You've got to be pretty retarded to try and claim that boring software won't be created on a site with a bunch of Linux users.
I promise you that calling me names isn't going to make your argument any stronger, and it's probably not going to convince anyone worth debating with that I'm wrong and you're right either.
Now, please notice the word "most" in my previous post. Some software, Linux being an example, does get developed on alternative funding models, in that particular case mostly by a few companies taking advantage of the vast market for an alternative operating system to run profitable consulting operations. And when you add up all the companies doing that in the entire OSS world, they still might not make as much code used by as many people as a single major commercial software company like Microsoft.
Obviously a lot of code also gets written in-house for private use, and that's fine, but that kind of bespoke software is hardly what we're talking about in a discussion on DRM, is it? Who is going to write all the generic toolkits that the in-house guys customise, or the general purpose office applications, in your world?
Even the rest of your claims are dubious at best. Even in the 80s, computing technology was making the process of "studio recordings" more accessable.
Are you suggesting that a musician with a room, a PC, and a bit of sound editing software will consistently get results of a similar quality to the same musician in a professional recording studio with a professional production team?
The problem with DRM is that it turns everything into a rental.
I'm not sure that is necessarily true, but even if we accept the premise, I don't see a problem with rental as long as everyone knows up-front what the deal is.
It doesn't matter if you've paid for a cheap subcription, a low unit cost, or a high unit cost. All of it is a glorified rental and most people don't realize this.
You think someone signing up for a Netflix account with a low monthly fee doesn't realise that they're paying for a limited-time subscription and instead thinks they're buying a copy of everything they can watch on Netflix?
Or that someone who pays a one-off charge to watch a major sporting event on pay-per-view thinks they're buying a permanent copy they can share with friends?
This especially true for any content that is tied to a particular service. The service goes away and so do your purchases.
Part of the problem every time this debate comes up is that too many people assume purchasing is the only sensible way to consume content. It never has been and probably never will be, and my major point is that alternative arrangements aren't necessarily a bad thing for either consumers or producers.
I'm not arguing that if you're making a purchase, on the understanding that you're buying full, permanent access to a work, and someone's DRM scheme then screws up and stops you getting what you paid for, that's somehow acceptable or desirable. I'm just saying you're only looking at a small part of a big picture, and in some of the other parts, there's a case for some sort of DRM.
Corporate shills are so busy screaming about "artists" rights that they have forgotten that the rest of us have rights too.
You do, and one of the most powerful is the right not to pay someone for access to their content on terms you don't like. If everyone stopped buying DRM'd works tomorrow, DRM would be gone on Monday. If customers made it clear that they were willing to pay more for a work as long as they could have a permanent copy, chances are the market would figure out how to price full sales vs. other access models or someone else would come along to fill in the gap.
What you don't have is a right to enjoy someone else's content on whatever terms you feel like or to enjoy it without compensating them at all for their work to create it. That's illegal whether DRM is used or not.
Most creative workers are still not paid enough to live on, and must maintain "day jobs" just to make ends meet.
Yeah, all those software developers with $100,000 salaries can hardly afford to put bread on the family table. You know when thousands of names of people doing hundreds of different jobs scrolled past in the credits for the Lord of the Rings films? Those guys were just putting it together in their spare time. And the books in the store I went past this afternoon were mostly just written, edited, illustrated, proofread, typeset, printed, bound and distributed by hobbyists for fun.
Of course some people in the creative business don't get paid a huge amount, but claiming that most creative workers don't make a living wage is just unrealistic. You're talking about industries that make up a significant chunk of national economies and employ millions of people full-time.
It only takes one to break the DRM and share the content around the world to render the DRM ineffective.
No, it doesn't. It only takes one to render the DRM ineffective for anyone who knows where to find the cracked version and is willing to risk using it, which isn't the same thing at all.
Unfortunately, if the price of being known is that everyone rips you off, you still never get paid. The popular argument you're hinting at is essentially a pyramid scheme con.
Say goodbye to feature films and big FPS games for example.
And most textbooks with good editorial values and carefully checked exercises.
And most studio-quality music recordings with professional production values.
And most of the software that does incredibly boring things to help run businesses all over the world more efficiently.
Creating new works is easy and often fun. Creating good new works usually requires a lot of effort and/or specialist skills, which in turn are usually provided by people who aren't the creator/copyright holder but get paid for their contribution like any other job. Take away the financial incentive and most of those laborious supporting jobs disappear, along with all the benefits they bring.
You're absolutely right that the blockbusters with astronomical budgets like Hollywood's latest movie or EA's latest sports game would be impossible without serious financial support, but that's just the tip of the iceberg.
The "rights management" is about the "owner" of the content; not the customer.
That simply isn't true.
There are numerous business models involving temporary or restricted access that are in the interests of both creator and customer. Usually this is because the customer gets more flexibility and/or pays a lower price for something, while the creator generates some income from people who wouldn't get enough value to justify a full purchase. Some of the most successful (in both financial and good will) distribution schemes around lately are based on subscription/library models. Pay-per-view models have been very successful for some kinds of content. Good old-fashioned rental still has its place.
