3 ms·

If 1-5 days lead time is the problem, why not promise to disable it afterwards? iTunes DRM has been broken and patched multiple times. The vast majority of its

If 1-5 days lead time is the problem, why not promise to disable it afterwards? iTunes DRM has been broken and patched multiple times. The vast majority of its content is also available on CD/DVD. I don't keep up with DirecTV, but I know there was at some point an active cracking community; while BD+ is still unbroken, AACS fell. These systems have been almost entirely deployed in embedded systems, which clearly makes them harder to crack. Still, the xbox360 and the wii have been cracked (can be modded). I do not think DRM has a good track record and I think it is fundamentally wrongheaded. I don't find the current solutions to DRM that interesting -- from what I understand they just lock down as much as possible (from TCM to HDCP). However, if/when Sun's DReaM stops being a pipe-DReaM, I'll definitely pay attention.

tptacek 18y ago
Disabling DRM after opening week is not at all a bad idea. iTunes DRM has been broken repeatedly. But the latest incarnation has survived multiple years, despite large incentive for a public break. It's been hard enough to break that what has been done has been kept private, for commercial reasons. Like it or not, it's a success story. DirecTV had an active cracking community 7 years ago. Then they contracted a famous cryptography team to develop what appears to be a white-box crypto scheme implemented directly in hardware gates. Nobody has been able to do anything with it since. It's a major success story. What was there in 1999 wasn't so much a "community" as a cottage industry, and now it's dead. BD+ actually has been broken. Title. By. Title. Even if that trend continues for the next several years, it's still a win for Blu-Ray, because SlySoft hasn't gotten a crack out within opening week yet, and they have to dedicate a team to refreshing their product at the whim of the publishers. I don't have a moral concern about DRM. I'd rather use unencumbered CDs. Sure, I'd also rather not pay for satellite TV. But as a CS problem, it's really interesting. The things that people say make it "impossible" actually make it Hard. Hard problems are fun, and we learn from them.
- jacobscott 18y ago
  Thanks for further fleshing these out; I think you're right that the three are success stories. Just to play devil's advocate, can you think of anything (reasonably popular) for sale on iTunes/Blu-ray or shown on DirecTV that can't be found free (illegally) online? What do you think about the darknet paper? http://crypto.stanford.edu/DRM2002/darknet5.doc http://crypto.stanford.edu/DRM2002/darknet5.doc
  - tptacek 18y ago
    I don't like this paper. It makes a facile argument ("DRM systems will leak"), and then supports it with inaccuracies. For instance, the notion that watermarking is unlikely to succeed owing to technical challenges with the "embedding layer" --- huh? This irritates me on general principles! Watermarks are covert channels, something most security disciplines try to eliminate, and generally concede to be unstoppable. What I think really happened here? This paper came out roughly a year after Ed Felten busted the SDMI watermark, and simply took his results and generalized them. Of course, SDMI is a crappy watermark; Ed Felten broke it in a matter of weeks.
    - jacobscott 18y ago
      Feel free to let me know if I am beating a dead horse; but it seems (e.g. matasano etc) like you have extensive expertise/knowledge here and I'm interested in your opinion. My next questions are about DRM in the general context of content protection. Do you think it will ever be difficult to (find and) download an unprotected Top 40 single from the Internet? An HDTV rip of a television show? Will the "DRM ecosystem" be able to secure popular content in the future, thereby having a significantly detrimental effect on piracy? Is the security of BD+ the beginning of a trend in next-generation content protection, or an anomaly? What I'm really trying to puzzle out is whether DRM prevents, or will prevent in the future, enough piracy (and convinces pirates to purchase? Very hard metric to quantify) to warrant the substantial inconvenience it places on legitimate customers.
      - tptacek 18y ago
        iTunes DRM doesn't inconvenience the typical iTunes customer. DirecTV content protection doesn't inconvenience DTV subscribers. Blu-Ray BD+ doesn't inconvenience most Blu-Ray customers (almost none of whom "back up" their DVDs). That's a big part of why they work. The trouble I think most people have in analyzing DRM is that it's not an all-or-nothing problem; it's an economic one. There will always be cammed copies of first-run movies for sale on the street and circulating on BitTorrent. But as long as it's easier to buy than to copy --- at least in the first 2 weeks of a release --- DRM is working. To achieve that, DRM vendors just need to make the cost of a break more expensive than those first couple weeks are worth in piracy costs. I don't really have a horse in this race. I'm not sold on DRM either. I've worked professionally on both sides of this problem. What I think right now is that CS types are underestimating the next generation of DRM systems. Software and content protection is getting more sophisticated. It also dovetails more effectively with systems security than it did 10 years ago. We want locks on our platforms so they don't get enrolled in botnets; those same locks will help content providers enforce contracts.

