15 ms·

Adobe Spyware Reveals Again the Price of DRM: Your Privacy and Security

504 points by sinak 12y ago

spodek 12y ago
> As our friend Cory Doctorow has been explaining for years, DRM for books is dangerous for readers, authors and publishers alike. Richard Stallman explained it a decade earlier in a piece worth reviewing now and then -- https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html.
- ChrisAntaki 12y ago
  Some of Stallman's predictions were spot on. > In his software class, Dan had learned that each book had a copyright monitor that reported when and where it was read, and by whom, to Central Licensing. (They used this information to catch reading pirates, but also to sell personal interest profiles to retailers.)
  - xnull2guest 12y ago
    > It was also possible to bypass the copyright monitors by installing a modified system kernel. Dan would eventually find out about the free kernels, even entire free operating systems, that had existed around the turn of the century. But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that. Not quite there, but almost (wrt PCs). https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Criticism https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In... https://en.wikipedia.org/wiki/Trusted_Platform_Module#Criticism https://en.wikipedia.org/wiki/Trusted_Platform_Module#Critic... http://rt.com/news/windows-8-nsa-germany-862/ http://rt.com/news/windows-8-nsa-germany-862/
    - Nitramp 12y ago
      And of course it's illegal to install other operating systems on smartphones and other devices. Citation required?
      - Karunamon 12y ago
        Most modern smartphones are bootloader locked. Circumventing those locks is arguably violating the anti-circumvention bits of the DMCA. Therefore, to install another OS, you have to break the law. Worth mentioning is that it's illegal in the same way breaking the speed limit by 1MPH is illegal, i.e. technically against the law, but your chances for ending up in trouble for doing it are nil.
        xnull2guest 12y ago
        Yeah looks like that was the argument that held up until just a few years ago. I remember it being 'illegal' (like breaking the speed limit) at that time. As of 2010 it appears to have changed. Note that it IS illegal to modify a phone so that it connects to a carrier it wasn't 'intended' to connect to.
        Crito 12y ago
        That is only for smartphones specifically though, as I understand it.
        droopyEyelids 12y ago
        Thats actually not worth mentioning. Speeding by 1mph isn't a practical or useful law to enforce. Creating a new OS and breaking the boot loader would require a group of people working together in some organized form, which would make it practical to target, and it'd probably be financially threatening to a larger company, which would make it useful to enforce. In 2014, companies are the political and cultural entities in our society, and a law like this kills off a class of entity.
        biafra 12y ago
        It might be illegal in _your_ country. But AFAIK reverse engineering or installing custom software on a device I bought is not illegal in Germany. Probably in most countries.
    - userbinator 12y ago
      Let's not forget the widening gap between "advanced user" and "developer", created by schemes like code signing, forced app-store distribution models, and the gradual removal of "only developers will need them" features from software. While there are arguably security benefits to such closed ecosystems, it also makes it much harder for users to be in control of their computers - which includes modifying and writing new software for them. Compared to a PC today, the original IBM PC/XT/AT was amazingly open. All versions of DOS came with a basic debugger, which could also be used to write short Asm programs. I remember these being popularly published in the computing magazines of the time, and there was a general attitude of openness around that. Perhaps the average user today doesn't care, but what astounds me is how much freedom we've given up in pursuit of security and safety. We seem to have gone down a path (or the corporations have led us down one) in which we're lead to believe that having responsibility and freedom is a bad thing, and that we'd be happier - blissfully ignorant - if we let these corporations (and governments) take over for us.
      - xnull2guest 12y ago
        We've gone in a security model that Bruce Schneier calls Digital Feudalism. We give up rights to have large centralized organizations take care of our security for us. In exchange we give them data that they are allowed to sell. This is both for devices and for services (notably Web 2.0). There are arguably benefits to this arrangement. Prostitutes have pimps, even though they cut into profits without taking much personal risk or providing much labor, because pimps do provide a safety mechanism. Likewise, vassals gave up large portions of what they produced for security from their lords and kings. We've returned to this arrangement because: 1.) Paying is painful and copying software is easy. Instead of making money from you, Web 2.0 have monetized you as a target for advertisers. Web services are 'in' because that's the only way software can't be pirated. Much of our software today displays GUIs on a screen but runs on other computers because of this reason. The new Office products all run in the cloud, MMOs offer the same deal, and games like Diablo III can only run when in constant connection to the internet, even though there's no technical reason why that should be the case. XBox One tried to (and backpedaled from) make the xBox always on always connected. Other streaming video game and content services try the same. Essentially, the internet has become glorified TV (minimally interactive), with more channels. 2.) The internet is the Wild Wild West. Security professionals have been yelling for ages that the rush to release and the need to compete together with closed source development was making the world an insecure place. Essentially every layer of our computing stack is insecure. Attestation of computer intrusion is ridiculously hard. And there's money (and geopolitical power) to be had. We designed things insecure from the start, and continue to do so. Individuals can't stay secure on their own. It's not possible. So up with the lords and vassals - we know it sort of works from history. I do think the average user cares. I don't think the average user is informed.
