Never from the car. Auto insurance, for some reason, (and I'm sure it's the insurance companies' huge losses in the fact) excludes CDs specifically in their policies. I guess I understand. I have a case full of over 400 CDs. If that got stolen from my car (or I lied and gave them to a friend for a week), the insurance company is out $7,000 - $8,000. And how many of us chuck the cases after we get the CDs?

It sucks. I know. I had $17,500 worth of software (again, in a case) stolen from my truck. I was a consultant, late home from a customer's business, with lots of troubleshooting CDs in my case along with VS .Net, SilkTest ($8,000 by itself) and others. I had to claim against my homeowner's policy, as my auto insurance said, "The physical media was CD, so we're not covering them. We'll cover the pair of gloves and the sunglasses."

Woo Hoo. $50 with a $100 deductible. Thanks. Gotta love Big Insurance.

Re:Lost in a Fire?

[Anonymous Coward]

Most insurance policies will only pay a token amount -- a dollar or two per recording -- for losses to a collection of CDs, tapes, records, books, and the like. This is done to discourage fraud, and makes sense for the majority of people who have a large number of recordings that they really don't listen to any more. But for the few listeners who make use of their entire CD library, it is most unfair.

Re:Lost in a Fire?

[Khlatu_Barada_Nicto]

Why would that matter? If they replaced it, they money he recived was in compensation for the lost physical objects, that financial compensation does not retroactively un-license the rights granted by the original purchase. I own Quickbooks. If my place burns, and somehow the computer makes out ok, but my original CD and packing get burned up, and IF the insurance company buys me a new copy of quickbooks, they are replacing the lost real property of the CD-ROM disc and book, the license for the copy installed on my workstation is still valid.

Re:Lost in a Fire?

[Dirtside]

I mean, I can't go to the lot and get another car because mine is destroyed in a fire.

The obvious difference is that if you download a copy of the CD, you haven't deprived anyone the use of the data you've downloaded. If you take another car, you have deprived that car's use to anyone else. (Similarly, if you copy a song from Bob, you can still both listen to it simultaneously. If you take Bob's car, you can't both drive it at once.)

Re:Lost in a Fire?

[Anonymous Coward]

Do you need a license to read a book? NO

You don't need one and don't get one when you BUY a CD.

Re:Lost in a Fire?

[ibbey]

If my place burns, and somehow the computer makes out ok, but my original CD and packing get burned up, and IF the insurance company buys me a new copy of quickbooks, they are replacing the lost real property of the CD-ROM disc and book, the license for the copy installed on my workstation is still valid.

IANAL, but I'm pretty sure you're wrong here. For all practical purposes, you are selling your old copy to the insurance company when you accept their reimbursement. The situation would be the same as if you took the software to the used software store and sold it there. Legally, once you sell it, you cannot continue to use the installed copy.

Of course, I could be wrong...

Re:Lost in a Fire?

[Jonner]

Where does the line get drawn between physical property and intellectual property, and what rights do you have if you HAD purchased it, but it's gone now?

This is digressing a bit, but I think it's important to stress that intellectual property doesn't exist. It's a very recent concept which is flawed at its core. How can one person or corporation have exclusive ownership of an idea? It's also a very harmful legal trend.

I think you meant to ask, "what are the limits of free use?"

Michelangelo's David

[heironymouscoward]

An excellent example.

The statue sits there, the result of laborious work by its creator (made possible thanks to a decade of training at the hands of other masters, but that's another story).

Now the statue is in the hands of a private collector who charges people to view it. He claims he owns it, but the state decides that the statue is far too important. They buy it, and put it on public display. Now everyone can see it, be inspired by it, make rough imitations, photos, even tiny or full-scaled replicas.

Which is preferrable? Which results in a better and richer culture?

Clearly no theft occurs by looking at the statue, except that the original owner cannot claim his viewing rights any longer.

This is the best metaphor for digital culture. totally intangible, yet very important. The discussion of "rights" and "theft" and "ownership" is meaningful only insofar as the direct artist is concerned. All other parties are unavoidably biased, and finally it is the common interest that must prevail.

It is clearly impossible to restrict all creations to "pey per view". Impossible and stupid, for people will simply turn elsewhere and make their own, or steal to view. Culture does want to be free, as you know very well because you are here on Slashdot, proving that point exactly.

Comparing Kazaa users with suicide bombers, burglars, and corporate thieves is fanciful slander, and you know it.

You are So Busted-No Fair Use Period

[gadlaw]

You know, as I understand it there is nothing that is fair use according to these bastards. So your admission to having taken money from the mouths of starving record executives can be used against you in a court of law (as soon as they finish rewriting the constitution). The only thing you can now do is to embrace your evil criminality. So go ahead, go into your bedroom and find those "Do not remove under penalty of law" tags on your mattress and just rip them off! Then just go into the living room and wait for the FBI to come bash in your door. They are on the way anyways. (you evil downloader of mp3's for CD's you already own guy you)

Rotten in Denmark?

[jabber01]

A video clip of "Goatse.cx guy and tubgirl together at last" may indeed be very, very rotten, but in Denmark, it's legal. So keep your aesthetic judgments to yourself. Puritan! ;)

Re:Rotten in Denmark?

[Cederic]

"we just knew something was rotten in Denmark"

- Chris Penn, in True Romance.

Offsets

[Anonymous Coward]

A cd ripper called "Exact Audio Copy", allows you to set your cd-rom/writer's read offset or read/write offset. Would this offset have any effect on the md5sum created? Say someone rips with the offset set at 0 and then again with the corrected offsets. The mp3 was encoded with the same encoder, settings, id3 information, volume adjustment, etc. Would the md5sum match?

Anyone thought of setting a honeytrap for RIAA?

[linuxbikr]

I was under the impression that MP3 (MPEG-1, Layer 3) was a lossy algorithm. Even with the same ripper settings working off the same stored raw CD audio file, will it actually produce identical output? Can the MP3 encoder drop different bits as irrelevant on different passes in time on the same data with the same settings? If this is indeed the case (I don't know, I am not familiar with the detail of the algortithm), then MD5 sums become a virtually foolproof way to identify a file since an identical sum can only be produced from the exact source MP3, not one that is close. Just a thought on that matter. And a second point, more of an idea really... Has anyone thought of trapping RIAA? Here is my proposal... 1) Go and buy 50-100 CDs from your local music stores (I know, this is abhorrent since you are lining the pockets of the people you want to fight but it is a means to an end). SAVE ALL THE RECEIPTS! You will need these. 2) Download a popular P2P program and sign on. 3) Go download crazy and download an MP3 for EVERY SINGLE SONG on the pack of CDs you just purchased. Be obviously, be a bandwidth pig, get somone's attention. 4) Take screenshots and printouts of the directories containing your "booty". This will establish the timestamps of when they were downloaded. Sign and date the screenshots, preferably with witnesses who sign them as well. 5) Wait for a supoena from RIAA. 6) Join RIAA in court and argue "fair use" by throwing up your stack of legally purchased CDs and the receipts for them clearly indicating that they were purchased PRIOR to the supposed infringement and you were simply wanting MP3s of CDs you own but lacked the knowledge/skill/time/tools to rip them. Is such a case copyright infringement? It's a dangerous game to play because the fair use doctrine has been supported, it is not a matter of law. The outcome could be undesired because it could cause a rethinking of what constitutes fair use. The fun part of such rethinking could be the broadening of what is considered infringement into areas where it was not infringement and ignite an absolute firestorm.

Can I share files for myself?

[Anonymous Coward]

Can I share files for my self? I'm at work... I have a large CD (and MP3) collection at home. I have a hight speed internet connection. Can I share the files to my self for use at work? (Ok, put the thinking caps on for a minute....)

Re:Can I share files for myself?

[lamp540]

some judge: I hereby find you guilty of not putting proper access restrictions on your information sharing devices!

Easy and dangerous (for RIAA) solution

[Anonymous Coward]

1 - Set up a server and fill it with legal content (free images, documentation, etc.).

2 - Collect hashes of well known artists tracks from p2p networks.

3 - Since many files can generate the same hash, alter slightly your legal content until the files remain useable but their hashes match with the mp3 tracks.

4 - Wait for the RIAA to knock your door.

5 - Call your lawyer and burn them to death. ...

Ok, let's add it.

6 - Profit!

Re:Easy and dangerous (for RIAA) solution

[lamp540]

1-4, done.

Not a big problem...

[flakac]

It would be a pretty simple matter to simply add a bogus data at the beginning of the MP3 file, which would get skipped by the player and have no effect at all on how the file sounds. In fact, this is how ID3 version 2 tags work. The ID3V2 tag is added to the beginning of the MP3 file, and since it doesn't have an audio sync signal, the player will skip until it finds it. This would more than invalidate RIAA's library of MD5 hashes.

Of course, if two people change the same file differently, file sharing programs won't be able to match them either...

MP3 Headers?

[pmz]

Do MP3 files have less than important metadata in their headers? Putting a single random integer into the file header and designing MP3 players and recorders to randomize that integer with each use of the file...

'Fair Use' isn't the same as 'reasonable'

[turnstyle]

The 'Fair Use' stipulated in US Copyright law has nothing to do with making copies of music.

Fair Use is about the right to quote portions of one work within another, as a means of making commentary, criticism, or parody. See Standford's explanation or Title 17, Chapter 1, Section 107 of the Copyright law.

You might argue that it's 'reasonable' to download an MP3 file that corresponds to a track from a CD that you own, but it's simply not 'Fair Use'.

Re:'Fair Use' isn't the same as 'reasonable'

[nearlygod]

Semantics. I was simply using the term that is commonly used in these debates. I will have to ad that my list of incorrect terms along with pirate and stealing.

Re:'Fair Use' isn't the same as 'reasonable'

[turnstyle]

"Semantics. I was simply using the term that is commonly used in these debates. I will have to ad that my list of incorrect terms along with pirate and stealing."

It's not at all an issue of semantics. A lot of people are genuinely under the misconception that Fair Use applies to copying music.

Fair Use grants us rights to use portions of another work within a new work, and that's certainly a Good Thing.

But if people think that a Fair Use excuse is going to protect them from one of these lawsuits, they'll quickly learn otherwise.

It's not a matter of semantics, it's a matter of being well-informed.

