Slashdot Mirror
iTunes DRM Hole Closed
FrYGuY101 writes "As recently covered on Slashdot, there was a hole in iTunes which allowed music to be acquired from the iTunes Music Store without Apple's DRM applied. Well, Apple has just released an update which closes this exploit."
I like how they handled that... no horrible punishments, no wagging their finger at the community... just fix the hole, force the update (for obvious legal reasons), and carry on loving your customers... I like...
:P
Too bad napster to go couldn't be so accomodating...
---
Programming is like sex... Make one mistake and support it the rest of your life.
When holes like this one open, it's only a matter of time before they close.
Rant:
This is no big surprise. Our favorite music is owned and operated by an industry
who cares more about money than music. The artists who write and play this music
have sold their souls to this industry. Until the artists wise up and use the
Internet to distribute their music on their own terms, this cat and mouse game will continue. It's not going away soon since many artists do it for the money anyway.
Considering you can burn Apple's song on CD and get rid of the DRM, who cares.
What I'd love is a way to download songs from Apple in a non-lossy format! If DVD Jon could do that, I'd give him a lifetime of gratitude!
If someone says he and his monkey have nothing to hide, they almost certainly do.
..someone just releases a patch to PyMusique so that it looks like version 4.7 of ITunes to Apple's servers...
and the endless game continues....
Of course the only change that Apple has made is to require iTunes 4.7 as the client. How long before someone figures out how to make PyMusique look like iTunes 4.7?
And as long as they are sending un-DRMd songs down to the client they are suceptible to man in the middle attacks (a proxy server which watches for iTMS traffic and saves the song streams to another file), or to someone directly pulling data out of the iTunes app (though the second would arguably violate the DMCA).
How was being able to PURCHASE something in a form that the user actually wanted an exploit? A bug that would allow someone to gain access to Apple's servers, or to steal information, or - for that matter - to steal songs without paying - all of those would be exploits.
Yes, but ITMS will accept version 4.7 upwards. The problem was that previously earlier clients had been able to connect, however it was with them that the loophole existed. I suspect it won't be too long before someone modifies PyMusique to trick ITMS into believing it's itunes, but still.
If you think that you would be signing a big fat contract with the music label, you're just as dumb as most of the artists out there. What you would be signing is a loan. You would be at the record labels mercy. Believe me, you are better off now. At least you don't owe the music labels anything.
..how ass-like they would look suing DVD Jon... again!
Besides, I really don't think there was anything illegal in his hack this time. Even with the U.S. DMCA included into consideration.
Misrepresenting software to get around the DRM could be interesting legally. (Yes, I know browsers can do this -- but not to avoid DRM.)
RTFA!
"iTunes 4.7 was released late last year"
It is actually PyMusique that was eploiting ITMS's backward compatability.
All Apple did is require ITMS users to use the most up-to-date version of the "free" software.
They did not release a new version, or patch, to iTunes to knobble PyMusic.
watashi wa bengoshi dewa arimasen!
Comment removed based on user account deletion
So how long before I'm not permitted by law to modify data which I have paid for...
Unless something's changed in the last 18 months or so, I thought the DMCA already did that (in the US). It prohibited the breaking of encryption schemes that are used to enforce copyright, and I don't believe it had any provisions for fair-use based exceptions. So while you may have bought a song from iTunes, and you paid for and own the data (in this case, the file), you are not legally allowed to remove the original compressed 128k audio data from it's DRM wrapper. You ARE allowed to burn it to a CD of coruse, as per the license...but at that point to get a compressed file usable in a non-iPod player, you'd have to recompress it, and double lossy compression is no fun.
Has this changed?
And on a side note, in most cases you no longer pay for data, but rather you pay for a license to use said data, and the data is included in the bargain. So, for instance, you don't pay for a copy of Microsoft Office...you pay for the priveledge of using MS Office, and Microsoft provides you with a disc containing it. Same with iTunes...you don't really pay for the file, you pay for the license to download and (within the limits of the agreement) play the song, and the file is provided to you.
And before you think I don't agree with you, I feel that, especially in the cases of entertainment-related data (music and movies) that this is bullshit, and that we need to bring back the idea of fair use.
I was just compiling the list of tracks i actually wanted to buy - I hadn't registered for iTunes before this but when PyMusique came out I had decided that I was going to buy all my tunes this way.
Seems that it will be a little while before I start giving apple any of my money. I believe that apple would have sold bucket loads of music if they had been a little slower off the mark. I was stood in line with cash in my hand.