- dchest 12y ago
  Except, even if Stallman didn't realize this, the story is mostly about state violence ("you could go to prison for many years for letting someone else read your books", "free operating systems ... were they illegal") where DRM is used as a tool to control and monitor people. DRM itself is not good or bad. As everything else, it can be abused, as Sony and Adobe showed us, or can be used for good (or neutral), for example, to allow indie shareware developers to let us try their software before purchasing a little registration code (I know, not free software, but let's not start this debate for now). It's a logical error to say that DRM itself is evil when some of the instances of it are evil. DRM is a "smart contract", a protocol for enforcing a contract without laws or violence. When you read that a person goes to prison for breaking DRM, realize that it has nothing to do with DRM, it's about state using violence to protect a failed smart contract, which is the opposite of the purpose of such smart contract.
  - idlewan 12y ago
    > It's a logical error to say that DRM itself is evil when some of the instances of it are evil. All of the instances of DRM are evil, because all of the instances of DRM'ed stuff prevents practical and unlimited sharing. In the digital world, any limitations on copying bits are akin to virtual restraints and locking information away. It prevents you from doing anything else than what the golden prison allows.
    - Tomte 12y ago
      > In the digital world, any limitations on copying bits are akin to virtual restraints and locking information away. Jennifer Lawrence might disagree with your laissez faire attitude.
      - idlewan 12y ago
        I'd argue that Jennifer Lawrence's sensitive bits shouldn't have been given to someone else (Apple) in the first place.
        12y ago
Karunamon 12y ago
One can only hope this blows up for Adobe the same way that Sony's music rootkit did. The sooner companies understand that DRM is a universally hated technology, the sooner we can all move on.
- gear54rus 12y ago
  Don't you think they already know that? Abolishing DRM will require new breed of company. Only a few can still be profitable without it (Mozilla, anyone?). Those who can't should also be abolished together with DRM as outdated and obsolete (especially the worst offenders like Amazon or Adobe).
  - krasin 12y ago
    I have to add that Mozilla is now shipping DRM too: https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challenge-of-serving-users/ https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... That's very sad. :(
    - deleted 12y ago
      [deleted]
    - Karunamon 12y ago
      Let's not tread this ground again. Mozilla is shipping a plugin framework, not "DRM".
      - xnull2guest 12y ago
        > Despite our dislike of DRM, we have come to believe Firefox needs to provide a mechanism for people to watch DRM-controlled content. We will do so in a way that protects the interests of individual users as much as possible, given what the rest of the industry has already put into place. We have selected Adobe to provide the key functionality. Adobe has been doing this in Flash for some time, and Adobe has been building the necessary relationships with the content owners. We believe that Adobe is uniquely able to bring new value to the setting. Well, no, they added DRM to Firefox. They say so as much in as many apologetic ways that they can. But agreed. There's a spectrum between DRM-only software and DRM-capable software. Adobe is DRM-only. Firefox is DRM-capable. Whether that's good or bad, and whether they could help it, is guaranteed debate and rabbit hole we want to avoid getting into.
steve19 12y ago
Fortunately Kindle DRM is so trivial to remove. I wish it had none but at least I know my books are mine forever and my reading habits are not being actively tracked if I use free non-Amazon ebook software. Amazon seems to turn a blind eye to it, probably because so few readers can be bothered using de-drm software.
- NolF 12y ago
  I learned to de-DRM my Amazon books due to the concerns of their licencing. Now I can put them on my phone and listen to the books with TTS. The kindle App for Android doesn't have the feature...
  - nyolfen 12y ago
    if the kindle app for ios is the same it does, highlight speech and tap the speaker icon at the bottom right
- betacat 12y ago
  It's also pretty easy to ignore a paper contract... until you get caught. Then, the level of triviality of circumvention doesn't mean crap in court.
majormajor 12y ago
Where does the DRM part come into play? The description sounds like it could be applied to just about any automatic sync-your-progress-across-devices feature, which is a hugely desirable feature IMO (my Kindle would be worth a huge amount less without it, since books almost always take multiple reading sessions to finish), and it's also very useful for movies/TV...
- mrj 12y ago
  Well, one reason: because if we had the freedom to use any ebook reader we wanted, then we wouldn't have to rely on Adobe spyware. DRM prevents that.
- llasram 12y ago
  Two ways: (1) the uploaded information appears to include book licence details; if the book-scanning aspect is true then this amounts to scanning for DRM-stripped or otherwise out-of-licence material. (2) Details are light on the new DRM scheme Adobe introduced in DE3, but some are claiming it to involve requiring always-on network connectivity; if that is true, then this information leak may be linked, or at least may not be blockable w/o also preventing access to DRMed books.
walterbell 12y ago