Re:'Fair Use' isn't the same as 'reasonable'

[terrymr]

Correct ... the "right" to make copies comes from the "Audio Home Recording Act" (I believe that's the name)

Re:'Fair Use' isn't the same as 'reasonable'

[squiggleslash]

Stanford's explanation includes four possible criteria, one of which is the all-important "The Effect of the Use upon the Potential Market". Given the case directly quoted beneath, and common sense, it looks like only one of the four criteria needs to be applicable for the use to be possibly "fair":

For example, in one case an artist used a copyrighted photograph without permission as the basis for wood sculptures, copying all of the elements of the photo. The artist earned several hundred thousand dollars selling the sculptures. When the photographer sued, the artist claimed his sculptures were a fair use because the photographer would never have considered making sculptures. The court disagreed, stating that it did not matter whether the photographer had considered making sculptures; what mattered was that a potential market for sculptures of the photograph existed. ( Rogers v. Koons, 960 F.2d 301 (2d Cir. 1992).)

This failed only because the Potential Market case turned out not to be applicable. Had it been, then its implied that the artist would have been using the idea under "fair use", despite no suggestion that his art constituted a commentary, criticism, or parody.

The Potential Market defense, especially when combined with copyright law's mandating of single backups, would strike me as encompassing things like making a copy of someone else's CD to recover a lost one.

It obviously wouldn't cover posting a copy of your own CD onto a network for millions of strangers to copy and redistribute.

Re:'Fair Use' isn't the same as 'reasonable'

[turnstyle]

"This failed only because the Potential Market case turned out not to be applicable."

But more to the point, it failed. And in that case it was a hand-made sculpture that reproduced the photograph. A perfect copy of an MP3 file isn't even close.

It's also fairly simple to shoot holes in any Potential Market argument. But here, I'm mostly addressing people that download music they don't legitmately own and think Fair Use is going to protect them.

As for people that already own a CD, the case is murkier, but quite frankly that's not who the RIAA is going after anyway. But even in such a case, it's easy to argue that there has been a loss of Potential Market -- for example, I just scatched my CD, but I had never backed it up. Downloading a copy is then a loss of Potential Market.

Which is all different from the question of whether it's reasonable. Remember My.MP3.com? They bought hundreds of thousands of CD's, ripped them, and made them available to people who could demonstrate physical poseesion of the corresponding CD's. That seemed perfectly reasonable to me, but My.MP3.com was sued into oblivion.

Fair Use arguments might fly on /., but they won't in court, and it seems best if people better understand how it actually all works...

Re:'Fair Use' isn't the same as 'reasonable'

[zurab]

The 'Fair Use' stipulated in US Copyright law has nothing to do with making copies of music.

Fair Use is about the right to quote portions of one work within another, as a means of making commentary, criticism, or parody. See Standford's explanation or Title 17, Chapter 1, Section 107 of the Copyright law.

You might argue that it's 'reasonable' to download an MP3 file that corresponds to a track from a CD that you own, but it's simply not 'Fair Use'.

Direct quote from Title 17, Chapter 1, Section 107:

Sec. 107. - Limitations on exclusive rights: Fair use

Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include -

(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;

(2) the nature of the copyrighted work;

(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and

(4) the effect of the use upon the potential market for or value of the copyrighted work.

The fact that a work is unpublished shall not itself bar a finding of fair use if such finding is made upon consideration of all the above factors

[emphasis mine]

IANAL, but it's clear to me that the list of actions - criticism, comment, news reporting, etc. that follow the phrase "such as" are being used as examples and is not an all-inclusive list at all. The actual criteria that are used to determine whether an action is covered under fair use are listed items 1-4. For example, if you are simply downloading songs that you already own on CDs (1) is not commercial use; (2-3) it's not a substiantial violation, even though whole song(s) are being copied; (4) the potential market or value of the song(s) are not being diminished or affected in any way since you already own songs and CDs in question, therefore, not likely at all to purchase them again. In this sense, downloading the songs that you already own on a CD could be considered fair use.

The Stanford review correctly points out, however, that the interpretation involves some subjectivity, and does not necessarily apply to all cases alike.

Re:'Fair Use' isn't the same as 'reasonable'

[turnstyle]

"IANAL, but it's clear to me that the list of actions - criticism, comment, news reporting, etc. that follow the phrase "such as" are being used as examples and is not an all-inclusive list at all."

But the theme is self-evident: using bits of one work within another. A perfect copy of an MP3 file isn't close.

The point is so simple, I'm suprised that it's at all contriversial. Anybody unfortunate enough to get hit with one of these lawsuits who plans on agruing (in court as opposed to on /.) that downloading MP3s is Fair Use better find a better argument.

btw, it's also easy to shoot holes in arguments that there is no loss of potential market. For example, I have a CD, I never backed it up, and then I scratch it. If I then decide to download another copy, that's a clear loss of potential market.

Re:'Fair Use' isn't the same as 'reasonable'

[zurab]

The point is so simple, I'm suprised that it's at all contriversial. Anybody unfortunate enough to get hit with one of these lawsuits who plans on agruing (in court as opposed to on /.) that downloading MP3s is Fair Use better find a better argument.

I don't really see it as you do. Even RIAA doesn't argue what you say here. In fact, they have never argued that downloading is illegal. They have always said that sharing was. Calls from RIAA to users of kazaa and others have been to disable sharing. This makes sense since it is the sharer who actually allows others to get a copy of the content that they don't have a right to share, and it is the sharer who makes and sends copies of copyrighted content to others. In the worst case, downloader could be responsible for contributory infringement; in the best case - for nothing at all. But back to the previous argument below.

btw, it's also easy to shoot holes in arguments that there is no loss of potential market. For example, I have a CD, I never backed it up, and then I scratch it. If I then decide to download another copy, that's a clear loss of potential market.

First of all, "shoot holes" does not mean "prove". Since they, the accusing party, would have to prove that the CD in question was scratched beyond repair, or lost, there was no backup, and likelihood that the person would purchase the CD again. You cannot be automatically assumed to be guilty without the accusing party proving it first.

Second, this gets further into a different argument as to what is being purchased when you purchase a CD. Do you purchase that medium as a physical item (with content)? Or do you purchase a lease to use the content contained on that medium?

In the former case, you have a right to make a backup copy of the CD content in case the original CD is scratched, lost, etc. Also, you can make copies (for yourself) to listen on your MD player, portable player, PC, In that sense, loss of one medium does not prevent you from restoring your backup, or enjoying the content from other media. The right to make personal copies, as far as I am aware, is not illegal. And then this goes back to accuser proving what happened with the original CD to make you download another copy, which cannot be proven for most of songs and such downloads.

However, in many respects, RIAA (and other IP corps) would like to have you believe in the latter, since they would like to have god-like control on their leasing or licensing of their IP. However, even in this case, a loss, or a damage to a CD does not invalidate your purchased right/lease/license to use the content. In fact, in this case, it would be reasonable to ask, and even legally require, the content owner to provide a replacement medium containing the leased content at the cost of the medium (rather than the market price of the content). If you establish a CD medium as a way or a key to using the leased content, then loss of a key should not prevent you, the purchaser, to your paid rights to the content. For other examples, if you lease a house or a car, losing your keys does not invalidate your car or property lease and definitely does not force you to sign another lease to get your car or house back. In fact, you are even allowed to make new keys on your own without any permission or involvement of the owner; frequently, you are expected to do so.

In either case, it is not a "slam-dunk" case of - if you download an mp3 file, you are automatically infringing copyright. But again, I agree that such downloading would fall on subjective interpretation, and could be considered to be anywhere from contributory infringement to nothing illegal at all.

Re:'Fair Use' isn't the same as 'reasonable'

[turnstyle]

"I don't really see it as you do. Even RIAA doesn't argue what you say here. In fact, they have never argued that downloading is illegal. They have always said that sharing was. Calls from RIAA to users of kazaa and others have been to disable sharing. This makes sense since it is the sharer who actually allows others to get a copy of the content that they don't have a right to share, and it is the sharer who makes and sends copies of copyrighted content to others. In the worst case, downloader could be responsible for contributory infringement; in the best case - for nothing at all. But back to the previous argument below."

Respectfully, no. The Napster ruling specifically indicated that users were violating copyright as both uploaders and downloaders.

The RIAA is going after uploaders for some simple reasons:

They're sitting ducks, and it's easy to find them and collect evidence.

It appeals to the selfish instinct that prefers downloading over uploading. The more people that they can convince to turn off the upload feature, the less efficiently other people can download.

You are mistaken if you think that downloading is somehow more legal than uploading within the context of a P2P exchange, just as it is mistaken to characterize copying complete MP3 files as Fair Use.

Re:'Fair Use' isn't the same as 'reasonable'

[zurab]

You are mistaken if you think that downloading is somehow more legal than uploading within the context of a P2P exchange, just as it is mistaken to characterize copying complete MP3 files as Fair Use.

IANAL (again), but I disagree. For example, you go to a local store and they are giving out "free sampler CDs". You pick one and take it with you. If the CD turns out to be illgally distributed, the worst, and very rarely, that you could be liable for is a contributory infringement; the best and usually - nothing at all.

Similarly, it is sharer's responsibility to make sure they are distributing the content they have rights to distribute. It is not downloaders' responsibility to make sure everything they download is legal. There is no legal or reasonable way that it could be enforced. Moreover, if you apply the same concept not to just songs and mp3s but to all other IPs, it gets more complicated. Am I, while browsing the web, required to make sure all content (images, flash animation, text, music, software, etc.) on any given website is licensed properly and does not infringe anyone's copyright? And do so before visiting any website? How about make sure they don't violate any web-related patents? Of course not!

In the above example (free sampler CDs), is it my responsibility to make sure that all songs on the CDs are properly licensed before grabbing one? If the CD contains contents from Warner Bros, Vivendi, BMG, would I be required to call each corporation and get an OK to grab the CD? Very unreasonable, and I don't see how that would be required by law. Similarly, if I download something off of P2P or anywhere from the Internet, I cannot be held responsible for taking extraordinary and unreasonable steps to make sure all content is "legal". In fact, it would make the user/downloader/customer's duty to be the judge and the jury of deciding whether all content they experience was legally obtained or not.

On top of all of the above, and as I stated in the grandparent post, it is the sharer that is making the alleged illegal copy and distributing the content. Copyright law, as far as I am aware, places more responsibility with copiers and distributors (the actual root of violation) than with users and consumers.

