Software To Stop Song Trading

Shippy writes "Palisade Systems is about to launch new software that can identify and block copyrighted songs as they are being traded online. However, the article fails to mention that it will also stop legal song downloads. The software blocks anything that's copyrighted, whether you already own the song in another format or not. Here's some snippets from the article: 'If installed in a university, for example, it could look inside students' emails, instant messages and peer-to-peer transfers...', and 'Jacobson said the identification process would not work on an encrypted network, such as is used in several newer file-swapping programs. However, the Palisade software could also act to block those applications from using the network altogether.' Great."

Comments

And, thusly...

[McCrapDeluxe]

Encrypted protocols increase in popularity.

Re:And, thusly...

[NtroP]

The article claims that the software could block encrypted communications, apparently indescriminantly. I wonder how that would affect legit transfers like scp, ssh or vpn connections.

I'm probably talking out of my butt here, but what if, instead of the entire "stream" being encrypted, just the "content" was, with a one-time, mutually agreed upon key? How would their software know the difference? It would never have the same "fingerprint" twice. Would it just block any traffic that looked like random noise?

I can see this software pissing a lot of sysadmins off - could you ever be absolutely sure those "ghosts" you've been chasing weren't this software being over zealous?

The parent is right though. This will just prompt those who wish to trade on P2P to take it to the next level. Especially now that the "Big Five" labels are trying to force Apple to charge $2.50 per song! If that happens I will stop buying songs from iTMS and say "screw the bastards, release the hounds", P2P here I come!

Re:And, thusly...

[LostCluster]

There's no way that any piece of software would be able to peek into encrypted sessions... so the only option this software would have would be a "deny all".

Seems like this could be useful as something a college could threaten installing unless P2P violators knock it off... but would be trading off quite a bit of legit functionality to ensure zero violations.

Re:And, thusly...

[Anonymous Coward]

I think the question he was asking is how could the software tell if the communication is encrypted.

Re:And, thusly...

[zenthax]

Isnt SSL also encrypted? So does that mean no more online shopping and banking?

Re:And, thusly...

[Nadsat]

Yes, McCrapDeluze: what you describe is the blowback, the reaction against the controllers.

Technology tries to liberate. Technology was once thought of as the essence of freedom's revolution itself. Recall Apple/1984... recall www-idealism. Then technology turns against itself and tries to control. Porn regulation, satillite cameras, fingerprints, RIAA server-side 'intellectual property' monitoring. Liberation vs. control. Hacktivists and regulators engaging in battle royal.

Sure there are always loopholes and entropy... but I fear the capability of technology to regulate and control will become so strong and so automated that only the most astute hacktivists or fleeting script kiddies will find sanctuary, leaving the rest of the populace to graze like sheep on genetic grass.

Re:And, thusly...

[kmonsen]

And, it would be quite illegal as well, or? I thought that was one of your wonderfull new laws that med cracking codes illegal. So it would be enough to just encrypt it in a simple way, since it is illegal for them to try to decrypt the files.

Re:And, thusly...

[j.bellone]

You see, every college that installs this will just piss off the students in the college. It will eventually prompt someone to write an application (if one isn't already written) to bypass this.

Look how Napster started... at college.

Re:And, thusly...

[Clovert Agent]

Network security devices do this with SSL by proxying the connection so you think you're connecting to the remote site by SSL, but in fact it's only as far as your perimeter, where it's managed (scanned, audited, etc) and sent over a new SSL connection.

There are lots of ways a P2P app could prevent that from happening of course. But then it might be easier to detect and block outright. Cat and mouse, as always.

wouldn't it be simpler

[tsunamifirestorm]

to spend money and give students a paid subscription for music downloads (some colleges have) then spend money tracking file sharing?

Re:wouldn't it be simpler

[Anonymous Coward]

I attend a Big 10 School, and while
interviewing for a tech-related position with
the head of dorm network-type stuff, I was told
that well over 90% of the internet traffic (barring worms and the like) can be attributed
to file-sharing. With the tightness of funds
that today's universities are dealing with,
maybe that bandwidth money could be better spent.

Re:wouldn't it be simpler

[FlipmodePlaya]

Actually, it would be cheaper to do neither. The U of Rochester, up here, is doing that, and they are under constant criticism for the program. People tend not to like money being spent on music for others (Windows users who live on campus) as opposed to their education, after they had paid for the latter. I don't see why a University is liable for the actions taking place over its network anyway... Make the students agree not to do it, so you can't be blamed, and let the RIAA hang them if they do.

Re:wouldn't it be simpler

[FsG]

Simpler, perhaps, but not a particularly good idea. What gives my college the right to decide what kind of music I'm going to listen to, and whom I'm going to buy it from? Despite common belief, not all music is owned by the RIAA, and I certainly wouldn't want a part of my tuition going into the pockets of these monopolists.

Re:wouldn't it be simpler

[Alsee]

spend money and give students a paid subscription for music downloads

Pointless so long as the RIAA refuses to sell anything except DRM crippled crap.

Even if the college did jack up their fees and force such a subscription on me, I'd still take free non-crippled files (P2P) in prefference to "free" (pre-paid) crippled files.

If they offered ordinary MP3's they'd attract more customers. The RIAA's refusal to sell a non-crippled product is purely self destructive. It's not like they've ever kept a single song from reaching P2P by refusing to sell MP3's. Using DRM only accomplishes one thing - driving away customers.

-

Re:wouldn't it be simpler

[LostCluster]

With the tightness of funds that today's universities are dealing with, maybe that bandwidth money could be better spent.

Every college's Terms of Service says that their computer systems are for "academic use only" or some similar phrase, in part because they have to in order to get grant funding to pay for their bandwidth. You might not remember signing that TOS, but trust me, every student at a college has signed something when they accepted admission that basically binds you to everything the school ever puts out as a "rule" whether you bother to read it or not.

So, forget the dream that they have to give you totally unrestricted bandwidth as part of the price of your dorm room. They never promised that to you, so if it goes away, tough.

Colleges have mostly played dumb that P2P has been going on, trying to claim that they're just a common carrier that can't really coprehend what's fair and what's foul over their network. Once they start trying to block copyrighted content, they'll start becoming liable for whatever slips through their checkpoint.

So... that's why any blocks we're going to see going up are going to be whole-protocol blocks or bandwidth throttles. They won't be blocking in the name of copyright protection, they'll be blocking in the name of bandwidth protection...

Re:wouldn't it be simpler

[UID1000000]

This is a good point. Frankly make them sign a contract or a LOI stating that if they do anything illegal that they have to indemify the university of any illegal actions and take full recourse for the aforementioned.

But if 90% of their traffic is P2P why not make it all internal traffic thus eliminating bandwidth costs? If there is a way to do this for instance block the ports that P2P programs use, hell block all the ports except 80 and then setup a VPN client with all ports open but restrict traffic to being only internal. Then the bandwidth load is reduced by 90% and the traffic (which would probably cut down) might come down by as much as 60-70%.

If new items need to be introduced to the P2P networks on the campus then the students should have to go out and use their own, their parents or some cafes' then they can bring it back into the closed school network.

What do you think of that?

Re:wouldn't it be simpler

[alienw]

At least at my school, ResLife runs its operations on its own separate financial account. Therefore, all of that bandwidth is paid for directly out of the pockets of those who live in the res halls. Therefore, they have absolutely no right to bitch about how that bandwidth is being used. I suspect the situation is exactly the same at your school, too, and the department is just trying to be greedy.

Re:wouldn't it be simpler

[packeteer]

Your recomendations lead me to believe you dont understand how internet traffic works. Becuase of the nature of traffic that real academic work uses (basically all ports/protocols/speeds are needed) you cant simply block it all to webpages.