Processor-level support for DRM will make future cases more interesting, https://www.virusbtn.com/virusbulletin/archive/2014/01/vb201401-SGX https://www.virusbtn.com/virusbulletin/archive/2014/01/vb201... "If software and hardware could be ‘sealed’ in some way to prevent an attacker from examining data in main memory, even if the attacker had administrator level privileges on the machine, not only could the confidentiality and integrity of data in the cloud be protected, but the algorithms and design of cloud hosted applications could also be hidden from prying eyes."
- Canada 12y ago
  So far I've seen very little evidence that this will work. Unless some true mechanism can be found for remotely verifying that you are loading your code into a known environment then there's no way to know that you're running in a secure enclave in the first place. The best attempt I've seen is sending a computation to be performed by the remote side and trying to infer the state of the CPU cache based on how long it takes to answer. If the timing is off then the cache must have been in an unexpected state and therefore unexpected code must have been executing on the machine. It's clever, but not practical. What has Intel come up with that's any better? What's described in your link could simply be emulated in software. How would the remote side know the difference?
  - wmf 12y ago
    In SGX, each processor will have a non-extractable private key and certificate. The certificate isn't emulatable.
  - walterbell 12y ago
    There's a long technical discussion in the first reference given in the article. Remove the space in the link.
  - comex 12y ago
    SGX includes microcode-based crypto which allows an enclave to both sign and encrypt things using keys based on a hash of the contents of the enclave and some master private key locked away in the CPU. I haven't looked into exactly how this works (although I'd love to defeat it some day when it's released...), but it can't be emulated in software unless you manage to extract the private key. https://software.intel.com/sites/default/files/article/413939/hasp-2013-innovative-technology-for-attestation-and-sealing.pdf https://software.intel.com/sites/default/files/article/41393...
jurassic 12y ago
Adobe is taking a pummeling this week. This news is nicely timed for the launch week of Affinity Designer, a serious competitor to Illustrator on the Mac App Store for casual and not-so-casual users who don't use Adobe products heavily enough to justify the cost of a monthly subscription. I tried it yesterday and was ready to cancel my Creative Cloud single-app subscription after about 20 minutes of experimentation. It's more than sufficient for my vector graphic needs as an indie developer.
- 13 12y ago
  I don't mind Affinity Designer at all, but it's still missing a lot of functionality I've become used to in Photoshop. I enjoy the speed and the interface, but the lack of in depth bitmap transform tools was a bit disappointing. They were however very responsive in the Beta and I imagine they'll keep that momentum up. If they manage it they might be a very capable alternative to Adobe Photoshop and Adobe Illustrator.
- michaelbuddy 12y ago
  Yup, I'm stoked on Affinity Designer. It also nicely promotes Serif software as an alternative to the Creative Suite. Serif has a lot of educational customers and casual users and probably would have more if people knew about them and their prices. I'm going to revisit their stuff. It's been about 10 years since I checked out their page layout program. But Affinity is fantastic. They put in a lot of great ideas into it in the UI. Xara on Windows and Affinity on Mac will be my go-to apps for vector drawing. Illustrator for me is basically just an app for conversion to make sure a file is ready to share. I hate working in it, clunky app.
  - estefan 12y ago
    There are also loads of great serif fonts. I've been using them for a while now. It's really great to see them moving into software.
devindotcom 12y ago
Given the scale of incompetence required to have your 'spyware' transmitting common and expected book data and metadata in plaintext, I have to say we should employ Hanlon's Razor here, and not attribute to malice what can adequately be explained by stupidity. That said, there's probably a little malice in there, too. And either way, this is probably a crippling blow to this branch of Adobe.
- Crito 12y ago
  When a drunk driver crashes into somebody, we do not care that they had no ill intent. Why should it matter here? Sufficiently advanced incompetence might as well be malice.
higherpurpose 12y ago
> Second, sending this information in plain text undermines decades of efforts by libraries and bookstores to protect the privacy of their patrons and customers. Someone needs to sue Adobe over this. That way we can stop such future invasions of privacy from DRMed machines in the future. Also, Microsoft will do much of the same with Windows 10, collecting data not just on ebooks, but any file you might open, and even characters you may type. Digital Editions is one app. Windows 10 is a whole OS, which makes the whole thing a lot scarier: http://www.theinquirer.net/inquirer/news/2373838/microsofts-windows-10-preview-has-permission-to-watch-your-every-move http://www.theinquirer.net/inquirer/news/2373838/microsofts-...
- walterbell 12y ago
  Is that only for the preview or also for GA? Why would any corporate customer agree to this policy? Maybe it's only for the free version of Windows 10, the one targeted at $200 Chromebook clones? The private equity members of Microsoft's board have been advocating for more focus on cloud services and less on Windows, e.g. recent moves to support Apple devices.
- RubyPinch 12y ago
  sans file monitoring (though windows has been offering to send heuristics and file signatures though windows defender for a while now) isn't that stuff that most already have signed away on? iOS's autocorrection for their keyboard, and cloud processing for siri? and same for android's TTS, STT engines (both are cloud-based by default if I'm not mistaken)? (and the google keyboard) without asking the user to agree to such things, microsoft can't enter the mobile device arena to the same degree as competitors
  - MiddleEndian 12y ago