Now, having said all that, and as far as strictly P2P, if it can be argued and proven that a downloader had a reason to know and believe that the content he/she is about to download (without downloading it first) infringes on someone's copyright then the downloader could be proven to have been guilty of contributory infringement. i.e. downloading a file called "Madonna.mp3" may not qualify since this could possibly contain anything from Madonna's interview, comments, parody of her, etc. - to one of her complete songs. Also, with some songs/content, one could make an argument that a downloader had no knowledge of the infringement of copyright by sharer, e.g. as far as they knew, it could have been the copyright owner itself distributing (or allowing the distribution of) number of songs to promote their albums and related content (a la sampler CD). In fact, this may make a lot of difference in the future, if and when smaller bands and recording studios get more exposure through this way. There would be almost no way to reasonably tell whether any content was intentionally shared for promotion (or other) purposes, or whether it was illegally made available by the sharer.

Because of this, as far as I understand, legally (as well as practically but that's another issue), accusing downloaders would stand on more shaky grounds. Suing sharers, however, is a more clear-cut case. That's my understanding of the whole thing anyway.

Re:'Fair Use' isn't the same as 'reasonable'

[turnstyle]

"Similarly, it is sharer's responsibility to make sure they are distributing the content they have rights to distribute. It is not downloaders' responsibility to make sure everything they download is legal. There is no legal or reasonable way that it could be enforced.

-snip-

Now, having said all that, and as far as strictly P2P, if it can be argued and proven that a downloader had a reason to know and believe that the content he/she is about to download (without downloading it first) infringes on someone's copyright then the downloader could be proven to have been guilty of contributory infringement."

A great post, and well reasoned, but the 9th Circuit Napster rulling has already stated that the downloaders were indeed violating copyright law. It's also worth noting that your response hinges on an 'ignorace' excuse which, ahem, is no excuse.

Sure ignorance can play a roll in mitigating damages, but you'll have to demonstrate a basis for that ignorance, and in the context of someone downloading music from Kazaa, you'll have a tough time doing so.

Re:'Fair Use' isn't the same as 'reasonable'

[rew]

IIRC, fair use in the case of software includes, as determined by some court, making one copy for backup purposes.

Re:'Fair Use' isn't the same as 'reasonable'

[Anonymous Coward]

Actually this type of fair use comes from the sony betamax decision (Sony v. Universal Studios 464 U.S. 417 (1984)). I'm not sure about the home recording act but there're a number of comments in Stevens's opinion that suggest exactly this kind of copying is exactly the domain of fair use. In fact even the District Court found that non commercial time shifting was a fair use. I'm unsure of why shape shifting (cd => mp3) would be exempted from this protection. Your description of fair use, while accurate is not the only kind of fair use. Despite how title 17 defines it, the doctrine's been refined over the years through countless legal maneuvers. The obvious similarity between these fair use standards of course is their origins in the first amendment. And while it's 100% correct that quoting an article, book, whatever, can be fair use, fair use is a much more inclusive doctrine than your post would suggest. As Stevens writes...

the District Court's factual findings reveal that even the unauthorized home time-shifting of respondents' programs is legitimate fair use

SONY CORP. OF AMER. v. UNIVERSAL CITY STUDIOS Of course the entire discussion is tragic, particularly when the courts have to step up to the plate because congress was too busy being lobbied to bother serving constituents.

RIAA Taxes

[brj]

Don't we already pay a small tax to the recording industry every time we buy blank audio CDs (but not data CDs)? I'd like to see some lawyer fight a case claiming that a P2P user has already paid the RIAA and is therefore exempt from their lawsuits when downloading the music and burning it to an audio CD. That would be an interesting lawsuit.

Re:RIAA Taxes

[shark72]

The tariff on blank audio CD-Rs goes largely to musicians and composers, not record companies or the RIAA. It's divvied up to various unions like the American Federation of Musicians, AFTRA, and the like. They, in turn, distribute it to artists. You will have probably heard of about 1% of these people, because they are famous. The rest are session musicians, composers, background vocalists, and the other working stiffs of the industry. A very small portion of the tariff goes to record companies. This is a very important distinction to understand if you kneel at the shrine of "record companies bad, musicians good."

So, you probably wouldn't see a lawyer picking up the case, since the lawyer would crack the lawbook. Anybody else who wants to learn more about the tariff on blank media is welcome to, as well. It's section 1006 of chapter 10 of title 17 of US copyright law.

At any rate, the tariff can be thought of "insurance," or a partial restitution to those whose works are presumably being copied illegally onto blank music CD-Rs. But, paying the tariff doesn't automatically give anybody a license to pirate music. This notion wouldn't pass what lawyers call the "laugh test," so this is another reason why the hypothetical lawsuit you describe would probably never come to light.

The problem is

[phorm]

That is shouldn't be (and isn't) illegal to download/copy your legit CD's, but sharing out the Mp3 files to those that don't have legit files is. RIAA nastygrams hit mostly people who share out, although I'm sure they're targetting some heavy downloaders too.

For myself, I've got a few CD's with skip-scratches, and one that fell between the seat and got scratched up quite badly. The original CD's were also a bit difficult to rip (which is one of the bigger problems are far as backup). So sometime when I'm not busy, I'll download the tracks all off Kazaa, and re-burn the discs that are fubared, probably into an Mp3-disk collection too. My originals have long since moved from my car to a safe place anyhow. Now, this could put me on the RIAA radar, but not so much as if I went and shared out said files to the masses. Of course, if nobody shared then P2P would die anyhow... which is why we have a real problem.

There is no way for P2P to identify legit owners of CD's, so we just share indescriminately. There is also no way for the RIAA to identify non-legit owners, so they just sue/nastygram indescriminately. Neither is right, though I smack the RIAA for being wayyyy too lawsuit friendly (esp in cases when the material is not infringing but their filters misidentify it), unfortunately there's no happy solution for either of us. I'm not going to buy a new CD because the damn things scratch too bloody easily, RIAA is not going to let people continue to trade off Brittney and BSB without paying for them...

Re:The problem is

[nearlygod]

Although I may not have said it as well as I could have, that is the basis of my question. If the RIAA continues to make copyrighted CDs and shuts down P2P services, what am I to do when I have a damged disc. I could make a backup even though I am entitled to one and I can't grab the files off of P2P because no one will give me access to the file out of fear of being sued. Now the RIAA can start making disc more fragile and easier to scratcha and I will be forced to buy the same disc over and over during the course of my lifetime. But I just want to listen to the damn song. Isn't it great to be a consumer in America?

Re:The problem is

[phorm]

Now the RIAA can start making disc more fragile and easier to scratcha and I will be forced to buy the same disc over and over during the course of my lifetime

That's not the problem. The problem will the combination of shitty discs, uncopyable discs (hell, sometimes even unplayable), and no P2P.

Copyable discs would allow you to back up shitty disks.
P2P would allow you to reattain and recreate shitty discs
But of course the RIAA wants neither of these, which is really just further proof that they're trying to market limited-use media.

A simpler way

[wirefarm]

As an expriment I just tried:

[sputnik57:~/Desktop] jim% md5sum Norwegian\ Wood.mp3
16b64198efdd1c183b97020ca9c69396 Norwegian Wood.mp3

[sputnik57:~/Desktop] jim% echo 0>>Norwegian\ Wood.mp3

[sputnik57:~/Desktop] jim% md5sum Norwegian\ Wood.mp3
5c8d12d1d83338b8a4c39c9401f683ac Norwegian Wood.mp3

The song plays perfectly afterwards, of course.
Of course, I could write a little perl script and inject "Ripped by Jim from his own CD" and not only mess up the MD5, but also convince a jury that I ripped it myself. If this is the best that the RIAA can come up with, they'll merely embarass themselves further. Future P2P apps will merely have a checkbox that says "Inject Random Bit?"

The other day, I asked a similar question on my site - If I buy a copy-protected CD that won't play on my Mac, can I download the songs in good conscience?

Cheers,
Jim

Re:A simpler way

[wirelessbuzzers]

If I buy a copy-protected CD that won't play on my Mac, can I download the songs in good conscience?

Certainly in good conscience. You've paid the label, you've supported the artist, you're allowed to play the song wherever; ethically, you have no reason not to download it.

And probably legally, too. The jury is still out on that, it'd be part of the fair-use laws. But I don't think the RIAA would sue you. Mostly they go after uploaders anyway, but they risk losing big if they force the courts to clarify whether this is legal or not.

that was easy.

[di0s]

Now may be the time to update your illegal mp3 file MD5 hash sums.

Done.

MD5 Hash NOT all that unique

[captainstupid]

Everyone seems to be thinking that it is very difficult to generate the same MD5 from a mp3, I don't agree.

FileDonkey allows you to search for files that have traversed their network by name, and displays the MD5 hash so that you can specifically search for THAT file.

Anyway, if you use their interface to search for "Oops I did it again" or any other drivel by britney spears, you'll get about 100 different files. Again, these are files that have traversed the relativley large file donkey network at some point, not files that are currently available for download. It seems to me that way more than 100 people have ripped that song and shared it.

Anyway, there aren't that many different MD5 sums for just about any song, yeah there are more than a few, but they are FAR from unique.

A perfect answer.

[Kjella]

No mod points, but it's at least a +3, Insightful, Informative and Funny :).

The truth of the matter is that it is that easy - to a geek. The problem has never been the access to cryptography - I remember encrypted containers existing even before PGPdisk, and even that is many years in the past. The reason it wasn't really a "problem" is that the general public was unaware of its existance.

You saw the same with mp3s. There were lots and lots on irc and newsgroups before too, but few people. It was when the general public and Napster got started it all took off. I expect them to try to cripple crypto - not the algorithms but the implementations, including extra backdoor decryption keys and similar. I don't expect the people in government to allow each individual to have their own, impenetrable digital "vault". Not without a fight anyway.

Kjella

Re:A perfect answer.

[mikeage]

Slightly different direction... anyone know of a way to do this under WinXP? PGPDisk (the free version.. 6.0.2) has some bugs that prevent it from handling long file names properly, and 7/8.0 cost money. Scramdisk used to exist, but it's only 95/98/ME, and their new product, DriveCrypt, is not free. Anything else out there?

Don't use MP3

[theoldmoose]

I rip my own CD collection with Ogg Vorbis. .ogg format is unemcumbered by patents (unlike MP3 -- is *your* ripper legal?).

Except for some genre music (Celtic, Jazz, etc) from unsigned artists I've obtained (legally) from the old MP3.COM site (before it was vilified), I have *no* MP3's for the RIAA to find, even if they manage to bust in through my firewall (or my front door, with or without a search warrant).

All of my ripping is for migrating from one media to another, and is protected by fair use.

The RIAA can go suck an egg, for all I care.

Re:Don't use MP3

[geoffspear]

If you're ripping the files for your own use and not sharing them on the 'net, they don't care about you, so your rhetoric is a bit pointless.