Maybe they did it for the record labels or was it for the iPod?
I wonder how happy all the Hymn and J-Hymn users out there are about what DVD Jon did. By releasing PyMusique, he got Apple to force everyone to use 4.7 iTunes if they want to use the iTMS. I believe that 4.7 broke Hymn and unless that has been addressed, now people will no longer be able to remove the DRM from music that they purchased from the iTMS.
What happened was fine, nothing to get your knickers into a knot about. When you buy music with DRM you are agreeing to use it according to the terms set forth. One of those terms is that you agree to how the terms may change in the future. That is why I do not buy music with DRM, the fact that what I can do with that music can change at any time.
It is too bad that the Apple DRM happens to be one of the least onerous and DVD Jon gave Apple a reason to make people move to slightly more restrictive terms with 4.7, but still just the fact that Apple can modify what you can and cannot do with the music from the iTMS is an immediate turn-off for me.
In an art, this is called "selling out."
When the Grateful Dead released the album "Touch of Gray" in the late 1980s, they had a couple big radio hits off it.
Some of their old fans accused them of "selling out," to which Jerry Garcia replied, "hey, we've been trying to sell out for years, it's just that nobody was buying."
Performance artists has always been about getting paid, not about creating something which will hang on a church ceiling forever. Shakespeare wrote his plays to make a quick buck, not to give you something to study in Middle School English classes. The fact that the stuff he wrote was good enough to be worth forcing on bored 12-year olds is strictly the gravy. Wealthy royalty paid him cash money to parade around in tights on a stage and show off his skills, so he wrote plays which the royalty would like. Hippies like you can call that "selling out" if you like, but I won't.
Information wants to be anthropomorphized.
So, the music executives have forced DRM on Apple and so they have to provide it in their files. But they aren't really doing anything. Basically the DRM is to prevent files from being just put on Kazaa and spread around the world. Yet, the DRM doesn't really stop this. There's still the burn and re-rip strategy which is quite effective, as well as the "buy a CD method" which is also effective for getting files onto the internet. The only thing this does stop is file which the person has purchased being accidentally leaked on the internet by some hard-drive scanning P2P program. Anybody who still wants to distribute their purchased music can still do so. All it stops is people who don't want to share their purchased music from sharing it unintentionally.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
For so long, one of the more legit arguments for downloading music via p2p was that music publishers gave customers no other options other than to purchase an entire, overpriced CD when all a person wanted was one or two songs. Now we have a multitude of options for buying music pretty damn inexpensively online with a very reasonable implementation of DRM, and some people still want to jump through hoops to cheat the system? For god's sakes, write your own music if you're that cheap!
A post a day keeps productivity at bay.
If you re-encode to the same format using the same encoder, the loss is probably minimal. If you re-encode to, say, MP3 or Ogg Vorbis, which quite probably have different ideas about which data should be thrown out, you're more than likely to start hearing defects much sooner.
Michel
Fedora Project Contribut
It is rapidly turning into a biased Apple fan site.
Bravo, well said.
For the first time ever, I'm finally seeing "This DRM is good!" posts on slashdot. And that my friends, is the end of slashdot.
Why? Because slashdot was known for their absurd pro-free software anti-DRM stance. Would you give a rat's ass if slashdot was like every other news site out there ? No.
Sunny Dubey
When you re-rip, you recompress (unless you rip only to WAV and never create MP3's).
The method you outline will inject some distortion into the file, much as you would get if you tooka JPEG file and re-compressed it again.
It appears that they ask the application to identify itself and if it isn't iTunes 4.7, it won't download. Sort of reminds me of those websites that checked to make sure you were running IE. That led to other browsers acquiring the ability to misidentify themselves. If that's so, it'll only take a week.
Now what we need is for Slashdot to verify that the user isn't someone who's going to run off and tell Apple.
If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
Walking into a brick and mortar building and purchasing a good old fashioned CD is still a method for getting music. And it doesn't have a DRM attached to it. So why does everyone insist on attaching a DRM to purchased music files? How are they different than the physical CD? A physical CD takes me less than 3 minutes to either rip into AAC or make a physical copy and pass around to whomever I please. Putting a DRM on things is just like saying, PLEASE, TRY AND HACK ME. Its no different than telling kids that they can't drink until they're 21. If you don't make a big deal out of it, neither will they (look at countries that don't have a drinking age for example). On top of that, we all know that DRM is a useless technology. You give the person an encrypted file AND the keys to open it. Wheres the security? And now for the honer system theory.... If it were made blatantly clear when you purchased a song from the iTMS that YOUR NAME and ACCOUNT NUMBER were embedded into the file (just like a license plate on a car), I would certainly think twice about sharing that file on a P2P network. At the same time I would have an unlocked unrestricted file to do as I please with.