Many of these models are impractical without some mechanism for restricting access to content outside of the agreed terms. It often doesn't have to be much, just enough that it's not completely trivial to keep the content from the service permanently to help people stay honest. A lightweight copy protection scheme fits the bill there just fine. Sure, maybe you can break it if you're willing to try hard enough and have no problem with ripping off the creator's work, but then you could probably have just downloaded an illegal copy on BitTorrent anyway if you're willing to do that.
However, even in a perfect world where DRM was unbreakable but it also never stopped a customer from doing anything legitimate, it would still be in everyone's interest to allow a variety of agreements to suit different needs. The alternative is a market where the only legal option is a full purchase and the only other option is black market pirate copies. That is always going to put at least one party in a worse position, even if everyone is acting in good faith.
In short, the rights management aspect is of no benefit to the customer only in the sense that copyright is also of no benefit to consumers. We could eliminate it tomorrow and everyone in society other than content creators would be better off... for a little while. But in the long run, without either these kinds of measures or some other viable incentive, the quantity and quality of works available would drop, which hurts the consumer too.
I'm reminded of Scott McNealy, formerly top dog at Sun, who (in)famously expressed a similar "privacy is dead" kind of attitude and believed everything belonged on the network rather than distributed/client-based. How's that working out for them?
I'm not sure getting rid of Google or Facebook will be quite so easy, but I am increasingly convinced that the tech world would be a better place if they disappeared tomorrow and we were forced to take a fresh look at how to do the kinds of things they do instead of many people just using them by default. There is way too much power over real people's lives being concentrated in a couple of US corporations with a track record of abuse, some morally questionable people running the show, and very limited (by the standards in most of the first world) safeguards to keep them in check. It is far from clear that if we started over on questions like "How do we find information?" or "How do we keep in touch with friends and family" then we'd decide the current ways of doing various things are the best ones, or even good ones.
You raise a valid concern, but the risk to privacy from current technology trends is a lot more than just that. If people start routinely uploading more photos and videos taken in public places -- using this technology or for any other reason -- then sooner or later it's going to create a vast database where the incidental bystanders in the backgrounds of pictures aren't incidental any more, they're easily trackable to anyone with software for facial recognition, gait analysis, or other similar biometric trickery and a bit of time and processing power to scan publicly available pictures (or their own database, if they're a photo sharing/uploading service like Facebook).
Social and legal understanding of what "privacy" means and why it's important haven't yet caught up with the era of Big Data, when old arguments about public places and casual, transient observations simply don't make sense any more. No observation is transient if it's being recorded, and no observation is casual if the subject is going into a searchable database.
While I certainly admire the famous Bhutanese "gross national happiness" philosophy, they do seem to pay for it in other ways. Their national literacy rate is around 60%, their life expectancy is in the low-60s, and climate change is doing nasty things to their farming, so some of the grass on the other side of the street is not greener. Of course, many of us might still do well to consider their general attitude to life...
I certainly agree that many PCs will be replaced by other devices in the home, and that this will cost the PC industry a lot of revenue it might have counted on a few years ago.
I'm not sure it's quite as overwhelming a majority as you're suggesting, though. For example, plenty of us write enough that doing it all on a touchscreen toy keyboard isn't very practical after a while, and someone's still buying enough PC games to keep EA and friends raking it in.
I don't believe that PCs will really die out in the home or that tablets will somehow take over the entire space. They're different tools for different jobs, divided sharply by whether or not consuming information or creating new material is the priority, and by whether depth of capabilities or simplicity of operation is more important. Plenty of people will still want to do jobs where PCs are better.
What the current situation does show is that a lot of things that have sucked about PCs since forever are finally becoming the commercial liabilities they always should have been now that there's genuine competition. Poor usability, poor security, and bloated, overcomplicated software are not your friends whoever you're working with, but particularly not if you're working with non-expert users who don't care about operating systems or browsers or office suites and just want to read the news, buy stuff on-line, or catch up with friends and family.
Not that I disagree with anything you said, but early Dell also had a reputation for quality in the days when the hardware/components industry hadn't consolidated as much as it has today, which parts you picked really did matter, and a lot of PCs suffered silly problems because of careless assembly. If you wanted a solid, reliable office PC, buying a Dell was about as safe a bet as you could place.
At the same time, their reputation for customer service and after-sales support might not have been anything special, but it wasn't bad either. They provided a good level of customisation earlier than many suppliers, probably because of the flexible process you mentioned.
Today, they've squandered both, with a succession of quality control problems and with lousy support and much hand-washing any time anything goes wrong. Apparently some of the equipment they make is still pretty good, when it works, but downtime can make a massive difference to the TCO for business equipment so that "when it works" is a serious drag on everything else they do, and much of what they make is nothing special anyway.
That leaves Dell is much the same position as Cisco: a big name brand that is hoping businesses will still buy their high-priced gear because of the name on the front while somehow not noticing that what's inside the box often isn't very good these days and you might find a better business relationship elsewhere as well. Unfortunately for them, the "no-one ever got fired for buying IBM" strategy doesn't really work any more, at least not for long.
The whole premise of foreign code having direct access to my machine seems broken to me.
I agree entirely. That's why there's a need for technologies that can run remote code in a sandbox with limited access to the host system, which is exactly why tools like Flash and Java applets have been useful.
The danger comes when the code in the sandbox isn't quite as isolated as it's supposed to be, as we see all too often. On the other hand, not having a sandbox at all doesn't so much solve the problem as remove the entire possibility of running remote code on a local host, which is a useful thing to do.
