4 ms·

>preventing users from saving the content How can an open source software prevent users from saving the content? If the CDM decrypts to plaintext, it should be

by nawitus 12y ago

>preventing users from saving the content How can an open source software prevent users from saving the content? If the CDM decrypts to plaintext, it should be trivial to modify the open source sandbox to save the plaintext data. (Obviously the software can prevent saving the content by default).

chimeracoder 12y ago
According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary) There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob). [0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challenge-of-serving-users/ https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... [1] https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
- ygjb 12y ago
  You got [0] wrong. It is an open source wrapper around a closed source CDM.
  - chimeracoder 12y ago
    Thanks, that's what I meant (and cited). That's what I get for typing quickly on my phone, haha.
- AnthonyMouse 12y ago
  Nobody really uses the analog hole. It's actually easier to do it digitally, and will remain so, because securing a device against arbitrarily many attackers with physical access and arbitrarily large amounts of time and resources is a practical impossibility. The analog hole is just the formal proof that DRM can never be effective, because if you can see it or hear it you can record it.
  - mike_hearn 12y ago
    Actually Cinavia is an interesting example of trying to close the analog hole. You can point a camcorder at your screen and record a movie, but if you try and play that recording back on a fancy TV or BluRay player, it still won't work because the audio track has encoded instructions in it saying "expect an encrypted/DRMd media stream". If the player sees the content expects to be DRMd, it silences the audio after about 20 minutes.
    - im3w1l 12y ago
      Wow that's wonderful. I can't wait until the police start playing that track at demonstrations.
    - darkmighty 12y ago
      That's quite interesting! Does it rely on steganography? Because as far as I know, it's quite difficult to keep the integrity of stego contents if the system is public knowledge (e.g. a low pass filter may destroy high frequency watermaking). The sheer amount of degrees of freedom in a minute of 30fps 4k video though makes it seem not so hard to accomplish a steep ( video quality x decoding probability ) tradeoff for attackers. Of course, then there's the software integrity problem -- I can't imagine a feasible system that prevents bypassing the software verification completely. Or, for hardware checks, I can't see a regulation enforcing "All TVs must have this enabled" (i.e. you just buy from an open brand). This would be more interesting though for authenticated video streaming. Imagine every user is required to reveal a real identity to retrieve content. Then they can not only watermark the content but point to the exact user responsible, as long as the content has enough degrees of freedom to support it. Makes file sharing a lot harder if you can be held responsible after an indefinite period.
      - mike_hearn 12y ago
        It watermarks into the audio track and is by all accounts incredibly sophisticated and robust. Pirates have been trying to destroy the watermarks for years and all they achieved is making the soundtrack unlistenable. For bypassing the software verification, it can be made quite hard although it's kind of irrelevant today because it only became mandatory (via BluRay Consortium "regulations") in 2012. So there are still lots of players around that don't do it and this will be the case for the forseeable future. Verance is doing a big push to get it into TVs and other things but I'm not sure how successful they are being. The technology works without a doubt but of course when you add up licensing costs, etc, it's not always necessarily a win.
- dublinben 12y ago
  It's not even necessary to exploit the analog hole. You can get an HDMI splitter that will strip HDCP, and an HDMI capture card that will let you save full quality, digital video from any protected source.
- nawitus 12y ago
  I interpreted the open-source wrapper to be something that receives the media to be displayed in the browser (but this is just a guess).
rlx0x 12y ago
I guess thats pseudo DRM. On the other end you have things like RTMPe, a proprietary highly complex binary protocol that is only implemented in the adobe flash plugin binary blob. Or something like HDCP (the copy protection part of HDMI) that builds a hardware encryption platform, with an central authority and certified hardware vendors. Those are just 2 examples of "strong" DRM, but since even those two have been so thoroughly broken, we can just assert that any DRM that is based on W3C EME is gonna be childsplay. I don't think anyone actually believes that this W3C crap is gonna be "secure".
- makomk 12y ago
  The EME standard is explicitly designed to support hardware encryption systems that provide end-to-end encryption - think a proprietary decryption black box in your devices that takes an encrypted, compressed video screen and overlays it directly onto the screen output without it ever touching RAM anywhere where software can access it. Good luck breaking that, short of inconvenient hacks involving HDCP decryption and recompression (and those may not be long for this world either - newer video outputs are AES-encrypted).
  - rlx0x 12y ago
    I think its always amusing when people say that <latest DRM tech> is unbreakable. When in fact there never was and never will be such a thing.
JoshTriplett 12y ago
Some Open Source PDF readers respect the "don't copy" and "don't print" bits, even though you can trivially disable them.
mdeslaur 12y ago
DRM is more about having leverage over the provider of the playback device and casual piracy than it is about protecting the content against hardcore piracy.
- zanny 12y ago
  Hardcore pirates don't watch this BS, they just get the entire season off Piratebay in 4k with surround sound.
- mixedbit 12y ago
  Which in reality translates to: DRM is about screwing honest users, pirates always find a way around it.
  - mdeslaur 12y ago
    Honest users couldn't care less, as long as it works.
    - mixedbit 12y ago
      The problem is that in most case it doesn't. Like in the example from this post, where users can no longer run fully open browser. Or when you buy a game and are unable to play it because your internet link is down. I have never seen a DRM system that wouldn't impede honest usage in some way.