    Not that I think it's good that mobile OSes spy on you, Windows 10 will a desktop operating system. Desktop OSes have not traditionally been known to spy on you.
  - k-mcgrady 12y ago
    >> "iOS's autocorrection for their keyboard" I'm pretty sure nothing you type leaves the device on iOS unless you give permission (which you can do with third party keyboards).
gldsmth 12y ago
I play pirated copies of games I bought and own on steam because I don't want steam to know how many hours I play my games, when I play them, from what place etc. I consider that is not anyone's business. Adobe's spyware isn't that different from what gamers have accepted with Steam unfortunately. Will book readers accept it, the way gamers did, or will they fight back? Unlike video games, there are alternatives, that are still popular (buying books on paper). I don't ever intend on spending any $ on a drm'd book when I can have it on paper for the same price without DRM.
- k-mcgrady 12y ago
  >> "I play pirated copies of games I bought and own on steam because I don't want steam to know how many hours I play my games, when I play them, from what place etc. I consider that is not anyone's business." Just a hypothetical: If the developer was giving you a discount on Steam because they could collect this information would you still buy it from Steam and then pirate it (getting the discount but not providing the information) or would you pay full price somewhere else? Not judging, just curious.
  - gldsmth 12y ago
    I buy games because I support the developers. I've spent full price money online on games that could've been bought for cheaper in physical form (amazon.fr is almost always cheaper than steam prices actually unless Steam is going through a sale. Regular prices on steam are always more expensive than getting the box delivered at your door). So, no. I wouldn't trade my privacy for cheaper prices, since the one reason that makes me "honest" and buy games in the first place is spending my money on things I like. I bought all the classic RPG I liked, and already owned in physical forms, on gog.com, just to show an interest in what I saw as a dying genre. Plus the fact that they are the only gaming platform that is DRM-free. Then I supported the kickstarter renaissance (Wasteland, Torment etc). I've put my steam profile on private, but if you could see it, you would see almost no game past 1hour of play because I never play games from steam. I only buy them on steam, then I download a copy that will not violate my privacy. Because for as long as I breath I will not let anyone intrude on my privacy. Also, when given the choice between steam and gog, I obviously chose gog.com.
chipotle_coyote 12y ago
God love the EFF, but they're using this as a platform to talk about one of their favorite hobby horses, and that's kind of obscuring the problem. Read the original article in which this was discovered -- this has nothing to do with DRM. http://the-digital-reader.com/2014/10/06/adobe-spying-users-collecting-data-ebook-libraries/ http://the-digital-reader.com/2014/10/06/adobe-spying-users-... Adobe is collecting data about every ebook on your system, regardless of whether it's using DRM and even regardless of whether it's even being managed by the Adobe Digital Edition reader. (And for an added security bonus, they're sending it in plain text.) If you install and launch the new version of ADE, it's going to do this whether or not every single ebook you have on your system is DRM-free. This is certainly an electronic privacy issue, but it's not a DRM issue just because Adobe Digital Editions supports Adobe DRM, and the EFF's headline is a little disingenuous. Adobe's rationale for this collection is indeed claimed to be related to licensing, but the biggest problem is how wide a net they're casting and how intrusive this information is -- ironically enough, if it was only sending this information about DRM-encumbered books, it'd arguably be much less of a scandal. (Although the fifty-eight people in the world using Adobe DRM would still have every right to be pissed.)
- dmix 12y ago
  Since Adobe is not selling books, how do they benefit from parsing this data? If not for DRM-style tactics? Are they selling it to third parties? Unless this is the case, then I'd say their obsession with DRM and rights management is the primary issue. Without of course discrediting that digital surveillance is the new standard.
  - chipotle_coyote 12y ago
    As I said (well, quoted), it is for licensing -- Adobe is apparently trying to support some kind of "metered licensing," in which you might pay by how long you keep a book out or even by how far you read in it. Is that the same as DRM? In practice, mostly, since it's hard to see how that particular scheme would work without DRM. (But licensing is not the same as DRM, right? I buy a lot of DRM-free tech books, but that doesn't give me license to put those books up for free on my web site.) But I'd nonetheless argue that the primary issue is not that Adobe is implementing new licensing schemes of dubious value. It's that Adobe implemented them in an exceedingly invasive way. I don't use Adobe Digital Editions unless I absolutely have to, but until now that's been because the software is awful, not because it's philosophically objectionable. I'd also argue that it may not be entirely fair to describe Adobe as "obsessed with rights management"; they're providing a platform for publishers, and using DRM -- or not -- is the publishers' choice. The chances are high that the "metered licensing" concept was borne of publisher request, not an Adobe plan to make everyone's life difficult. Making everyone's life difficult is just Adobe's standard execution plan.
vlunkr 12y ago
I could be wrong, but it seems to me that DRM is useless. People who like to pirate will pirate, no matter what safeguards you put in place, it's been proven over and over. It's just a nuisance for people who want to obtain media legally. If I paid for something, why can't I use it on any device I own with any software? It makes the purchase so much more valuable.
userpasswd 12y ago
We do what we must Because We can