Re:Don't use MP3

[theoldmoose]

To be more clear, if you eschew MP3 format entirely, and use Ogg instead, then you won't get hassled by the RIAA, even accidentally. Further, you will be helping to move away from the patent issues surrounding MP3 format.

The more folks that find (and support) companies that support Ogg, the better off everyone will be.

What better excuse than to keep the RIAA away from your door?

Re:Don't use MP3

[geoffspear]

I don't think RIAA cares what format you use. If you share huge quantities of ogg files they'll be just as likely to come after you as if you use WMP or MP3. Their issues are not related to MP3 sharing, they're related to music piracy in general.

The relative merits of different formats are completely irrelevant to the discussion.

Re:Don't use MP3

[theoldmoose]

OK, let's try this again. I know the RIAA says that they are concerned about music sharing in general, but so far, their techniques involve scanning MP3 files looking for violations.

So far, I've not heard of *anyone* being accidentally accused of illegal song swapping when the RIAA stumbled over their collection of .ogg files, mainly becuase I believe that the RIAA is so clueless it will take them another few years to even realize that folks can harbor music collections in some other format than all the proprietary commercial ones out there (MP3, WMP, WAV, etc, etc)

I mainly brought up the Ogg issue, because a number of folks have complained about the possibility (quite real, from recent accounts) of being hassled by the RIAA for legal music collections that were somehow 'discovered' to be on their personal or work computers. Not that using Ogg is a total solution, but a combination of common sense and staying under the radar, by using something besides what all the illegal song swappers seem to be currently using, should help to keep your life a little more hassle-free.

You can use MP3 if you want, but I'll be smug and say that I stand less of a chance of getting a knock on the door from the RIAA and/or their minions someday than you. And no, I don't post my .oggs publicly, but I do carry them around with me from place to place on various media (CD-R/RW, CF, USB HD), including work, and just want to enjoy my music, not spend a lot of time explaining where I got all those MP3s (not!) from.

If that doesn't make any sense to you, then just write me off as a kook, if that makes you feel any better. I like ogg, not only because of freedom from MP3s patent issues, but I've found it produces smaller, better sounding files (to my ears) than MP3 does.

Check out tckOggRipper, at TheKompany.com. It's a free download, and you can get ones for both Linux and Windows (maybe Mac, too, I don't recall).

change your ID3 tags!

[szadig]

Here's some programs I found to change a bunch of ID3 tags in a hurry: http://www.maazl.de/project/mp3/mp3tag.html http://id3master.mute.cz/what.htm

entrapment. you lose

[Anonymous Coward]

stop trying to justify your mp3 stealing habit with stupid schemes like this.

I found a much easier way to avoid RIAA files

[waspleg]

it's really very simple, you search for your songs, and look for the ones that come up with 300+ people and have their "bandwidth" set at 1566

then you sort the list by bandwidth so that all the 1566's are at the top and avoid them

they are easy to spot because if you start to download the song and actually listen to it (and I can give a specific example, try 50 Cent's "Backdown" .. not usually my style of music but my brother has the cd and I liked the song while listening to it in his car) and a few seconds in you will hear it fuck up and yet 300 people still have that copy and all have stupid usernamers as well.. also you will notice that the speed on these mp3's is extremely high (in the 200 Kb/s range)

hope this helps you out.

Hashes and Compression

[buckhead_buddy]

Hashing and compression aren't really my thing so maybe someone could clarify my understanding.

I was under the impression that hashes are not reversible like compression algorithm's are, but that they try to add as much chaos between slightly different variations of the original. (The same way the telephone company racks up money by having area codes be very distant from each other; a typo in the area code probably means big bucks for a wrong number)

My spreadsheet of 1997 budget information could produce the same hash as a RIP of Meeco's Star Wars disco theme remix, but it would be unlikely to produce a hash similar to my 1996 budget information (which is practically the same other than 1996 being 1997). None of these would ever compress to the same result using a loss-less compression scheme (or they might be in for a surprise when they uncompressed their Mecco track).

Producing a unique result for each file is what a compression algorithm does. If a hash were truly unique and reversible then you'd have a compression algorithm, right?

Now to make this relevant to this case...

Could someone make a MP3 from MD5 generator? It'd create an MP3 with the goal of having exactly the same MD5 hash as the original song. Admittedly it'd probably sound like a confusion of radio static and Husker Du. Not anyone's cup of tea to listen to probably, but it might wind up being just the sort of edge case to make MD5 hashes insufficient evidence in court (especially if the defendent had a nose ring). If this isn't possible, then perhaps it could make a JPG from MD5 generator? Visual noise is much more appealing to many than auible noise and probably easier to create.

Re:Hashes and Compression

[jargoone]

The same way the telephone company racks up money by having area codes be very distant from each other; a typo in the area code probably means big bucks for a wrong number

This is either a conspiracy theory or an outdated idea. Not sure which.

My spreadsheet of 1997 budget information could produce the same hash as a RIP of Meeco's Star Wars disco theme remix, but it would be unlikely to produce a hash similar to my 1996 budget information

Both are equally likely.

Producing a unique result for each file is what a compression algorithm does. If a hash were truly unique and reversible then you'd have a compression algorithm, right?

A unique result is simply a side effect of compression. And I can create you a hash that's truly unique and reversible: add a 0 to the end of each file. Unique, reversible, but not compression.

Re:Hashes and Compression

[Anonym0us Cow Herd]

Both are equally likely.

Better to say... both are equally unlikely.

Re:Hashes and Compression

[Anonym0us Cow Herd]

Could someone make a MP3 from MD5 generator?

First let's talk about theory. Yes you could. There are an infinite number of mp3 files that will give you the same MD5 checksum. Some of them will be works of genius, and some of them will be absolute crap. Some of them will be appropriate for children, and others will not.

Now let's talk about practice. No you could not. You would need to examine 2^127 files in order to have a 50 % chance of one of those files having a certian predetermined MD5 hash. This is a big number. How many stars are there in the entire universe again? And just how big is 2^127?

Re:Hashes and Compression

[jargoone]

Better to say... both are equally unlikely.

Sort of like "six in one half dozen in the other". But I'm saying "six in one half dozen" and you're saying "one dozen minus six in the other". Why obfuscate? I'm just saying the likelihood is the same.

Unless you're kidding, of course.

Re:Hashes and Compression

[BlaisePascal]

Don't think of MD5 like a lossy compression algorithm, think of it instead like a lossy encryption algorithm. It's much more similar.

Block encryption algorithms work by taking two blocks (the key block and the data block) and combining them into one block. It is possible to chain blocks so that to decrypt the last block it is necessary to decrypt all the previous blocks.

MD5 works similarly. It has a core bit that combines pairs of blocks, and a wrapper that chains blocks together like an encryption algorithm does. Except instead of showing you all the blocks, it only outputs the last block.

Because MD5 only has 128 bits of output, there are obviously "collisions", or two files that differ in content but have the same MD5 sum. But a design goal of MD5 was to make collisions hard to find. To wit: 1) it should be hard to create two different files with the same MD5 sum, and 2) it should be hard, given one file, to create a second ,different, file with the same MD5 sum. It is also hard to create a file with a given MD5 sum.

So, no, a MP3 from MD5 generator isn't possible. More accurately, to do so efficiently would constitute a major break of the MD5 algorithm. So far, after years of scruteny, MD5 has only turned up minor weaknesses, no major breaks.

Re:Hashes and Compression

[KoshClassic]

Yes, you are correct, if each hash was unique and reversible you would have a compression algorithm. The problem is that they are not.

An MD5 hash (or any hash, for that matter) produces a output that is a fixed length - lets take 128 bits as an example. That means that there are 2^128 possible hash values in my example - a very large number. Statistically, for any given 128 bit hash value determined with a given hash algorithm, only 1 in every 2^128 possible files will also hash to the same value with that same algorithm.

Suppose your friend describes to you a mystery file. He tells you a 128 bit hash for the mystery file, tells you the hash algorithm used to arrive at that hash and tells you the length of the file is 512 bits (note that an MD5 hash does not tell you the length of the file, but as I will demonstrate, even with that information reverse engineering the mystery file cannot be done with anything other than a guess). Everything else being equal, you've got a hash value that 1 in every 2^128 files will match. But you're dealing with 2^512 possible files. Statistically, 2^384 of these possible 512 bit files will match your hash. Good luck guessing which one (hint: this makes the problem of breaking 128 bit cryptographic keys seem like childs play)

The problem only becomes worse the longer the original file - and since the hash does not tell you the original files length, you must also consider files of every possible length, not just a single length (512 bytes in the above example).

Bottom line is, hash values are completely useless for regenerating the original file. This fact must make Seagate, Western Digital, Maxtor and Conner executives sleep much better at night.

Re:Hashes and Compression

[Nucleon500]

It would be possible to create a file with a given MD5 sum, in the same sense as it's possible to break strong encryption. But in both cases, your only option is brute force, the kind that would take thousands of years, even accounting for Moore's Law. In both cases, there are no known mathmatical shortcuts.

Without actually doing the math, I think MD5 sums are much less likely to give false positives than most forms of DNA matching are.

Re:Hashes and Compression

[Richy_T]

If it were easy to create a file that matched a pre-defined MD5 hash, it would mean MD5 hashing kind-of pointless don't you think?

Rich

Re:Hashes and Compression

[flonker]

Hashes are not reversible. Hashes do NOT produce unique results for each file. Cryptographic hashes produce results that are nearly impossible to duplicate with a different file.

So, creating an MP3 that has the exact same MD5 as the original song would likely take very long. Assuming 1 million MP3s hashed and compared per second, It would take very, very roughly, 1e25 years. That's 10,000,000,000,000,000,000,000,000 years. Probably more. Same numbers apply to jpeg or any other file format.

Re:Hashes and Compression

[FingerDemon]

Curse you for making me remember that hideous disco version of the Star Wars theme!

I can only respond in kind... Meow mix song.

There. Take that!

Shame on you!

[Anonymous Coward]

for buying Celine....sincerely...why must you support her audio abuse?

Towards a suitable use of the Enemy.

[eddy]

Clearly any new P2P clients should use a homebrew and/or keyed hash, and be distributed with one of those "no reverse-engineering allowed"-click-throughs and DMCA threats. Add some token "copy prevention mechanism" into the program (encrypt parts of it). Make sure that there is no comfortable way to use a normal client for this kind of large scale "hash searching/cataloging" the RIAA would want to employ, such that they must rev-eng in order to get the data or build the code that they need.