by nawitus 12y ago

chimeracoder 12y ago

According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary) There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob). [0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challenge-of-serving-users/ https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... [1] https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole

ygjb 12y ago
You got [0] wrong. It is an open source wrapper around a closed source CDM.
- chimeracoder 12y ago
  Thanks, that's what I meant (and cited). That's what I get for typing quickly on my phone, haha.
AnthonyMouse 12y ago
Nobody really uses the analog hole. It's actually easier to do it digitally, and will remain so, because securing a device against arbitrarily many attackers with physical access and arbitrarily large amounts of time and resources is a practical impossibility. The analog hole is just the formal proof that DRM can never be effective, because if you can see it or hear it you can record it.
- mike_hearn 12y ago
  Actually Cinavia is an interesting example of trying to close the analog hole. You can point a camcorder at your screen and record a movie, but if you try and play that recording back on a fancy TV or BluRay player, it still won't work because the audio track has encoded instructions in it saying "expect an encrypted/DRMd media stream". If the player sees the content expects to be DRMd, it silences the audio after about 20 minutes.
  - im3w1l 12y ago
    Wow that's wonderful. I can't wait until the police start playing that track at demonstrations.
  - darkmighty 12y ago
    That's quite interesting! Does it rely on steganography? Because as far as I know, it's quite difficult to keep the integrity of stego contents if the system is public knowledge (e.g. a low pass filter may destroy high frequency watermaking). The sheer amount of degrees of freedom in a minute of 30fps 4k video though makes it seem not so hard to accomplish a steep ( video quality x decoding probability ) tradeoff for attackers. Of course, then there's the software integrity problem -- I can't imagine a feasible system that prevents bypassing the software verification completely. Or, for hardware checks, I can't see a regulation enforcing "All TVs must have this enabled" (i.e. you just buy from an open brand). This would be more interesting though for authenticated video streaming. Imagine every user is required to reveal a real identity to retrieve content. Then they can not only watermark the content but point to the exact user responsible, as long as the content has enough degrees of freedom to support it. Makes file sharing a lot harder if you can be held responsible after an indefinite period.
    - mike_hearn 12y ago
      It watermarks into the audio track and is by all accounts incredibly sophisticated and robust. Pirates have been trying to destroy the watermarks for years and all they achieved is making the soundtrack unlistenable. For bypassing the software verification, it can be made quite hard although it's kind of irrelevant today because it only became mandatory (via BluRay Consortium "regulations") in 2012. So there are still lots of players around that don't do it and this will be the case for the forseeable future. Verance is doing a big push to get it into TVs and other things but I'm not sure how successful they are being. The technology works without a doubt but of course when you add up licensing costs, etc, it's not always necessarily a win.
dublinben 12y ago
It's not even necessary to exploit the analog hole. You can get an HDMI splitter that will strip HDCP, and an HDMI capture card that will let you save full quality, digital video from any protected source.
nawitus 12y ago
I interpreted the open-source wrapper to be something that receives the media to be displayed in the browser (but this is just a guess).

rlx0x 12y ago

I guess thats pseudo DRM. On the other end you have things like RTMPe, a proprietary highly complex binary protocol that is only implemented in the adobe flash plugin binary blob. Or something like HDCP (the copy protection part of HDMI) that builds a hardware encryption platform, with an central authority and certified hardware vendors. Those are just 2 examples of "strong" DRM, but since even those two have been so thoroughly broken, we can just assert that any DRM that is based on W3C EME is gonna be childsplay. I don't think anyone actually believes that this W3C crap is gonna be "secure".

makomk 12y ago
The EME standard is explicitly designed to support hardware encryption systems that provide end-to-end encryption - think a proprietary decryption black box in your devices that takes an encrypted, compressed video screen and overlays it directly onto the screen output without it ever touching RAM anywhere where software can access it. Good luck breaking that, short of inconvenient hacks involving HDCP decryption and recompression (and those may not be long for this world either - newer video outputs are AES-encrypted).
- rlx0x 12y ago
  I think its always amusing when people say that <latest DRM tech> is unbreakable. When in fact there never was and never will be such a thing.

JoshTriplett 12y ago

Some Open Source PDF readers respect the "don't copy" and "don't print" bits, even though you can trivially disable them.

mdeslaur 12y ago

DRM is more about having leverage over the provider of the playback device and casual piracy than it is about protecting the content against hardcore piracy.

zanny 12y ago
Hardcore pirates don't watch this BS, they just get the entire season off Piratebay in 4k with surround sound.
mixedbit 12y ago
Which in reality translates to: DRM is about screwing honest users, pirates always find a way around it.
- mdeslaur 12y ago
  Honest users couldn't care less, as long as it works.
  - mixedbit 12y ago
    The problem is that in most case it doesn't. Like in the example from this post, where users can no longer run fully open browser. Or when you buy a game and are unable to play it because your internet link is down. I have never seen a DRM system that wouldn't impede honest usage in some way.