504 points by sinak 12y ago

> As our friend Cory Doctorow has been explaining for years, DRM for books is dangerous for readers, authors and publishers alike. Richard Stallman explained it a decade earlier in a piece worth reviewing now and then -- https://www.gnu.org/philosophy/right-to-read.html https://www.gnu.org/philosophy/right-to-read.html.

ChrisAntaki 12y ago
Some of Stallman's predictions were spot on. > In his software class, Dan had learned that each book had a copyright monitor that reported when and where it was read, and by whom, to Central Licensing. (They used this information to catch reading pirates, but also to sell personal interest profiles to retailers.)
- xnull2guest 12y ago
  > It was also possible to bypass the copyright monitors by installing a modified system kernel. Dan would eventually find out about the free kernels, even entire free operating systems, that had existed around the turn of the century. But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that. Not quite there, but almost (wrt PCs). https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Criticism https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In... https://en.wikipedia.org/wiki/Trusted_Platform_Module#Criticism https://en.wikipedia.org/wiki/Trusted_Platform_Module#Critic... http://rt.com/news/windows-8-nsa-germany-862/ http://rt.com/news/windows-8-nsa-germany-862/
  - Nitramp 12y ago
    And of course it's illegal to install other operating systems on smartphones and other devices. Citation required?
    - Karunamon 12y ago
      Most modern smartphones are bootloader locked. Circumventing those locks is arguably violating the anti-circumvention bits of the DMCA. Therefore, to install another OS, you have to break the law. Worth mentioning is that it's illegal in the same way breaking the speed limit by 1MPH is illegal, i.e. technically against the law, but your chances for ending up in trouble for doing it are nil.
      - xnull2guest 12y ago
        Yeah looks like that was the argument that held up until just a few years ago. I remember it being 'illegal' (like breaking the speed limit) at that time. As of 2010 it appears to have changed. Note that it IS illegal to modify a phone so that it connects to a carrier it wasn't 'intended' to connect to.
        Crito 12y ago
        That is only for smartphones specifically though, as I understand it.
      - droopyEyelids 12y ago
        Thats actually not worth mentioning. Speeding by 1mph isn't a practical or useful law to enforce. Creating a new OS and breaking the boot loader would require a group of people working together in some organized form, which would make it practical to target, and it'd probably be financially threatening to a larger company, which would make it useful to enforce. In 2014, companies are the political and cultural entities in our society, and a law like this kills off a class of entity.
      - biafra 12y ago
        It might be illegal in _your_ country. But AFAIK reverse engineering or installing custom software on a device I bought is not illegal in Germany. Probably in most countries.
  - userbinator 12y ago
    Let's not forget the widening gap between "advanced user" and "developer", created by schemes like code signing, forced app-store distribution models, and the gradual removal of "only developers will need them" features from software. While there are arguably security benefits to such closed ecosystems, it also makes it much harder for users to be in control of their computers - which includes modifying and writing new software for them. Compared to a PC today, the original IBM PC/XT/AT was amazingly open. All versions of DOS came with a basic debugger, which could also be used to write short Asm programs. I remember these being popularly published in the computing magazines of the time, and there was a general attitude of openness around that. Perhaps the average user today doesn't care, but what astounds me is how much freedom we've given up in pursuit of security and safety. We seem to have gone down a path (or the corporations have led us down one) in which we're lead to believe that having responsibility and freedom is a bad thing, and that we'd be happier - blissfully ignorant - if we let these corporations (and governments) take over for us.
    - xnull2guest 12y ago
      We've gone in a security model that Bruce Schneier calls Digital Feudalism. We give up rights to have large centralized organizations take care of our security for us. In exchange we give them data that they are allowed to sell. This is both for devices and for services (notably Web 2.0). There are arguably benefits to this arrangement. Prostitutes have pimps, even though they cut into profits without taking much personal risk or providing much labor, because pimps do provide a safety mechanism. Likewise, vassals gave up large portions of what they produced for security from their lords and kings. We've returned to this arrangement because: 1.) Paying is painful and copying software is easy. Instead of making money from you, Web 2.0 have monetized you as a target for advertisers. Web services are 'in' because that's the only way software can't be pirated. Much of our software today displays GUIs on a screen but runs on other computers because of this reason. The new Office products all run in the cloud, MMOs offer the same deal, and games like Diablo III can only run when in constant connection to the internet, even though there's no technical reason why that should be the case. XBox One tried to (and backpedaled from) make the xBox always on always connected. Other streaming video game and content services try the same. Essentially, the internet has become glorified TV (minimally interactive), with more channels. 2.) The internet is the Wild Wild West. Security professionals have been yelling for ages that the rush to release and the need to compete together with closed source development was making the world an insecure place. Essentially every layer of our computing stack is insecure. Attestation of computer intrusion is ridiculously hard. And there's money (and geopolitical power) to be had. We designed things insecure from the start, and continue to do so. Individuals can't stay secure on their own. It's not possible. So up with the lords and vassals - we know it sort of works from history. I do think the average user cares. I don't think the average user is informed.
dchest 12y ago
Except, even if Stallman didn't realize this, the story is mostly about state violence ("you could go to prison for many years for letting someone else read your books", "free operating systems ... were they illegal") where DRM is used as a tool to control and monitor people. DRM itself is not good or bad. As everything else, it can be abused, as Sony and Adobe showed us, or can be used for good (or neutral), for example, to allow indie shareware developers to let us try their software before purchasing a little registration code (I know, not free software, but let's not start this debate for now). It's a logical error to say that DRM itself is evil when some of the instances of it are evil. DRM is a "smart contract", a protocol for enforcing a contract without laws or violence. When you read that a person goes to prison for breaking DRM, realize that it has nothing to do with DRM, it's about state using violence to protect a failed smart contract, which is the opposite of the purpose of such smart contract.
- idlewan 12y ago
  > It's a logical error to say that DRM itself is evil when some of the instances of it are evil. All of the instances of DRM are evil, because all of the instances of DRM'ed stuff prevents practical and unlimited sharing. In the digital world, any limitations on copying bits are akin to virtual restraints and locking information away. It prevents you from doing anything else than what the golden prison allows.
  - Tomte 12y ago
    > In the digital world, any limitations on copying bits are akin to virtual restraints and locking information away. Jennifer Lawrence might disagree with your laissez faire attitude.
    - idlewan 12y ago
      I'd argue that Jennifer Lawrence's sensitive bits shouldn't have been given to someone else (Apple) in the first place.
      - 12y ago