In time, JavaScript and HTML5 may effectively offer a similar generic sandbox that can do much the same things instead. No doubt there will be some security issues there too. For now, however, we're not there yet.
C doesn't have safety belts and airbags, that's your complaint?
Your car analogy is poor. You're talking about whether the language is good for safety, and safety belts and airbags save lives.
If you can't be bothered to check your work and your inputs, to consider pathological cases and data, no linguistic tool is going to make your work stable and secure.
That's an absolute argument in a relative world.
I don't need to check that I'm not dereferencing a NULL pointer everywhere if my programming language's type system means there is no NULL value in that context. The entire class of mistakes is removed.
I don't need to check for an off-by-one error updating a loop counter if I'm using a loop control structure in my programming language that has no explicit counter at all. The entire class of mistakes is removed.
No human programmer is perfect, no matter how good or experienced they are. I make mistakes. You make mistakes. Every single programmer reading these posts makes mistakes. The only way to remove a class of errors with close to 100% reliability is to use tools and processes that remove the possibility of the human error in the first place.
If my tools do that for me in some cases, it leaves me that much longer to think about the other ones, and makes it that much clearer for my peer reviewers to check that I got the logic right when I do. It's not as if I have somehow mysteriously lost all my defensive programming skills by using a more powerful language instead of C! I'll just be using those skills to better effect, because I can concentrate on the harder problems and trust that the easy ones are already solved.
Well, I don't accept your premise about good programmers writing secure C++ code. The evidence just doesn't support your position: there are plenty of vulnerabilities found in software written in C++, just like every other language in widespread industrial use today. Often they just come in the form of library vulnerabilities that your unsuspecting C++ linked into his application, but they're still out of his control unless he wants to rewrite his security library, which I hope we would all agree is a Really Bad Idea(TM) if he's not genuinely a security expert himself.
But even if we grant your premise for the sake of argument, how is someone supposed to write secure C++ and then run it in someone else's browser accessed over the web without posing a security risk to the remote user? You're comparing apples to oranges.
For a long time, there was a real need for things that browsers couldn't do natively and that meant plug-ins like Java or Flash. Of course that also meant the security risks that came with them, but who was offering a better option at the time? As new technologies mature, the use cases that made plug-ins helpful may be better served in other ways. However, it's unrealistic to expect everyone who was using those technologies to drop them and rewrite everything overnight, and many of the newer technologies are objectively not as good at getting useful things done as Java or Flash yet.
Apple tried your just-bin-it approach with Flash on their mobile devices, and all that happened was that when you visit popular sites on your more-expensive-than-a-laptop iPad you see messages saying content isn't available for your device, while competitors pitch products with slogans like "See the whole web!" What do you think would happen if we somehow magically made the Java plug-in disappear tomorrow?
giving me a browser plugin that the vast majority of sites don't legitimately use along with the runtime that's needed to make desktop/background apps run is nutty
Unfortunately, that's not the situation for many people.
In reality, a lot of very popular web sites and applications do run Java applets, even if you personally happen not to use any of them. Common examples in these kinds of discussions are a few major banks, some national government web sites, some teleconferencing/screen sharing tools widely used in businesses, a few games, etc.
Meanwhile, many people at home have no use for Java for desktop/background applications at all. Relatively little end user software is actually written in Java these days, and Java's most popular use seems to be writing business middleware code.
C was a great language for its time, but from a security point of view it is still a nightmare. Unfortunately, whatever theoretical equivalence they might have, in practice different programming languages are not just syntactic sugar.
C is the language that introduced many of us to terms like "buffer overrun" and "access violation" and "null pointer dereference" and "off by one error". These are kinds of programmer error that everyone makes sometimes if they have the chance, even world class programmers who write core OS and networking tools we all rely on every day, and of course most programmers aren't world class and make far, far more mistakes if you give them the opportunity to do so.
C also has very little expressive power, in the sense of letting programmers implement the concepts they need concisely and elegantly, and it hardly has a type system worth mentioning at all. Both of these things are also severe disadvantages when it comes to writing robust, secure code.
If you really think that C is the pinnacle of programming language design and that all these more modern languages are inferior, you might like to consider the sage advice Kipling almost gave: "If you can keep your head when all about you are losing theirs... they probably know something you don't."
Or it's too early in the morning, my sense of humour hasn't finished booting, and your post really was intended as a troll, in which case you have succeeded gloriously and I tip my virtual hat to you...
I agree wholeheartedly. Almost the entire software development industry is rotten, and Java is just an easy target to pick on because of the browser plug-in vulnerabilities.
Certainly security is a difficult thing to get right, but that's no excuse for using tools and techniques that are horribly inadequate for writing secure code. Take a look at how many critical vulnerabilities get patched in every major browser in a year and you see they're no shining beacons of security virtue either. A substantial proportion of our core infrastructure is still written in error-prone, bug-friendly languages like C and C++, which looking objectively from the outside is just crazy.
Unfortunately, it's an institutional malaise, something that is hard for any individual actor in the system to fix. Most development projects simply can't afford to just give up on languages and run-time platforms with vast ecosystems surrounding them that dramatically increase productivity or they'll put themselves at a significant competitive disadvantage. That will continue until someone's "better alternative" language/platform also comes with the same kind of ecosystem.
