7 ms·

I don't know, perhaps I'm totally wrong, but this just depresses me. I can see the point from an engineering point-of-view, this is a riddle to be solved, but w

• tptacek 12y ago
  I understand where you're coming from (also, piracy repulses me). However: it's worth knowing whether content protection is implemented soundly. Contrary to overwhelming popular opinion, there are content protection schemes that work. Generalist engineers mistakenly believe that content protection schemes must be unbreakable to provide value. They don't: all they have to do is cost more to break than the value of the content they protect (across all the users who might subsequently get access to it). For an example of a content protection scheme that worked extremely well, see modern satellite TV smart cards. Given that there are ways to implement content protection soundly, there's validity to research that determines whether a given content protection scheme is sound.
  • Steer 12y ago
    First, I'm a bit starstruck by getting a reply from tptacek, I feel validated that I wasn't totally off base. Silly, I know. Thank you for your reply and you are of course right, I appreciate you also putting this into context (tv smart cards). As I said, I was probably overly dramatic. My point was that normally we explain piracy by "it is an easier way of enjoying ..." and I can agree with that, but few things are easier to use (and pay for) than Spotify. I can see your point about researching their content protection. Edit: Wow, learned my lesson, don't express admiration. I guess I just don't get the downvoting without leaving a comment.
  • bri3d 12y ago
    I generally agree, but I think you're conflating two kinds of content protection. One prevents the attacker from accessing something they aren't subscribed to, and relies on crypto and secure subscriber identity mechanisms. This is completely possible to implement soundly. The other prevents the attacker from copying something they can see or listen to, and relies on bizarre mechanisms designed to prevent the user from learning the state of their hardware. I find the latter awful, because it's an infinitely losing battle (you can always point a camera at your display in the end) which erodes consumer freedoms and encourages walled gardens. Satellite TV is a funny example - since the communication is strictly one-way, the hardware state needs to be protected or it can be cloned, but I still think it's fundamentally a question of the transport protection variety rather than the copy protection one.
  • Zigurd 12y ago
    Having strong content protection on a system, and securing that system for its owner are not reconcilable goals. DRM and "trusted computing" is Big Brother Inside.
  • MichaelGG 12y ago
    Are there protection schemes that "work" on properly user-controlled hardware? DirecTV and Xbox and the like can get away with this since they can ship a big block of hardware. It requires some level of work (not click and play) to crack such a device, even if you know how to do it. Whereas any software-based mechanism, without buy-in from the OS/OEM, is essentially going to always be one click away from being cracked, as far as end-users view it.
  • jrockway 12y ago
    Indeed, the goal of DRM is to transfer the liability to someone else. If you make a product that plays back DRM'd content, you don't want to get sued when someone figures out how to use your system to pirate stuff. So you ask the copyright holder what to do, and they say "buy solution XXX that's already approved", and then you do. Then you're happy, because you don't get sued, the chip manufacturer is happy, because you have to buy their chips (and whatever other fun add-ons you may need for your product) from them, and the copyright holder is happy, because the chip company's lawyers convinced their lawyers that nobody can pirate stuff. Meanwhile, it all works because nobody cares to break your DRM because audio is already widely distributed in lossless DRM-free formats (CDs), and Blu-Ray DRM is already broken. The pirates don't want Netflix's 5Mbps stream when they can just buy a Blu-Ray and get a 50Mbps copy instead. (Similarly, they don't want Spotify's Vorbis stream because they can just source material from the uncompressed CD.) (Piracy works because it's a http://en.wikipedia.org/wiki/Smart_cow_problem http://en.wikipedia.org/wiki/Smart_cow_problem)
• gsnedders 12y ago
  > I can see the point from an engineering point-of-view, this is a riddle to be solved, but why would you want to help people circumvent one of the (to me) reasonable ways of enjoying and paying for music? I have a PPC computer running Linux. It is impossible for me to use Spotify on this computer. I am happy to pay for the service. Is it irresponsible for me to reverse-engineer the protocol so that I may use a service I have paid for on a device they do not support? Reverse-engineering the protocol doesn't necessarily mean I want to pirate the content.
  • Steer 12y ago
    From my point of view; if you are paying for Spotify, feel free to use any way you can to actually use the service. If you are not paying for it; don't use it. I did not understand the article as a way of enjoying the service on not supported OSes, but I can agree that is a good thing as long as people pay for the service.
  • andor 12y ago
    I just checked the web player, and it requires Adobe Flash (gnash is not enough). The fun thing is, even with DRM coming to browsers natively, there probably won't be a module for Linux/PPC. DRM must be closed-source for obscurity, and the market for Linux/PPC is too small.