Karunamon 12y ago

One can only hope this blows up for Adobe the same way that Sony's music rootkit did. The sooner companies understand that DRM is a universally hated technology, the sooner we can all move on.

gear54rus 12y ago
Don't you think they already know that? Abolishing DRM will require new breed of company. Only a few can still be profitable without it (Mozilla, anyone?). Those who can't should also be abolished together with DRM as outdated and obsolete (especially the worst offenders like Amazon or Adobe).
- krasin 12y ago
  I have to add that Mozilla is now shipping DRM too: https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challenge-of-serving-users/ https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... That's very sad. :(
  - deleted 12y ago
    [deleted]
  - Karunamon 12y ago
    Let's not tread this ground again. Mozilla is shipping a plugin framework, not "DRM".
    - xnull2guest 12y ago
      > Despite our dislike of DRM, we have come to believe Firefox needs to provide a mechanism for people to watch DRM-controlled content. We will do so in a way that protects the interests of individual users as much as possible, given what the rest of the industry has already put into place. We have selected Adobe to provide the key functionality. Adobe has been doing this in Flash for some time, and Adobe has been building the necessary relationships with the content owners. We believe that Adobe is uniquely able to bring new value to the setting. Well, no, they added DRM to Firefox. They say so as much in as many apologetic ways that they can. But agreed. There's a spectrum between DRM-only software and DRM-capable software. Adobe is DRM-only. Firefox is DRM-capable. Whether that's good or bad, and whether they could help it, is guaranteed debate and rabbit hole we want to avoid getting into.

steve19 12y ago

Fortunately Kindle DRM is so trivial to remove. I wish it had none but at least I know my books are mine forever and my reading habits are not being actively tracked if I use free non-Amazon ebook software. Amazon seems to turn a blind eye to it, probably because so few readers can be bothered using de-drm software.

NolF 12y ago
I learned to de-DRM my Amazon books due to the concerns of their licencing. Now I can put them on my phone and listen to the books with TTS. The kindle App for Android doesn't have the feature...
- nyolfen 12y ago
  if the kindle app for ios is the same it does, highlight speech and tap the speaker icon at the bottom right
betacat 12y ago
It's also pretty easy to ignore a paper contract... until you get caught. Then, the level of triviality of circumvention doesn't mean crap in court.

majormajor 12y ago

Where does the DRM part come into play? The description sounds like it could be applied to just about any automatic sync-your-progress-across-devices feature, which is a hugely desirable feature IMO (my Kindle would be worth a huge amount less without it, since books almost always take multiple reading sessions to finish), and it's also very useful for movies/TV...

mrj 12y ago
Well, one reason: because if we had the freedom to use any ebook reader we wanted, then we wouldn't have to rely on Adobe spyware. DRM prevents that.
llasram 12y ago
Two ways: (1) the uploaded information appears to include book licence details; if the book-scanning aspect is true then this amounts to scanning for DRM-stripped or otherwise out-of-licence material. (2) Details are light on the new DRM scheme Adobe introduced in DE3, but some are claiming it to involve requiring always-on network connectivity; if that is true, then this information leak may be linked, or at least may not be blockable w/o also preventing access to DRMed books.

walterbell 12y ago

Processor-level support for DRM will make future cases more interesting, https://www.virusbtn.com/virusbulletin/archive/2014/01/vb201401-SGX https://www.virusbtn.com/virusbulletin/archive/2014/01/vb201... "If software and hardware could be ‘sealed’ in some way to prevent an attacker from examining data in main memory, even if the attacker had administrator level privileges on the machine, not only could the confidentiality and integrity of data in the cloud be protected, but the algorithms and design of cloud hosted applications could also be hidden from prying eyes."