Realistically, we'll probably have to put up with this sort of nonsense until either the general public start wising up to how much security failures really cost and vote with their wallets, or governments step in and regulate to force the issue, or some project starts eating everyone's lunch because it really does offer such an improvement that using it is a compelling advantage and it can bootstrap its own ecosystem. And it's not as if any of those options doesn't have problems of its own...
The US doesn't have a high enough standard for privacy and data protection laws for me to feel comfortable with them running the Internet either. But the freedom of speech issue can be fixed using a widely used "common carrier" principle that might well be acceptable in Switzerland or Germany and someone could easily detect whether this was being honoured. Unfortunately, the privacy issue cannot be so easily fixed, and I find it implausible that the US government would voluntarily surrender a chance to spy on the whole world's traffic given their demonstrated history of frequent abuse in this area. Indeed that history is one of the main reasons I don't think the US should be allowed to keep the kind of control they have.
In any case, the US attitude to freedom of speech is out of sync with social norms in much of the world, not to mention internally inconsistent, and frankly a lot of the ethically dubious censorship that goes on in the Western world is probably done by or at the direct request of the United States government, often acting in the interests of United States big business. Put another way, protecting freedom of speech is hardly a strong argument for leaving the US in charge anyway.
Trying to regulate any major international infrastructure with a single country in charge of almost everything is always going to be troublesome, but if I had to pick an alternative to the US, I can think of a few credible choices.
Switzerland, maybe? Their position on neutrality in international matters is promising.
Germany? They are successful economically, but also for obvious reasons very conscious of individual freedom and the dangers of centralising too much power.
The trouble I have with the US is that it tends to appoint itself the world's policeman, but primarily when doing so serves US interests. Similarly, what most of the world calls things like "human rights" that apply to all, the US tends to value as "Constitutional rights" that protect primarily US citizens. While these things are perfectly understandable and of little concern if you're actually from the US, most people on the Internet aren't, and that's always going to make for awkward relationships.
FWIW, I once again agree with, or at least sympathise with, many of your comments. This is getting quite long so I won't go point-by-point, but I wanted to follow up on a couple of specific issues.
My cautionary views about relying on the courts are not because there is anything wrong with the principle of allowing flexible laws and "having your day in court" to fix any mistakes. The problem is the cost of such an idealised process, in two very different ways.
Firstly, there's the literal financial cost. If everything is principled (which unfortunately tends to imply "vague") then it seems likely that a lot more people would challenge a minor charge when they are in fact guilty and have no realistic chance of succeeding in court. That results in an increased burden on courts that also have to deal with other matters, and usually on a higher effective penalty for the challenger. I am strongly of the view that for justice to be served, everyone must have a right to a fair hearing if they are accused by the government of any crime, but I don't believe it serves anyone's interests to encourage that path when it really has little if any chance of changing anything.
Secondly, my views are also coloured by my experiences of seeing courts in action first hand (as a witness, not a defendant or prosecutor). The defendant in the case that I mentioned before had her life turned upside down for something like a year before the matter was finally closed. She wound up having to go to court at least twice, as did the rest of us, because it wasn't possible to hear the case on the original scheduled day. This wasn't really the court's fault, because they couldn't know that an unusually high number of urgent matters that they were required to deal with first would arrive that morning, but it still meant that everyone involved lost another whole day at work, for which the courts don't pay much if any compensation, and the case didn't come back to court for several months afterwards, so just when the defendant thought it would finally be over they pulled a bait-and-switch. When the case was finally heard, the defendant was understandably distressed about the whole thing, and that was on top of having been involved in an accident in the first place. Should she have suffered all of this over what would most likely not have resulted in more than a few points on her driving licence and a relatively small fine anyway? It just seemed absurdly disproportionate to me; she went through far more of an ordeal than she would have just taking the points and fine, and in the end she wasn't actually found guilty of doing anything wrong. And of course the case also used up court time, police time, witness time, and so on.
The other point I just wanted to comment on quickly was the question of using a phone any time the engine is running. I think we probably do disagree here, because I very much think that just because you're stopped at lights, for example, that's not a good excuse to start a phone call. Obviously the lights can change, and anyone in the driving seat should always be aware of what's happening around their vehicle so they know how to react when that happens. Perhaps my view here is strongly influenced by living in Cambridge, where we have a lot of cyclists who will (rightly or wrongly) weave through between traffic to reach the front of the queue at lights. Sometimes they do that unwisely, and if as a driver you haven't been keeping an eye on your mirrors and blind spots while you're waiting, bad things can happen as a result. So while the guideline of "if the engine is running" might not be perfect, for the same reasons any of these technical offences isn't perfect, I do think it is reasonable. If you're not so sure you won't be going anywhere in the near future that you've turned your engine off, I think you probably shouldn't be risking a non-emergency call either, which brings us back to the same principle vs. pragmatism situation that we discussed before.
(FYI, I might not be around to reply again in the next couple of days, but thanks for an interesting discussion either way.)
Slashdot Mirror
Sorry, I'm from the UK, so I don't know what point you were trying to make there.
You've got to be pretty retarded to try and claim that boring software won't be created on a site with a bunch of Linux users.