• jfindley 12y ago
  There are far, far easier ways of getting pirated music if that's your goal. I strongly doubt this will significantly affect the level of piracy in music; instead it's a really interesting application of a pair of interesting things, PANDA and the difference in 'randomness' between encrypted and unencrypted streams. I wonder if we'll start to see more crypto methods that deliberately avoid looking like encrypted data to make this sort of attack harder. ISTR agl's pond did something like this, but I could be imaging it, and I've not seen it widely implemented.
• mjgoins 12y ago
  Spotify is not the one reasonable way of paying for music. Purchasing drm-free downloads, physical CDs, cassettes, and vinyl are the reasonable ways.
  • mootothemax 12y ago
    Spotify is not the one reasonable way of paying for music. Purchasing drm-free downloads, physical CDs, cassettes, and vinyl are the reasonable ways. It's a damned convenient service though. My iTunes library is huge. I still end up listening to the same albums with my (paid) Spotify subscription for the pure convenience alone. Edit: I've just remembered the boxes upon boxes of CDs I have in storage in the uk. That's five years, doubt I've given them a second thought for at least the last four.
    • lostlogin 12y ago
      I recently loaded my CDs into the bin after ripping them all - though even the ripped cloud library is rarely touched. The removal of hundreds of CDs was fantastic. There were a couple of live performance CDs I have which were recorded at concerts I attended, I kept them. The mass of physical media is now gone.
  • ljf 12y ago
    If you want to pay for music / support artists you love, then seeing them perform (and paying for it) is the best way of getting cash into their pockets and not the record company's.
• shmerl 12y ago
  It can be seen as a form of protest against the mere idea of the practice of DRM. I.e. it doesn't mean authors advocate piracy, but they make a stand against unethical overreaching preemptive policing and its undemocratic off-shoots (DMCA-1201).
• CrazedGeek 12y ago
  There are semi-legitimate reasons to break Spotify's DRM. One artist I follow was about to release an album, but their record label cancelled it at the last second. Luckily, it still got uploaded to Spotify, so I was able to download a copy of it.
  • nitrogen 12y ago
    I'm curious, was any motivation given for the album's cancellation? It seems strange for a company to abandon a product that's basically done (though I've seen it happen for various reasons).
    • CrazedGeek 12y ago
      The band wanted to release both the album through the record label they were signed to and an acoustic version by the singer through their own record label. Somewhere along the line, the major label started getting really pissy at the band and both (A) wouldn't release the album at all unless the acoustic version was cancelled and (B) refused to send the band preorder copies. The albums are The Hands that Thieve by Streetlight Manifesto and The Hand that Thieves by Toh Kay, but I'm not sure if there's a detailed writeup anywhere. The band posted this: http://streetlightmanifesto.com/update-the-continued-struggle/ http://streetlightmanifesto.com/update-the-continued-struggl... and eventually had to cancel all of the preorders. They also posted this about their label: http://streetlightmanifesto.com/streetlight-manifesto-proudly-boycotts-itself/ http://streetlightmanifesto.com/streetlight-manifesto-proudl...
• darklajid 12y ago
  Well - I've got some stuff that I bought from Audible. But I just rent it. Worse, I cancelled my account because of this crappy DRM in the past (got a new one now) and that seems to mean that I will never again be able to listen to the books I purchased. Right now I'm listening to an audiobook. I would LOVE to listen to that on my Linux machine. How..? I would DEFINITELY prefer not to lose that access (again?), when I decide that the subscription for crappy DRM'd content isn't worth my money.
  • barking 12y ago
    It's a long time since I cancelled my Audible account. There was a lot of stuff that annoyed me about Audible, such as the fact you couldn't roll over credits to the next month and difficulty cancelling being two. However in fairness to them I can still log in and download from my library there. Also the one human I interacted with there was very helpful in getting me cancelled.
    • MattJ100 12y ago
      For what it's worth, they do allow credit roll-over now (up to some limit). Still, I'm annoyed at the DRM, I can't listen to what I want where I want, and there are alternative DRM-free alternatives, so I'm also seriously considering cancelling my account. Glad to hear they still let you access your previous purchases (it was my main worry).
