Hacks kindlepid/kindlefix 0.2

[sirbruce]

Originally Posted by RickyMaveety

Well, I am a lawyer, and no matter how I dissect the matter, I don't see how either of those python scripts does anything in violation of the DMCA.

Really? Because 17 USC 1201 seems to be pretty clear:

(A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

The PID in an ebook file is clearly a 'technological measure that effectively controls access', namely, to only a device with that PID. Using Kindlefix to substitute a different PID for the one in the file clearly circumvents that. I agree with your earlier analysis that there's little actual damage here, and that the publisher probably does not care so long as it's only being read on one device and not copied multiple times for multiple devices.

But it's still a technical violation, at least until an exemption is granted.

[slayda]

Originally Posted by sirbruce

Really? Because 17 USC 1201 seems to be pretty clear:

(A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title.

The PID in an ebook file is clearly a 'technological measure that effectively controls access', namely, to only a device with that PID. Using Kindlefix to substitute a different PID for the one in the file clearly circumvents that. I agree with your earlier analysis that there's little actual damage here, and that the publisher probably does not care so long as it's only being read on one device and not copied multiple times for multiple devices.

But it's still a technical violation, at least until an exemption is granted.

From my understanding of Kindlefix, it does not substitute a different PID, it in fact allows the Kindle to read the file with the Kindles original PID.

I could also quibble about how effectively it does control access but I won't go there.

[tompe]

Originally Posted by slayda

From my understanding of Kindlefix, it does not substitute a different PID, it in fact allows the Kindle to read the file with the Kindles original PID.

Now I am confused... If you have a book that was not intended to be read on the Kindel and have DRM that enforce that. Why is not making it possible to read the book on the Kindle circumventing the DRM?

[Sydney's Mom]

I think it is a fair use argument. If I pay to read the content, and I have to use kindlefix to make the content readable on my device, I have not circumvented the DRM. There is a specific exception for that. However, if I used it to be able to read it on my computer AND my kindle, then there would be a problem.

[Nate the great]

Originally Posted by tompe

Now I am confused... If you have a book that was not intended to be read on the Kindel and have DRM that enforce that. Why is not making it possible to read the book on the Kindle circumventing the DRM?

It's not that the book can't be read on the Kindle, it's that the Kindle refuses to read the book. The Kindle's PID is already in the book before you run kindlefix.

My position on kindlefix hinges on whether it "unpacks" the PIDs or "decrypts" them. I use the word unpack to refer to a process that is identical on all ebooks, and decrypt to refer to one that requires something to make the process unique. For example, you can unpack any ZIP file with just about any software. You need a specific PID to decrypt an ebook.

So, whether kindlefix violates the DMCA depends on how the PIDs are stored in the file header. Is it closer to a ZIP file, or closer to encryption?

[tompe]

Originally Posted by Nate the great

It's not that the book can't be read on the Kindle, it's that the Kindle refuses to read the book. The Kindle's PID is already in the book before you run kindlefix.

And refusing to read the book is part of the DRM. If I would sell a MobiPocket book with DRM I might want not to make it available to Kindle users for some reason. The DRM enforces my right to make this decision. I do not see how using kindlefix is not circumventing the DRM and reading the book on a Kindle against my wishes.

[sirbruce]

Originally Posted by slayda

From my understanding of Kindlefix, it does not substitute a different PID, it in fact allows the Kindle to read the file with the Kindles original PID.

I could also quibble about how effectively it does control access but I won't go there.

Ahh, okay, I misunderstood. I thought people were using kindlepid to get their Kindle PID, downloading an ebook from, say, Fictionwise with their computer or other device's PID, then running Kindlefix on it to change the PID.

Re-reading, I see now that Kindlefix simply fixes a special 'flag' in the file that allows it to be used on Kindles; the file already has to have the Kindle PID in it.

So now I see the PID really has little to do with it. Kindlefix is certainly a program that circumvents a bit that controls access to the file.

[RickyMaveety]

Originally Posted by slayda

From my understanding of Kindlefix, it does not substitute a different PID, it in fact allows the Kindle to read the file with the Kindles original PID.

I could also quibble about how effectively it does control access but I won't go there.

That is also my understanding. It does not substitute a different PID. It allows the user to indicate what the correct PID for the device is so that they can read the book.

In addition, considering that the user has paid the appropriate amount to the appropriate people, and has presumably purchased a license to read the book, I need for someone to tell me where the damage lies in allowing the user to read that book on the device they own ... the one with that particular PID.

And, please, tell me exactly who is being damaged? You are suggesting that there are authors out there who only want their book to be read on a particular device?? So, the book will not be available in brick and mortar bookstores, no one can go into the store to buy one, no one can go into a library to check the book out .... it is ONLY going to be available for one reading device? Somehow I don't see the author of that book making very much money .... and, for that matter, I don't see the publisher of the book making very much money.

And, while everyone is quoting the literal text of the code, if I cannot buy a legitimate digital copy of a book to read, and I instead purchase a regular brick and mortar bookstore copy, I'm still "circumventing" that technological barrier that controls access to the work.