I promise you that calling me names isn't going to make your argument any stronger, and it's probably not going to convince anyone worth debating with that I'm wrong and you're right either.
Now, please notice the word "most" in my previous post. Some software, Linux being an example, does get developed on alternative funding models, in that particular case mostly by a few companies taking advantage of the vast market for an alternative operating system to run profitable consulting operations. And when you add up all the companies doing that in the entire OSS world, they still might not make as much code used by as many people as a single major commercial software company like Microsoft.
Obviously a lot of code also gets written in-house for private use, and that's fine, but that kind of bespoke software is hardly what we're talking about in a discussion on DRM, is it? Who is going to write all the generic toolkits that the in-house guys customise, or the general purpose office applications, in your world?
Even the rest of your claims are dubious at best. Even in the 80s, computing technology was making the process of "studio recordings" more accessable.
Are you suggesting that a musician with a room, a PC, and a bit of sound editing software will consistently get results of a similar quality to the same musician in a professional recording studio with a professional production team?
The problem with DRM is that it turns everything into a rental.
I'm not sure that is necessarily true, but even if we accept the premise, I don't see a problem with rental as long as everyone knows up-front what the deal is.
It doesn't matter if you've paid for a cheap subcription, a low unit cost, or a high unit cost. All of it is a glorified rental and most people don't realize this.
You think someone signing up for a Netflix account with a low monthly fee doesn't realise that they're paying for a limited-time subscription and instead thinks they're buying a copy of everything they can watch on Netflix?
Or that someone who pays a one-off charge to watch a major sporting event on pay-per-view thinks they're buying a permanent copy they can share with friends?
This especially true for any content that is tied to a particular service. The service goes away and so do your purchases.
Part of the problem every time this debate comes up is that too many people assume purchasing is the only sensible way to consume content. It never has been and probably never will be, and my major point is that alternative arrangements aren't necessarily a bad thing for either consumers or producers.
I'm not arguing that if you're making a purchase, on the understanding that you're buying full, permanent access to a work, and someone's DRM scheme then screws up and stops you getting what you paid for, that's somehow acceptable or desirable. I'm just saying you're only looking at a small part of a big picture, and in some of the other parts, there's a case for some sort of DRM.
Corporate shills are so busy screaming about "artists" rights that they have forgotten that the rest of us have rights too.
You do, and one of the most powerful is the right not to pay someone for access to their content on terms you don't like. If everyone stopped buying DRM'd works tomorrow, DRM would be gone on Monday. If customers made it clear that they were willing to pay more for a work as long as they could have a permanent copy, chances are the market would figure out how to price full sales vs. other access models or someone else would come along to fill in the gap.
What you don't have is a right to enjoy someone else's content on whatever terms you feel like or to enjoy it without compensating them at all for their work to create it. That's illegal whether DRM is used or not.
Most creative workers are still not paid enough to live on, and must maintain "day jobs" just to make ends meet.
Yeah, all those software developers with $100,000 salaries can hardly afford to put bread on the family table. You know when thousands of names of people doing hundreds of different jobs scrolled past in the credits for the Lord of the Rings films? Those guys were just putting it together in their spare time. And the books in the store I went past this afternoon were mostly just written, edited, illustrated, proofread, typeset, printed, bound and distributed by hobbyists for fun.
Of course some people in the creative business don't get paid a huge amount, but claiming that most creative workers don't make a living wage is just unrealistic. You're talking about industries that make up a significant chunk of national economies and employ millions of people full-time.
DRM assumes, right from the very beginning, that you are a criminal that the content producer must be protected from.
To be fair, if 90% of players on your game company's servers are known to be using pirate copies, that's not an entirely unreasonable assumption.
It only takes one to break the DRM and share the content around the world to render the DRM ineffective.
No, it doesn't. It only takes one to render the DRM ineffective for anyone who knows where to find the cracked version and is willing to risk using it, which isn't the same thing at all.
Unfortunately, if the price of being known is that everyone rips you off, you still never get paid. The popular argument you're hinting at is essentially a pyramid scheme con.
Say goodbye to feature films and big FPS games for example.
And most textbooks with good editorial values and carefully checked exercises.
And most studio-quality music recordings with professional production values.
And most of the software that does incredibly boring things to help run businesses all over the world more efficiently.
Creating new works is easy and often fun. Creating good new works usually requires a lot of effort and/or specialist skills, which in turn are usually provided by people who aren't the creator/copyright holder but get paid for their contribution like any other job. Take away the financial incentive and most of those laborious supporting jobs disappear, along with all the benefits they bring.
You're absolutely right that the blockbusters with astronomical budgets like Hollywood's latest movie or EA's latest sports game would be impossible without serious financial support, but that's just the tip of the iceberg.
The "rights management" is about the "owner" of the content; not the customer.
That simply isn't true.
There are numerous business models involving temporary or restricted access that are in the interests of both creator and customer. Usually this is because the customer gets more flexibility and/or pays a lower price for something, while the creator generates some income from people who wouldn't get enough value to justify a full purchase. Some of the most successful (in both financial and good will) distribution schemes around lately are based on subscription/library models. Pay-per-view models have been very successful for some kinds of content. Good old-fashioned rental still has its place.
