Pan Macmillan: DRM Is Not Evil

[zelda_pinwheel]

Originally Posted by Sweetpea

And Z, watermarking with a sensitive thing is not what I had in mind! But would you distribute a file, which is encrypted with your CC and watermarked with your full name?

it depends what you mean by "distribute" ! i wouldn't put it on a filesharing site, but that's a decision independent of any watermark ! i *would* share it with friends / family, however, it's true, i'd feel less comfortable than with a non-marked file, because once again, it could be lost / stolen ; or my trustworthy friend could share it with just one of her trustworthy friends who could share it with a friend who turns out not to be trustworthy at all (and who doesn't care, because he doesn't know me, after all...), and then my name is on a file on a p2p site and i am not happy about that. but i still want to be able to share with my (immediate) friends, and not have to worry about such unlikely but possible hypotheses. this is (one of the reasons) why i'm against drm and why i'm not even too convinced i accept social drm, because of possible circumstances out of your control which will have direct repercussions on *you* even if you are not directly at fault.

[Abecedary]

I think LazyScot summed up my thoughts on the student photocopying issue pretty well. Most people wouldn't bother photocopying a $5 paperback, and students are kind of the exception to the rule. I guess I grew up in a somewhat atypical place, since I only knew of students who would copy a few pages or maybe a chapter of a textbook. At 10 cents a page, copying a whole textbook would get pretty expensive (still cheaper than buying it, but the extra hours spent copying it add up). But yeah, once the first copy is made, additional copies are only a matter of loading up the sheet feeder...

As for the whole DRM approach that publishers are taking, this is an instance where I think something similar to the whole Zune "squirting" thing might actually make sense. It would be nice if you could squirt a copy of a book to someone else, and then it would expire from their device after 2 weeks. Put a semi-lock on the owner's file that says something like "only 1 squirt allowed per week" to prevent you from handing it out to anyone and everyone. Of course, this requires that everyone have the same/similar type of device that supports this scheme, so it'll likely never happen. But if DRM is required (which I'm not entirely convinced it is), then this is a level I'd find acceptable while still being usable.

[Sweetpea]

Originally Posted by Abecedary

Of course, this requires that everyone have the same/similar type of device that supports this scheme, so it'll likely never happen. But if DRM is required (which I'm not entirely convinced it is), then this is a level I'd find acceptable while still being usable.

Hmm, and the current DRM implementations don't? (require you to have the same/similar type of device, that is).

I think we (the users) can all agree that if a DRM is required, let there please be only one implementation that works on all devices. Your method could work too in that case. Add that to a watermarking method and you'll have alleviated Z's fear of her books (containing her private info) being distributed without her knowing...

Naturally whether such a scheme would be possible is a completely different question!

[zelda_pinwheel]

Originally Posted by Sweetpea

Hmm, and the current DRM implementations don't? (require you to have the same/similar type of device, that is).

I think we (the users) can all agree that if a DRM is required, let there please be only one implementation that works on all devices. Your method could work too in that case. Add that to a watermarking method and you'll have alleviated Z's fear of her books (containing her private info) being distributed without her knowing...

Naturally whether such a scheme would be possible is a completely different question!

yes, something like that could perhaps work, as long as i can use *my* (purchased) books on any device i want, for as long as i want, as many times as i want. if i can also share with my friends and not worry about them sharing with someone less trustworthy that might be okay to have the watermarking, although 1. i'm not sure how i feel about a time-limit ; if the book is long, it can take more than 2 weeks to read it, and 2. maybe i lend it to them but they don't start reading it right away because they are already engrossed in a 2000 page saga which they really want to finish first (say, the millenium trilogy i hear it's so addictive you are litterally incapable of not reading it straight through to the end). so before they even start, the loan is expired ? that's really annoying ! really, i still think no drm at all is the best way. and baen and o'reilly publishers agree with me, too.

[LazyScot]

Originally Posted by zelda_pinwheel

this is a valid point (the people who say "if i *can* do it, it must be legal", simply because they don't know any better) but i still think it would be much better to try to act against this with an effort of education rather than ineffective, pointless, costly and very annoying (to legitimate customers only !) drm.

I agree that education and no DRM is the better way, but I'm not convinced it will succeed 100%. The question is whether or not it will succeed enough to allow a DRM-free model for paid-for content to work. I'd much rather not have to worry about having keys for my house and car, but I don't think the "education" system protects them; in the same way the "honesty box" is not a widespread system (though I agree it works in some cases).

