Digital rights (and wrongs)

[Xugumad]

This is a slightly modified re-post of something I wrote somewhere else. It's about secure digital audio, and disappearing rights for computer users, uncopiable CDs, and Microsoft. The usual stuff, then.

All modern sound cards (SB Live and newer) support what's called the Secure Audio Path. With the proper hardware support (which is now luckily present in WinME and XP), SAP-enabled soundcards will only output sound if SAP-enabled devices (like most modern computer speakers) are detected on the output channel. Windows media has this Digital Rights Management technology built into it. Give it a few years, and you can be certain that Windows will only let you play/copy files that you have purchased the 'digital rights' to. Ok, here's a hint: how does the sound get from the CD drive to the speakers? Two ways:

1. through a cable connected to straight to the soundcard
from the drive.

2. Digital Audio Extraction.

SAP is implemented on an OS kernel level in the soundcard drivers/hardware, as well as in the OS itself. With fully 'digital rights managed' WMedia files, if the proper keys are set within the file, it becomes unplayable unless several conditions are met, usually within the hardware. The second that there is a critical mass of installed approved hardware and software (WinME/XP, SB Live and above, etc.), MS and content producers will simply start locking out 'insecure' media.

The only way you'll be able to rip CDs from your system in 5 years' time is by using pre-SB Live soundcards and operating systems. Since the VAST majority of operating systems comes pre-installed (OEMs), this will become irrelevant at some later stage. The laws of market demand will eventually see most people use Windows Media, simply because it'll become ubiquitous.

About the technological detail:
"The SAP adds 'static' interference to media files that require video and audio cards to authenticate themselves with Windows software before they can be played. The company would be able to verify that a media player isn't playing an "unsecured" file, which according to Microsoft would eliminate much of the threat of piracy."

If the current attempts at protected CDs work (and it looks like many of them are), that old hardware won't work either. The DMCA already makes copyright circumvention devices, hardware, and activity highly illegal, and the SSSCA is adding more on top of that. All MS needs to do is to include a VERY minor patch in their Windowsupdate critical updates package, and a lot of things simply won't work anymore.

What, people aren't going to take it? Do you really believe that? The geeky people who spend all their time here and on Slashdot will try to find ways around it, sure. But the 99% of people who get WinXP/ME pre-installed simply won't have the option. All they need is the vast majority - who cares about the whiny complaints of people who have consistently been portrayed as obsessive nerds and intellectual property pirates? We aren't providing any of the big bucks that MS lobbyists spend on campaign contributions.

Go and read the docs listed above. They have pretty pictures. They explain how 'piracy' will be stopped at the *kernel* level. You can have all the nifty hardware you want, unless the OS co-operates, it won't work. Linux/FreeBSD won't help you read CDs that computer CD drives physically can't read either.

The minority will be smart, and probably ultimately defeated. We have too much working against us - all the TV and cable networks are owned by 'content producers' who are scared of having their stuff distributed for free without them being able to make money off it. The same applies to music, books, ANYTHING that can be converted into bits and bytes.

Come on: Bush basically ordered the DOJ to end the MS trials with a castrated settlement that effectively does NOTHING. Gates is on record as being "very satisfied" with the ruling; how often do you hear a defendant saying that unless he got away unpunished?

Use your brain. Know what's being done. Be aware that the freedoms that came with cheap CD-Rs, Napster, Morpheus and ubiquitous CD burners are rapidly disappearing.

Links:
http://www.directionsonmicrosoft.com...xgnpt_illo.htm

http://www.wired.com/news/technology...,41614,00.html

http://msdn.microsoft.com/library/de...opathmodel.asp

X.

[Undertoad]

Excellent post, on a critical subject.

It's all about the file formats. If the kids can't rip and rewrite on XP systems, suddenly there is a call for many times the current number of Linux desktops. Talk about your killer app.

I have an awful lot of faith in the dorm-bound masses. They will determine what doesn't work, and find the ways around it. They will rewrite the rulebook again, and hopefuly nobody will get hurt except the weasels.

What the media companies need to understand is that such prohibitions won't work unless they only hurt a little bit. It's like.... I'm not going out of my way to break region encoding on my DVD player, because I don't know of any DVDs that I want that I can't watch anyway.

[Xugumad]

Tony,

You mentioned that....

> It's all about the file formats. If the kids can't rip and
> rewrite on XP systems, suddenly there is a call for many
> times the current number of Linux desktops. Talk about
> your killer app.

The problem is that MS won't flip the big DRM switch until the RIAA gives the nod. Guess when that will be - just about when copy-protected audio CDs (which are on the market right now) are ubiquitous. Those CDs are NOT playable on computer CD-ROM drives, due to error-correction tech differences between computer and home audio CD players. Combine WMedia and SAP with rip-proof CDs, and Linux/FreeBSD etc. just won't help.