Kiteboarding Gear Mention slashdot and get 10% off!
WTF? Last time I checked, all Jon (there's no 'h' in his name) wants to do is watch dvds and listen to music purchased via iTunes on his Linux box. What Jon has done is indeed illegal in some countries (more extreme /. members would call them corporate states), but I don't think that any honest person can say it's unethical.
It's really quite simple. If you buy something, you can do whatever the hell you want with it, so long as your actions don't harm anyone. Don't give me that "indirect harm" bullshit, either. I'd give you ground if we were talking about releasing the plans for building an antimatter bomb, but not for something so inconsequential as circumventing DRM and copy protection.
"The newly born animals are then whisked off for a quick run through a giant baking oven." --heard on Food Network
So, you're saying Apple is standing there with a gun to your head, "forcing" DRM on you?
Oh, you mean you're choosing to purchase the music from iTunes and THEN complaining about the DRM after the fact? For a second, I thought you had something legitimate to say...
" With iTunes 4.7.1, there are restrictions placed on how many computers you can transfer the songs to. Now I'm forced to upgrade the damn thing on 3 of my computers."
Oh come on, its apple that ultimatly causes these restrictions not Jon. Don't get mad at him, its you who decided to sign up to a service that can renegotiate its terms at any later stage.
I'm wondering what the reactionary response to this will be.
In high school (a long long time ago) a friend of mine got a -3 on a question on a test. The girl sitting next to him got a -1 on the same question with a near identical response. He complained and the situation was resolved by giving the girl a -3 instead of a -1.
My point, instead of raising awareness of the stupidity of the law and making it better for the rest of us...will DVD Jon just ruin it for us? Will his escapade just serve to make DMCA laws worse? Will the RIAA use this to show that DMCA laws are not tough enough?
I tried for 5 years to come up with a clever sig...only to realize that I am not clever.
And if Linux fixes a local root exploit, do you pop up and say that it's a Linux bias and what they actually did was break compatibility with a convenient password recovery tool?
If someone has a service and there is a way to subvert the intended use, that is a hole. Just because you like it doesn't make it less of a hole.
If your beloved indy artists were any good, most of them would sell out to the major labels in a second.
Don't blame me; I'm never given mod points.
> Do you have any documantation of the "mediocre quality" claim?
Well, the fact that Apple provides the option to rip/encode your cd's with their lossless codec implies (to me) that the AAC codec is not as good in quality of sound. I could live with their current DRM if I were able to purchase songs and download them in their lossless codec, as it would allow me to burn a CD in actual CD quality, but I don't think that option is currently available.
Just out of curiosity, if someone provided you with some "documantation", would iTunes music suddenly sound not-as good as CD?
Why is everyone so passionate about listening to music or watching movies? Where is the focus of the human being today that postings on /. about DRM, piracy, RIAA, and other media-related topics tend to draw more postings than any other subject?
I understand being passionate about something, but seems to me that how and where you listen to music should not even be on your top 10.
The advent of digital media is contributing to the decline of free thought. All people posting pro- and anti- multimedia copyright issues should redirect their passions to things that make a difference in their communities. All of these postings are just reiterations of previous postings with a different subject line. "There is nothing new under the sun."
It is this type of behavior and response to "The Man" that gives them knowledge of the power they possess. A power, by the way, they do not rightfully deserve! The music and movie industry is geared towards our entertainment. How is it that entertainment has this kind of impact on us? They should not be able to draw these levels of emotions from people, unless it is through the content of the media, not the cost or format.
If you want to send messages to the powers that be, quit buying music, quit pirating music, quit paying $60 for a ticket to a concert for a washed-up 80s hair band. Read a book. Write a book. Paint something. Take your kids to the park, sans iPod. Learn to play an instrument. Write YOUR OWN music. Put the power of entertainment back in it's rightful place: in YOUR hands.
Flame me if you like. Call me a dumbass. Fact of the matter is, regardless of what my opinions are on this topic, who I think is right, or who I think is wrong, I am the one who has the ultimate decision and control over what entertains me and the impact it has on my life. You should reclaim the same.
~kiddcreole
There are 10 kinds of people in this world: Those who know binary, and those who don't.