6 Comments

1. 

   David Magda on Tuesday, 2 January, 2007 at 5:32 pm

   Bruce Schneier has been saying this for years:

   Abstractly, it is an impossible task. All entertainment media on the Internet (like everything else on the Internet) is just bits: ones and zeros. Bits are inherently copyable, easily and repeatedly. If you have a digital file — text, music, video, or whatever — you can make as many copies of that file as you want, do whatever you want with the copies. This is a natural law of the digital world, and makes copying on the Internet different from copying Rolex watches or Louis Vuitton luggage.

   http://www.schneier.com/crypto-gram-0105.html#3

   Of course the various content organizations (RIAA, MPAA, etc.) are now moving from technical means of DRM to legal means.

2. 

   Miro on Tuesday, 2 January, 2007 at 10:36 pm

   The so called ‘entertainment industry’ (represented by RIAA and MPAA) as we know it is dead.
   It used to be fun to watch movies, now most of my friends play computer games, write/read blogs and pretty much spend a LOT of time on their computers.

   There is so much new things to do with computers these days – pirating movies is probably the least attractive one.

   They need to stop blaming pirates for lost of revenue and face the reality – it is a dying business model (as it is at the moment). I know that it doesn’t sound very attractive as explanation in front of the shareholders as if one blames it on the pirates, but that is not my problem.

   You can use all the encryption you want – somebody will break it, you can sue every pirate you can find – your revenue is not going to move up one bit; you can block computers with DRM and live Internet authorization, do all you want – at the end people will just do something else instead of watching/buying a move.

   Most customers of the Internet era do not respond well to treads and limitations, so MPAA will have to find ways to attract people not to alienate them if they want to exist.

   Wake up MPAA, it is XXI century… evolve or disappear.

3. 

   Wes Felter on Wednesday, 3 January, 2007 at 4:17 pm

   Actually they do have a way of changing the keys, and it is fascinating reading. (Too bad this cool technology isn’t being used for good.)

   http://web.archive.org/web/20060604054302/http://www.lotspiech.com/AACS/

4. 

   Robin Harris on Wednesday, 3 January, 2007 at 5:20 pm

   David, I recommend Schneier to everybody who wants to learn more about security. I even have him in my blogroll, which for some reason refuses to publish.

   Miro, there was a time when the publishing industry thought Xerox machines would destroy the book business. Still waiting for that to happen.

   Wes, great link! I only understand about 20% of the article, but I did note this rather large loophole:

   There is one final hole: the pirate copy could be an exact bit-for-bit copy of a legitimate disc; I call that a lithographic copy. This can happen if a contracted replicator does an overrun without informing the studio, or a third-party strips the plastic off of a disc they have purchased in the market, and use it as a master. In these cases, of course, the signature will verify, and revocation is impossible because legitimate discs with that certificate exist in the market. Under this attack, the technical means AACS has defined are no longer effective (although there are rumors that the new “Blu-ray” DVD format addresses this attack by technical controls on the replication process itself).

   Which gets back to the point that David quoted: they’re just ones and zeros. I’m impressed by the AACS scheme: “The NNL key management scheme (also called the subset-difference scheme) is as efficient as a public-key system in revoking compromised devices, but unlike a public-key protocol, it does not require devices to have two-way conversation to establish a shared key.” Pretty smart!

   Yet even Lotspiech – the L in NNL – admits that AACS relies upon non-technical means to defeat all attacks. And that, I submit, is the Achilles heel of the system, even if the AACS technology turns out to be every bit as good as NNL believe. People are flaky, so the system will be compromised in ways that no one has yet anticipated.

   Finally, I’m not yet convinced that the world is going to move to HD DVDs as fast as the move from tape to DVD. My next home entertainment purchase is likely to be one of these up-converting DVD players to go with the HDTV. And while I love the DTS sound that is standard on HD DVDs, I won’t be in any big hurry to replace my current DVDs – especially since I don’t know which standard will be victorious. So all this effort may be for naught, at least commercially, for years to come.

   Robin

5. 

   David Magda on Wednesday, 3 January, 2007 at 6:24 pm

   DRM is not about stopping piracy, but about controlling licensing. As Universal Pictures’s Jerry Pierce said in an interview:

   We don’t expect [customers] to make copies of HD DVDs for their friends. And we don’t think customers want to do that either. So, DRM needs to give them some restrictions beyond what both the customer and we believe are the proper usage rules. That’s what we need to achieve. DRMs enable business models, they don’t stop piracy. And we want to make sure that we have a rich one without making it so easy so that you can violate what we agreed on when you purchased a movie.

   http://www.denguru.com/2006/08/04/tg_daily_interviews_universal_pictures/

   Which some people say is simply about keeping honest users honest, but which is countered by saying that’s like keeping tall users tall. 🙂

   ‘DVD Jon’ even comments that DRM isn’t abou piracy:

   http://nanocrew.net/2006/01/08/deaacscom/

   Much like doors, gates, and locks DRM is not really effective–it just reminds the ‘unskilled’ on what they’re supposedly allow to do and what they’re not allowed to do. So if you want DRM, according to Ed Felten, you have to choose a threat model (this is after all security):

   If you’re a copyright owner, you have two threat models to choose from. The first, which I’ll call the Napsterization model, assumes that there are many people, some of them technically skilled, who want to redistribute your work via peer-to-peer networks; and it assumes further that once your content appears on a p2p network, there is no stopping these people from infringing. The second threat model, which I’ll call the casual-copying model, assumes that you are worried about widespread, but small-scale and unorganized, copying among small groups of ordinary consumers.
   […]
   If you’re a DRM advocate, the first rule of security analysis says that you have to choose a threat model, and stick to it. Either you choose the Napsterization model, and accept that your technology must be utterly bulletproof; or you choose the casual-copying model, and accept that you will not prevent Napsterization. You can’t have it both ways.

   http://www.freedom-to-tinker.com/index.php?p=317

   In general all of these technical measures are completely useless, so the various media organizations have resulting to legal means and now are suing the pants off of anyone they even suspect of download stuff (even grandmothers who don’t have a computer). AACS is actually is a form of NNL (broadcast encryption), but it seems there were situations that the designers may not have taken into account–and now we have BackupHDDVD.

   In general there is less and less need for the *AA organizations. The main aspects in (say) music are: production, recording, promotion and distribution. All but promotion can be replaced by home studios and decent computers and software. Distribution is mostly solved via the Internet, as is promotion (do we need another manufactured boy band or pop princess?). The fact is that, for the major record companies at least, there is no longer a major need for them IMHO and they are simply following Pournelle’s Iron Law of Bureaucracy:

   Pournelle’s Iron Law of Bureaucracy states that in any bureaucratic organization there will be two kinds of people: those who work to further the actual goals of the organization, and those who work for the organization itself. Examples in education would be teachers who work and sacrifice to teach children, vs. union representative who work to protect any teacher including the most incompetent. The Iron Law states that in all cases, the second type of person will always gain control of the organization, and will always write the rules under which the organization functions.

   http://www.jerrypournelle.com/archives2/archives2mail/mail408.html#Iron

6. 

   Wes Felter on Thursday, 4 January, 2007 at 3:46 pm

   The MPAA doesn’t fear the Ukrainian mafia copying discs for profit, but they are working hard to reign in DVD Jon and BitTorrent. I guess this is just another case where people only worry about things they can control, even if the real risk is elsewhere.