Argument in favor of DRM

[eschwartz]

Originally Posted by HarryT

I've already explained why in the other thread. It has nothing to do with the topic of this thread, and I'm not going to repeat myself.

I don't really expect an explanation.

1. I was only pointing out that you have it all backwards in terms of who said what.
2. I don't really expect you to have an explanation in general, since you didn't have one in the other thread where your explanation belonged.
3. You appear to be very good at justifying this* as a moral imperative, so who am I to argue? By arguing I can only ever prove myself immoral and a thief, yes? Brilliantly persuasive argument.

* -- no lending ebooks to a friend, even though pbooks are all right??? not even by sharing your Amazon account with them.

[dgatwood]

Originally Posted by Sgt.Stubby

My facts are correct. Encryption does trigger DMCA protections, and there is a prohibition on circumventing it. The fact that other access controls have the same effect was not relevant to my point. You're just muddying the waters here.

Breaking encryption isn't necessarily a DMCA violation. The encryption must be used for protecting a copyrighted work. That's why all those printer vendors that have tried to use the DMCA to sue over someone copying their anti-counterfeiting control chips have had their a**es handed to them in court.

Originally Posted by Sgt.Stubby

Regarding the barcode scanner, I don't recall the players involved. I only recall how loosely the court interprets encryption.

IIRC, that one didn't even go to court; they just sent a bunch of C&Ds and threatened to do so.

Originally Posted by SteveEisenberg

The same is true of the checkout in a bookstore. It only inconveniences the people who pay before walking out with a book.

That's a bit of a non sequitur. Providing people a means to pay is very different from creating a technical means to detect people who don't pay.

DRM is more like those magnetic strips inside products that are detected when you walk out the door. They do work against clueless criminals, but lots of people steal stuff in spite of them, and when cashiers fail to deactivate them, they frequently inconvenience real customers. The big difference is that those strips only inconvenience real customers once (or twice if they end up returning the product), whereas DRM potentially inconveniences customers on an ongoing basis, depending on how the customer intends to use the product.

Originally Posted by SteveEisenberg

Locking doors thousands of times a year is a significant inconvenience for me, but negligibly inconveniences people who are really good at picking locks. What's different about DRM isn't the inconvenience level for those playing by the rules, but the social class of the lock-pickers. Pickers of physical locks tend to have dropped out of high school. But DRM scofflaws fill the halls of UCLA, Wisconsin, and Harvard.

With door locks, you don't risk losing your entire car if something damages your key. And locking your door doesn't prevent you from changing the seat covers or replacing the radio. So the inconvenience level for those playing by the rules does, in fact, differ considerably in the worst case. Car locks are a minor nuisance for legitimate users; DRM limits legitimate users' ability to use what they have paid for in ways that some people consider significant.

Originally Posted by rkomar

Okay, if the keys are in persistent storage, that makes it easier for now. However, that can change. In my job, I'm working with Trusted Execution Environments that allow stuff to be encrypted and decrypted on the device without the keys being accessible within the main OS, and the environment is becoming more widely available in systems with ARM CPUs. Using the TEE to encrypt the key store would make it hard to crack. You'll probably be back to trying to fish the key out of the app when it has the ebook open (assuming that they don't keep the key in the TEE and do all decryption inside it).

I'm sure somebody will try that, and as soon as they do, it will be cracked by someone opening the book and dumping the unencrypted contents as it gets processed. And as soon as a single person makes an unencrypted copy available, the DRM is moot; there's no need for everyone to break it.

In fact, what you're describing is an awful lot like the way that most hardware copy protection dongles work. Those apps are invariably cracked pretty quickly. To do so, someone literally runs the app and uses every feature. As each page of the encrypted binary gets decrypted by the hardware device, the cracker writes the decrypted code to the same offset in a new file. After every page of code has been decrypted, the person removes the code that does the decryption, and now has a decrypted version of that app. It ends up on warez sites shortly thereafter.

[Quexos]

I have never dealt with DRM's and I never plan to. DRM's are oppressive and I don't know why people put up with it. I don't !

[rkomar]

Originally Posted by dgatwood

...I'm sure somebody will try that, and as soon as they do, it will be cracked by someone opening the book and dumping the unencrypted contents as it gets processed. And as soon as a single person makes an unencrypted copy available, the DRM is moot; there's no need for everyone to break it.

In fact, what you're describing is an awful lot like the way that most hardware copy protection dongles work. Those apps are invariably cracked pretty quickly. To do so, someone literally runs the app and uses every feature. As each page of the encrypted binary gets decrypted by the hardware device, the cracker writes the decrypted code to the same offset in a new file. After every page of code has been decrypted, the person removes the code that does the decryption, and now has a decrypted version of that app. It ends up on warez sites shortly thereafter.

If you read my comments earlier, you'd see that I'm more interested in the impact on those of us who want to rid their own purchased ebooks of DRM encryption. I don't care about how easy it is for professional pirates. I don't think that most people who own an encrypted book are interested in getting it from the darknets either. We already paid money for it.