• __david__ 12y ago
  > but why would you want to help people circumvent one of the (to me) reasonable ways of enjoying and paying for music? Because DRM sucks. Why can I only listen to Spotify through their player? Why am I restricted to using it only on computers/devices that they've ported their player to? It's not exactly the same, but back when iTunes sold DRM encrusted music files, I used to strip all the DRM from the files I legally purchased, so that I could play them on my Linux system, stream them to my Philips wifi speaker system, etc. Being locked in to a single vendor's ecosystem sucks. This is part of the reason why I currently refuse to purchase video from iTunes or Amazon. When the industry wises up and drops DRM from video, I will happily start patronizing them. Spotify is a bit different—it's more like Netflix than iTunes or Amazon. Still, if I'm paying for it, it's still frustrating to only being able to use their players [1]. [1] My TiVo has a built-in Netflix player, but it really sucks. Much of the newer content doesn't actually decode properly. Being locked into their system means I'm at their mercy. If I could get at the stream I could use a computer somewhere to transcode it into something the TiVo could reliably play... But the DRM prohibits me from doing that, and that's frustrating.
  • alttab 12y ago
    Frustrating to use their players? Not for 99% of their customers who don't even know what you're talking about. Don't like the restrictions? Don't buy it. Isn't America great?
    • scrollaway 12y ago
      Spotify is a Swedish / UK company. Everything America is not.
    • devcpp 12y ago
      Yeah, I don't use Spotify for that reason. But that guy was just answering a question.
  • mnx 12y ago
    If you buy premium, you can listen to it from other players, for example: http://www.clementine-player.org/ http://www.clementine-player.org/
• davexunit 12y ago
  Digital Restrictions Management turns a computer against it's users. It uses proprietary software to attempt to prevent users from sharing. It's unethical and needs to be circumvented wherever it is found.
• biturd 12y ago
  I know very little about encryption aside from general principles on what it is, why we have it, and what it's goals for existence are. That being said, piracy, love it or hate it, it's here to stay for the time being. I see the "problem" as a simple one. If there is chance that a systems DRM can be broken by merely one person, all efforts by that provider, and now most other providers, at least those that share methodologies, is pointless. If a song, book, or movie are locked down, only legitimate subscribers can use that media under the terms the owner or distributor of that media define. But if only one person of the potentially millions is able to break that encryption, one person has now made all the work and man hours of into said encryption completely worthless. If it takes a few weeks to break encryption that took months of multiple man hours to create, was that time wisely spent? Once it's broken, the data is now open to everyone. That being the case, I feel were in a "why bother" scenario. The main reason I see illegally pirated material not proliferating even more is the technical barrier to acquiring the files. And often times, applications and protocols like bit-torrent, tor, VPN's, SSL links, etc. have too high a technical barrier for the common user to start pirating their media. Once that burden is removed, it's game over and everything will be free at a click of the mouse, until something new comes along or a better business model that works with the fast changing technology world we are in. When you are waging a war of one against millions and the one can actually win without putting themselves in harms way, you have a war that many will think is a sure fire win for the millions. A million against one is a pretty good ratio. But in this case, the one has a very good chance of annihilating the millions. Eventually we will learn there is no point. In the meantime, people do this type of reverse engineering for a number of reasons I imagine. Curiosity, the challenge, making a political statement, and most importantly, to learn. From this, perhaps something new is learned. And from that a new library is made which then gets adapted to detect intrusions on our personal computers and embedded devices. Who knows what may come of this research. In the end, my position on piracy doesn't matter. What I do know is it will happen, encryption will be reverse engineered or broken, and those who can't learn the technology to use the new research will continue to find the barrier to piracy too high. Others won't, and will get their media freely, sans any lockdown from what you want to do with what you purchased. Cars can go well over the speed limit. Some to speeds that make no sense to even exist. But they are legal, and most people follow the speed limit laws. The cost and barriers of breaking those laws are too high so people follow the rules. With DRM, the cost is negligible, so the rules will be broken. But mainly, I think the answer to your question is that curiosity drives a lot of this. Aside from curiosity it could be a lack of trust. Researchers want to know what is going on with their media and hardware. How do you know an encrypted file is not up to nefarious deeds? The common user never will. But a researcher like this would discover that the file was up to more than just DRM, and that could potentially help those millions of people become more aware of security, and learn to be more skeptical of what they buy.
• AlyssaRowan 12y ago
  This is just some really neat reverse-engineering research using Spotify as an example. He doesn't want to harm Spotify. Also, DRM is not necessarily intrinsically linked with payment. For example, people release DRM-free games on the Humble Bundles, and they make millions for charity. There are some business models that don't work well without it, yes (Spotify's particular model of streaming, for example), but plenty that don't need any DRM at all (digital radio stations, for example).
  • Perseids 12y ago
    > There are some business models that don't work well without it, yes (Spotify's particular model of streaming, for example) I would even argue that Spotify only needs to include DRM to pacify the labels it has deals with. Because you can get basically any specific mainstream song via Youtube and if you want to have huge collections of some music genre there are torrents for that, too. The main selling point of Spotify is its implicit promise of rewarding the authors and the comfort of music selection it offers.