Re:wouldn't it be simpler

[Anonymous Coward]

Bullshit. Most universities have separated their residence hall network from their academic network in some manner (many have a completely separate ISP for their ResNet). So grant money has nothing to do with it.

We've moved beyond the "you can only use the computer network in your residence hall for academic purposes." Internet access is an expected utility for today's students, not a generous gift from the university or a special privilege. It's no different than electricity or telephone access. We don't place ridiculous limits on those services (imagine if we only let students talk to the their professor or advisor over the phone!) and we shouldn't (and many don't) place them on Internet access. Besides, how in the hell do you define "academic use?"

You're absolutely right that most universities block P2P and similar due simply for economic reasons. Many universities tried to increase bandwidth to keep up with student demand but it's proven impossible. And none of us want to play copyright cops. It's not our damn job to protect someone else's copyright.

Re:wouldn't it be simpler

[jrockway]

> you cant simply block it all to webpages

My school does. The internet is essentially useless. SSH in from your home computer (because you don't want to cart your tower home just so you can use eclipse; my computers at home won't run it quickly but they run X fine) and forward X? AHaahahahaaha that's a security hole!

CVS from sourceforge? Ahahahaha that's a security hole!

Check your off-campus email? Ahahahaha that's a security hole!

Vist a site running on port 8081? Ahahaha that's a security hole!

I'm also required to run an anti-virus program* on my Linux box. Linux is a big virus-spreading OS these days.

* Actually, I'm required to lie and say that I'm running Anti-Virus software. I'm not. You know why? BECAUSE THERE AREN'T LINUX VIRUSES ;) (Ooh but you can be a vector for transmitting windows viruses. Block email then, that's where all the fucking viri/viruses come from these days)

Yeah sorry. I'll be so glad to be out of this place (where students are expelled from privately writing a rap song about the math program) in 2 months.

Re:wouldn't it be simpler

[Brandybuck]

Frankly, it would be much easier to simply not give the students free internet access. Make them buy their own account, just like everyone else does in the real world. Then crack down hard on inappropriate use of the university network. I fail to understand why students and universities need special exceptions to the rules the rest of have no problems with.

Re:wouldn't it be simpler

[eyeye]

They should run an NNTP server then all the students can download from inside the network. That would really save bandwidth.

Re:wouldn't it be simpler

[packeteer]

two examples of linux anti virus follow/;

http://www.centralcommand.com/linux_products.html

http://www.drweb-online.com/en/index.asp
(included in some distros such as mandrake 9.2)

Re:wouldn't it be simpler

[singularity]

Reverse SSH tunnelling is your friend.

I have not had problems checking mail from anywhere.

WiFi. The 3rd Internet

[DigiShaman]

I guess it's time to start bridging those WiFi networks around the world. If you can't beat em, fuck em. I start file sharing over WiFi networks. I look forward to the days of local BBSes again. (WiFi BBS?)

Re:WiFi. The 3rd Internet

[name773]

ah, you must be an American
it would be far more interesting and fun to write a program to circumvent their measures as many others have found

Re:WiFi. The 3rd Internet

[dont_think_twice]

Posting this concept on Slashdot is easy. Doing it is a whole different matter ...

Mod the parrent down as a troll... nothing to see here.

I love it. Pure, honest intellectual fascism. Basically, you say "Your suggestion is impractical, so you should be modded down, and nobody should even see your idea."

I don't have any problems with your objections to his idea, but why insist that he should be modded troll for saying something that you disagree with?

Re:WiFi. The 3rd Internet

[lazybeam]

Hey there are wireless meshes starting up everywhere. I am running one in my city of 100k people - there are already 10 nodes after a few months. The uni here has always blocked all "external" traffic and has only 3MB/day allowance for the proxy server.

Re:WiFi. The 3rd Internet

[Lehk228]

your university only allows 3 Megs a Day!?!? I'd be packing my bags and make sure to let the administration know why i was leaving.

Encrypt everything

[Zorak Man]

Encrypt IM encrypt file sharing encrypt your email

Re:Encrypt everything

[Anonymous Coward]

You brought up something interesting there.
How many "encrypted" file-sharing tools are there?

* Waste
* Mnet
* Freenet
* Entropy

From what I know most of these are either not very popular (Waste, Mnet) or not suited to distribute large files (Freenet, Entropy).

Am I misinformed?

Re:Encrypt everything

[Ezel]

MUTE

Looks promising but not ready for primetime yet.

Hmm...

[LordK3nn3th]

How does this effect pay-for programs like iTunes?

Also, is this RIAA-only songs being blocked, or other songs? Copyrighted doesn't always mean "undistributable". Someone may hold the copyright to something but may actually let people distribute it-- am I wrong there?

Re:Hmm...

[darkewolf]

No, you are correct.

I write 'music'. I legally own the copyright, but for the most part I give it away free. Eventually going to press a CD or two but I'd prefer people listen to it, and that does mean filesharing is fine :)

Re:Hmm...

[maxbang]

No, dude. This actually looks at the sounds of files being transferred and compares them to an existing database of songs. It's not as simple as adding random characters.

Not a chance.

[rdsmith4]

This will never work - if it does in fact suppress the legal transfer of imformation, it's clearly counterproductive and stands little chance of ever being implemented. Universities are more reasonable than that!

...right?

what about my copyright?

[Bhull]

how do i tell this software that i want people to trade MY copyrighted music? if they block my file swapping would that be some sort of anticompetitive thing? just because the RIAA and its labels own the majority of music being traded doesnt mean that all the music being traded belongs to them.

'finger print'

[Mattwolf7]

But how can it determine?

Palisade's version of the technology sits inside a network, rather than inside a file-swapping program. If installed in a university, for example, it could look inside students' emails, instant messages and peer-to-peer transfers, seeking audio "fingerprints" that could be compared with information in Audible Magic's database.

If I send my friend an mp3 of me playing some music how can it tell that from me sending a copyrighted work? Is it reading the 'finger print' and then checking byte by byte? Isn't that going to kill traffic... But couldn't it be beaten by adding one extra byte to the file? Sending in another format?

Re:'finger print'

[jparp]

Apparently, you have to be a little more createive.

Supossidly it uses a technique called, Mel-Filtered Cepstral Coefficients to look for patterns in the audio output of the file. that is they dont check-sum the file, they play the file, and use there fingerprint technology on the way the file sounds when it is played.

This still has many problems. As other posters already pointed out, encrypting, archiveing, or simply renaming the extension of the content, would make it difficult to find. Unless of course, they plane on playing all the data on people PC's via every known music codec in existance.

Im assuming they actually look at peoples PC's as the problem of reasembling the packets would require identifyingm, emulating, and extending every p2p protocall known to man.

Of course, they probably figure they can find most stuff by focasing on kazaa and mp3's.

As another poster said. this might work. for about 10 whole seconds.

Re:'finger print'

[ajs318]

They certainly didn't mind the loss of quality when walkman cassettes were all there was.

MY Rights??

[Anonymous Coward]

When did trading copyrighted music online become one of my "rights"?

Funny, on slashdot GPL violators are on step below Charles Manson, while copyright infringers of music, movies, and software are somewhere below jaywalkers.

Re:MY Rights??

[dolphinling]

When did trading copyrighted music online become one of my "rights"?

When the internet was invented.

Re:MY Rights??

[Frizzle Fry]

Perhaps that opinion mostly comes from the fact that GPL are mostly violated by people with money to make yet more money without earning it, while copyright infringers (of the most common sort targeted by the music industry) are not looking to make a profit from thier actions.