Many of these models are impractical without some mechanism for restricting access to content outside of the agreed terms. It often doesn't have to be much, just enough that it's not completely trivial to keep the content from the service permanently to help people stay honest. A lightweight copy protection scheme fits the bill there just fine. Sure, maybe you can break it if you're willing to try hard enough and have no problem with ripping off the creator's work, but then you could probably have just downloaded an illegal copy on BitTorrent anyway if you're willing to do that.
However, even in a perfect world where DRM was unbreakable but it also never stopped a customer from doing anything legitimate, it would still be in everyone's interest to allow a variety of agreements to suit different needs. The alternative is a market where the only legal option is a full purchase and the only other option is black market pirate copies. That is always going to put at least one party in a worse position, even if everyone is acting in good faith.
In short, the rights management aspect is of no benefit to the customer only in the sense that copyright is also of no benefit to consumers. We could eliminate it tomorrow and everyone in society other than content creators would be better off... for a little while. But in the long run, without either these kinds of measures or some other viable incentive, the quantity and quality of works available would drop, which hurts the consumer too.
I'm reminded of Scott McNealy, formerly top dog at Sun, who (in)famously expressed a similar "privacy is dead" kind of attitude and believed everything belonged on the network rather than distributed/client-based. How's that working out for them?
I'm not sure getting rid of Google or Facebook will be quite so easy, but I am increasingly convinced that the tech world would be a better place if they disappeared tomorrow and we were forced to take a fresh look at how to do the kinds of things they do instead of many people just using them by default. There is way too much power over real people's lives being concentrated in a couple of US corporations with a track record of abuse, some morally questionable people running the show, and very limited (by the standards in most of the first world) safeguards to keep them in check. It is far from clear that if we started over on questions like "How do we find information?" or "How do we keep in touch with friends and family" then we'd decide the current ways of doing various things are the best ones, or even good ones.
You raise a valid concern, but the risk to privacy from current technology trends is a lot more than just that. If people start routinely uploading more photos and videos taken in public places -- using this technology or for any other reason -- then sooner or later it's going to create a vast database where the incidental bystanders in the backgrounds of pictures aren't incidental any more, they're easily trackable to anyone with software for facial recognition, gait analysis, or other similar biometric trickery and a bit of time and processing power to scan publicly available pictures (or their own database, if they're a photo sharing/uploading service like Facebook).
Social and legal understanding of what "privacy" means and why it's important haven't yet caught up with the era of Big Data, when old arguments about public places and casual, transient observations simply don't make sense any more. No observation is transient if it's being recorded, and no observation is casual if the subject is going into a searchable database.
While I certainly admire the famous Bhutanese "gross national happiness" philosophy, they do seem to pay for it in other ways. Their national literacy rate is around 60%, their life expectancy is in the low-60s, and climate change is doing nasty things to their farming, so some of the grass on the other side of the street is not greener. Of course, many of us might still do well to consider their general attitude to life...
Too bad Java suffers from null pointers.
Yes, it is. In that respect, Java has a design almost as unfortunate as C and C++.
I certainly agree that many PCs will be replaced by other devices in the home, and that this will cost the PC industry a lot of revenue it might have counted on a few years ago.
I'm not sure it's quite as overwhelming a majority as you're suggesting, though. For example, plenty of us write enough that doing it all on a touchscreen toy keyboard isn't very practical after a while, and someone's still buying enough PC games to keep EA and friends raking it in.
I don't believe that PCs will really die out in the home or that tablets will somehow take over the entire space. They're different tools for different jobs, divided sharply by whether or not consuming information or creating new material is the priority, and by whether depth of capabilities or simplicity of operation is more important. Plenty of people will still want to do jobs where PCs are better.
What the current situation does show is that a lot of things that have sucked about PCs since forever are finally becoming the commercial liabilities they always should have been now that there's genuine competition. Poor usability, poor security, and bloated, overcomplicated software are not your friends whoever you're working with, but particularly not if you're working with non-expert users who don't care about operating systems or browsers or office suites and just want to read the news, buy stuff on-line, or catch up with friends and family.
Not that I disagree with anything you said, but early Dell also had a reputation for quality in the days when the hardware/components industry hadn't consolidated as much as it has today, which parts you picked really did matter, and a lot of PCs suffered silly problems because of careless assembly. If you wanted a solid, reliable office PC, buying a Dell was about as safe a bet as you could place.
At the same time, their reputation for customer service and after-sales support might not have been anything special, but it wasn't bad either. They provided a good level of customisation earlier than many suppliers, probably because of the flexible process you mentioned.
Today, they've squandered both, with a succession of quality control problems and with lousy support and much hand-washing any time anything goes wrong. Apparently some of the equipment they make is still pretty good, when it works, but downtime can make a massive difference to the TCO for business equipment so that "when it works" is a serious drag on everything else they do, and much of what they make is nothing special anyway.
That leaves Dell is much the same position as Cisco: a big name brand that is hoping businesses will still buy their high-priced gear because of the name on the front while somehow not noticing that what's inside the box often isn't very good these days and you might find a better business relationship elsewhere as well. Unfortunately for them, the "no-one ever got fired for buying IBM" strategy doesn't really work any more, at least not for long.
The whole premise of foreign code having direct access to my machine seems broken to me.
