Slashdot Mirror
Privatunes Anonymizes iTunes Plus
njondet writes "French-law.net
reports that Ratatium.com, a French website specialized in technology news and software downloads, has just launched
Privatunes, a free software that anonymizes DRM-free files bought on iTunes Plus. Last month's revelations that the DRM-free files sold by EMI on iTunes Plus came with user's full name and account e-mail embedded in them had raised serious privacy concerns. Ratatium.com
explains (in French) that Privatunes is aimed at guaranteeing the privacy of users but also their rights as consumers to freely share and trade the songs they have purchased. However, the claim that this software is perfectly legal will surely be tested."
From their site:
5 reasons to erase private information from my legally acquired iTunes Plus library:
Yeah. A name and email address. On an electronic file that you purchased. In name and email address fields in the clear. How...wrong.
1. Am I still a child who needs his pencilcase and schoolbag tagged with my name?
Utterly irrelevant to the discussion.
2. I bought the damn tune, but someday I may want to sell it (hey, how is it more stupid that selling old CDs ?).
It's not "more stupid" than anything. And since Apple is the first entity that's even allowing this possibility at all with mainstream music from mainstream labels on any meaningful scale, I guess I must not recognize your gratitude.
3. I just have a thing for privacy. Is it dirty?
No, but it's dirty when you think everything is automatically an "invasion of privacy".
4. How the heck do I know it's not gonna be shared on P2P networks by my 6 year old step sister???
How do you know the reason the name and email address is there is for tracking file sharers? How do you even know that would stand up in court? Why does everyone assume that's the reason it's there? Has it occurred to you that this might have been a concession to the labels to make them "feel good", or any number of other reasons? Has it occurred to you that since name and email address have always been included in all purchases from the iTunes store that, uh, maybe nothing has changed?
What if the EU mandates a system for returns and refunds someday from the iTunes store? Wouldn't your account name and email be an easy way for normal individuals to return songs? And before anyone says, "Well, it should be encrypted, then," can you honestly look at me with a straight face and tell me you wouldn't be even more upset that Apple was including unknown personal information, encrypted, in each song bought from iTunes? If it's there at all, it's actually preferable that it's plaintext, because then there are simple ways to remove it without anyone being able to claim that you're breaking some law for removing encrypted information or some other ridiculous thing.
"But it shouldn't be there in the first place."
I know, this is the part is a difficult situation since it is mandatory for all persons on earth to purchase from only the iTunes store. If only Apple didn't force you to buy no-DRM songs from iTunes.
Oh, wait...
5. I thought good customer-seller relationship ment something like... how do they say, "trust' ?
Why do you assume that an electronic item you purchased yourself from the iTunes store having your name and email address embedded in internationally standardized MPEG-4 atoms intended exactly for that purpose somehow equates to lack of "trust"? "Trust" to do what?
I thought the main argument against DRM was so that we could use our files anywhere we wished, on any device we wished. Now we can. Sure, it has your name and email address in it. It's not hidden. It's not a secret. It doesn't matter if most normal users don't realize this. It's still not hidden, nor is it a secret. Most "normal users" don't "realize" a lot of things.
And from the summary:
However, the claim that this software is perfectly legal will surely be tested.
Tested by whom or what? For what purpose?
The software is perfectly legal. Why is this even in doubt? It's a file with no DRM, and you're removing text that is IN THE CLEAR, IN PLAINTEXT in the file that YOU BOUGHT. Removing it by ANY MECHANISM is perfectly legal in any jurisdiction I can think of.
No DRM means just that: no DRM. No encryption. No reverse engineering. No DMCA provisions. Etc.
If you want to make an anonomyzing tool, great. But don't puff it up to be more than it is.
Again, my favorite quote that sums up the stupidity of the outrage over a name and email address being in a file you purchased, from a Gartner analyst:
This just pisses me off. Who really cares besides people who just want to immediately dump the file straight to a filesharing network? So it's got my name and email embedded in the file? So what? Apparently unlike a lot of people who are interested in this service, I'm not planning on sending the files to anyone, and if I burn someone a mix CD, the info will be stripped when it's converted to CDA anyhow.