Why is DRM *necessarily* costly?

Originally Posted by zelda_pinwheel

yes, "draconian" seems apt. but can "a more reasonable drm scheme" exist ? what would it look like ? how would it work ? perhaps a social drm / watermarking scheme, but even then, as i said, i have some reserves simply because you never know what could happen which is beyond your control. i would be interested to hear some ideas or concrete suggestions though. perhaps there is something obvious which i haven't thought of.

I don't see why it couldn't be made to exist, especially if every device had sensible communications, and a built in "move" button for content. It should also be possible to make it completely transparent and cope with device loss/failure (assuming some sort of content escrow agency could be set up).

Originally Posted by HarryT

Even in that circumstance, all you could do would be to try and encrypt the original file with every possible key until you got a match for the encrypted file. For a 16-digit credit card number, such a "brute force" approach would probably be impractical.

I'd guess that you could reduce the CC numberspace quite substantially, say to 8 digits, based on knowledge of likely geography, card suppliest, likely number creation dates, the actual number formats, etc. 10^8 should be brute force searchable over a weekend for a reasonably powerful computer, assuming reasonably small block sizes within the file. And a simple syntax check of what comes out should allow you to decide if the key is probably right, even without the original file to hand. (Though I suspect it is easier to just go to suitable sites and buy the numbers you want, if a recent New Scientist article is anything to go by.)

Originally Posted by zelda_pinwheel

it depends what you mean by "distribute" ! i wouldn't put it on a filesharing site, but that's a decision independent of any watermark ! i *would* share it with friends / family, however, it's true, i'd feel less comfortable than with a non-marked file, because once again, it could be lost / stolen ; or my trustworthy friend could share it with just one of her trustworthy friends who could share it with a friend who turns out not to be trustworthy at all (and who doesn't care, because he doesn't know me, after all...), and then my name is on a file on a p2p site and i am not happy about that. but i still want to be able to share with my (immediate) friends, and not have to worry about such unlikely but possible hypotheses. this is (one of the reasons) why i'm against drm and why i'm not even too convinced i accept social drm, because of possible circumstances out of your control which will have direct repercussions on *you* even if you are not directly at fault.

Interestingly, I think your case could be used to argue for DRM (sorry). It would either prevent the case being able to happen, or provide a fingerprint trace of who was actually responsible.

[Abecedary]

Originally Posted by Sweetpea

Hmm, and the current DRM implementations don't? (require you to have the same/similar type of device, that is).

I was thinking more along the lines of the hardware perspective (all devices would need to have Wi-Fi that could easily be switched to a P2P sharing mode to allow quick/easy "squirting" of books). But your point is well taken.

[Moejoe]

The simple idea behind DRM is to place a model of physical scarcity upon digital abundance. Whether that be encrypted DRM or social DRM, the idea is flawed and needs to be re-evaluated. Old supply and demand economic models do not work in the digital realm, especially when you have essentially an infinite product. I am rapidly becoming convinced that everthing digital should be completely free (if limited) and any payment should occur as a complimentary, voluntary purchase to either add value or gain you a physical object. I can't see any other way forward.

[zelda_pinwheel]

Originally Posted by LazyScot

I agree that education and no DRM is the better way, but I'm not convinced it will succeed 100%. The question is whether or not it will succeed enough to allow a DRM-free model for paid-for content to work. I'd much rather not have to worry about having keys for my house and car, but I don't think the "education" system protects them; in the same way the "honesty box" is not a widespread system (though I agree it works in some cases).

Why is DRM *necessarily* costly?

well, sure, there will always be some dishonest people who will make it necessary for you to keep a key for your house and car, but no form of drm will stop them anyway, so why concentrate on them ? i still think (and models like baen and oreilly would tend to confirm this hypothesis) that the vast majority of people want to be honest and will pay for content, provided it is easy to find, convenient (no jumping through all kinds of ridiculous drm hoops), and reasonably priced (another hurdle the publishing company is currently taking pains not to jump over, with a few notable exceptions).

as for why drm is necessarily costly... hm, because the drm server companies are greedy ? adobe drm (for example) costs 10000$ to purchase the licence / sdk to be able to make drm-encoded files, PLUS a fee for each file served. the publishers aren't going to just absorb that cost ; they pass it along to the customers. that means drm not only is making a worse ebook experience for us, it's also costing us money. thanks guys !