Canada 12y ago
So far I've seen very little evidence that this will work. Unless some true mechanism can be found for remotely verifying that you are loading your code into a known environment then there's no way to know that you're running in a secure enclave in the first place. The best attempt I've seen is sending a computation to be performed by the remote side and trying to infer the state of the CPU cache based on how long it takes to answer. If the timing is off then the cache must have been in an unexpected state and therefore unexpected code must have been executing on the machine. It's clever, but not practical. What has Intel come up with that's any better? What's described in your link could simply be emulated in software. How would the remote side know the difference?
- wmf 12y ago
  In SGX, each processor will have a non-extractable private key and certificate. The certificate isn't emulatable.
- walterbell 12y ago
  There's a long technical discussion in the first reference given in the article. Remove the space in the link.
- comex 12y ago
  SGX includes microcode-based crypto which allows an enclave to both sign and encrypt things using keys based on a hash of the contents of the enclave and some master private key locked away in the CPU. I haven't looked into exactly how this works (although I'd love to defeat it some day when it's released...), but it can't be emulated in software unless you manage to extract the private key. https://software.intel.com/sites/default/files/article/413939/hasp-2013-innovative-technology-for-attestation-and-sealing.pdf https://software.intel.com/sites/default/files/article/41393...

jurassic 12y ago

Adobe is taking a pummeling this week. This news is nicely timed for the launch week of Affinity Designer, a serious competitor to Illustrator on the Mac App Store for casual and not-so-casual users who don't use Adobe products heavily enough to justify the cost of a monthly subscription. I tried it yesterday and was ready to cancel my Creative Cloud single-app subscription after about 20 minutes of experimentation. It's more than sufficient for my vector graphic needs as an indie developer.

13 12y ago
I don't mind Affinity Designer at all, but it's still missing a lot of functionality I've become used to in Photoshop. I enjoy the speed and the interface, but the lack of in depth bitmap transform tools was a bit disappointing. They were however very responsive in the Beta and I imagine they'll keep that momentum up. If they manage it they might be a very capable alternative to Adobe Photoshop and Adobe Illustrator.
michaelbuddy 12y ago
Yup, I'm stoked on Affinity Designer. It also nicely promotes Serif software as an alternative to the Creative Suite. Serif has a lot of educational customers and casual users and probably would have more if people knew about them and their prices. I'm going to revisit their stuff. It's been about 10 years since I checked out their page layout program. But Affinity is fantastic. They put in a lot of great ideas into it in the UI. Xara on Windows and Affinity on Mac will be my go-to apps for vector drawing. Illustrator for me is basically just an app for conversion to make sure a file is ready to share. I hate working in it, clunky app.
- estefan 12y ago
  There are also loads of great serif fonts. I've been using them for a while now. It's really great to see them moving into software.

devindotcom 12y ago

Given the scale of incompetence required to have your 'spyware' transmitting common and expected book data and metadata in plaintext, I have to say we should employ Hanlon's Razor here, and not attribute to malice what can adequately be explained by stupidity. That said, there's probably a little malice in there, too. And either way, this is probably a crippling blow to this branch of Adobe.

Crito 12y ago
When a drunk driver crashes into somebody, we do not care that they had no ill intent. Why should it matter here? Sufficiently advanced incompetence might as well be malice.

higherpurpose 12y ago

> Second, sending this information in plain text undermines decades of efforts by libraries and bookstores to protect the privacy of their patrons and customers. Someone needs to sue Adobe over this. That way we can stop such future invasions of privacy from DRMed machines in the future. Also, Microsoft will do much of the same with Windows 10, collecting data not just on ebooks, but any file you might open, and even characters you may type. Digital Editions is one app. Windows 10 is a whole OS, which makes the whole thing a lot scarier: http://www.theinquirer.net/inquirer/news/2373838/microsofts-windows-10-preview-has-permission-to-watch-your-every-move http://www.theinquirer.net/inquirer/news/2373838/microsofts-...

walterbell 12y ago
Is that only for the preview or also for GA? Why would any corporate customer agree to this policy? Maybe it's only for the free version of Windows 10, the one targeted at $200 Chromebook clones? The private equity members of Microsoft's board have been advocating for more focus on cloud services and less on Windows, e.g. recent moves to support Apple devices.
RubyPinch 12y ago
sans file monitoring (though windows has been offering to send heuristics and file signatures though windows defender for a while now) isn't that stuff that most already have signed away on? iOS's autocorrection for their keyboard, and cloud processing for siri? and same for android's TTS, STT engines (both are cloud-based by default if I'm not mistaken)? (and the google keyboard) without asking the user to agree to such things, microsoft can't enter the mobile device arena to the same degree as competitors
- MiddleEndian 12y ago
  Not that I think it's good that mobile OSes spy on you, Windows 10 will a desktop operating system. Desktop OSes have not traditionally been known to spy on you.
- k-mcgrady 12y ago
  >> "iOS's autocorrection for their keyboard" I'm pretty sure nothing you type leaves the device on iOS unless you give permission (which you can do with third party keyboards).