I agree entirely. That's why there's a need for technologies that can run remote code in a sandbox with limited access to the host system, which is exactly why tools like Flash and Java applets have been useful.
The danger comes when the code in the sandbox isn't quite as isolated as it's supposed to be, as we see all too often. On the other hand, not having a sandbox at all doesn't so much solve the problem as remove the entire possibility of running remote code on a local host, which is a useful thing to do.
In time, JavaScript and HTML5 may effectively offer a similar generic sandbox that can do much the same things instead. No doubt there will be some security issues there too. For now, however, we're not there yet.
C doesn't have safety belts and airbags, that's your complaint?
Your car analogy is poor. You're talking about whether the language is good for safety, and safety belts and airbags save lives.
If you can't be bothered to check your work and your inputs, to consider pathological cases and data, no linguistic tool is going to make your work stable and secure.
That's an absolute argument in a relative world.
I don't need to check that I'm not dereferencing a NULL pointer everywhere if my programming language's type system means there is no NULL value in that context. The entire class of mistakes is removed.
I don't need to check for an off-by-one error updating a loop counter if I'm using a loop control structure in my programming language that has no explicit counter at all. The entire class of mistakes is removed.
No human programmer is perfect, no matter how good or experienced they are. I make mistakes. You make mistakes. Every single programmer reading these posts makes mistakes. The only way to remove a class of errors with close to 100% reliability is to use tools and processes that remove the possibility of the human error in the first place.
If my tools do that for me in some cases, it leaves me that much longer to think about the other ones, and makes it that much clearer for my peer reviewers to check that I got the logic right when I do. It's not as if I have somehow mysteriously lost all my defensive programming skills by using a more powerful language instead of C! I'll just be using those skills to better effect, because I can concentrate on the harder problems and trust that the easy ones are already solved.
Well, I don't accept your premise about good programmers writing secure C++ code. The evidence just doesn't support your position: there are plenty of vulnerabilities found in software written in C++, just like every other language in widespread industrial use today. Often they just come in the form of library vulnerabilities that your unsuspecting C++ linked into his application, but they're still out of his control unless he wants to rewrite his security library, which I hope we would all agree is a Really Bad Idea(TM) if he's not genuinely a security expert himself.
But even if we grant your premise for the sake of argument, how is someone supposed to write secure C++ and then run it in someone else's browser accessed over the web without posing a security risk to the remote user? You're comparing apples to oranges.
For a long time, there was a real need for things that browsers couldn't do natively and that meant plug-ins like Java or Flash. Of course that also meant the security risks that came with them, but who was offering a better option at the time? As new technologies mature, the use cases that made plug-ins helpful may be better served in other ways. However, it's unrealistic to expect everyone who was using those technologies to drop them and rewrite everything overnight, and many of the newer technologies are objectively not as good at getting useful things done as Java or Flash yet.
Apple tried your just-bin-it approach with Flash on their mobile devices, and all that happened was that when you visit popular sites on your more-expensive-than-a-laptop iPad you see messages saying content isn't available for your device, while competitors pitch products with slogans like "See the whole web!" What do you think would happen if we somehow magically made the Java plug-in disappear tomorrow?
giving me a browser plugin that the vast majority of sites don't legitimately use along with the runtime that's needed to make desktop/background apps run is nutty
Unfortunately, that's not the situation for many people.
In reality, a lot of very popular web sites and applications do run Java applets, even if you personally happen not to use any of them. Common examples in these kinds of discussions are a few major banks, some national government web sites, some teleconferencing/screen sharing tools widely used in businesses, a few games, etc.
Meanwhile, many people at home have no use for Java for desktop/background applications at all. Relatively little end user software is actually written in Java these days, and Java's most popular use seems to be writing business middleware code.
C was a great language for its time, but from a security point of view it is still a nightmare. Unfortunately, whatever theoretical equivalence they might have, in practice different programming languages are not just syntactic sugar.
C is the language that introduced many of us to terms like "buffer overrun" and "access violation" and "null pointer dereference" and "off by one error". These are kinds of programmer error that everyone makes sometimes if they have the chance, even world class programmers who write core OS and networking tools we all rely on every day, and of course most programmers aren't world class and make far, far more mistakes if you give them the opportunity to do so.
C also has very little expressive power, in the sense of letting programmers implement the concepts they need concisely and elegantly, and it hardly has a type system worth mentioning at all. Both of these things are also severe disadvantages when it comes to writing robust, secure code.
If you really think that C is the pinnacle of programming language design and that all these more modern languages are inferior, you might like to consider the sage advice Kipling almost gave: "If you can keep your head when all about you are losing theirs... they probably know something you don't."
Or it's too early in the morning, my sense of humour hasn't finished booting, and your post really was intended as a troll, in which case you have succeeded gloriously and I tip my virtual hat to you...
I agree wholeheartedly. Almost the entire software development industry is rotten, and Java is just an easy target to pick on because of the browser plug-in vulnerabilities.
Certainly security is a difficult thing to get right, but that's no excuse for using tools and techniques that are horribly inadequate for writing secure code. Take a look at how many critical vulnerabilities get patched in every major browser in a year and you see they're no shining beacons of security virtue either. A substantial proportion of our core infrastructure is still written in error-prone, bug-friendly languages like C and C++, which looking objectively from the outside is just crazy.