So what's the privacy problem? It's like someone stealing my wallet. Hell yea that's a privacy concern! What's the solution? Someone steals my iPod and they'll be able to figure out my name?!? They'll also be able to figure out what my house, wife, car, and kid look like because of the pictures on the damn thing, and don't even get me going about documents I store on the damn thing...They'll also be able to figure out my Slashdot handle, because the damn thing has "Satanic Puppy" engraved on the back.
So do I actually care that my info is in the file header? Hell no! It's my goddamn file, it should have my goddamn name on it! And if I wanted to go breach some copyright, I'd at least have the stones to strip the info myself. How fricking lazy do you have to be?
When I wanted DRM-free music, I wanted it because I fricking hated not being able to listen to my damn music wherever the hell I wanted to without jumping through hoops. I've got that, and that's all I care about. Far as I'm concerned the service is fine (though a bit pricey).
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
I am really interested in if the site will live a long life...
I guess someone will take it down, because they are modifying purchased material.
:(){
He's not trolling or attempting to incite a flamewar. He's making several perfectly valid points about the knee-jerk reactions to Apple's DRM-less iTunes files.
Javascript + Nintendo DSi = DSiCade
If you want to upgrade your 256 kbit/s AAC to lossless in a couple of years then leave the proof of purchase IN your iTunes Plus tracks. It enables iTunes to tell that you bought the track from iTunes Store. If you use this app on your iTunes Plus tracks you will be buying lossless for full price like a newbie.
IANAFL* but here come a 100 comments and criticisms based entirely on sketchy understandings of American copyright law, none of which have any relevance in France.
* I Am Not A French Lawyer
Three Squirrels
Freely share downloaded music from iTunes? Did they abolish copyright law in France? I had no idea!
Seriously, while this software may be considered legal, there is little reason to use it unless you are planning to share your music or are deathly afraid of someone stealing your iPod or computer.
Of course, if you are afraid of someone stealing your iPod, what security measures do you use against someone stealing your wallet? Are all your credit cards and your photo ID without your name?
Help! I'm a slashdot refugee.
What's not "private" about files stored on your own hard drive? Everyone else's drive is beyond the boundaries of fair use, so they won't ever show up there, right?
There are only a few letters difference between "privacy" and "piracy"
My web domain.
If you use this app on your iTunes Plus tracks you will be buying lossless for full price like a newbie.
Can't you keep a non-modified copy for this purpose?
Putting back an arbitrary ID in the file can't be much harder than removing the original one, therefore, the simple existence of such tool makes this marking a very weak proof of purchase, so I suspect that Apple will only trust their own server logs.
"Last month's revelations that the DRM-free files sold by EMI on iTunes Plus came with user's full name and account e-mail embedded in them..."
Revelation to whom? People who had their head jammed in the sand for the past few years? That information has been in iTunes purchases for years - it's nothing new. Anyone shocked by this "revelation" needs to change their calendar because they're a bit behind...
I write my name in books when I buy them, and I've never considered the "privacy concern" of erasing it when selling the book, because the buyer already knows who I am. We wanted DRM-free music, we got it. The only people complaining are the cheap bastards who want to share the files over P2P.
Can we please start complaining about privacy issues that actually matter, like the fact that iPhone users' only service option is the same monopoly that was and is spying on the majority of all of our Internet traffic, without a court order or Congressional oversight?
Actually, I'd say he's trolling and trying to incite a flamewar by making valid points about the knee jerk reactions to the Apple embedding peronal information in DRM-less files downloaded from their store. This is slashdot, after all.