tptacek 18y ago

Disabling DRM after opening week is not at all a bad idea. iTunes DRM has been broken repeatedly. But the latest incarnation has survived multiple years, despite large incentive for a public break. It's been hard enough to break that what has been done has been kept private, for commercial reasons. Like it or not, it's a success story. DirecTV had an active cracking community 7 years ago. Then they contracted a famous cryptography team to develop what appears to be a white-box crypto scheme implemented directly in hardware gates. Nobody has been able to do anything with it since. It's a major success story. What was there in 1999 wasn't so much a "community" as a cottage industry, and now it's dead. BD+ actually has been broken. Title. By. Title. Even if that trend continues for the next several years, it's still a win for Blu-Ray, because SlySoft hasn't gotten a crack out within opening week yet, and they have to dedicate a team to refreshing their product at the whim of the publishers. I don't have a moral concern about DRM. I'd rather use unencumbered CDs. Sure, I'd also rather not pay for satellite TV. But as a CS problem, it's really interesting. The things that people say make it "impossible" actually make it Hard. Hard problems are fun, and we learn from them.

jacobscott 18y ago
Thanks for further fleshing these out; I think you're right that the three are success stories. Just to play devil's advocate, can you think of anything (reasonably popular) for sale on iTunes/Blu-ray or shown on DirecTV that can't be found free (illegally) online? What do you think about the darknet paper? http://crypto.stanford.edu/DRM2002/darknet5.doc http://crypto.stanford.edu/DRM2002/darknet5.doc
- tptacek 18y ago
  I don't like this paper. It makes a facile argument ("DRM systems will leak"), and then supports it with inaccuracies. For instance, the notion that watermarking is unlikely to succeed owing to technical challenges with the "embedding layer" --- huh? This irritates me on general principles! Watermarks are covert channels, something most security disciplines try to eliminate, and generally concede to be unstoppable. What I think really happened here? This paper came out roughly a year after Ed Felten busted the SDMI watermark, and simply took his results and generalized them. Of course, SDMI is a crappy watermark; Ed Felten broke it in a matter of weeks.
  - jacobscott 18y ago
    Feel free to let me know if I am beating a dead horse; but it seems (e.g. matasano etc) like you have extensive expertise/knowledge here and I'm interested in your opinion. My next questions are about DRM in the general context of content protection. Do you think it will ever be difficult to (find and) download an unprotected Top 40 single from the Internet? An HDTV rip of a television show? Will the "DRM ecosystem" be able to secure popular content in the future, thereby having a significantly detrimental effect on piracy? Is the security of BD+ the beginning of a trend in next-generation content protection, or an anomaly? What I'm really trying to puzzle out is whether DRM prevents, or will prevent in the future, enough piracy (and convinces pirates to purchase? Very hard metric to quantify) to warrant the substantial inconvenience it places on legitimate customers.
    - tptacek 18y ago
      iTunes DRM doesn't inconvenience the typical iTunes customer. DirecTV content protection doesn't inconvenience DTV subscribers. Blu-Ray BD+ doesn't inconvenience most Blu-Ray customers (almost none of whom "back up" their DVDs). That's a big part of why they work. The trouble I think most people have in analyzing DRM is that it's not an all-or-nothing problem; it's an economic one. There will always be cammed copies of first-run movies for sale on the street and circulating on BitTorrent. But as long as it's easier to buy than to copy --- at least in the first 2 weeks of a release --- DRM is working. To achieve that, DRM vendors just need to make the cost of a break more expensive than those first couple weeks are worth in piracy costs. I don't really have a horse in this race. I'm not sold on DRM either. I've worked professionally on both sides of this problem. What I think right now is that CS types are underestimating the next generation of DRM systems. Software and content protection is getting more sophisticated. It also dovetails more effectively with systems security than it did 10 years ago. We want locks on our platforms so they don't get enrolled in botnets; those same locks will help content providers enforce contracts.