Unfortunately, it's an institutional malaise, something that is hard for any individual actor in the system to fix. Most development projects simply can't afford to just give up on languages and run-time platforms with vast ecosystems surrounding them that dramatically increase productivity or they'll put themselves at a significant competitive disadvantage. That will continue until someone's "better alternative" language/platform also comes with the same kind of ecosystem.
Realistically, we'll probably have to put up with this sort of nonsense until either the general public start wising up to how much security failures really cost and vote with their wallets, or governments step in and regulate to force the issue, or some project starts eating everyone's lunch because it really does offer such an improvement that using it is a compelling advantage and it can bootstrap its own ecosystem. And it's not as if any of those options doesn't have problems of its own...
The US doesn't have a high enough standard for privacy and data protection laws for me to feel comfortable with them running the Internet either. But the freedom of speech issue can be fixed using a widely used "common carrier" principle that might well be acceptable in Switzerland or Germany and someone could easily detect whether this was being honoured. Unfortunately, the privacy issue cannot be so easily fixed, and I find it implausible that the US government would voluntarily surrender a chance to spy on the whole world's traffic given their demonstrated history of frequent abuse in this area. Indeed that history is one of the main reasons I don't think the US should be allowed to keep the kind of control they have.
In any case, the US attitude to freedom of speech is out of sync with social norms in much of the world, not to mention internally inconsistent, and frankly a lot of the ethically dubious censorship that goes on in the Western world is probably done by or at the direct request of the United States government, often acting in the interests of United States big business. Put another way, protecting freedom of speech is hardly a strong argument for leaving the US in charge anyway.
Trying to regulate any major international infrastructure with a single country in charge of almost everything is always going to be troublesome, but if I had to pick an alternative to the US, I can think of a few credible choices.
Switzerland, maybe? Their position on neutrality in international matters is promising.
Germany? They are successful economically, but also for obvious reasons very conscious of individual freedom and the dangers of centralising too much power.
The trouble I have with the US is that it tends to appoint itself the world's policeman, but primarily when doing so serves US interests. Similarly, what most of the world calls things like "human rights" that apply to all, the US tends to value as "Constitutional rights" that protect primarily US citizens. While these things are perfectly understandable and of little concern if you're actually from the US, most people on the Internet aren't, and that's always going to make for awkward relationships.
FWIW, I once again agree with, or at least sympathise with, many of your comments. This is getting quite long so I won't go point-by-point, but I wanted to follow up on a couple of specific issues.
My cautionary views about relying on the courts are not because there is anything wrong with the principle of allowing flexible laws and "having your day in court" to fix any mistakes. The problem is the cost of such an idealised process, in two very different ways.
Firstly, there's the literal financial cost. If everything is principled (which unfortunately tends to imply "vague") then it seems likely that a lot more people would challenge a minor charge when they are in fact guilty and have no realistic chance of succeeding in court. That results in an increased burden on courts that also have to deal with other matters, and usually on a higher effective penalty for the challenger. I am strongly of the view that for justice to be served, everyone must have a right to a fair hearing if they are accused by the government of any crime, but I don't believe it serves anyone's interests to encourage that path when it really has little if any chance of changing anything.
Secondly, my views are also coloured by my experiences of seeing courts in action first hand (as a witness, not a defendant or prosecutor). The defendant in the case that I mentioned before had her life turned upside down for something like a year before the matter was finally closed. She wound up having to go to court at least twice, as did the rest of us, because it wasn't possible to hear the case on the original scheduled day. This wasn't really the court's fault, because they couldn't know that an unusually high number of urgent matters that they were required to deal with first would arrive that morning, but it still meant that everyone involved lost another whole day at work, for which the courts don't pay much if any compensation, and the case didn't come back to court for several months afterwards, so just when the defendant thought it would finally be over they pulled a bait-and-switch. When the case was finally heard, the defendant was understandably distressed about the whole thing, and that was on top of having been involved in an accident in the first place. Should she have suffered all of this over what would most likely not have resulted in more than a few points on her driving licence and a relatively small fine anyway? It just seemed absurdly disproportionate to me; she went through far more of an ordeal than she would have just taking the points and fine, and in the end she wasn't actually found guilty of doing anything wrong. And of course the case also used up court time, police time, witness time, and so on.
The other point I just wanted to comment on quickly was the question of using a phone any time the engine is running. I think we probably do disagree here, because I very much think that just because you're stopped at lights, for example, that's not a good excuse to start a phone call. Obviously the lights can change, and anyone in the driving seat should always be aware of what's happening around their vehicle so they know how to react when that happens. Perhaps my view here is strongly influenced by living in Cambridge, where we have a lot of cyclists who will (rightly or wrongly) weave through between traffic to reach the front of the queue at lights. Sometimes they do that unwisely, and if as a driver you haven't been keeping an eye on your mirrors and blind spots while you're waiting, bad things can happen as a result. So while the guideline of "if the engine is running" might not be perfect, for the same reasons any of these technical offences isn't perfect, I do think it is reasonable. If you're not so sure you won't be going anywhere in the near future that you've turned your engine off, I think you probably shouldn't be risking a non-emergency call either, which brings us back to the same principle vs. pragmatism situation that we discussed before.
(FYI, I might not be around to reply again in the next couple of days, but thanks for an interesting discussion either way.)