And, quite honestly, unless the intent is to track the propagation of the files across the internet and be able to identify the source of the propagation, there's no realy reason to include the information - especially in plaintext. My take is that if you care about it, you should be able to remove the data; if you don't, don't remove it. If it burns you so bad, just don't buy from iTMS, though since you can't buy some of thof from anywhere else that's sort of a useless suggestion. It would be better if they didn't put the info in there to begin with, imho. Not that it matters to me - I don't buy digitally compressed tunes.
Is it just my observation, or are there way too many stupid people in the world?
Article 5 of the French 'Code de la Proprietre Intellectualle'?
And what about the 'Paysanne Amburte vs L'Etate (Loire-Dessus}1998?
These should surely be required reading for any slash-dotter who wants to comment on this radical move on the part of French Resistance?
Give me a day or so and I'll see if I can't dig up some translations of the above. But I'm sure you can read French like a native, so you can start checking here: http://www.legifrance.gouv.fr/WAspad/ListeCodes
I think most companies already keep track of what they sell and to whom. It's called accounting.
Note: The following comments are made without any knowledge of French DRM, privacy, or consumer laws. As a result, this post isn't commentary on legalities. Just idiocy.
Privatunes is aimed at guaranteeing the privacy of users but also their rights as consumers to freely share and trade the songs they have purchased.
Apple finally gives nerds what they've been shouting for--higher-quality DRM-free songs--and this is how the community responds? By anonymizing purchased music so people can pirate it? These guys are class-A asshats.
Last month's revelations that the DRM-free files on iTunes Plus came with user's full name and account e-mail embedded in them had raised serious privacy concerns.
How is someone supposed to steal the name and e-mail address from songs you aren't passing around to all of your buddies and the Internet? Oh, wait. Hasn't the Apple ID info been inside iTunes tracks since the beginning of the iTMS, anyway?
Mikey-San
Karma: +Eleventy billion (mostly affected by watching Celebrity Jeopardy)
> If you want to upgrade your 256 kbit/s AAC to lossless in a couple of years then leave the proof of purchase IN your iTunes Plus
> tracks. It enables iTunes to tell that you bought the track from iTunes Store. If you use this app on your iTunes Plus tracks
> you will be buying lossless for full price like a newbie
Gee, if only there was some way of writing plaintext information to AAC atoms. Unfortunately, consumers don't have access to the supercomputer clusters Apple must use to write a few lines of text to a metadata tag, cementing their bullet-proof proof of purchase scheme.
You fail it. (It is deserving an "Informative" tag.)
...at whoever thinks this eliminates all traces of your identity from a file. Your info could be encoded 50 different ways in the file, and if this app only scrubs 49 of them before you send the file to your friends on BitTorrent -- and seriously, what other point is there to this? -- then you're still hosed.
There's no reason to include the information in the file. They already know what they sold to you. Counting on the client to tell Apple what songs the consumer has purchased would be a very stupid decision anyways. That would be easy to spoof.
The way they would handle an upgrade to lossless is the way they already handled the upgrade to 256 kbit. They knew what they sold you so they let you purchase the upgrade and download it again. You didn't even need the file in your library to do this.
...so that when the jackbooted RIAA thugs break down my door at 3 a.m. in the morning I can point to the embedded ID as proof of ownership.
"How to Do Nothing," kids activities, back in print!
I'm not sure why it would piss you off that someone has released a free (as in beer, but soon to be released with source code, according to their website) app to clean out a couple of personal details in your music files? You don't have to download it or use it, but some people might want to. Not necessarily so that they can share the files on the Internet or anywhere else, but just for their own piece of mind. Atomic Parsley, which can be used to edit the metadata in mp4/aac files, has already had this ability in a simple command line form. I figured it wouldn't be long before someone slapped a limited GUI on it for just this purpose. Really, it's a good thing for people who want it (and obviously people do, because there has been a fair sized outcry over this whole iTunes Plus situation). For people who aren't concerned, don't bother with it. And stop complaining.
Do things like Tor and TrueCrypt bother you too?
but let me put it this way: my private information is not under any scope of anyone else's digital rights. These rights belong to me and I reserve the right to manage them how I want.