If a company puts GPL'd code in their (closed) product, they save the money they otherwise would have had to spend to pay programmers to write equivalent code. If you copy music, you save the money you otherwise would have had to spend to buy it at a store. These are more similar than you seem to be willing to acknowledge.

Re:MY Rights??

[Anonymous Coward]

That fails in two ways:
First, my point was more towards the resultant use of the copyrited material. The company stealing GPL code sells that code to make an economic profit. The music trader listens to the music and does not sell it to others. They make no profit.

Secondly, many people still buy CD's, often moreso, after they are exposed to it online. So it seems that the companies do not usually give back to the GPL project if they decide to take something.

Re:MY Rights??

[deathazre]

and there's more than enough jaywalkers here at my school.

I've already lost all faith in ITS here, so I have no problem yelling at them if they implement something like this and it interferes with the legal stuff I do (say, IRC). Cable back at home's better than the school's network anyways.

Re:MY Rights??

[Oriumpor]

well uhh... they aren't checking for VIOLATORS sir... they are checking for ALL copyrighted material in the database... Transfering a song from one of my machines to another of my machines for my personal use, via EMAIL/P2P intercepted, and cancelled because it is copyrighted material is not protecting the copyright holder, it's preventing my fair use.

Re:MY Rights??

[PhxBlue]

When did trading copyrighted music online become one of my "rights"?

I think the fair question is, when did you lose the right to trade copyrighted music online? Especially under circumstances that are already allowed by Fair Use?

Re:MY Rights??

[brucmack]

Because trading copyrighted music online doesn't have to be illegal:

1) It could be paid for (iTunes or by tax on recordable media).
2) The copyright holder could wish for the file to be openly shared.
3) The copyrighted music has already been purchased on other media.

Re:MY Rights??

[JamieF]

>when did you lose the right to trade copyrighted music online?

That depends on what you mean by "trade". If you're talking about allowing anonymous strangers to make complete copies of songs from your computer that are copyrighted and not authorized for this kind of distribution by the copyright holder, then you never had that right. There is no such right. The rights belong to the copyright holder, except for fair use. Allowing unlimited copies to be made for free and given to anonymous individuals is not fair use.

Maybe the song is copyrighted, but the copyright holder has authorized free online copying of the song. Maybe you know the person you're giving the copy to, and you know 100% for sure that they have a legal license to that song, such as from owning a CD. Those are mitigating circumstances.

Just because it's easy to commit a crime doesn't make it not a crime anymore. Little old ladies don't fight back as much big beefy ex-cons when you try to mug them, but that doesn't make it less illegal, or less wrong. It just makes it easier.

Re:MY Rights??

[Soluxx]

Why do you assume that someone downloads an MP3 of a song would actually buy the CD if they weren't able to get the MP3?

Re:MY Rights??

[lysium]

If a company puts GPL'd code in their (closed) product, they save the money they otherwise would have had to spend to pay programmers to write equivalent code. If you copy music, you save the money you otherwise would have had to spend to buy it at a store. These are more similar than you seem to be willing to acknowledge.

That is not similiar. If I downloaded copyrighted music, and then incorporated that music into my own music for resale, then I would be committing an equivalent violation. Using downloaded music as an 'enterainment tool' is comparable to a company downloading GPL software for internal company use.

It's just a bad analogy, either way.

===---===

Umm...

[Ryan.Merrill]

Wait... it did say that it can look into student's emails and instant messages right? So basically it is giving the University free right to look into student's messages and claim that they are merely looking for illegal songs. There has got to be something that can be done by the students at these universities to block this. This is a total invasion of privacy. If any university tries to impose this onto the students attending, the students must do something. Hopefully we haven't lost all of our rebellious nature.

Re:Umm...

[dfung]

r4bb1t is absolutely right here. People get up in arms because GMail says they will read your mail to index it and that seems like an invasion of privacy. In fact, there's nothing that would stop AIM from capturing all your IM chatter.

Except of course, that if they did that, there's a danger that they'll become liable for the content of the information that's passing through. This arose before when it went to the courts as to whether ISPs are liable when their accountholders harbor kiddie porn on the ISP's computers.

If AOL/AIM had the ability to scan for possible terrorist actions, porn, or the next Columbine, and DIDN'T intercede, then potentially they would be open to enormous damages. If you were a 9/11 victim and you found out that AIM was the facilitator for planning an attack (and I absolutely am not implying that!), you can bet that AOL would become a lawsuit target after everybody realized you won't get a multi-million dollar settlement from selling the terrorist's apartment junk.

This issue of possible liability will probably prevent Palisade from getting anywhere. I'm sure that AIM reserves the right to scan your IM, but probably zealously makes sure that it's not doing that. Now, when they get a subpoena from the Justice Nazis, that's a totally different question.

Re:Umm...

[Undefined Parameter]

Lost all of my rebellious nature? Nope. I'll fight tooth and nail to prevent my uni from even considering purchasing one of these things, if I get a chance.

(And, unfortunately, they probably will; the MPAA came down on our IT department, a few years ago, because someone -- not necessarily a student, as it was summer and there are a lot more summer camp-goers than students here, during the summer -- was allegedly trading a movie that hadn't been released, yet. My uni's response was to immediately fold, shutting down internet service, then blocking some ports and bringing it back up just in time for students to arrive, and finally buying a packet-shaper a couple of months later. This last step has been the worst, since not one person in our IT department knows how to use the thing, no less use it right. It is currently being used to block gnutella, kazaa, and the other 'usual suspects'... as well as every computer game known to man. I'm not only assumed to be guilty, I can't even be a gamer, anymore, because it's "not an academic use of the university's resources." Sorry for the rant.)

Now, if you can get me a shotgun, shells, a kevlar vest, leather gloves, a hairnet, rock-climbing shoes, and a couple of alibis, I'll not only make sure that the students rebellious nature is not lost, I'll prove it by taking care of the packet-shaper and any other intrusive or offensive hardware/software! ;-)

(Note to the FBI and Homeland Security: I'm joking.)

~UP

Re:Umm...

[batura]

Uh, dude, they already have this right. This has been around in the user agreement at Universities for quite some time. When I went to the Dorms at UW, I believe I signed on to this with my living agreement, not to mention that you probably agree to this when you receive your computer account.

Stenography

[dduardo]

I wonder how this technology will hold up against stenography. Let me think about it for a moment. Hmm...

Re:Stenography

[Darth Coder]

Why, do you have a protocol for P2P via court reporters?

Re:Stenography

[casuist99]

Perhaps you mean Steganography?

Somehow I suspect it would not prevent file sharing via that sort of method, but there are simpler methods out there. If you're sending it to a friend, why not just PGP encrypt the file and send it to them? Then no one would know what you're sending, and it's a heck of a lot more secure than steganography (see recent posts on /., other sites).

Re:Stenography

[maxbang]

I think you're on to something here. Writing all of your songs in shorthand, scanning them, then emailing the resulting tiff files will prove no match for this anti-filesharing initiative.

What is needed..

[bcore]

..is a P2P app that can run over an SSL connection, disguised as web traffic. I'd bet that could beat this thing. Does such a thing exist?

Re:What is needed..

[dolphinling]

What's wrong with just plain FTP over SSL? No one's going to be blocking FTP anytime soon...

Re:What is needed..

[Rikus]

> ... disguised as web traffic

And it won't look the least bit suspicious when the host is connected to several other hosts, transferring encrypted data at full-speed 24 hours a day.

Re:What is needed..

[bcore]

And it won't look the least bit suspicious when the host is connected to several other hosts, transferring encrypted data at full-speed 24 hours a day.

Suspicious maybe, but surely this thing can't be designed to block anything that is remotely suspicious.. Maybe I'm wrong, but damn that would suck.

