Adobe Flaw Allows Full Movie Downloads For Free

webax writes with this excerpt from Reuters: "[An Adobe security hole] exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience. 'It's a fundamental flaw in the Adobe design. This was designed stupidly,' said Bruce Schneier ... The flaw rests in Adobe's Flash video servers that are connected to the company's players installed in nearly all of the world's Web-connected computers. The software doesn't encrypt online content, but only orders sent to a video player such as start and stop play. To boost download speeds, Adobe dropped a stringent security feature that protects the connection between the Adobe software and its players." webax also notes that the article suggests DRM as a potential solution to the problem.

Comments

Doublethink

[QuantumG]

Wow, so even Bruce Schneier is subject to the DRM double think now? What part of this is hard to understand? You have to give the viewer the key so it can decrypt the video stream and play it to the user.. if the user can see it, the user can record it. Game over. No amount of "encryption" can change the facts.

Re:Doublethink

[Spy der Mann]

The dumb part here is that they send the whole movie to your computer even if you're just watching the free two-minute preview. The two-minute restriction is only enforced in the flash applet.

Web programming 101.
Children, repeat after me: When you program for the web, NEVER, EVER trust the client.

Re:Doublethink

[TubeSteak]

Now, no amount of DRM can stop a paying customer from copying the movie, but a smartly designed system could certainly make the customer pay for the movie before giving the whole movie to them.

Having the preview show you a preview length clip is not a "smartly designed system" it is basic common sense.

Any site that try to protect their content with stupid tricks instead of creating separate content for the preview honestly deserve what comes their way.

I guess content providers have to make a decision as to which is cheaper &/or better:
1. Licensing DRM
2. Buying extra hard drives to store preview clips instead of streaming from the full movie/audio/whatever

Re:Doublethink

[logicmethod]

Flash Player has had the critical flaw of not being able to cancel HTTP requests for years. This causes all kinds of problems for Flash / Flex developers across the board, not only for media streaming applications. Adobe has finally implemented a fix in Flash Player 10--which should be out of beta in the next few weeks--that allows the developer to actually cancel a request and stop the stream. The development community has been bringing this to Adobe's attention for years, and why it has only yet to be addressed is beyond me--it seems so basic. I agree that it isn't a great idea to use the actual media for a preview versus creating a separate preview version, but this flaw makes it extremely easy to grab any file that Flash requests.

Re:Doublethink

[squiggleslash]

Well, there are many points to the article, but one of them is that someone can watch the movie for free because Adobe's server software is set up to continue streaming the movies after showing the free "clip". That, indeed, is "stupid", it relies upon trusted client software. DRM is one solution to this problem, but another is not to stream content to people's PCs they haven't paid for.

Ming boggles...

[PineGreen]

...at how fuckin dumb this all is. If you can see it, you can copy it, maybe it is more difficult, but not impossible. Do these idiots never ever learn?

in case you hadn't noticed

[drDugan]

sadly, axxo and fxg and their black market friends already figured out years ago how to get movies for free to most anyone willing to look for them. it brings the end of an industry in it's current form.

There are better models: allow people, if they choose, to take media without paying for it, but give them credit, additional access, and membership benefits when customers do sponsor/pay for the media they consume. It is really not that complicated... find something you can sell because you can no longer technically control the distribution of your product.

Major media producers cannot change the progression of technology with policy and lawsuits. They would be so much better off to adopt what tech can enable, and build effective business models around providing customers with real value when they do pay for media, instead of using fear and lawsuits to force them to pay when they don't have to.

Re:Switcheroo

[fuzzyfuzzyfungus]

Typically, DRM related security bugs get fixed markedly faster than do security bugs that threaten the security of the computer the software is installed on. Just to remind you who the customer is, and who the consumer is, y'know.

This is new?

[Toonol]

Doesn't everybody know that all flash video is easily accessible? Most of the time it's just a case of dragging it out of the cache. Sometimes you need to jump through more hoops, but I thought it was common knowledge that you could download it all.

You have to re-encode it if you want to, say, burn it on dvd, but that's not too hard. I use winFF (yes, I use windows).

From the article:

[jrockway]

The problem exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience.

Uh, the pirates were already uploading the full HD rips to Usenet days before the movies were even released. No pirate would want the shitty version Amazon is offering.