If the drive is physically unable to read an audio CD, the OS becomes irrelevant. If MS and the 'content producers' work hand in hand, 100% of media on the net will become usable only in MS products (since they are the only ones whose complete control of the OS and media player can guarantee that it won't be pirated). With the DMCA and SSSCA, 'circumventing' the DRM built into that media by the content producers becomes illegal.

Check mate.

I give it five years.

(and I hope people will respond to this thread, even though it's not about the Image of the Day, cheese steaks, or Bin Laden :-)

X.

[russotto]

Originally posted by Xugumad
Tony,

The problem is that MS won't flip the big DRM switch until the RIAA gives the nod. Guess when that will be - just about when copy-protected audio CDs (which are on the market right now) are ubiquitous. Those CDs are NOT playable on computer CD-ROM drives, due to error-correction tech differences between computer and home audio CD players. Combine WMedia and SAP with rip-proof CDs, and Linux/FreeBSD etc. just won't help.

The copy protected CDs will be broken. Have been, I believe. And you're forgetting the great Achilles heel of all audio copy protection schemes: The analog path. Even if Microsoft-AOL-Disney manage to block all digital paths, there's not a whole lot they can do about re-digitizing the audio output. One D/A A/D conversion doesn't lose much fidelity, particularly if you're going to be ripping to lossy MP3 or Ogg Vorbis anyway.

And the digital paths will be broken, DMCA or no DMCA. There will be software, mod chips, and other means of defeat, all available to anyone who cares to look a bit. The RIAA will play whack-a-mole with the hosting sites, and if they can they'll have a few programmers ass-raped in prison, but they won't stop it.

Xug -

I have made mp3s off my extensive record collection. Yes, vinyl records.

If you can *listen* to it, you can rip it. Period.

Worst case scenario? CD player out -> Sound Card In, record that audio & then encode it into an mp3. It's a bit of a pain in the ass, but it's not so hard that most people couldn't figure out how to do it.

As for operating system choice... I already don't use Windows - I've got countless Linux boxen & 2 Macintosh computers (plus Jenni's iMac, if you wanna count that). There are a lot of people like me.

The fact of the matter is, there will always be piracy. I will always be able to take my cds and rip them into mp3s (which I do, with iTunes on my PowerMac G4, and holy crap is it a joy to make mp3s on that box), and I'll always be able to listen to them. Or the next big format. If you can hear it, it can be ripped.

[MaggieL]

The very annoying core concept here is the ongoing, continually expandng desire of corporations to collect money for selling something while retaining control of what was purportedly sold, usually for th epurpose of depleteling its value. Why sell a perpetual licence for an operating system, when you can make a rental business out of it? Why sell a copy of a movie when you can sell a limited licence to view it?

The sales pitch for video movies "Own it today!" really gets up my nose, when it should be: "Own a revocable licence to view this program in a limited set of circumstances we control".

After all...your ongoing revenue opportunities for a product shouldn't be limited only to those who haven't already discovered for themselves what utter crap you're pushing when they can also include those you've already victiminzed. :-) Why run the risk of saturating your market? Create one with dranage holes...

[russotto]

http://www.directionsonmicrosoft.com...xgnpt_illo.htm

Now, looking at it from the viewpoint of the hacker: How can I get unprotected digital output?

First, best, and most obvious: I can modify Windows Media Player not to add the noise. If there are integrity checks to prevent modification of Windows Media Player, I disable them. I may need to disable several layers of checking, but once it is done it is done. Then I can anonymously distribute my modification. The problem with this method is it's probably the one they've gone to the greatest lengths to prevent.

Second: I can sign my own components. Sure, I don't have Microsoft's private key. But chances are there's room for several public keys in the OS... and chances are some of them are unused (can you say "NSAKEY") and I can substitute my own public key for which I have a private key. Then I can anonymously distribute my signed component and my method for installing the key.

Third: I can determine the characteristics of the noise and remove it myself.

Fourth: I can modify the sound card firmware to ignore the "disable digital output" flag.

Fifth: I can arrange to modify one of the signed components in memory AFTER its integrity has been checked.

Sixth: I can modify the "DRM Component" to ignore signatures. This is probably another well-protected path, however.

There's probably other methods that I can't think of off the top of my head (plus the analog path).