I guess uploading with it would be particularly suspicious and problematic though, given that the uploader would appear to be running a public webserver, which college campuses don't seem to like either.

Re:What is needed..

[syousef]

"What's wrong with just plain FTP over SSL? No one's going to be blocking FTP anytime soon..."

I work as an IT consultant in Australia and work on site most of the time. Our clients - banks and insurance companies - certainly do do block FTP and SSL. They usually block anything that isn't HTTP or HTTPS on port 80. This is a genuine frustration for me as I often want to send log files and software to the HQ of the software firm I work for.

To make matters worse one client I worked for had a policy of restricting access to external email and other content (games, porn etc.). They used web filter software which I won't name here for now. Lots of legitmate sites I'd want to get to for genuinely work related purposes were also blocked.

I wouldn't be at all surprised if this is the method adopted by large educational institutions in the end. They won't be able to fight large corporates for very long with the limited funding they do have. It will only take a handful of large law suits to sway them towards censorship.

Its an interesting world we live in now. It seems to have become standard practice somewhere in the late 90s to make product and then intimidate or sue your customers.

Re:What is needed..

[ultranova]

Oops. You can't sue someone for being suspicious. Yet :)

Yes you can. You can't win, but you can drive them bankcrupt trying to defend themselves.

It isn't about justice, it's about extortion.

Re:What is needed..

[Ark42]

Unfortunately, you can get written up for such a thing. Its the only thing I was ever written up for while at college. Go outside and go for a run at 12:30am? Campus police come knocking on your door and cite us for "Unusual Behaviour". Were we loud? nope. Break anything? nope. Go anyplace offlimits somehow? nope. 'We *could have been* raping people or looking into windows if people didn't close their blinds though'. Sure it was completely rediculous, and I fough it, and won, and had it removed from my record, but that doesn't mean everybody else will.

Re:What is needed..

[syousef]

HTTPS is HTTP _over_ SSL. Typically its a single port that handles web requests on 443. You can block all other ports for SSL, and still allow port 443.

Re:What is needed..

[rixstep]

What we should do...

Is use steganography.

We embed an MP3 inside a JPEG.

Then, just to really screw them up, we embed the JPEG inside an MP3.

Re:What is needed..

[Anonymous Coward]

Our clients - banks and insurance companies - certainly do do

Heheheheheheheh....do do

Re:What is needed..

[Anonymous Coward]

Dude. Move to a free country.

Re:What is needed..

[zcat_NZ]

Even if all your web traffic was encrypted, multiple https sessions to a large number of different hosts, and doing a lot of traffic is _much_ different from normal websurfing. They could reliably detect and block this if it became common.

Here's my suggestion. Open an https session, and pass some sort of simple 'obfuscating' key to the sender. This is a short https session that can't easily be distinguished from normal web surfing.

Then the sender obfuscates the data with your key, and send it back to you via a 'plaintext' FTP session. Nothing identifies the data as encrypted, but it's also not recognisable as a 'copyrighted' work. What are they going to do, block all ftp?

Re:What is needed..

[Shakrai]

We embed an MP3 inside a JPEG.

Then you'll get sued by RIAA and Compression Labs at the same time! Two for the price of one! Can't beat that.

Re:What is needed..

[IntentionalTort]

Yeah. You try that, and you'll be sued for misuse of legal process. For such a clearly intentional violation, punitive damages will be likely. Let's try it out: (1) institution or continuation of a criminal or civil proceeding against the accused (CHECK) (2) termination of the proceeding in favor of the accused (CHECK) (3) absence of probable cause for prosecution or civil proceedings (CHECK) (4) improper purpose of the accuser (common law requires malice) (CHECK under both standards) Anyhow, this entire discussion is partially moot: universities absolutely DECRY clamping down on ANY free speech rights. Hell, most won't even put up a firewall because of the "potential to block the flow of information." This is more likely to be a commercially supported venture, to make sure the employees aren't going to rack up any respondeat superior / acting within the scope of duty liablity.

Re:What is needed..

[sageman]

One easy way we found to beat the typical way of blocking programs (port blocking) was to write and algorithm that changes the port being used every hour or so based on certain "seemingly random" variables. And, for a small interim period (so as to not drop packets during the port transition), two ports are actually opened. That's what we have done for our WASTE modifications.

How will this work any better than spam filters?

[digitalvengeance]

From the article:

"seeking audio "fingerprints" that could be compared with information in Audible Magic's database."

We've tried database-oriented filters to stop spam in the form of keyword lists and the like for years, yet spam is more of a problem today than it was 5 years ago. Why won't the same techniques that let spam slip past our filters let content slip past these filters? Add a byte here or there, run a very light encryption routine over a file and bam - one broken filter.

Even if the networks that use encryption in the protocol itself are stopped - encryption on the file level can be used on insecure networks and this software becomes useless.

Josh

Will it look inside...

[ChangeOnInstall]

...of an SSH tunnel? :)

Re:Will it look inside...

[Rikus]

> will your university continue to allow you to use SSH?

Don't be ridiculous. Banning SSH would basically be banning secure remote logins, which would be so outrageous that nobody would accept it. Besides, universities frequently give students SSH access to various machines for use with classes. Are they going to switch to telnet?!

someone will use this for sure

[neurosis101]

Despite the restrictions of the softwared, I'd bet that a University for sure will pick this up. Eventually what will happen is some people on the network won't be able to download some voice recording or some file send to themselves or something and a big fuss is going to erupt. That or some privacy issue is going to kill it.

The university I attend has explicit privacy rules, available for everyone to read. If I recall correctly this sort of thing would violate those rights awarded by the school and as soon as someone brings it up it'll disappear.

Re:someone will use this for sure

[crackshoe]

NJIT (New Jersey Inst of Tech) has something similar to this in place, and has for this most resent semester. we get around it by zipping the files or modifying the suffixes.

so archive it

[tintub]

Is this software going to intercept any archives (.rar, .tar.gz, .zip etc.), unarchive them and check them? I'm not against such software - Universities have a right to disallow file trading on their networks, just as I have a right to use an ISP which doesn't use such software for my home connection. However, I just think that this won't work, at least not without blocking or hindering so much legitimate use that everyone revolts against it.

Gates offers his own solution to protecting IP

[Anonymous Coward]

Microsoft founder Bill Gates is scheduled to make a press release Friday morning to announce his partnership with the MPAA and RIAA to release a product that he guarantees can block all illegal file sharing 100%.

The solution will be called "Knife". This aptly named solution will entail taking a sharp pointed object to cut a network connection cable in half. Knife is to be released in a Home ($99 - straight edge) and Professional ($199 - serrated) version.

Rumors are circulating about a WiFi solution Gates has pondered entitled "Complete Technological Annihilation via Nuclear Bomb Generated EMP fields".

Both are expected with a Fall 2004 release date.

Copyright-status repository?

[mfh]

> They want to take the position of not filtering out all peer-to-peer [traffic], stopping copyrighted works but not the other content."

Here's the problem: how do RIAA and MPAA distinguish, legally, between copyrighted material that is permitted (fair-use), and that which is not? I'm talking about articles, fair-use media vs. illegal-to-distribute-or-possess copyright media. How do these watchdogs inform the public of such differences? The onus is truly on the RIAA/MPAA if you ask me. The story, strangely, is "Copyright © 2004 CNET Networks, Inc. All Rights Reserved," which begs to question... how can a twelve-year-old truly understand this discombobulated law?

That's the problem with the whole thrust of the RIAA argument against P2P (that the illegal trading of this copyrighted material hurts business). What about Internet articles? These articles are copyrighted works, published to the Internet by their respective owners, but quite often articles are mirrored by websites like Slashdot. Sometimes the copyright owners like this mirroring, and other times they do not (they seem to flip flop on it, depending on the source). Therefore, the lack of consistancy *should* make it extremely difficult to win a copyright case, although somehow the owners always win.