If files identified using such an algorithm end up in court, we could probably force the RIAA into having to argue that such click-throughs carry no legal weight and that reverse-engineering such "protections" is legal -- which would be very good indeed.

Not to mention, hilarious.

Re:Towards a suitable use of the Enemy.

[Anonymous Coward]

You can't hide behind laws to protect your criminal activity. Any protection you have will be removed (by default or by court)... besides, they can still reverse-engineer, behind closed doors, to find people they want to go after.

Too much of that article was inaccurate

[The Tyro]

I wouldn't put too much stock in that Kuro5hin article... full of typos and inaccuracies.

Some of their data on the 5.56 NATO, particularly regarding wound ballistics, was incorrect.

Some of their statements about armor-piercing ammunition were bogus.

I used to regularly give wound ballistics lectures to my students and residents, and I'd have to say that there are far better sources out there than that article. Getting gun info off the internet is always a dicey affair. I'd recommend sticking to military and medical/surgical publications if you really want to know what a bullet does to the human body.

For further reference, I'd recommend the International Wound Ballistics Association. I'd also recommend doing a search for articles by one of its members, Dr. Martin Fackler... his writings are fairly illuminating.

Fair warning before you go internet-researching: some of the material is gruesome. I have to know about this stuff professionally... it's part of my job, but it's not for everyone. If, however, you really want to know what happens when bullet meets flesh, I'd start there.

Just my $.02

No.

[wirelessbuzzers]

go back to your crypto text looking for words like 'collision' and 'birthday attack'.

A birthday attack allows you to produce two files with the same hash in about the square-root of the normal expected time, if you have a lot (order of exabytes at least in the case of MD5) of memory.

However, they are comparing the sig to a *specific* rip on KaZaA. Even if she were trying to make a rip that matched something's MD5, this could only increase her speed by order of (#files on KaZaA), which brings it down to maybe 2^100 effort. In fact, she is presumably not trying, so her odds against with ~1000 files of even having one match are ~2^90:1.

Making another file with the same sig is easy, we did it as an assignment at school with text files instead of mp3s, but the point holds.

I very much doubt that you could do this if "sig" means "md5sum". If you mean a CRC (or other non-cryptographic checksum), or CBC-residue (where you know the key), yes, this is easy. If you mean a CRYPT residue (like UNIX uses), this is doable if you have a couple CPU-months to spare.

In fact, David Wagner (at Princeton) reports that

crypt("2NGGMda3", "Hx") = "yX8CL2luKyI"
crypt("gnB9Gw1j", "s8") = "yX8CL2luKyI"

But I defy you, or anyone else, to show two different strings with the same MD5sum. While progress has been made in cryptanalyzing MD5, it is not yet broken (ie, nobody has been able to reduce the time required to break it from brute-force).

It was estimated in 1994 that a $10M machine could find a collision in MD5 in 24 days. Today this would probably be less than a million... but the only people likely to have this are not about to jump up and admit it.

Re:No.

[Anonymous Coward]

At one time I was wanting to find and weed out duplicate files across my media. I wrote some perl to enter into a database the file info and the MD5 sum of all my files(took quite a while to run of course). Then I did a left outer join on the table to itself, where the id was different but the MD5 was the same. I had enough collisions that I altered the table to hold data for both an MD5 and another (might have been an RC4 hash or a SHA1 hash can not remember for sure) along with the size of the file. Took even longer to populate the table, and of course the join almost killed my machine, but I was able to find duplicates where both hashes matched and confirmed them using diff. Collisions do happen, but of course it is near impossible to find a collision on a specific MD5.

Perfect!

[lightspawn]

If they just create a public database of RIAA-owned tracks, we can all stay away from any RIAA music and maybe even have the clients shield us from it automatically.

Ripping process differs

[BestNicksRTaken]

Everyone is missing the point here with the MD5 hashes.

OK, if you use the defaults in your MP3 encoder, and the ID3 tags from CDDB the *encoding* would be the same, but not the end file. Know why?

The rippring process differs greatly - you've got things like scratches on discs that some CD-ROMs will pick up as errors and some won't, you've got pauses due to slow processor/HD on different computers etc.

The only way I'd say to get an identical file would be to rip it using the same computer, encoder and CDDB - in which case "Jane Doe" must have been the original producer of the Napster file if the KazaA one matches it (or she copied it from someone else).

She's guilty as Hell, but personally I support her as the RIAA/MPAA are scum.

What about AAC files?

[MacGod]

How would this technology do with iTunes-compressed AAC files? One would assume that they wouldn't match up to their MP3 counterparts in the least, but I wonder if the RIAA even scans for these files (since they're used by a minority anyway).

hash collisions

[lightspawn]

If you were to examine 2^127 different files, then you would have a 50% chance of one of them giving you the desired MD5 hash. Do you know how large 2^127 is?

Sorry, but your math is way off. Do you need 183 people for a 50% chance of a shared birthday? You only need, hmm, twenty-odd people for that.

Re:hash collisions

[canajin56]

No, YOUR math is off. Parent is not saying that you need that many for a 50/50 of ANY of them having the same one. You need that many for a 50/50 of having "...the desired MD5 hash."
In other words, while it's true that you only need twenty-odd people to have a fair chance of at least two of them sharing a birthday, you DO need 183 to have a fair chance of one or more of them having MY birthday.

Re:hash collisions

[daBum]

The birthday thing is not entirely accurate here.

Yes, in a group of 25-30 people, odds are that 2 of them will have the same birthday. However, odds are still 1 in 365 that it will be June 3rd. (or whatever _your_ birthday is...).

Point being, they are looking for a specific hash, not just 2 that happen to come out the same. (Look, Sven, we've found 3 that match "fd8ddaf41fd482a6aa1a492915a3e788"... but none that match "0123456789abcdef0123456789abcdef". Hm. We should keep looking.)

Re:hash collisions

[lightspawn]

Point being, they are looking for a specific hash, not just 2 that happen to come out the same. (Look, Sven, we've found 3 that match "fd8ddaf41fd482a6aa1a492915a3e788"... but none that match "0123456789abcdef0123456789abcdef". Hm. We should keep looking.)

I apologize; I misunderstood the comment. But it may be something they're considering doing - if several people have the exact same file, the RIAA may decide the at most one of them is the original owner, and the others (perhaps decided by when the files appeared on their IP address/usernames) are infringers.

Re:hash collisions

[lightspawn]

Actually, the original math is still way off:

If you were to examine 2^127 different files, then you would have a 50% chance of one of them giving you the desired MD5 hash.

If you examine 2^127 different files, you'll get a lot of collisions (how many? anyone?) so your chances of getting a desired MD5 are less than 50%.

What were they thinking?

[ewn]

Maybe they're speculating that the jury will immediately succumb to the magic word 'hash'.

But otherwiese, frankly, i don't see what this could be good for. Hashes (whether MD5 or SHA or some other algorithm) don't prove a thing.

Identity: The identity of the hashes of two MP3s only provey that the MP3s were encoded with identical settings from an identical CD source. If two people, one in NY the other in LA buy the latest Red Hot Chili Peppers album and rip and encode it both on Windows machines using identical versions of RealOne (or any encoder) then the resulting MP3s will have identical hashes. Whether the probability of two different files accidentally having the same hash ist 1 in 2 or 1 in 2^127 is absolutely irrelevant here. The chances of two people using the same software with the same CDDB information to rip the same track from a CD that sold a million copies is a lot higher. Everybody with a half episode of Matlock legal expertise will tear the RIAAs position apart on this ground.

Trackability: Hashes cannot be used to reliably track the path of copies across P2P networks either. Since the hash is more sensitive to minor changes than the ear doing random changes to the ID3 tags or randomly changing a bit or two somewhere in the MP3 will wipe the tracks.

So two files having the same hash doesn't prove they come from a single origin. Two files having different hashes doesn't prove they don't come from a single origin.

Hashes don't prove a thing

Re:What were they thinking?

[elflord]

Whether the probability of two different files accidentally having the same hash ist 1 in 2 or 1 in 2^127 is absolutely irrelevant here.

Standards for civil suits are "preponderance of evidence". Odds of 1 in 2^127, and additional evidence (e.g. name of the file) would probably pass the "beyond reasonable doubt test", and would certainly pass the "preponderance of evidence" required in a civil case.

By the way, if you found say 100 or so files, and they all had hashes that matched certain files (and the same titles), that would reduce the odds further.

I would expect that they would use this in addition to other methods (to pre-screen data, and as corroborating evidence), not in place of them.

New Cheech and Chong.

[Anonymous Coward]

Chong: Say, man. They're coming after us with hash, man.

Cheech: Far out, man.

Sis? Where is my 28.8?

[Anonymous Coward]

Forget changing the tags, just download them on the 28.8 you gave to your sister!

Given the right phone line, (i.e. qwest), it will automaticly throw lots of random data into the downloaded file and wa-la! different MD5 and a very differnt file than what everyone else has.

Nobody has a song that sounds just like mine once I download it... (also works great when your trying to get a new remix going) :>

MD5 hash "posers"

[digital photo]

One of the interesting aspects of MD5 hashes was that they were an improvement over CRC hashes. This was due to the fact that you could actually generate a file which had the same CRC hash, but had completely different content.

Wonder if there is a utility for generating files with random content, but with the same hashes as another file?

Perhaps a reverse md5 hash generator which takes a hash and generates a file.

Re:MD5 hash "posers"

[eric76]

Wonder if there is a utility for generating files with random content, but with the same hashes as another file?

Perhaps a reverse md5 hash generator which takes a hash and generates a file.

If that were possible, it would destroy the value of an MD5 hash immediately and everyone wouild quit using it faster than you could blink.

The purpose of CRC hashes is entirely different. They are designed to detect a burst of bit errors in a stream of data, the type of error that is most likely to occur in a network transmission. They are not meant for fingerprinting files.

I doubt that anyone with any degree of sophistication in cryptology would attempt to use CRC and MD5 hashes interchangeably.

Re:MD5 hash "posers"

[0111 1110]

Perhaps a reverse md5 hash generator which takes a hash and generates a file.

And while we're on that subject let's try not to give our enemies any ideas.

Re:MD5 hash "posers"

[Anonymous Coward]

Wonder if there is a utility for generating files with random content, but with the same hashes as another file?

No, that's rather the whole point of a crytographic hash.

Re:MD5 hash "posers"

[IWX222]

wouldn't even downloaded files sometimes have different MD5 hashes? as far as i know there's very little continuitity checking or error correction while downloading with something like kazaa, and a few bits out of place might not affect the MP3 but would affect the MD5....right?