[jet_silver]

<P>You don't get what you used to get when you 'bought' a CD. The value of CDs (vids, ebooks) have diminished from what you used to get. This is a change, and I believe in "Le Chatelier's Law as Applied to Systems": The system pushes back. (Aside: This "law" is discussed in John Gall's excellent book 'Systemantics'.)
<P>Econ 101 says there is a relationship between money expended and value received and that is called the 'elasticity' of the product. A perfectly elastic product's sales will vary with price (or value per money expended). Decrease the value received and down go the sales. OTOH an inelastic product's sales don't vary with value. Content producers have decided their product is -inelastic-, therefore they'll sell the same amount regardless of value received. And it appears, so far, that they're right. I imagine few people refuse to purchase CDs today because of changes to the value received. How many more controls will go on before people begin to resent them?
<P>The point of DMCA, SSSCA, and the hardware changes Xugumad discusses is to keep the value of content down. Therefore, someone willing to distribute content whose value is -greater- than what you get with all these controls has an opportunity to win a lot of a market.
<P>Nothing says the RIAA controls -every bit- of content. It only controls the particular bits of content 'owned' by its members. I am perfectly free, for example, to publish a CD of me singing to my girlfriend's dog without any RIAAesque controls. (Duffy likes my song but he won't pay for the CD, and if you're smart you won't either.) But decent content is still perfectly salable without any controls.
<P>Does this suggest anything to you? It suggests the following to me: instead of climbing on the rights-management pay-to-play treadmill, people will search for alternatives. It suggests that samizdat publishing, without DRM, is going to be big. Artists, except for a few Very Big Names, have little to lose from leaving content controls the way they were in 1982. So what we'll have, shortly I imagine, is two kinds of music available: one kind, available at norightsatall.com, will have DRM built in. The other, available at some Napster-like site, won't have DRM. Guess which the kids will be listening to?
<P>The RIAA is asking for too much, and I am betting they won't get it. What's more, once people find out the depth of the scam, there will probably be an enormous backlash. People don't like having 'their rights' (whether they are legal rights or only perceived rights resting on tradition) abused or removed.

[jaguar]

First thing that came to mind is gee, i'm glad i've got my debian cds here that'll past 20 years easily. Until they kill open source its not impossible becuase DRM requires hardware and OS.

Second is social, people have a pretty high shit-swallowing tollerence but i've got a feeling this is gonna be tested bigtime. Most people do *not* pay for windows, and Office, when the subscription system becomes the norm alot of home users are going to start kicking up a shit and looking round a bit more. Same aaplies with mp3s etc, most people my age *do not* buy many cds, yet we have +1000 mp3s. Lock the shit out of it and people will start saying well gee, since they're treating us like shit, we'll start looking elsewhere. THe majority of the population will not swallow +$1000 for Office/Windows every couple of years. Particuarly home users which is where linux needs a bigger foothold.

Third, nothing is unhackable, and most things have been hacked. Just look at the amount og keygens and crack out there, people you decompile frigging exes and wallow though megs of asm code ripping out well designed security measures, these people are tough to beat to say the least. *every* secure system put forward so far has had the shit hacked out of it (literally).

Fourth that came to mind is that AOL-Time-Warner does not like msft at all, heck they're not supporting XP on thier ISPs now, its corperate war. ICQ now has file sharing, when people start putting mp3s on that(they already have) whats the RIAA gonna do, shut down ICQ? or even AOL? Be funny to watch eh? Infighting could keep this from getting off the ground, getting all these guys to agree is not easy, they're all equally ruthless and lacking in ethics, its like streetfighting, cept with a few trillion dollars floating around.

[mbpark]

Hello,

It's there. It's not pleasant.

It's a trojan installed by Internet Explorer, your friend that installs a complete PKI infrastructure under Windows.

I discovered this with IE4 and IE5 installs when I discovered during a client call that the High Encryption Pack does not work properly under 95 and 98 because it doesn't switch to RSAENH.DLL, but keeps it at RSABASE.DLL. This is why I won't use Windows 95 or 98 .

There is no way in hell that an NT4 systems needs to do Driver Signing, Directory Services Authentication, or standard authentication.

Windows Media Player installs it as well.

I just un-screwed up what Adaptec DirectCD did to my DVD-ROM, and I discovered lots of fun integration of DRM into the CD-ROM and DVD-ROM in the registry. Wow. It's screwy like that.

In a nutshell, everything passing from the DVD-ROM passes to the DVD-ROM driver (storprop.dll, cdfs.sys, udfreadr.sys, cdrom.sys, and redbook.sys) and from there to lots of other fun devices. You can't even check the functions with dependency walker from Visual Studio. I just tried. However, storprop.dll is the gateway to them all. And it handles all your reading and writing . And it gates to PKI DLL's, cdaudio.sys, cdrom.sys, and cdfs.sys, udfreadr.sys.

Those four DLL's handle all your system translation for CD-ROMs and DVD's. Completely undocumented and they call direct to the kernel and PKI functions.

Storprop.dll handles all your devices and reading and writing to and from them.

Essentially, stripping out the DRM and PKI with copy protection will involve stripping out that DLL and replacing it. Good luck, since it handles every removable device.

It may be possible to bypass the CD-ROM driver and the copy protection by using a different, OLDER, SCSI CD-ROM driver that 2000/XP supports. These don't use cdrom.sys, but different .sys drivers like neccdrom.sys that may be just ports just so they work under 2k/XP, without the Digital Rights Management, that are direct to the system.

Look for these drivers to disappear in XP and Windows.NET Professional.