IANAL, yet my argument is that two distinct laws ought govern copy protection, because this fork-in-the-road is quite ambiguous. Firstly, how are any of us to know the status of copyrighted materials downloaded? What if we download a song over P2P, expecting the song to be one of the songs that are fair-use, and we pass the song along to a ton of other people? Secondly, how do we distinguish between the legality copyrighted articles that are online and music, and the fair-use music?

Because there exists no truly accurate copyright-status repository, I think all the people under suit from a watchdog might have some ammunition.Without a bona fide/impartial database of illegal filenames and md5 checksums to verify your current P2P files, how can you be responsible for these files?

Furthermore, if you downloaded a song from P2P, you should legally be able to upload it back to that P2P, if you truly believed the files to be fair-use, which could truly be any file.

Re:Copyright-status repository?

[Tim C]

quite often articles are mirrored by websites like Slashdot

Slashdot doesn't mirror anything, it just links to the article at source. The reason for that is copyright - slashdot doesn't have permission to mirror the article. Stuff published on the net is still copyrighted unless specifically mark as being public domain.

Linking to an article in no way copies it, and so cannot be prevented by copyright law. There is no inconsistency here - if slashdot copied the article verbatim and hosted it on their own site, then they'd be infringing copyright.

True, people do sometimes copy articles into comments here, in case the server is slashdotted. For what it's worth, they are in fact commiting copyright infringement, and are opening themselves (and potentially slashdot) up to legal proceedings. I don't suppose it would ever come to that, but the copyright holder would be within their rights to sue.

(Disclaimer: IANAL, etc)

Stopping secure transmissions

[zymurgy_cat]

Uh, correct me if I'm wrong, but how can one stop all "secure" file swapping communications w/o killing off unrelated important stuff? I tunnel through anonymizer.com when I surf, and I imagine any file sharing program worth its salt could do a similar type thing through the same port (22). Wouldn't they end up not only killing file sharing but also people checking their bank accounts, registering online, buying stuff on Ebay, etc?

As for looking into email, sheesh! Public key encryption will avoid that, and any attempt to block those types of communications would be rather stupid and overreaching.

This will work for about ten seconds

[Poilobo]

If this is based on fingerprinting technology it would be pretty trivial to cutoff the Type 1 and Type 2 tags, reverse the content and stick'em back on. Reverse the process after downloading. Of course you could always UUencode the song and add a zip extension to it or a multitude of other tricks to hide what your doing.

Never underestimate the power of broke, bored, determined college students.

Slashdot: News for trolls. Stuff that's biased.

[LostCluster]

it will also stop legal song downloads. The software blocks anything that's copyrighted, whether you already own the song in another format or not.

Uhm... no. That's not a legal download. That's a rationalization that some people have tried to claim, but it's not exactly one the courts have confirmed. You can format-shift your own copy of a song, but you can't take somebody else's copy of a song you happen to own a copy of in another format.

Unless you're the copyright holder, you don't really "own the song", you own a "copy of the song" that you're allowed to use. If all you've done is just buy the overpriced CD, you're still not allowed to distribute a copy of your copy under any conditions...

Re:Slashdot: News for trolls. Stuff that's biased.

[Phanatic1a]

That's not a legal download.

Bullshit.

Don't make the mistake of assuming all nations operate under the same set of laws.

According to the Copyright Board of Canada, downloading copyright files from P2P networks is completely legal, provided that the copying is done for private and noncommercial use. You don't even need to own the song in another format.

So yes, over a rather large percentage of the earth's total land area, it is a legal download.

Re:Slashdot: News for trolls. Stuff that's biased.

[byronne]

Alright, let me get one thing straight here. I've been in several bands over the last 10-20 years and frankly, I would fucking love it if our material was being actively traded over P2P networks, because at least then someone is listening to and enjoying what I've done. I don't care if I see a dime from P2P, cuz I didn't see a dime from the record company either. I'm still in debt, supposedly paying for the privilege of being in their 'roster' of stars. Well, fuck them. Maybe I made a bad business decision, but I feel zero obligation to think that many other 'artists' haven't also been given similar treatment. Believe me, the sooner we expose the RIAA for what it is (i.e. - a corporate protection agency) and for what it is not (artists' protection), the clearer this ludicrous debate will become.

RTFA, - Geez....

[byronne]

neither RIAA nor Audible Magic had given them a demonstration of the filtering tools. Industry trade group P2P United says it has repeatedly contacted the company asking to see the filters in action.

Ikezoye said he still has not demonstrated the technology for the peer-to-peer companies.

This brings up a ton of questions:
- What are they looking for in the content of P2P traffic?
- What defines copyrighted or 'controlled' material? Bootlegs won't be in there...
- If it ain't installed in the client, where is it installed?
- Will this work on server based P2P like soulseek?
- What possible gain is to be had by filtering this?

Studies have already shown that CD sales increase where there is a market of 'try before you buy'. (Australia, for example) When is the RIAA going to wake up and realize that the biggest marketing tool in history is at their command and they don't have to do a damn thing to prevent it?
Radio killed the vinyl star? Nope.
Video killed the radio star? Um, nope.
MP3 killed the video star? Maybe, but absolutely to the artists' benefit and not some fat f*ck from Clear Channel.

Filtering is way too invasive to even be considered an option. Sheesh.

Legal P2P?

[LostCluster]

If they've got software that can "name that tune" as it passes by in MP3... isn't that the holy grail for legalizing P2P?

All it would take is some authorizing legislation, and every time a P2P song passes through the toll booth, a few pennies (quanity specified in the law) get transfered to the song owner. Those pennies can either be asorbed by the ISP as part of their service, or they can pass it along to the customer as part of their bill.

There you go. If it can block it, it can log it too...

Re:Eck

[l810c]

From the article:
seeking audio "fingerprints" that could be compared with information in Audible Magic's database

I think they will get a database from the RIAA of copyrighted songs to compare against. I doubt garage bands will be in the database.

The more you tighten your grip...

[Mskpath3]

You know, I'm not one to break out the Star Wars quotes lightly, but : "The more you tighten your grip, Tarkin, the more star systems will slip through your fingers." What a dopey system. Everyone knows that the only way you're going to stop this kind of thing is through draconian legislation! :)

Lyrical Email

[kyoko21]

The following IM conversation is brought to you by the fUtUrE between two hormonal college freshmens:

AeFr4tb0y69: Damn babe, you were so hot last night!

CutIeyPiEKit86: ya know I gots da bounce ;-)

CutIeyPiEKit86: oh papi

CutIeyPiEKit86: baby hit me one more time

>: This Instant Message session has been detected to contain copyrighted materials. The network administrators here at {INSERT SCHOOL_NAME} has been made aware at {INSERT TIME_STAMP} a copyright violation was detected and all parties including copyright holder(s) has been notified. Thank-you for using {INSERT INSTANT_MESSAGE_CLIENT_NAME} and have a wonderful day.

I suspect the ACLU will not be very far behind.

already illegal to use encryption in one media..

[zogger]

.. and that's the HAM bands. Encryption is verbotten. Of course, the government doesn't follow it's own laws, witness, it's "legal" to broadcast without their "speech license" if we are in a state of emergency.
*But*, we are *always* under several overlapping "states of emergency"(one of the main reasons we do not have constitutional government-side isue), YET they still bust microbroadcasters whenever they feel like it for not having their license or paying their fees. In short, liars.