Re:MD5 hash "posers"

[Anonymous Coward]

The error checking may or may not happen in the application, but the transmission itself is TCP-based and utilizes a 16-bit checksum that would detect most transmission errors.

Yes, even one bit out of place would change the MD5 hash completely. However, it's unlikely that there will be a bit out of place. TCP transmissions are designed to be very reliable. If they weren't none of the software that you download from the 'Net would ever work. One bit out of place wouldn't necessarily affect an MP3, but it would certainly cause your favorite application to fail on compile. :-)

Missing the pragmatic point

[Mryll]

Remember that the MD5 hashes are the values used by popular P2P software to enable synchronized multi-source downloading of a file. If everybody "sharing" modifies files to affect MD5 hash values, then the P2P networks essentially fall apart into single source FTP-like downloading.

Re:Missing the pragmatic point

[dpete4552]

Napster was very successful with single source downloads for years.

Please try to pay attention

[filmsmith]

Great-grandparent: Just because I leave the front door open does not mean that anyone can enter and take what they want from my house. Same as my computer. The action of downloading is at question not making the article available.

Grandparent: To use your analogy, if you leave the front door of your house open (while you're away), you should expect that someone will come in, and if you're lucky, take something.

Parent: There are few people I know that lock up every door and window before they leave the house (I live in a small town). I've been to rural areas where people leave their keys in their cars. In both cases, there is no expectation of B&E or theft.

What the Grandparent is saying is that the original post used the wrong analogy in saying that 'just because his door is open doesn't mean people can come in and take what they like.' The reply to that was (in very simple terms) that by using Kazaa, the proper analogy would be to say 'I'm leaving my front door open while I leave town. Anyone who wants to come in and take stuff is welcome' (we'll ignore the fact that in Kazaa world, files are not taken, but copied (I hate that tired argument on semantics))

So to sum up, grandparent didn't say people who leave their door open EXPECT people to come in and take stuff, but if they're comparing it to such an activity as using Kazaa, then the analogy needs to be reworked. All caught up now? Good.

Re:Please try to pay attention

[emptybody]

However with KaZaa, the user is supposed to follow the rules and not download anything for which they do not have license to access.

Just because you CAN do it does not make it right.

And I, for one...

[filmsmith]

Welcome our new RIAA Overlords.

But...

[medscaper]

I had $17,500 worth of software (again, in a case) stolen from my truck.

...as an aside. I almost forgot. The idiot who broke into my truck left the software CD case on my neighbor's car when he broke into THAT one. Got some more sunglasses and two music CDs.

Apparently, not everyone's aware of the value of software. Or maybe they were, and afraid to get tracked with it. I dunno. Either way, the software was returned to me within a week of the theft and the claim got cancelled. The cops found me by finding a backup of my resume on one of the CDs.

Can someone explain how SHA1 does this

[hackorama]

In this article

it states

"Compare this with SHA-1 & RIPEMD with which no such forethought is necessary (because no B can be found that hashes to the same M with these two alternative algorithms)."

I would have thought that any hash algorith would *theoretically* have collisions. Can somebody smarter than me explain this.

Thanks.

Re:Can someone explain how SHA1 does this

[Anonymous Coward]

It means that given an arbitrary hash value M you can't pick an input to the hash B that will produce the same hash without resorting to a brute force calculation.

mod parent up

[Anonymous Coward]

please, dear moderators.

Please Mod Parent Up

[Anonymous Coward]

It's the funniest thing that I've read here all week!

Very off topic, but...

[joeykiller]

...speaking of MD5 hashes and MP3 files, have any of you heard of a tool that matches "fingerprints" of sound files without ID3 tags and downloads these from the Internet and tag the ID3-less files?

I mean I once read about something like that here on Slashdot.

It should be doable: The latest Linux Magazine had an article by Randall Schwarz, describing how to break down large images into small 16x16 normalized version, and how these could be used to determine which images on his hard drive were identical or near-identical.

I think this is interesting.

[SatanicPuppy]

The RIAA is trying to confuse the issue in many ways. Part of it is that they're treating CD's and music as 2 different things.

When you buy the CD you're not buying rights to the music at all. Fair use for them covers little more than the right to play your own CD, just not in a really big crowd. If the media is destroyed, you no longer have any rights to the content, because the content isn't what you paid for.

In this sense, whatever happens to your CD's your rights are gone. If you can't play them for any reason, that's your tough luck.

The thing is, you're not really buying a physical thing. What you're buying is content. Not to say that you have unlimited rights to it, but it is clear that you DO have rights to the content, otherwise there would be no possible justification for charging 18.00 for a .25 cent piece of plastic.

That being the case, it is crystal clear that you have a right to backups, seeing as you paid for the content. But what is unique about your CD? Nothing. Someday they may try and watermark every single CD, but not today. So what distinguishes your backup from someone elses? A few random numbers of a hash algorythim? Doesn't seem like enough to deny you your right to the content that you've paid for.

Just my opinion.

Re:I think this is interesting.

[Anonymous Coward]

In the same breath you state "...because the content isn't what you paid for..." and "...What you're buying is content..." I think you're on to something, but it falls flat there. I'm not bashing, because I'm equally confused. I don't think anyone, anywhere has sufficiently explained what exactly we walk out the door with when we leave a record store with our purchase. If it's a physical replica of a master of a recording, and I paid for it, I should (pursuant to the rights embodied in other media and products) be able to do quite a bit with it without worrying about content owners and other suit-wearing monkeys. If it's merely a small set of rights, I don't see how those rights vanish when I lose my CD, or it is destroyed in a fire or stolen. I never signed an agreement _ nor entered into one implicitly _ that waived my continued rights to consume that media content product. So what do I own now that I've purchased the latest John Mayer CD? A CD that sucks, or the rights to listen to a CD that sucks? Who knows?

Re:I think this is interesting.

[SatanicPuppy]

I should have been clearer.

I think the RIAA believes that you're buying a piece of plastic, which happens to have content on it, and that all your rights to the content hinge on the plastic.

I personally think that you're buying rights to the content, which makes the CD itself immaterial as it is simply a medium, with no inherent value.

checksum calculations

[butane_bob2003]

This must eat quite a few CPU cycles. Any idea what kind of machines/software the RIAA is using to perform these operations?

Don't like the RIAA? Don't Buy.

[Anonymous Coward]

If you don't like the RIAA's jackboot tactics, there is a simple solution. Don't become a consumer of their products. Buy independent music.

I don't believe the AHRA made a distinction

[TheConfusedOne]

Analog only. Fair use doesn't cover digital as far as I can tell.

Notice that it wasn't called the Analog Audio Home Recording Act. You can also look at the huge battle that they had over DAT's and the Serial Copying functionality that they put in it. (You were allowed to only make copies from the original.) That would suggest that the act covered digital as well.

The NET Act is a complete travesty. First, it incorrectly tries to shove the word THEFT back into the debate. Second, it completely redefines the criminal laws. (The fact that the NET Act was lobbied for also would go towards showing that the AHRA covers digital since they needed this additional law and language.)

There's no real length for excerpting things. This is why Fair Use is an affirmative defense that is interpreted by the courts. It may be necessary to excerpt almost all of a song as part of a critical review of it while you may only need to point to the quick lick that a rapper lifted for another review.

Re:I don't believe the AHRA made a distinction

[3terrabyte]

Analog Audio Home Recording Act

Heheh, well, maybe it wasn't named that due to not having to describe a medium that wasn't around at the time. (at least at consumer level).

DAT's and the Serial Copying functionality that they put in it......That would suggest that the act covered digital as well.

Actually the Serial Copying was something that was specifically mentioned in these laws. Mfg's have strict guidelines they have to follow. But this nasty 'general use' thing called the computer doesn't fall under that, so I'd still argue that the "old" Fair Use laws covering 'digital' still hasn't been addressed. It's been a while since I've read up on it, so I'll have to concede further debate on that.

This is why Fair Use is an affirmative defense

Best description of the day!

Re:I don't believe the AHRA made a distinction

[lynx_user_abroad]

You can also look at the huge battle that they had over DAT's and the Serial Copying functionality that they put in it. (You were allowed to only make copies from the original.) That would suggest that the act covered digital as well.

But even on a DAT, it's not a digital copy. That was the point. When you use a DAT to make a (digital) copy of a (digital) original, the "copy" will not be the same because the I'm an original/I'm a duplicate bit will be different.

There is nothing in my reading of the HRA which could be interpreted to allow perfect digital copies of copyrighted material in a commercial setting. "Digital" was covered under HRA only as far as your "digital copying device" enforced "analog-like" limitations.

Exact Audio Copy

[balthan]

ExactAudioCopy is ripping software that will allow you to make exactly the same rips using differents computers with different CD-ROM drives.

If two people start with the same source, it is entirely possible they will encode with the same options and produce the exact same file.

An example of RIAA's subpoenas

[Anonymous Coward]

Available online here.

Here's one for ya.

[SatanicPuppy]

I share files. I share a lot of files. Video and audio; no porn or anything gross, but if you want an episode of the simpsons or south park, I'm yer guy. I share music too, and a good bit of it I own on CD.

Here's the thing. I never rip anything. I've got a nice fast cable connection, and it's not worth it to me to go dig through my car looking for something when I can just grab it online. So everything that I share is content provided by some hypothetical individual way up the chain.

So who is to blame for this? Say I grab a file from some guy running on 56k, then I distribute that to 3 million people. According to the RIAA I would be liable for 3 million downloads, which is fair, but so would the orginal guy, which is clearly not, even though he was the original violator, and the only person in the situation who definitely owned the media. The reality of the situation would be different still; I'd probably upload it to a couple dozen people (my upload pipe is pretty skinny), and they'd all upload it to 12 people, etc. And ALL of us would be liable for the 3 million downloads, which is completely absurd.

Part of the problem is, there isn't any real way to tell, aside from having my ISP provide an exact record of the stuff that came and went from my computer, which I know for a FACT they're not doing (since I work for them). So there is no way to know how many times the file has been shared. I sure as hell don't know.

Since it is impossible to determine how many times the file was shared, it is impossible to know what the damages ought to be. The RIAA is going off on this hypothetical crap, "Millions of times! Billions of dollars!" but there is no way they're going to be able to hold that up in court, especially not with so many defendants. If nothing else, their inability to prove damages is going to hurt their case. I can see a jury levying a multi-million dollar judgement on a huge corporation for the benefit of some everyday joe, but I really can't see them doing the reverse.

Just my opinion.