I suppose it does come down to the word "effectively." Because that particular type of DRM is about as ineffective as it gets. There's a typical federal code logical loop for you ....

1. If some hacker can easily circumvent the DRM then it must not be "effective";

2. If the DRM is not effective, then it's not illegal to circumvent it ...

Ah yes, the proud work of our elected officials ...


Oh, and before I forget, the law does not exist in a vacuum. The party who considers themselves (or their DRM) violated under the code must be the one who brings the complaint. There is a little issue of standing. And .... I want to hear the convoluted reasoning someone is going to have to go through to explain how my using my PID associated with my Kindle at another online bookstore circumvents DRM put in place by Amazon?? It could, in theory, circumvent DRM put in place by the other online bookstore, but then Amazon has no standing to complain about that.

[InlawBiker]

Originally Posted by RickyMaveety

Oh, and before I forget, the law does not exist in a vacuum. The party who considers themselves (or their DRM) violated under the code must be the one who brings the complaint. There is a little issue of standing. And .... I want to hear the convoluted reasoning someone is going to have to go through to explain how my using my PID associated with my Kindle at another online bookstore circumvents DRM put in place by Amazon?? It could, in theory, circumvent DRM put in place by the other online bookstore, but then Amazon has no standing to complain about that.

Eh, well, I'm not a lawyer but I know a bit about cryptography and programming. I changed the script so I don't always have to type my PID and now I'm digging into the code. The DRM is not circumvented, removed or altered with kindlefix.py. The payload (the e-book) is still encrypted and usable only by the PID(s) used to encode it.

Comparing the original .prc and pythonfix'd .azw files, there are only about 28 bytes different between the two.

In fact, I would wager that the e-book payload is never even decrypted when it's run through the script. It's possible to isolate just the Mobi header and maybe decrypt only that. Perhaps the author will come around and clue us in.

Anyhow I think we're all saying the same thing. The spirit of DMCA isn't broken here and nobody is at a loss, except Amazon is no longer the sole provider of DRM content for the Kindle.

[tompe]

Originally Posted by InlawBiker

Eh, well, I'm not a lawyer but I know a bit about cryptography and programming. I changed the script so I don't always have to type my PID and now I'm digging into the code. The DRM is not circumvented, removed or altered with kindlefix.py. The payload (the e-book) is still encrypted and usable only by the PID(s) used to encode it.

The meta data is changed and it is not encrypted. What I do not understand is why people comsider the encryption being the only part of the DRM. The bits that kindlefix.py changes is also part of the DRM system.

If it legally is not effective then this is one thing. It is still part of the DRM event if it is not legally effective.

[RickyMaveety]

Originally Posted by tompe

The meta data is changed and it is not encrypted. What I do not understand is why people comsider the encryption being the only part of the DRM. The bits that kindlefix.py changes is also part of the DRM system.

If it legally is not effective then this is one thing. It is still part of the DRM event if it is not legally effective.

Tompe, tell me this ... if the DRM is supposed to prevent someone, other than the purchaser of the book, from accessing the book, and the script does nothing to alter that, then how is the DRM being circumvented?

Not trying to be confrontational, but I am curious.

[tompe]

Originally Posted by RickyMaveety

Tompe, tell me this ... if the DRM is supposed to prevent someone, other than the purchaser of the book, from accessing the book, and the script does nothing to alter that, then how is the DRM being circumvented?

Not trying to be confrontational, but I am curious.

The DRM is also supposed to prevent it to be used on a Kindle.

[sirbruce]

Well, "supposed" is an assumption, but it certainly DOES do exactly that.

[pilotbob]

Originally Posted by tompe

The DRM is also supposed to prevent it to be used on a Kindle.

Isn't the DRM supposed to allow the ebook to only WORK on the devices identified by the 1-4 PIDs for which it is encrypted?

In that case, an ebook encrypted for the Kindle PID will only be for that kindle. How would changing the document type metadata to a value the kindle needs violate or circumvent that in any way? The protection is still there.

BOb

[JSWolf]

If I have a Mobipocket eBook that has say 2 PIDs in it and I can view it with Mobipocket Reader and then I change the document type (one of the PIDs is for the Kindle) to say this can be viewed with a Kindle, I've just changed the DRM. I can no longer view it with Mobipocket Reader. So in effect, I have just changed the DRM. I have prevented this eBook from being read on the devices it was meant to be read on based on the PID and document type.

The DRM is no longer the same DRM it was before. The DRM tells me what I can and cannot read the eBook with. Changing just the document type is changing the DRM's permission. So in effect, you have changed the DRM to allow Overdrive Mobipocket eBooks to be viewed on a Kindle.

Persoanlly, I do not see any difference to changing the DRM to allow the eBook to be viewed on a Kindle as opposed to reading it with Mobipocket Reader. For library eBooks, the DRM is still going to expire so it cannot be read bast it's allowed time. But legally, this may not be acceptable.