See, their laws mean nothing, they are there for THEIR convenience and THEIR profit, to be used ON you when they see fit..whether it's their own little idea or some lobbying force bribes them into it.. so don't be surprised if encryption on the net is made illegal, or to sort of slide into it first, they might make you register, pay a fee, get yet again another government "license" permission, and make you hand over your private key first before you use it. They already have gone on record saying they want that, various alphabet goon agencies, and eventually they get what they want. All they need to do is drop the buzzword "terrorism" now.

After reading

[the_Bionic_lemming]

So - this software will block my VPN to work and not allow me to work from home?

Methinks that this software will die a quick death.

What about fair use and off-site backups?

[Anubis333]

So this software would make backing up your data illegal? I have all my CDs ripped, and I ftp them to another drive at another location frequently. This would stop any student from sending any of his MP3's to a computer at home for back up. That sounds fair.

Carnivore?

[kyoko21]

Is it just me or does this sound like RIAA bought their own version of Carnivore?

This is a turn for the worse

[Obscenity]

If this actually comes to pass, this will set a horrible precident for the future. To be allowed to intrude into private computers should be against the law, unless a search warrant is granted. Allowing this to be implemented in an actual setting would be disastrious. Not to mention that THEY get to decide what is copyrighted and what is not protected. --Those who would trade in freedom for security deserve neither. -- Jefferson

JOIN THE RIAA TODAY! JUST FOUR EASY STEPS!

[britneys 9th husband]

RIAA (RECORDING INDUSTRY ASSOCIATION OF AMERICA) is the first organization which
gathers GREEDY RECORD EXECUTIVES from all over America and abroad for one common goal - being GREEDY RECORD EXECUTIVES.

Are you GREEDY ?
Are you a RECORD EXECUTIVE ?
Are you a GREEDY RECORD EXECUTIVE ?

If you answered "Yes" to all of the above questions, then RIAA (RECORDING INDUSTRY ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join RIAA (RECORDING INDUSTRY ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time RIAA member.
RIAA (RECORDING INDUSTRY ASSOCIATION OF AMERICA) is the fastest-growing GREEDY RECORD EXECUTIVE community with FOUR OR FIVE members all over United States of America. You, too, can be a part of RIAA if you join today!

Why not? It's quick and easy - only 4 simple steps!

First, you have to obtain a copy of THE COMPLETE WORKS OF METALLICA and listen to it. (You can download the music (~280mb) using BitTorrent, by clicking here.

Second, you need to succeed in posting an RIAA "first post" on slashdot.org, a popular "news for thieves" website

Third, you need to join the official RIAA irc channel #RIAA on irc.riaa.com, and apply for membership.

Fourth, you need to pay the nonrefundable RIAA MEMBERSHIP FEE of FIVE MILLION UNITED STATES DOLLARS (US$5,000,000)
Talk to one of the ops or any of the other members in the channel to sign up today!

If you are having trouble locating #RIAA, the official RECORDING INDUSTRY ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is lawsuitnet, and you can connect to irc.riaa.com as our official server. If you do not have an IRC client handy, you are free to use the RIAA Java IRC client by clicking here.


If you have mod points and would like to support RIAA, please moderate this post up.

______________$*________________________________
| _____________&@_______________________._a,____ |
| _________._______a_______aj#0s_____aWY!400.___ |
| __ad#7!!*P____a.d_______#!-_#0i___.#!__W#0#___ |
| _j#'_.00#,___4#dP______j#,__0#Wi___*00P!_"#L,_ |
| _"#ga#9!01___"#01______"4Lj#!_4#g_________"01_ |
| __"#,_________*@`_________`___-!^_____________ |
| __#1_,%________$^_____________________________ |
| __J1__$%______________________________________ |
| __jk___58___RECORDING INDUSTRY_ASSOCIATION____ |
| _______________OF_AMERICA_____________________ |
| ______________________________________________ | (c) RIAA 2003, 2004
` _______________________________________________'

I used to work for Palisade...

[Anonymous Coward]

I was working for Palisade when they developed the first version of PacketHound.

Actually, I should say when they stole PacketHound, since it was actually created by a coworker in his off hours, outside of Palisade. The CEO at the time fired this guy and sued the developer to gain the rights to PacketHound. Kind of ironic that they stole something that is supposed to prevent stealing!

Like Palisade's original product, called ScreenDoor, PacketHound is just a packet sniffer that sends out TCP RST packets to disrupt connections. Palisade (and Iowa State University) actually have a patent on this, even though there have been firewalls and other programs (like Snort) which do the same thing, and predate the patent.

Palisade itself is a tiny company that is milking this one patent/idea for most of its products. But they are somehow good at getting press...

Re:Oh, No! Not SSH?!?

[BitterOak]

Since I (and undoubtedly many others, I'm sure) use SSH for everything, I wonder how they plan to shut down even an insignificant fraction of any kind of sharing?

Simple. Ever heard of a man-in-the-middle? You make an SSH connection to a computer on the other side of this software. It detects you are using SSH, and steps in during the key negotiation protocol. Your client complains that the host key has changed. You either refuse the new host key and you're SOL, or you accept it and the software can still look for copyrighted material. You complain about security, but they claim your connection is still "secure" as it is reencrypted on both sides by this software.

how about... pu the tech to some good use.

[uv_light]

as someone noted before, encrypt everything. It is not just good idea for file swapping, also, it is good practice incase of information leak.

anyway, that's not my point, I think it would be good idea if people can change the software slightly so that it block different thing, *cough*spam*cough*, it might be more constructive than blocking `any` kind of copyrighted material. Well of course, it would be nice there is no censoring of information, but we are too far away from that.

if you like this, thank you. If you don't, sorry I took your time to read this.

Steganography

[markan18]

maybe we just need to rename songs as .doc or .jpg. If that crap can still catch them, cram the song into real images or insert them into real office documents.

One may insert them into icmp packets (ping still allowed??). What if i encrypt all my email, will encryption be outlawed? The war on file sharing is turning into a war on drugs, we all know how effective it is.

I think anyone can still get packets and or out a given network can download and upload songs or anything. those big 5 labels are causing real damage trying to police the internet and deserves to die real fast

Re:Steganography

[Brandybuck]

The war on file sharing is turning into a war on drugs, we all know how effective it is.

Except pot smokers aren't being sued by large corporations for failing to bogart and the DEA isn't blowing the heads off of neighbors of file traders by mistake.

Re:Steganography

[dolphinling]

Actually, how about embedding the .ogg in a data: url in a web page? That might get around things if they check each file individually. And if need be, you can use steganography to put the song in a .png, and then embed that in a data: url. How cool would that be?

/. apparently mangles data: urls but you can see some in action at http://www.mozilla.org/quality/networking/testing/ datatests.html

This is just going to become a cycle...

[Peterus7]

(It already is one...)

Music is shared. The industry finds way to block it, but in doing so pisses people off. New P2P app. Random corporate ups ante, finds new way to find out identity of P2P user. New P2P program that blocks ID. People post about it on slashdot. People make funny comments, and get modded up. Piracy increases, RIAA makes new blocking program. Cowboy Oneal finally decides that he's sick of it all and declares a ban on P2P relating articles.

Anyways, down to real business: The more people try to stop people from downloading files, the more it becomes damaging to themselves. Not only are they blowing money on quick fix solutions that do nothing but piss people off and force them to resort to other methods, but in the end their problem is that people are going to download their crap no matter what. If they stop them from downloading, they sure as hell won't buy it, so they might as well let them be.

Now, I'm not saying that's the right solution, or there is a solution, but I think trying to stop it and potentially messing people up all over the board is just a haphazard and dangerous way of doing things. Go back to the drawing board... And as much as I hate to admit it, but I feel by the time they solve P2P, Mac will be in control of the market, we'll be insectoid alien slaves, and Elvis will have returned, and will have posted a story on the truth about aliens here.