OT: your sig

[Theaetetus]

"DEG DED {DE}F ED CBCA..." (George Gershwin)

Should be "DEGG" in the first group. He hits that G twice.

-T

from the Napster network ..

[Anonymous Coward]

umm.. didn't anyone tell these guys that "The Napster network" is dead?

What's the point in tracking mp3 files from a "network" that dosen't exist anymore?

Maybe I'm missing something, but that just seems pointless to me!

Steganography to the rescue!!!!

[VORNAN-20]

A suggestion - there exist steganography tools that will embed jpeg images into audio files, usually by tweaking the lower order bit of some of the 16-bit samples in the wave file. If you embedded a jpeg of something appropriate (a big poster that read "Fsck the RIAA" somehow seems right) then it would totally confuse any fingerprinting of a wave file.

Note that the RIAA's fingerprint generation may not operate on the whole CD track but rather on certain parts of it, so you would really want something that would affect most of the song. A well-designed stegano picture-camouflager would probably not affect the sound quality of the final result even to most golden audiofile ears. I believe something similar could be used for MP3 files.

Re:Steganography to the rescue!!!!

[sharph]

To do this, you would need to decode the MP3, reandomize or encode a picture into those least-significant bits, and reencode. This would destroy sound quality. MP3 is a lossy format. It's going to sound crappy if you decode it and reencode it.

Re:Steganography to the rescue!!!!

[Anonymous Coward]

You're forgetting that some of us actually do own the CD.

Re:Steganography to the rescue!!!!

[sharph]

If you already own the CD, why are you downloading the MP3.

The RIAA is going to base their chksums on songs they download off the net. Things get unpredictable with multiple bitrates, VBR, different ID3 tags, etc.

RIAA Adopts High-Tech Gumshoe Tactics

[$exyNerdie]

RIAA Adopts High-Tech Gumshoe Tactics

Re:Giving someone what they already have, is illeg

[anthony_dipierro]

Sending the MP3 files to someone they knew already had the CD, was ruled to be copyright infringement.

When done for a for-profit purpose. I don't think a court would rule the same way if it was the downloader on trial. That would seem to fall under fair use.

MD5's work both ways

[Anonymous Coward]

Remember that thing a few months ago about a fake Madonna clip? A P2P system can have a known-bad list that can prevent something from even showing up in the offerings/search. Known-good MD5's would help finding the real thing, ignoring low-quality encodings, partial-file encodings, etc. See caezarschallenge.org results from DEFCON 9.

Almost, but not quite

[Fareq]

If you accepted insurance money for the CDs, then, while the license to listen to the music still exists, you have transferred it to the insurance company who paid you.

If you total a car, the insurance company will give you X dollars and TAKE AWAY YOUR CAR.

When you buy insurance, you are buying a guarantee that, in the event of loss/damage, that the insurance company will buy your stuff at a "fair" price.

What if she did buy those CD?

[glenrm]

1000 songs and 1 movie, that is about 90 CDs and 1 DVD, she easily could have bought all of these, if she has all of them in her collection she not only has a stronger case, but she was obviously a good customer. Are there any open-record labels or bands that distribute music via MP3 and encourage that the music be shared P2P? What are your favorites?
Digital and Direct is the Future

Re:What if she did buy those CD?

[shark72]

Would not make a difference. She was nailed because she was distributing copyrighted material, not because she downloaded it. If you're distributing copyrighted stuff without the owner's permission, whether you bought it or downloaded it doesn't have much effect.

Re:What if she did buy those CD?

[glenrm]

It might make a difference to Senator Coleman, it might make a difference in efforts to amend the DMCA. But you are correct it would not make a difference under the law or to the judge (if he is one of the 95% of judges that follow the law as written).

Re: Yup, Quite

[Khlatu_Barada_Nicto]

If you total a car, the insurance company will give you X dollars and TAKE AWAY YOUR CAR

Right, this is a poor analogy because you need the physical car to receive any benefit from it.

A much better analogy would be a highly ornate copy of your university degree in an expensive frame. Cost you $250, if it burns up, insurance company gives you $250 and gets to keep your burnt up frame and degree, but YOU still have right to use the benefit of what the degree you EARNED bestowed upon you, your title. The insurance company may have "bought your stuff at a fair price", but they didn't buy the rights and privileges bestowed upon you by your original purchase of your education.

Your argument suggests that if the degree burns up, you're no longer an Enginering M.S. and you have to go to school again because the insurance company reimbursed you for the physical object. Not the way it works.....

doped files

[c0d1]

Regarding the comment about identical hashes from identical rips in the original post...

The assumption made by aSiTiC is that they are tracking arbitrary files ripped and tagged by an unknown individual. Given this context, it does seem like it would be hard to tell a legitimately ripped MP3 versus one "obtained" via file swapping.

However, it would be a far easier task to track MP3 files which have been purposely "altered" to produce a distinctive hash that is different from the hash produced with an MP3 ripped from the original CD.

Done this way, it becomes far easier for the RIAA to prove that the MP3s you have were obtained improperly, since they are different from proper rips and, further, are identical to "known" illegal copies.

Anyway, for what it's worth, this is my guess as to what the RIAA is actually tracking.

Lets hear it for ogg!

[Anonymous Coward]

So, I just tested this out. Since ogg uses variable bit rates:
oggenc ./noartist/unknown_disc/23-track_23.wav -o 23.1.ogg
oggenc ../noartist/unknown_disc/23-track_23.wav -o 23.1.ogg
oggenc ../noartist/unknown_disc/23-track_23.wav -o 23.2.ogg
lame ../noartist/unknown_disc/23-track_23.wav 23.1.mp3
lame ../noartist/unknown_disc/23-track_23.wav 23.2.mp3
md5sum ./*
811d4be6827f70fb0ce810e742eaa50c ./23.1.mp3
5481dfa57a190bb559aa99a0cc578984 ./23.1.ogg
811d4be6827f70fb0ce810e742eaa50c ./23.2.mp3
5c4f2df9ef3fcb88d964101b09450f61 ./23.2.ogg

So what?

[Cyberllama]

Yeah, I download my mp3's from the fasttrack network. And yeah, my hashes probably match many of those on other people's systems. But you know what? I own the cd's for them anyways.

You know why I didn't just encode them myself?

Because its *FASTER*. I can download the mp3 in literally seconds as opposed to the minutes it takes to encode them. Does the RIAA really think they can make a legal distinction between encoding songs off of cd's I own, and downloading songs off the internet that are from cd's that I own?

If that's not fair use, I'll eat my hat. . . My tasty, delicious hat. . .

Just ask!

[khrtt]

I will be happy to provide you with the md5 of all the mp3 files that I posess (legally, duh). You can post files with identical checksums, then.

Then again, how the heck are you gonna make them have identical md5>:? Do you have access to that linux supercomputer from yesterdays article?

Stolen

[taernim]

I always used to get in arguments with people over this:

I had 250 CDs stolen 2 years ago at a hotel.
According to Washington State laws, the hotels are not responsible in a case like this.
My insurance wouldn't cover it.

So what do I do?
I *paid* for the content... should I be able to download the albums I was missing?

I'm sure the RIAA would say no, but that's bull. The problem is they don't want ANYONE downloading, regardless of their reasonsing, and that's part of the problem.

easy ways to defeat this

[Anonymous Coward]

Since any change to the file will change its MD5 sum, you can play with the ID3 tags, or add "a moment of silence" at the end of the track, neither of which would further degrade the content.

Change a few bits...

[Anonymous Coward]

If they are using an automated process based on checksums to find stolen songs (as opposed to actually listening to the songs), then it should be possible to completely shutdown their ability to find matches by sprinkling a few random bit changes throughout the files.
If every user did this on every download, all files would be different and the automated methods of investigation would be ruined. Interestingly, digital audio (and video) can suffer a great deal corruption and not suffer and perceivable difference...

Birthday paradox

[Chazman]

If you were to examine 2^127 different files, then you would have a 50% chance of one of them giving you the desired MD5 hash. Do you know how large 2^127 is?

Actually, due to the birthday paradox, the odds of finding two files with the same 128-bit MD5 hash increase to 50% at somewhere closer to 2^64 files examined. Or at least, so argues Bruce Schneier in Practical Cryptography. And the argument seems to have some good sound mathematical basis.

Of course, 2^64 is still pretty darn big. In the general case where there isn't a potential common source for the two files, certainly still big enough to prove the link between the two files beyond a reasonable doubt.

But I'm still going to counter your argument in this case -- if two people buy the same CD, and each rips that CD cleanly, then the inputs to their respective MP3 encoders are identical. There are but a small number of MP3 encoders out there (what, a dozen, maybe three dozen? certainly no more than a dozen that are in common use by average people). Most people don't change their encoder options from the defaults, and most rip at 128kb. Most of those who don't rip at 128kb rip at 192kb. Encoders are deterministic. Same inputs and same settings mean same outputs. Now all that's left is the id3 tags. We've got CDDB / FreeDB homogenizing them. So I actually find it significantly likely that two people could each rip a song from their own store-bought copy of the same CD, and end up with identical MP3 files. In this case, the MD5 hash match means nothing -- sure it proves that the files are identical, but with such a high probability of arriving at legitimately identical files independently, it does nothing to prove that one file was copied from the other.

Re:Birthday paradox

[Anonym0us Cow Herd]

But we're not looking for any two files with the same hash. We're looking for another file whose hash matches a specific value.

Let me say it differently....

We're not looking for two people who have the same birthday. We're looking for another person who has MY birthday.

Time for a new ID3v2 header field...

[Max Threshold]

RIAA_MD5_CONFUZZLE

If you what the same hash

[zakezuke]

I find it shocking that we naturaly assume that cd to HD copy involves *ripping*. Somewhere around here I have an old toshiba 2x drive which doesn't offer that new fangled protected track protection. It will copy tracks as files without *ripping* without bit errors.

I think this is easily circumvented

[HanClinto]

Why not just change a few bits in the file after it's downloaded? Use an open-source P2P client and have it modify the file after it's been downloaded. Much like Kazaa lets you change a file's description yet it still associates that file with the other otherwise identical files on the network, change a custom field in the file description which alters the MD5 sum. I'm sure it would be trackable, but if everyone did it for themselves in a non-standard way, the RIAA would have a hard time keeping up with all the methods people make for altering MD5 sums.

MOD UP PARENT

[Anonymous Coward]

obligatory text

Simpler Method

[Anonymous Coward]

Why not just set one obscure key of the ID3 tag ('comment', 'year', 'genre', et cetera) filled with a random string? If people learn to leave good random data in the comment feild, all (~) md5 hashes would be unique. I just wrote a shell script to crawl /media and randomize my ID3 data; I'll publish it if you'd like.