Although I applaud EMI for freeing their music from DRM, I don't see that as enough reason to meet them halfway and compromise a basic privacy privilege.
Strawman. Obviously I am out to steal your privacy and deny you encryption, because the ridiculous outrage attendant on some easily removed metadata pisses me off. Grow up. I never even suggested it should be shut down, that's just your read on the situation.
What makes me angry are the people who have the sheer audacity to be pissed off that their DRM-free music has their fricking name on it. Not in it, not watermarked to it, no, just on it. It's the single biggest industry concession in the history of commercial online file distribution, and it's a damn good one, a good faith effort.
The group of people who are most likely to hit this site are people who are probably not acting in good faith...the real hardcore privacy junkies can already do this stuff themselves.
So pardon me if I'm not all giddy that copyright infringing 13 year olds now have a nifty tool at their disposal. It wouldn't take much to reverse this DRM-free music experiment, and I'd really rather not see that happen.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
"Because US courts have ruled that a service provided for the purpose of breaking copyright is liable for civil damages (see Napster, et al)."
And how does this service "break copyright"? Keeping in mind this is a French service even with the Berne convention.
If you really want to share a file, just go buy the CD, rip it, and put it online.
Futhermore I seriously doubt most people who buy music at the iTunes store
1) are going to know that this software exists
2) are going to care that this software exists
3) are going to run this software so they can share their music
Finally, Apple could easily (and might already) use digital watermarking to add personal information to the music file, which is a lot harder to remove (no I did not say impossible).
Basically, if they can make sharing iTunes files a bigger hassle than buying/ripping a physical CD and publishing that, the DRM is still effective.
That said, this software does matter for iTunes users. If you lose your iPod or your machine gets p4wned and your files get shared without you knowing, at least this software can make sure your name is not in the files in an easily readable format anymore.
Don't become a regular here -- you will become retarded.
From the summary (with emphasis added):
Serious privacy concerns? You want serious concerns, subscribe to the EFF's mailing list. If Apple was embedding your credit card or social security number in the file, that'd be serious. Or did you perhaps mean to write "raised ridiculous privacy concerns"?
Just a theory here: Maybe they want you to find and remove the plaintext data. That way you don't notice the watermarking that contains the encrypted form of the same information.
Has anyone verified if two DRM-free downloads of the same song by different people are otherwise identical after having been stripped of the plaintext identifiers?
Apple's online Customer Privacy Policy statement* should perhaps include words to the effect of:
:)
"...blahblahblah..."
Apple's CPP, as written in this example, follows the 'who, what, when, where, why' format (more specifically for this case: 'why, what, when, how') of a traditional document designed to provide clear and logical information for the purpose of fulfilling an obligation to the public. The document then goes on to cover protection of the integrity of your info, purpose of cookies & pixel tags and Apple's supposed companywide commitment to user privacy.
The CPP contains 2,084 words and mentions customer service/support, forums, websites, purchases, logons, emails, software updates, market research, data-sharing with law enforcement and third party vendors, people you send gift certificates to and feedback, yet....it does not reveal the simple fact that some of your personal information is embedded in every song you choose to include in your iTunes library. An oversight, I'm sure, but one that in some people's minds casts doubt on the entire CPP. That is a shame, since Apple's legal team seems to have taken such pains as to exhaustively cover as many specific personal use examples as they could come up with. All the price of doing business these days. When they take steps to outline embedded info, not only in songs, but applications, etc., the issue, at least in my thinking, will go away
*The linked version I referenced, for those that for whatever reason wish to reverse-assemble my comment/logic, was last modified 12.2004 as noted by Apple. Any version dated otherwise is hereby disqualified in relation to my comment.
I can hear it now from EMI - "Hey, under the DMCA, you can't circumvent digital management." "Oh, wait. This wasn't DRM. Never mind."