Finally, if the decryption is done within the Trusted Execution Environment itself (rather than just the key store being decrypted there), then no part of the decryption takes place in the "normal world" reading app. So, the warez binary you will be left with won't decrypt anything.

[latepaul]

Originally Posted by Quexos

I have never dealt with DRM's and I never plan to. DRM's are oppressive and I don't know why people put up with it. I don't !

Even if it wasn't trivial to remove I wouldn't call DRM oppressive. Annoying perhaps.

The fact is that if I were to avoid DRM then that means there's certain authors I like that I'd either have to not read or read in paper. I don't agree with DRM but I just don't feel strongly enough to do that.

[dgatwood]

Originally Posted by rkomar

If you read my comments earlier, you'd see that I'm more interested in the impact on those of us who want to rid their own purchased ebooks of DRM encryption. I don't care about how easy it is for professional pirates. I don't think that most people who own an encrypted book are interested in getting it from the darknets either. We already paid money for it.

The problem is, most people will then rid their own purchased eBooks of DRM by downloading a cracked copy from somewhere, and if someone accuses them of copyright violation, they'll trot out their purchased copy as proof that they do have a license for the content. Whether that will hold up in court is anybody's guess, but at least ethically, they'll be in the right to do so.

The bigger problem with that is that the strength of the DRM then draws people to illegal download sites, which makes them statistically more likely to download pirated content that they don't legally own. Thus, even hypothetically near-perfect DRM tends to encourage piracy rather than diminish it, and diminish sales rather than increase it.

Finally, if the decryption is done within the Trusted Execution Environment itself (rather than just the key store being decrypted there), then no part of the decryption takes place in the "normal world" reading app. So, the warez binary you will be left with won't decrypt anything.

Ah. You're talking about running the entire book reading app inside the TEE. There's little question about whether that scheme would eventually be cracked, though it would be more difficult.

One possible attack involves debuggers. After all, the folks developing the software have to have a way to debug it, which means there's almost guaranteed to be some means of attaching some sort of debugger to gain access to those protected tools' memory, even if it requires soldering JTAG pins somewhere.

Another possible attack involves modified CPUs with dual-ported RAM and a second core that sniffs the main RAM. It is likely impossible to close that hole.

A third possible attack involves attacking the TEE itself. The purpose of a TEE is to run very simple, minimal software that is robust against attack, for very limited purposes, such as protecting device passcodes and biometrics data. The more complicated the software you run in the TEE, the more impossible it becomes to secure it. Because the entire book reader would run in the TEE, chances are good that any security holes in the main OS would also exist in the TEE, because you'd be importing most of the code. Thus, at that point, your TEE would be no more secure than the rest of the OS, so you'd have people doing all sorts of attacks on it through the content itself, looking for buffer overflows in image parsers, etc.

This, of course, assumes that they would even bother to attack the TEE in the first place, rather than going around it entirely. After all, most consumers demand to have access to their content on computers (even if they don't prefer to consume it there), and DRM is only as secure as the weakest system on which the content is accessible.

[rkomar]

Originally Posted by dgatwood

The problem is, most people will then rid their own purchased eBooks of DRM by downloading a cracked copy from somewhere, and if someone accuses them of copyright violation, they'll trot out their purchased copy as proof that they do have a license for the content. Whether that will hold up in court is anybody's guess, but at least ethically, they'll be in the right to do so.

The bigger problem with that is that the strength of the DRM then draws people to illegal download sites, which makes them statistically more likely to download pirated content that they don't legally own. Thus, even hypothetically near-perfect DRM tends to encourage piracy rather than diminish it, and diminish sales rather than increase it.

I definitely agree with the second paragraph. However, the power-hungry type pushing for total control via DRM will never believe it.

Ah. You're talking about running the entire book reading app inside the TEE. There's little question about whether that scheme would eventually be cracked, though it would be more difficult.

One possible attack involves debuggers. After all, the folks developing the software have to have a way to debug it, which means there's almost guaranteed to be some means of attaching some sort of debugger to gain access to those protected tools' memory, even if it requires soldering JTAG pins somewhere.

Another possible attack involves modified CPUs with dual-ported RAM and a second core that sniffs the main RAM. It is likely impossible to close that hole.

A third possible attack involves attacking the TEE itself. The purpose of a TEE is to run very simple, minimal software that is robust against attack, for very limited purposes, such as protecting device passcodes and biometrics data. The more complicated the software you run in the TEE, the more impossible it becomes to secure it. Because the entire book reader would run in the TEE, chances are good that any security holes in the main OS would also exist in the TEE, because you'd be importing most of the code. Thus, at that point, your TEE would be no more secure than the rest of the OS, so you'd have people doing all sorts of attacks on it through the content itself, looking for buffer overflows in image parsers, etc.

This, of course, assumes that they would even bother to attack the TEE in the first place, rather than going around it entirely. After all, most consumers demand to have access to their content on computers (even if they don't prefer to consume it there), and DRM is only as secure as the weakest system on which the content is accessible.