I don't see why it couldn't be made to exist, especially if every device had sensible communications, and a built in "move" button for content. It should also be possible to make it completely transparent and cope with device loss/failure (assuming some sort of content escrow agency could be set up).

that is a good idea, but your content escrow agency... again, who pays for that ? i really get cranky when i am in essence forced to pay for added inconvenience.

Interestingly, I think your case could be used to argue for DRM (sorry). It would either prevent the case being able to happen, or provide a fingerprint trace of who was actually responsible.

how would it provide a fingerprint trace ? the only fingerprint trace i see there is my own, so even if i didn't upload the file (which was lost / stolen / lent to someone who turns out to be unscrupulous unbeknownst to me) i will end up paying the consequences ! not very fair, it seems to me.

[JSWolf]

Originally Posted by HarryT

You've slightly lost me there. As I understand it, your credit card number is used as an encryption KEY; it's not stored IN the eReader book any more than, say, a Mobipocket book stores device PIDs in the file.

I do understand the Mobipocket PID setup. But for eReader, you don't have your CC stored in your reading software. So where does the CC # get used to decrypt the eReader book?

[Alisa]

While I'm sure we could brainstorm a much fairer DRM scheme than generally exists today, I think it's a bit of a moot point. The wily hackers of the world have a really good track record of finding ways around these things. I think it would be more rational for publishers to think about how they can still sell books with the assumption that people are going to be able to copy them.

[zelda_pinwheel]

Originally Posted by Alisa

While I'm sure we could brainstorm a much fairer DRM scheme than generally exists today, I think it's a bit of a moot point. The wily hackers of the world have a really good track record of finding ways around these things. I think it would be more rational for publishers to think about how they can still sell books with the assumption that people are going to be able to copy them.

yes !!! precisely. it seems to me that this discussion (and more importantly, the original article) is essentially asking the wrong questions.

[Sweetpea]

Originally Posted by JSWolf

I do understand the Mobipocket PID setup. But for eReader, you don't have your CC stored in your reading software. So where does the CC # get used to decrypt the eReader book?

I had to enter my CC number when I first opened the book.

[Steven Lyle Jordan]

Originally Posted by zelda_pinwheel

yes !!! precisely. it seems to me that this discussion (and more importantly, the original article) is essentially asking the wrong questions.

I don't think so, myself. I agree wholeheartedly that DRM in itself is not evil, but has not yet been properly implemented to satisfy buyers and sellers... and it must satisfy both, or you either won't have customers, or you won't have products. (Personally, I'd rather have products.)

But I also think the publishers need to spend more time on finding alternative methods of revenue for digital products, as the models for physical products simply do not apply... as well as adding more value-added content and quality to e-books in order to encourage acceptance of some reasonable level of DRM, and to discourage the desire to hack and distribute.

Security methods that satisfy customer and producer have been accomplished in other industries, and there's no reason to think it can't be accomplished with e-books.

[Shaggy]

Originally Posted by Steve Jordan

I don't think so, myself. I agree wholeheartedly that DRM in itself is not evil, but has not yet been properly implemented to satisfy buyers and sellers... and it must satisfy both, or you either won't have customers, or you won't have products. (Personally, I'd rather have products.)

I think the main problem is that in the seller's view, DRM is about a lot more than just copy protection (which it's miserable at anyway). To sellers, DRM is also a great way to eliminate fair use and first sale rights. That is probably just as important to them, if not more so, than copy protection. This is obviously completely opposite of what buyers want though. I think that's the real reason that DRM hasn't been "properly" implemented yet. In many seller's opinion, the current implementation IS proper.

[Elfwreck]

Originally Posted by JSWolf

I do understand the Mobipocket PID setup. But for eReader, you don't have your CC stored in your reading software. So where does the CC # get used to decrypt the eReader book?

As Sweatpea said--you enter the CC# when you first open the book, either on your computer or mobile device. After that, the book can be read on that device without trouble (unless maybe it's uninstalled & reinstalled? I haven't experimented much with secure eReader files.)

Since eRreader was designed for PDAs, this works fine. But no dedicated ebook readers use the eReader format, possibly because the unlock mechanism doesn't go well with the firmware. It's basically "enter password to open book," with your CC# as the password.

I wish some of the eInk readers would attach the software for unencrypted eReader .pdb files, though. I have plenty of those that I'd like to avoid re-converting to new formats.