"Anonymize iTunes tracks"? All it does is strip out metadata. You can do this yourself with one basicially any application that either remuxes, converts the stream, or alters tag/meta information. Pretty much any music player out there. Hell, even Apple's own iTunes can do this! I could understand the use if it could do batch processing on your entire iTunes library, but this tool cannot even do that.
I don't patronize iTunes, but I find the labeling offensive, because there is no fucking point. It's easily removed, obviously, so it clearly provides no substantial benefit. In return, there are negative consequences; for example, if someone steals the file off your computer (you fuck up and make anon ftp available to the root, or something) and then distributes it, you are prime lawsuit-fodder.
It's much like DRM. It doesn't actually stop people from doing the things you don't want them to do, so why do it? Why treat your customers like criminals up front? It's almost surely in response to requests from copyright holders, but that doesn't mean I have to be happy about it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The only problem with Apple including the name and email address in purchased music is that the iTunes UI won't let me filter on it for smart playlists! It's really useful information, and I want to be able to _use_ it to automatically separate the music that my wife buys from the music that I buy.
Or just head over to a used cd store like this one, buy the original album for $5 to $7, archive it to your disk in lossless format, and put it away for storage. Why screw around with itunes when you can have the real deal straight from the get-go -- and be free to do whatever you want with it, including converting to lossy for your portable player -- typically even for less money?
Oops, did I just give away the secret to amassing the ultimate music collection without breaking a single law?
...call them "privateers."
"How to Do Nothing," kids activities, back in print!
It's none other than Fucktard Taco with his ass-fucking buddy brokeback-neil. Chances are, if it's not communist open-sores or ogg/flac/[insert name of communist open-sores format here] they will post a story to attack it, which doesn't surprise me since the shitdot sheeple will gladly take an ass-fucking from either. Fucktard taco & brokeback-neil should both go slit their fucking wrists so the shitdot sheeple will follow his lead.
GO AHEAD, FUCKING FLAME AWAY OR WASTE YOUR GOD-DAMNED MOD POINTS FUCKTARDED SHITDOT SHEEPLE!
Correct me if I'm wrong, and I know this crowd will, but if a program can be written to REMOVE the name and email address, couldn't one be written to REPLACE it with whatever text you might like??
Now MP3 with the RIAA name and email address flooding P2P networks, that would seem humorous at first, but then i thought.......
It could be any other person or group....so doesn't that really mean that the data in the file would not be permissible as evidence. You'd have to prove that the file came from me, not that my name and email address were in the file.
Stripping out the name and email address out of a file that I own and do not share should not be illegal. Putting someone elses name and email address in it, that should be illegal:)
The posting of the file on a P2P network is a separate issue.
The current version of Privatunes blanks out the name and Apple ID/email fields from iTunes Plus files, but it doesn't remove all of the fields that Apple, or a litigant subpoenaing Apple, could use to identify a user. There are two of those, marked sign and chtb, which I posted about here.
There are some other differences between copies of a track purchased by different users, but they're only a byte or three here and there. Probably still worth blanking. vbindiff on *nix (or a similar hexdiff program for other platforms) will show you these fields.
Fixing copyright
Why is that funny? That seems like a good idea to me.
I am government man, come from the government. The government has sent me. -- G.I.R.
> at 3 a.m. in the morning
as opposed to at 3 a.m. in the afternoon?
Anonymous called! it wants it's Ipod back!
Mine does it the right way; it doesn't "blank" any characters, it recalculates all atom lengths, and it recalculates the entire stco table as required. When the input files are the same songs downloaded from different accounts, the resulting output files all have identical MD5 hashes. Hell, even if you're not interested in privacy, it saves a minimum of 32KB per file - which adds up - that's like an extra 75 songs on a 30GB iPod.
And BTW - privacy may not concern some people, but to others it's very "real". Why else would the DMCA, of all things, protect against use of Personally Identifiable Data for copy protection mechanisms? Either the people who wrote the DMCA believe Personally Identifiable Data is a serious and "real" issue, or they put this provision in section 1201 of the DMCA to promote file sharing. Take your pick.