As I said above, all of this is too involved for those wishing to rid their own ebooks of DRM for personal use. You keep focusing on the dedicated pirates rather than the consumer. It is my belief that DRM is chiefly aimed at the consumer and not the dedicated pirates.

[Cosimo]

Originally Posted by webroot

...My stand is not to take any extreme position like "DRM is bad" or "DRM is all good" i want to know why still drm is alive, do people have reasonable alternative to that other than simply trusting consumers that it wont pirate....

Perhaps it is still 'alive' because the majority of people don't really notice it exists. I'm only guessing but I would say the vast majority of people who buy a Kobo or Kindle use it exactly as those companies want them to, they buy directly on their reader or website and then sync via wifi or with their desktop app. They aren't going to encounter DRM unless they switch brands and have an expectation to take what they already own to the new platform and find out they can't.

[shalym]

Originally Posted by Cosimo

Perhaps it is still 'alive' because the majority of people don't really notice it exists. I'm only guessing but I would say the vast majority of people who buy a Kobo or Kindle use it exactly as those companies want them to, they buy directly on their reader or website and then sync via wifi or with their desktop app. They aren't going to encounter DRM unless they switch brands and have an expectation to take what they already own to the new platform and find out they can't.

...which is happening to those who bought Sony readers right now, and will probably be happening to those who bought a Nook in the very near future. I would bet that Kobo will be taking over the Nook customers eventually, just like they did the Sony customers, and we will be hearing from the Nook people who go to buy a book from Kobo.com and can't read it on their Nooks because it is using Kobo's proprietary format. As I said, it's already happening to the people who use Sony's readers.

Shari

[Cosimo]

Originally Posted by shalym

...which is happening to those who bought Sony readers right now, and will probably be happening to those who bought a Nook in the very near future. I would bet that Kobo will be taking over the Nook customers eventually, just like they did the Sony customers, and we will be hearing from the Nook people who go to buy a book from Kobo.com and can't read it on their Nooks because it is using Kobo's proprietary format. As I said, it's already happening to the people who use Sony's readers.

Shari

Whoopsy

[rcentros]

Originally Posted by dgatwood

The problem is, most people will then rid their own purchased eBooks of DRM by downloading a cracked copy from somewhere, and if someone accuses them of copyright violation, they'll trot out their purchased copy as proof that they do have a license for the content. Whether that will hold up in court is anybody's guess, but at least ethically, they'll be in the right to do so.

The bigger problem with that is that the strength of the DRM then draws people to illegal download sites, which makes them statistically more likely to download pirated content that they don't legally own. Thus, even hypothetically near-perfect DRM tends to encourage piracy rather than diminish it, and diminish sales rather than increase it.

The only problem with this scenario is that it's just not true. Most people here go with Calibre and Uncle Alf and simply de-worm (de-DRM) the books they've already bought. So all this supposed "danger" of being slowly sucked into the shady world of "illegal download sites" simply doesn't apply. This is a straw man argument. All my books are de-wormed -- all of them were bought from Amazon, or Barnes & Noble, or Google. None of my "cracked" titles were purchased or downloaded from an illegal site. I know the difference between stealing and buying.

[rkomar]

Originally Posted by rcentros

The only problem with this scenario is that it's just not true. Most people here go with Calibre and Uncle Alf and simply de-worm (de-DRM) the books they've already bought. So all this supposed "danger" of being slowly sucked into the shady world of "illegal download sites" simply doesn't apply. This is a straw man argument. All my books are de-wormed -- all of them were bought from Amazon, or Barnes & Noble, or Google. None of my "cracked" titles were purchased or downloaded from an illegal site. I know the difference between stealing and buying.

What would you do if you couldn't de-worm your ebooks? The technology to keep you from doing that currently exists. It isn't deployed yet, but things are moving in that direction. I would not call it a "straw man".

[jgaiser]

Originally Posted by rkomar

What would you do if you couldn't de-worm your ebooks? The technology to keep you from doing that currently exists. It isn't deployed yet, but things are moving in that direction. I would not call it a "straw man".

The problem is that the ebook has got to be readable and if it's readable it can be de-DRM/pirated (see the Music industry). And as the early game industry discovered, even foolproof copy protection schemes ain't.

[ApK]

Originally Posted by jgaiser

The problem is that the ebook has got to be readable and if it's readable it can be de-DRM/pirated (see the Music industry). And as the early game industry discovered, even foolproof copy protection schemes ain't.

But I don't it's an unreasonable notion that if a sufficiently annoying DRM took a sufficiently large amount of time/knowledge/tools (etc, take your pick), then more people would turn to waiting for someone with the right time/knowledge/tools to do it, and get a copy from them. It's not very huge leap.

[eschwartz]

Originally Posted by rkomar

As I said above, all of this is too involved for those wishing to rid their own ebooks of DRM for personal use.

Only until someone automates the whole thing with a plugin...