Didn't they raise a stink about....

[m0ng0l]

GMail looking inside e-mails? Isn't this just doing the same thing? What is to stop them from releasing a "new, improved" version of this software to allow universities to look inside e-mails for other things? Phrases that look like part of a term paper, that I *may* be plagarizing (sp?)

FUD off

At least not going to college anymore, I don't (for now) have to worry about this. What I can see is this software is automaticly presuming you are guilty of music swapping, and searching your e-mail without due process (BTW, IANAL)
If the courts want to use an e-mail as evidence, do they not have to get a warrant? Why should this be any different?

harumph.
Jason A.

Privacy Issues

[zors]

The article says that personal e-mail will be ran through this as well, as a student about to go to college in the fall, this is truly disturbing. Is anyone else angry about the idea of their school looking through their e-mail? What if i'm sending a legal copy?

As long s there's a network connection...

[ruhk]

... this software cannot block file sharing.

If I decide to encode a song as a text file containing the bit-string of a song and slap that on a web server, what is this software going to do? Oh, sure, the size of that MP3 just jumped by a factor of sizeof(char), but its out there. Maybe it'll be smar t and read the first X bytes of any file it passes? What if the file is multiple parts? I can serve it on my web server. I can toss it up on NNTP.

In short, the only way this software can stop filesharing is to block the network connection entirely. This is perfectly obvious even to a dimwit like me.

Maybe try the obverse

[Badanov]

Maybe the cry to go to encryption is the wrong way. If it is in fact the intention of trade organizations to scan networks and invade privacy to enforce their rights, maybe it would be better to create a standard that could not encode an audio file but transform it into plain text.

The wargame company that makes Combat Mission does this to their save game files. The files are encoded not encrypted and the data read in/out into the file is true plain text, but unreadable. You cannot tell this is an encoded file by any means I am aware, but the file loads up smoothly and quickly.

Seems to me iffin you wanted to defeat this new drive to invade privacy, making a software module that will allow you to store and transport music (and many other kinds of files as well ) files as plain text would be a tremendous blow to those efforts.

Re:easily beaten

[Rikus]

I don't think that simply testing the fingerprint of the actual data in the file would work very well, since there isn't a very good chance that an mp3 of a track encoded by Person A will match an mp3 of that same track as encoded by Person B. Aside from the obvious changes such as higher or lower bitrates, the actual data is likely to be different depending on the encoder used (though producing basically the same sound).
I assume a more complex system involving actual analysis of the sound would be necessary in order to detect illegal audio files.

Fan Mail

[GrEp]

Please direct all fan mail to the head of Palisade, Doug Jacobson. dougj@iastate.edu

Check out his senate testimony(Google Cache). This guy makes a living spooking the spooks.

I do this because I have to

[Anonymous Coward]

why insist that he should be modded troll for saying something that you disagree with?

Obligitory: You must be new here.

the death of a thousand cuts

[zogger]

really, what's overplayed? the various cop shops want to be able to intercept any net trafic, they are on the record of desiring everyone's private keys. The FCC violates it's own laws on little guys, yet lets the fatcats skate most of the time and rip billions from the public. It's just data. The discussion evolved to "using encryption" and to me, starting with the one verified example I brought up, it's not far fetched to assume that sometime in the not so distant future it will be illegal, or highly regulated. They already made copyright infringement be a felony punishable by jail time and fines if the feel like it. Anyone see that one coming even 3 years ago?

If anything, I think more people need to get more upset over it, because a too-casual outlook towards this whole... creeping big brotherism and being a serf in your own nation afraid to enjoy life won't be stopped by ignoring it.

I don'thave a dog in the file sharing fight, don't do mp3's or movies, but I can smell a conjob when I see one, and the record and movie ghouls been pulling a rip of massive proportions for decades now. There's laws on the books and then there's laws that beg to be broken. Prohibition was one that went on way too long until it was a national embarassment. They started another stupid buncha laws, and not enough people spoke up and fought to stop it,so now we have the war on some drugs, that got us 1/2 way to a full-bore police state.

Sometimes ya just got to say no to stupid stuff. I walked with people who got refused service in restaurants because of their skin color,and it was "legal" for that to happen to them at the time. I took the gas when we tried to stop a stupid war that wasn't legal and was a scam based on a whopper lie, yet they called it "legal" and killed millions of people over it, both "our guys" and some other people, and they didn't care. And on and on, stupid things big AND little, but they all add up, and they all apply to everyone sooner or later. Even when you think this latest stupidity don't apply to you, eventually it will, because their job is to think of stupid things to make life more complicated and to make it harder to avoid "offending" them so they can "crack down" on you for..whatever. Just think of all the things they are gonna "crack down" on. Believe me, they won't run out of nouns to target. Eventually they'll get to something really important to you, "general you' I mean.

Now we got all sorts of stuff like that going on, PLUS we got this cyber world to deal with, and some things are just as stupid as the others. I say it's righteous to say NO to obviously stupid things. And the deal is, with government and their corporate pimps, it's the death of a thousand cuts with those people,they just keep coming and they ain't got no pity, you got to say "NO! quit cutting me" everytime they try it,no matter how small the cut is, and be quick with the bandaids and iodine.

If you keep taking the little cuts, because "oh well, it's just one little cut", pretty soon it adds up to be the equivalent of a meat cleaver in it's effects. It's like, what's the line, how far do you eat it when they are trying to make you eat it constantly?

In short, it's not tin foil hat if it's real,and if you can step back and look at the bigger picture and not get hung up on minutiae, and realise that they WILL cut you as often as they can think of a new way to do it.

Scare Tactics

[Axel2001]

I don't think that stuff like this comes along with the intent to actually use it in the long term...

It's kind of like shopping at a place like Walmart. They have those stupid little detector things at the doors that go off and are supposedly to catch shoplifters. The fact that they are there is the deterrent. I have yet to see one person caught shoplifting, but have seen countless people doing some shopping, pay for the item(s), and walk out the door. Everyone stops and looks.

The music industry is doing much the same thing. They don't really think they are going to catch anyone doing serious damage, they just count on the deterrent factor, and they count on publicity. We need to stop making such a big fucking deal of everything the RIAA, et. al. does. It only empowers them.

Legitimate sharing of copyrighted works

[Eythian]

iRATE is a program that downloads music that artists have put on the net. These downloads are also taylored to your own tastes, based on comparing what you like with other users. With this, there isn't a need for P2P music file sharing, and risking being sued by the RIAA, as copying this music is sanctioned by the artist. (Unsurprisingly, not much of this music is made by RIAA labels)

Or SSH

[Sycraft-fu]

I would LOVE to see a university try to block that. A small private one might (and I emphize might) be able to get away with it but a big one? Forget about it.

Hell, our university REQUIRES SSH for many things. You can't telnet to the e-mail cluster any more, it's SSH only. Likewise the webmail is SSL only. You just don't have a choice, you'll use the encryption or you'll not use the system. My department is working on going to that. Going to be no telnet, no FTP, no unencrypted IMAP or pop. Everything will be SSH, SFTP (which is also SSH), or SSL. Unencrypted communications will be in-building only, or for things like the main website. You want to access any systems, you'll do it with an encrypted protocol, or use an encrypted VPN tunnel to get a local address.

So either SSL or SSH would work well. They are just too useful and used for too many things. Try and shut that down and you'll find backlash like you can't believe.

Re:Not every college

[Bastian]

Not every college says their computing resources are for academic use only. Honestly, such a policy is kind of ridiculous - with such an agreement, you've suddenly said your students aren't allowed to do a whole host of things, such as use their campus network connection (or campus e-mail account) to keep in touch with family and friends. You've also said your students can't use the campus network to download games and all sorts of other stuff that you really shouln't be disallowing people who live on campus from doing.