The RIAA *can* blank the ID3 data before comparing files, but that's a lot more hassle for them, and no loss whatsoever on our end. Or someone could just write a utility that adds 0.000002 seconds of whitespace at the beginning or end of a song. (With my 6.1 Bose setup, I resent the thought of my MP3s becoming glitchy; At present, they sound like CDs)

Just hold on a moment there.

[The Revolutionary]

You aren't the one producing the music.

What if the artist wants the RIAA lifestyle? What if the artist wants big money to produce a music video and use high-end studio equipment?

If that's what the artist wants, I say go ahead. I have not, do not, and will not purchase their music of course, and while I do not infringe copyrights, I will encourage others to share these artists' music at will, but by all means, if what you want is to have an album put out by an RIAA member studio, it certainly seems that it is within your rights to do so.

I suspect that most artists, as much as they may whine about the RIAA and member studios, will not give up the lifestyle afforded them by being on a big label, even after or when their contracts allow them to.

Sorry, nice try

[coinreturn]

Perhaps if the insurance company had reimbursed you for the entire cost of your education, your argument would apply.

However, the CD is a tangible object and does not grant you any such rights as infinite copies forever, no matter how much you'd like to read into the fair use doctrine. If you can replace it so easily for free, you should not have been paid dime one by the insurance company since by your argument, the physical CD has no value. I will allow they could give you a blank CDR.

Could you.....

[ziggy_zero]

...circumvent this by burning all of your mp3's to audio CD's then ripping them back? I know it would be time consuming, but it would make it look like you ripped them all, no?

Re:Could you.....

[UrGeek]

Why burn them? Just either trim the MP3's or add a .1 second of silence. Strip the ID tags or update them. Better yet, convert to Ogg Vorbis!

CDs covered in my house fire.

[coinreturn]

I was actually surprised my insurance company paid for CDs lost in my house fire. Thankfully, mine were undamaged downstairs and all that were damaged were my daughter's NSync, etc.

Insurance paid for audio CDs and software minus depreciation (full value for what I actually replaced - not the NSync!)

crime

[Anonymous Coward]

it seems to me that with the RIAA downloading all of a user's files to inspect them they are risking copyright infringment themsleves. If you so happen to have a song on your computer that they do not possess the copyrights for you could counter sue the RIAA for illegal downloading. my question is how is it a crime to allow people to download? the riaa only knows that they downloaded the song from you, not that anyone else has done so. leading to the conclusion that there would only have been a crime committed if they didnt have the copyright of what they downloaded. if the riaa had record of you downloading a song from someone else then they could investigate you, otherwise it seems they have no record or proof or true suspicion of a crime. an analogy of their current investigation model is peering in windows of peoples homes and getting warrants to investigate the houses of people who own many extravagant items for thievery.

Re:crime

[Tonttoro]

IANAL, but would like to answer your question: my question is how is it a crime to allow people to download?

That is called copyright infringement, you are not authorized to distribute copyrighted material you do not own, or have license to distribute. There are exceptions to this, you could copy material for close circle of friends, etc.

Re:crime

[man_ls]

Nice thought, however, I think that by sharing a song that *you* own the copyright on, over a P2P network, is implicitly giving permission for anyone to download it: including RIAA.

Prohibition

[Anonymous Coward]

Not supporting child porn in anyway but...

Some laws are actually outdated... The selling and consumption of liquor for example was outlawed at one point in american history.

It was considered to be an idea that no one liked nor something that could be enforced.

Technically I would say that trading mp3s is less damaging to society and less lethal (take drunk driving and public disorder for example) than such digital activities.

Wait a minute....

[Anonymous Coward]

....so the RIAA is downloading unlicensed files from P2P networks, right? THAT ILLEGAL! Arrest them!!!!

RIAA makes Communism look good.

[Anonymous Coward]

Every day I hear another new quip about the RIAA it reminds me of the author of Tetris... Which invention sold millions but all the profits went to the state. Russia and China... Mother bed to all that is piracy.

Then again... Perhaps there should be gulags for corporate lawyers with demonstrators in the street holding pictures of matyred students arrested for sharing software.

But seriously... I think there needs to be a revolution... CEO's should be shacked with limitations of $300,000 a year and no stock options. MTV productions should be exiled or sent to Alaska to work hard labor.

And the goverment should spend all it's resources to a 5 year plan of bringing fiber optic cables to each residential place in america. Outlaw outsourcing to other nations in technlogy field. Outlaw copyrights and patents all together, unless you make under $50,000 a year.

Sure that would bother allot of people, but current situation is no longer acceptable.

Or all the technocrats should pool a fund and purchase a nation and we could move to it thumbing noses to the great imperialist RIAA.

Of course I think it would be Animal Farm all over again...

Precedent for dismissing this RIAA action

[Anonymous Coward]

I remember a case where a man and woman in a car were charged with a crime on the basis of the color of the clothes they were wearing and the color of the car. The eyewitness couldnot ID them personally, so the prosecution got a statistician to say that the chance of the another man and woman in a car fitting that exact description was so low that it was extremely likely (something like 99+%) that it must be them. But the judge struck this argument. Surely the RIAA counting on MD5 hashes is a variant of the same argument. Even if you want to argue its 99.99999...% likely, it comes down to the random number generator and we all know those are far from random

Roadrunner cable users already subpoenaed

[Anonymous Coward]

The idea that AOLTW customers are not receiving RIAA subpoenas is a myth. Look around EFF's site for the area where they've scanned PDF copies of all subpoenas... The one issued for "Munkeyspanker21@KaZaA" was sent to RoadRunner, which is operated by AOLTW.

Randomizing MD5 hashes using VBR

[Krellan]

How long is it until someone makes a quick patch to LAME (or other popular open-source MP3 encoder) to slightly randomize the VBR bitrate decisions?

In a typical VBR song, the bitrate changes so fast that changing the bitrate of a few blocks would be unnoticeable. It would have practically no effect on the sound quality. Oftentimes, a block will be right on the edge, say between 112 and 128 kbps, and the encoder will have to make a decision on which one to use. Currently, the encoder just follows the same strategy each time, rounding off to the nearest bitrate. A patch could make it random, instead of deterministic. Nobody would know the difference, and then each and every MP3 generated by the encoder would have a completely different MD5 hash, even when using the same source material!

Come to think of it, this technique could also be used for tracking of purchased MP3 music. Every time a customer downloads a purchased track from an online music store (like iTunes), the MP3 could be generated on the fly, and slight variations could be introduced in the VBR bitrates. This could be used to embed a "serial number" into each MP3 track. Then, when the track shows up on Kazaa or whatever, it could instantly be traced and the person who leaked it would be known! That would strongly discourage people from leaking purchased music.

I'd be very surprised if this isn't already being done... surely I can't be the first person who has thought of this....

Ripping personal music collections

[Oshkoshjohn]

I have ripped about 200 albums from my collection of CD's. The tracks are all at 320kps, which, although it takes a huge amount of space to store, means they are unlikely to be confused with the 64kps crap that tends to prevail for file-sharing. Also, ripping, instead of directly copying, allows a person to have the contents of more than one album on a single CD. The main reason I chose to rip my albums, however, is that if my in-car music is stolen or damaged, I've lost approximately fifteen cents per disk.

Mixed Feelings

[ragingmime]

Should that read: "Now may be the time to stop cheating people and start paying for your music!"

I dunno... I have mixed feelings on the whole record industry thing. While I try to respect people's copyrights and don't use filesharing software, I don't like a lot of the record industry's practices, and so I don't have a whole lot of sympathy for them when they complain about people stealing music - especially when said people wind up purchasing that music if they like it.

That said, $19 is an outrageous price for a CD (that's generally what I saw at the Virgin Megastore the other day), and when I buy a CD, I want to be able to rip it onto my computer for easy access, or make Mix CD's or whatever. Copy protection is unfair, and at any rate looks like it's easily broken.

The solution to this isn't to steal the music; it's to start supporting the little guys who don't gouge you like the big labels do. After downloading a bunch of free songs by the Jazz-Electronica group Subthunk, I had good reason to buy their $11 CD from their website. MP3.com has some good, free music and cheap CD's if you're willing to do some looking, not to mention Ampcast and a bunch of other, similar download sites and independent labels.

I don't support posting copyrighted material on the Internet, but I do think that the RIAA should loosen up. The best way to get them to do that is to help the little guys give them a run for their money. It's been said before, but I'll say it again - vote with your wallet!

Copyright: consumer right to make a copy?

[lpq]

Please doon't laugh, but I thought a part of copy _right_ was the right
of the consumer to make a copy of the work obstensibly for archivie purposes -- like playing the copy and saving the original as a master to make more
copies of CD or works thare are destroyed or lost. Perhaps (and easily),
I'm incorrect, but wouldn't copy prevention violate my right to make a
usable copy "? I don't know, but I don't think it is required that the
format of the backup be of the same format as the original (i.e. - copying
from a CD to tape or disk should also be permitted.

The best piece of contextual bullshit I saw recently was on some artwork, The Blue Fairy that claimed
to be copy protected. Of course it scanned in just fine into my computert
and makes for a nice computer background --- which was the primary reason
I bould it, though you couldn't read their shrink wrap license until
you opened the padciage. Specifically they said you couldn't use it as
a private screen background or in a craft project (i.e. -- cut the picture
into pieces and make a collage). Near as I can tell, they have no legal
backing for their 'fluff' and to my knowledge copy protected isn't a
legal term and I'm not sure the pidture is actually copyrighted -- maybe
just copy protected!
---shrink wrap pictures that you can read until you open the picture.

Next thing, you'llh ave a shrink wrap on a book that says you are not allowed
to store the contects in your memory or related a synopsis of a book to
another person or to write a book reifview;. Can you say joke? It will
only get worse when people have electronic eyes that transmit images to
memory stored in their brain (cybog tech). What if the person is
genetically enhanced with a photographic memory? Will they be barred
from museams and such?

Its like all the bogus patent on technology that has been developed independantly by more than one person at the same time, implemented, then one of the implmentors shows that they had filed the first patent -- The purpose
of the patent was to reward inventors for bringing something useful to
society -- but if it was so obvious that 400 or 1000 people did it at
the same time, can it, or should it be patentable?

Baloney is getting deeper all the time
-l

Re:Incitement

[Evil Adrian]

If you are comparing blatant theft to the American Revolution, you have no idea how to draw parallels, or even how to reason logically.