gldsmth 12y ago

I play pirated copies of games I bought and own on steam because I don't want steam to know how many hours I play my games, when I play them, from what place etc. I consider that is not anyone's business. Adobe's spyware isn't that different from what gamers have accepted with Steam unfortunately. Will book readers accept it, the way gamers did, or will they fight back? Unlike video games, there are alternatives, that are still popular (buying books on paper). I don't ever intend on spending any $ on a drm'd book when I can have it on paper for the same price without DRM.

k-mcgrady 12y ago
>> "I play pirated copies of games I bought and own on steam because I don't want steam to know how many hours I play my games, when I play them, from what place etc. I consider that is not anyone's business." Just a hypothetical: If the developer was giving you a discount on Steam because they could collect this information would you still buy it from Steam and then pirate it (getting the discount but not providing the information) or would you pay full price somewhere else? Not judging, just curious.
- gldsmth 12y ago
  I buy games because I support the developers. I've spent full price money online on games that could've been bought for cheaper in physical form (amazon.fr is almost always cheaper than steam prices actually unless Steam is going through a sale. Regular prices on steam are always more expensive than getting the box delivered at your door). So, no. I wouldn't trade my privacy for cheaper prices, since the one reason that makes me "honest" and buy games in the first place is spending my money on things I like. I bought all the classic RPG I liked, and already owned in physical forms, on gog.com, just to show an interest in what I saw as a dying genre. Plus the fact that they are the only gaming platform that is DRM-free. Then I supported the kickstarter renaissance (Wasteland, Torment etc). I've put my steam profile on private, but if you could see it, you would see almost no game past 1hour of play because I never play games from steam. I only buy them on steam, then I download a copy that will not violate my privacy. Because for as long as I breath I will not let anyone intrude on my privacy. Also, when given the choice between steam and gog, I obviously chose gog.com.

chipotle_coyote 12y ago

God love the EFF, but they're using this as a platform to talk about one of their favorite hobby horses, and that's kind of obscuring the problem. Read the original article in which this was discovered -- this has nothing to do with DRM. http://the-digital-reader.com/2014/10/06/adobe-spying-users-collecting-data-ebook-libraries/ http://the-digital-reader.com/2014/10/06/adobe-spying-users-... Adobe is collecting data about every ebook on your system, regardless of whether it's using DRM and even regardless of whether it's even being managed by the Adobe Digital Edition reader. (And for an added security bonus, they're sending it in plain text.) If you install and launch the new version of ADE, it's going to do this whether or not every single ebook you have on your system is DRM-free. This is certainly an electronic privacy issue, but it's not a DRM issue just because Adobe Digital Editions supports Adobe DRM, and the EFF's headline is a little disingenuous. Adobe's rationale for this collection is indeed claimed to be related to licensing, but the biggest problem is how wide a net they're casting and how intrusive this information is -- ironically enough, if it was only sending this information about DRM-encumbered books, it'd arguably be much less of a scandal. (Although the fifty-eight people in the world using Adobe DRM would still have every right to be pissed.)

dmix 12y ago
Since Adobe is not selling books, how do they benefit from parsing this data? If not for DRM-style tactics? Are they selling it to third parties? Unless this is the case, then I'd say their obsession with DRM and rights management is the primary issue. Without of course discrediting that digital surveillance is the new standard.
- chipotle_coyote 12y ago
  As I said (well, quoted), it is for licensing -- Adobe is apparently trying to support some kind of "metered licensing," in which you might pay by how long you keep a book out or even by how far you read in it. Is that the same as DRM? In practice, mostly, since it's hard to see how that particular scheme would work without DRM. (But licensing is not the same as DRM, right? I buy a lot of DRM-free tech books, but that doesn't give me license to put those books up for free on my web site.) But I'd nonetheless argue that the primary issue is not that Adobe is implementing new licensing schemes of dubious value. It's that Adobe implemented them in an exceedingly invasive way. I don't use Adobe Digital Editions unless I absolutely have to, but until now that's been because the software is awful, not because it's philosophically objectionable. I'd also argue that it may not be entirely fair to describe Adobe as "obsessed with rights management"; they're providing a platform for publishers, and using DRM -- or not -- is the publishers' choice. The chances are high that the "metered licensing" concept was borne of publisher request, not an Adobe plan to make everyone's life difficult. Making everyone's life difficult is just Adobe's standard execution plan.

vlunkr 12y ago

I could be wrong, but it seems to me that DRM is useless. People who like to pirate will pirate, no matter what safeguards you put in place, it's been proven over and over. It's just a nuisance for people who want to obtain media legally. If I paid for something, why can't I use it on any device I own with any software? It makes the purchase so much more valuable.

userpasswd 12y ago

We do what we must Because We can