At the college I went to, the computer center understood that the campus network and internet connection weren't just an academic tool. They were also a student entertainment service and a way to attract kids. A college with a TOS that doesn't allow this or has a generally crappy low-bandwidth internet connection in the dorms stands to lose a lot of good applicants to well-wired schools. Which isn't to say that the network was totally unrestricted - there were bandwidth caps on traffic going through all the popular filesharing ports, for example, and all non-port-80 traffic in the dorms was restricted during peak hours.

I have seen such policies on computer labs (with the understanding that e-mail is okay), and that does make sense.

Return of binhex.

[Steamhead]

Just plain old text, can't be something bad with that.

and people thought GMail was bad for "Privacy"

[dargon]

> 'If installed in a university, for example, it could look inside students' emails, instant messages and peer-to-peer transfers...'

Damn, someone comes up with a piece of software that will snoop into your e-mails, im's and p2p, violating your privacy in an even bigger way than GMail and not a single person even mentions the fact that this program could be hijacked to snoop for things such as credit card numbers, passwords, etc. Atleast with GMail you have a choice whether or not you use the service. The people this software would effect don't exactly get the choose whether or not they participate in it's use.

Re:Eck

[m3000]

Heh, some universities (cough*mine*cough) don't care if there are legal uses. We were the subject of this wonderful article from the beginning of the year about schools to avoid.

Basically all file sharing programs are blocked, along with all bittorrent (say goodbye to Linux ISO's and any other legitimate use) and most recently they've blocked off IRC. Yes, all of IRC. It still works on the campus wireless network, but you can't get any wireless signal in the dorms where these restrictions take place. As much as I love the dorm life, I'm getting an apartment next year.

So legal uses or not, if someone thinks it'll solve a problem, they don't care what else gets in the way.

Re:Illegal search and seasure?

[Firefly1]

Now, if people are already leery about the government, which is notionally accountable to them, doing this sort of thing, what on Terra makes these private entities think that their doing it will be accepted?
Quite aside from the insulting and inexcusable assumption that is at the root of such a program ('guilty until proven innocent'), what reassurances do people have that this capability will not be abused? For instance, it's quite easy to destroy someone's reputation by planting child pornography on their hard drive, then 'anonymously' tipping the FBI...

Another way to get around the problem...

[Elliot Anderson]

All you would have to do is write the song out in binary, scan it in, save as a jpg and pgp the email.

Problem solved!

Oh, my... Where to *start*...

[The Master Control P]

For starters, I'll be damned if your fscking spybot will ever acess my hard drive. Block all ports by default, opening as needed.

How, exactly, does a remote program ruffle through my files without my permission, anyway? Mandated backdoors? Screw them.

If it looks for an audio "fingerprint," how will it react if some 10-year-old wrote a 5K program to insert a random byte every N bytes of the MP3 (or any file)? If I do something as idiotic as flipping all the bits? The ways to foil things that search based on fingerprints are too many to name.

Who the hell gave you permission to look at my private e-mails? Oh, yeah... I DIDN'T!

Amendment IV: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

How exactly will it react to a file named "Britney-Spears.mp3" that contains nothing but static? Did I mention the violation of privacy?

They've already admitted that it's completely impotent against encrypted traffic, and there are already encrypted p2p clients.

For the love of God, don't these control freaks realize when they're beaten?

OK, I think I've got most of the obvious replies out of the way. It's obvious that the current control freaks "up there" see the Internet, and realize quite well what it can and will do them if they can't nip it in it's budding stages. Kid yourself not: They will wage an all-out war against privacy on the Internet. And as always, all that is needed for evil to win is for good to do nothing.

Contact your congressperson. Have all your friends do the same. Snail-mail them. E-Mail them. Donate money to their campaigns. Get the word out!

Re:How will this work any better than spam filters

[Lehk228]

Actually they are more interested in keeping music off the internet in order to prevent bands from going independant, the internet makes them far less important than they once were.

No man is an encryption island

[0x0d0a]

Encryption only works if other people do it too.

I use GPG. Nobody else that I know does, and so I cannot encrypt email to them.

How many people really use WASTE?

As for AIM encryption, how many people are using gaim, have the encryption plugin compiled in (which frequently doesn't work with the latest version of gaim), and don't mind the occasional compatibility problems the encryption plugin causes with other AIM clients? I've come to the conclusion that the *only* instant-messaging protocol that I know of with effective and widespread encryption is Jabber, but few people use Jabber -- sure, it's great for talking to your techie friends, but not everyone in the world is a techie.

And, thusly...Fermat's Foil.

[Anonymous Coward]

"There's no way that any piece of software would be able to peek into encrypted sessions... so the only option this software would have would be a "deny all"."

Actually there's one very simple but obvious thing they could do. Proof of which I will write in the margins of this post.

Why bother?

[trezor]

Why bother with encryption? Just set up some phony malformed files (and keep your mp3s rared whatever) and share all your bandwidths worth.

The system is supposed to work on audio-finger printing. I can imagine how easy a system like this could be DOSed. Now imagine all P2P users worldwide doing this (P2P-app prepares this stuff). It'd be the biggest DDOS of all time.

This censorship mayhem is so ambitious it's bound to fail.

And you can see where it's going, too

[Anonymous Brave Guy]

I think you've got the problem absolutely right. This is a direct consequence of two things: big media business abusing its monopoly, and a certain type of Joe Public breaking the law. In both cases, these are not good things, but they are done because the perps think they can get away with it.

As has often been said (but rarely heard) in these parts, the correct solution to this situation is to fix the problem, not to try to circumvent it by ever more devious means. The music industry should be compelled by the legal system to stop its price fixing practices, under the threat of having its business made seriously unprofitable by the courts. That will lead to reasonable competition in the market, and fairer prices and better distribution methods will naturally follow.

At the same time, I have no sympathy for the song-swappers who have been taking the piss for years because the tech was ahead of the law. You brought this upon yourselves. Copyright law is there for a reason. If you don't like the law, the solution is to seek to have it changed. If as many people agree with you as you think, that shouldn't be difficult, now should it? Of course, in this case, the widely-flouted law actually is reasonable, it's the failure of the authorities to enforce the flip-side of the law and smack the media outfits down that is causing the problem.

By carrying on with the current approach, all the oh-so-clever, we'll-just-use-encryption song swappers in this thread are simply inviting the inevitable: legislation to ban encryption in electronic transmissions, together with draconian enforcement rules and mandatory monitoring. This is a fight you cannot win. Wake up and start fighting the fight you can, or the world will be a worse place for your selfish actions.

Who needs encrypted protocols?

[Tsu-na-mi]

Who needs encryption? Just move from Songname.mp3 to Songname.mp3.zip/rar/ace/lzh/whatever. The compression should remove any 'fingerprint'.

Makes for a few challenges but it would easily defeat the system by the sounds of it.

The trend among content-filtering firewalls is ..

[apankrat]

The trend among content-filtering firewalls is to filter SSL sessions by splitting them in two - one from the client to the firewall and another from the firewall to the server. If the session cannot be split, it's rejected.

Eventhough it's client-friendly man-in-the-middle attack, which defeats the whole purpose of SSL, there is a demand for this functionality.

--

The way it works is the client installs extra root CA certificate, and the firewall is given its own CA-enabled certificate derived from the former. Whenever it sees SSL connection coming from the client, it accepts its on behalf of the server, handshakes with the server, then replicates server's certificate signing with its own key and proceeds handshaking with the client. And the client accepts this forged peer's certificate, because it traces back to 'trusted' firewall CA. Pure magic.