Slashdot Mirror
iTunes DRM Hole Closed
FrYGuY101 writes "As recently covered on Slashdot, there was a hole in iTunes which allowed music to be acquired from the iTunes Music Store without Apple's DRM applied. Well, Apple has just released an update which closes this exploit."
I like how they handled that... no horrible punishments, no wagging their finger at the community... just fix the hole, force the update (for obvious legal reasons), and carry on loving your customers... I like...
:P
Too bad napster to go couldn't be so accomodating...
---
Programming is like sex... Make one mistake and support it the rest of your life.
When holes like this one open, it's only a matter of time before they close.
Rant:
This is no big surprise. Our favorite music is owned and operated by an industry
who cares more about money than music. The artists who write and play this music
have sold their souls to this industry. Until the artists wise up and use the
Internet to distribute their music on their own terms, this cat and mouse game will continue. It's not going away soon since many artists do it for the money anyway.
Considering you can burn Apple's song on CD and get rid of the DRM, who cares.
What I'd love is a way to download songs from Apple in a non-lossy format! If DVD Jon could do that, I'd give him a lifetime of gratitude!
If someone says he and his monkey have nothing to hide, they almost certainly do.
..someone just releases a patch to PyMusique so that it looks like version 4.7 of ITunes to Apple's servers...
and the endless game continues....
Of course the only change that Apple has made is to require iTunes 4.7 as the client. How long before someone figures out how to make PyMusique look like iTunes 4.7?
And as long as they are sending un-DRMd songs down to the client they are suceptible to man in the middle attacks (a proxy server which watches for iTMS traffic and saves the song streams to another file), or to someone directly pulling data out of the iTunes app (though the second would arguably violate the DMCA).
How was being able to PURCHASE something in a form that the user actually wanted an exploit? A bug that would allow someone to gain access to Apple's servers, or to steal information, or - for that matter - to steal songs without paying - all of those would be exploits.
If you think that you would be signing a big fat contract with the music label, you're just as dumb as most of the artists out there. What you would be signing is a loan. You would be at the record labels mercy. Believe me, you are better off now. At least you don't owe the music labels anything.
Misrepresenting software to get around the DRM could be interesting legally. (Yes, I know browsers can do this -- but not to avoid DRM.)
Comment removed based on user account deletion
I wonder how happy all the Hymn and J-Hymn users out there are about what DVD Jon did. By releasing PyMusique, he got Apple to force everyone to use 4.7 iTunes if they want to use the iTMS. I believe that 4.7 broke Hymn and unless that has been addressed, now people will no longer be able to remove the DRM from music that they purchased from the iTMS.
What happened was fine, nothing to get your knickers into a knot about. When you buy music with DRM you are agreeing to use it according to the terms set forth. One of those terms is that you agree to how the terms may change in the future. That is why I do not buy music with DRM, the fact that what I can do with that music can change at any time.
It is too bad that the Apple DRM happens to be one of the least onerous and DVD Jon gave Apple a reason to make people move to slightly more restrictive terms with 4.7, but still just the fact that Apple can modify what you can and cannot do with the music from the iTMS is an immediate turn-off for me.
So, the music executives have forced DRM on Apple and so they have to provide it in their files. But they aren't really doing anything. Basically the DRM is to prevent files from being just put on Kazaa and spread around the world. Yet, the DRM doesn't really stop this. There's still the burn and re-rip strategy which is quite effective, as well as the "buy a CD method" which is also effective for getting files onto the internet. The only thing this does stop is file which the person has purchased being accidentally leaked on the internet by some hard-drive scanning P2P program. Anybody who still wants to distribute their purchased music can still do so. All it stops is people who don't want to share their purchased music from sharing it unintentionally.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Sort of. He could only have violated the TOS if he had agreed to them through the iTunes EULA. Since this program wasn't using iTunes, the Terms of Service weren't invoked.
For so long, one of the more legit arguments for downloading music via p2p was that music publishers gave customers no other options other than to purchase an entire, overpriced CD when all a person wanted was one or two songs. Now we have a multitude of options for buying music pretty damn inexpensively online with a very reasonable implementation of DRM, and some people still want to jump through hoops to cheat the system? For god's sakes, write your own music if you're that cheap!
A post a day keeps productivity at bay.
I'm not speaking strictly from firsthand analysis, but it doesn't look like the hymn developers are violating the ToS. hymn is a tool that performs certain operations on standard data objects (mp4 atoms). Actually using it on music files you bought from iTMS is a ToS violation... by the user. You can maybe make arguments about the "intended purpose" of hymn, but that's a much more complicated issue.
Incidentally, as much as I dislike DRM and will probably never buy any DRM'd music (it just feels unclean), I have to second Quasar's post: Apple could have gotten their legal action on, and they deserve credit for instead doing what they did. You can't even really fault them for trying to "pull the rug" via undocumented software changes; aside from the fact that such is really standard industry practice (laugh), iTunes and iTMS belong to Apple and can be changed at their will. (This lock-in is the cause of my first objection to DRM in general, but that's a separate argument.)
"There are hundreds of game theorists at the gates, sir, and they want to hold an election!"
It appears that they ask the application to identify itself and if it isn't iTunes 4.7, it won't download. Sort of reminds me of those websites that checked to make sure you were running IE. That led to other browsers acquiring the ability to misidentify themselves. If that's so, it'll only take a week.
Now what we need is for Slashdot to verify that the user isn't someone who's going to run off and tell Apple.
If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
Walking into a brick and mortar building and purchasing a good old fashioned CD is still a method for getting music. And it doesn't have a DRM attached to it. So why does everyone insist on attaching a DRM to purchased music files? How are they different than the physical CD? A physical CD takes me less than 3 minutes to either rip into AAC or make a physical copy and pass around to whomever I please. Putting a DRM on things is just like saying, PLEASE, TRY AND HACK ME. Its no different than telling kids that they can't drink until they're 21. If you don't make a big deal out of it, neither will they (look at countries that don't have a drinking age for example). On top of that, we all know that DRM is a useless technology. You give the person an encrypted file AND the keys to open it. Wheres the security? And now for the honer system theory.... If it were made blatantly clear when you purchased a song from the iTMS that YOUR NAME and ACCOUNT NUMBER were embedded into the file (just like a license plate on a car), I would certainly think twice about sharing that file on a P2P network. At the same time I would have an unlocked unrestricted file to do as I please with.
Kiteboarding Gear Mention slashdot and get 10% off!
WTF? Last time I checked, all Jon (there's no 'h' in his name) wants to do is watch dvds and listen to music purchased via iTunes on his Linux box. What Jon has done is indeed illegal in some countries (more extreme /. members would call them corporate states), but I don't think that any honest person can say it's unethical.
It's really quite simple. If you buy something, you can do whatever the hell you want with it, so long as your actions don't harm anyone. Don't give me that "indirect harm" bullshit, either. I'd give you ground if we were talking about releasing the plans for building an antimatter bomb, but not for something so inconsequential as circumventing DRM and copy protection.
"The newly born animals are then whisked off for a quick run through a giant baking oven." --heard on Food Network
I'm wondering what the reactionary response to this will be.
In high school (a long long time ago) a friend of mine got a -3 on a question on a test. The girl sitting next to him got a -1 on the same question with a near identical response. He complained and the situation was resolved by giving the girl a -3 instead of a -1.
My point, instead of raising awareness of the stupidity of the law and making it better for the rest of us...will DVD Jon just ruin it for us? Will his escapade just serve to make DMCA laws worse? Will the RIAA use this to show that DMCA laws are not tough enough?
I tried for 5 years to come up with a clever sig...only to realize that I am not clever.