Hacks kindlepid/kindlefix 0.2

[Nate the great]

Thomas, the kindlepid script does step one, not step two. That script cannot be used on a DRMed ebook. It would do nothing to the ebook.

[Nate the great]

@Thomas

Also, you seem to have conflated the kindlepid and kindlefix scripts. These are 2 separate pieces of code.

Just so you know, the kindlefix script does not insert a PID in to a DRMed ebook. Instead it takes the ebook and a matching PID (it's already in the ebook), and inserts into the header of the ebook the integer that Amazon decided to use to separate Kindle and Mobipocket ebooks. The DRM is not touched; it will continue to function as designed.

[Thomas Ryan]

Originally Posted by sirbruce

The PID is not "part" of the DRM scheme. It's a public identification number used as a reference key. The fact that it's somewhat obscured on the Kindle is irrelevant. [...].

Originally Posted by Nate the great

@Thomas
Also, you seem to have conflated the kindlepid and kindlefix scripts. These are 2 separate pieces of code.
Just so you know, [...] The DRM is not touched; it will continue to function as designed.

Bruce your point is partly right, and the wrong part is likely based on a wrong assumption. Nate - you are also correct (except I don't exactly know what conflate means). In my orginal post, I had the detail wrong.

I think the "key" is to decide what you mean by "DRM" - the whole scheme, or just the last parts pertaining to actual book content.

Let me try again, and for those of you being dragged through the weeds - I am wondering (not concluding) if you should reconsider some your assumptions about kindlefix in light of what it really does and what the DMCA says. Of course, if you don't care about DRM issues, never mind. On the other hand, if you are taking some high moral ground to respect DRM, and also loving kindlefix, you may have a logic problem in your head. Or, maybe not. I don't decide for you.

Based on a recollection of kindlefix.py, here is how I understand mobi DRM to work.

The "DRM" is indeed based on PIDs. PIDs are not private; yes, they have become more obscure over time. (users once entered PIDs into the mobipocket web-site before downloading content)

Mobi files contain key-records in addition to encrypted content. The key-records are also encrypted.
A key-record holds a PID (representing a device), a set of DRM rights for that PID, and the key to decrypt the content.

To "adjust" the DRM for a book on a device, one of the book's key-records must contain the device PID.

Step 1: kindlepid helps you determine a device's PID.

Step 2: kindlefix decrypts key-records in a book until it finds one matching the PID whose DRM rights need adjustment.
It adds "Kindle read" permission (dw4|0x800)(?) to the key-record for that PID, re-encrypts the key-record, and replaces the key-record in the mobi file.

It is correct that kindlefix does not access the book content.

So my question is whether kindlefix as used in step two is prohibited "circumvention" in the context of DMCA cited earlier. It is decrypting part of the book file.

[pilotbob]

Originally Posted by Thomas Ryan

Nate - you are also correct (except I don't exactly know what conflate means). In my orginal post, I had the detail wrong.

conflate is combine (two or more texts, ideas, etc.) into one

BOb

[desertgrandma]

Originally Posted by Thomas Ryan

Step 2: kindlefix decrypts key-records in a book until it finds one matching the PID whose DRM rights need adjustment.
It adds "Kindle read" permission (dw4|0x800)(?) to the key-record for that PID, re-encrypts the key-record, and replaces the key-record in the mobi file.

It is correct that kindlefix does not access the book content.

So my question is whether kindlefix as used in step two is prohibited "circumvention" in the context of DMCA cited earlier. It is decrypting part of the book file.

The book is being "borrowed' in the same way a paper books is physically "borrowed" from a brick and morter building.

It is "returned" when the loan period is over.

If it is not kept after the loan period, like a paper book, where is the illegality?

[sirbruce]

Originally Posted by Thomas Ryan

So my question is whether kindlefix as used in step two is prohibited "circumvention" in the context of DMCA cited earlier. It is decrypting part of the book file.

Okay, so I think we agree that kindlepid is not illegal under DMCA.

As for kindlefix, I think that one doesn't need to concentrate on the "decrypt" aspect, since in any event it serves to circumvent "access control" to the file, which is also against the DMCA unless covered by an exemption, which ebooks currently are not except for read-aloud or screen reader functions.

Now, I think given the letter of the law, Kindlefix certainly does violate DMCA, even if you are using it for 'legit' purposes such as substituting on PID for another with no intent to steal. However, I don't think this is really a big deal, since you're not violating copyright to get access to something you shouldn't, but rather to get access to something via a particular device as opposed to another device. Does copyright cover not only whether and how something is distributed, but also how it is consumed? I don't think that's a settled issue. The current exemptions for the DMCA are often made when access to the media in question is otherwise 'impossible'; for example, software that require dongles where the dongles are no longer available. This certainly *implies* that copyright can't arbitrarily control methods of access. One can certainly make the case that non-Kindlefixed ebooks are perfectly capable of being read on other devices, and I agree. On the other hand, I don't think it's necessarily the intent of the publisher to prevent Kindles from accessing said ebooks.

So I think it's a technical violation, yes, but I doubt it's one that anyone would pursue. Furthermore I could *easily* see an exemption being granted in the near future to specifically allow for the copyright circumvention of ebooks for the purposes of reading them on unsupported devices.

[Valloric]

Originally Posted by slayda

scotty1024, are you, by any chance, related to HarryT or perhaps a desendent of Senator McCarthy? Just asking ...

There's no need for that.

And that side-jab at HarryT... that's just unkind.

[JSWolf]

I have a Sony Reader PRS-505. Now, let's say I want to purchase an eBook but it's not available in a format my 505 can handle? So I purchase it in a format that it is available that my computer can handle. Now, I strip the DRM, convert it so I can use this eBook with my 505. I don't give it out or sell it. I might allow my wife and/or mother-in-law to read it if they want. But, what I have done is purchase an eBook that I would otherwise not have purchased if I could not have stripped the DRM. Maybe technically, I've broken a broken law. But morally, I have done nothing wrong. I've not let more then three people (myself included) read this eBook. I don't think I've done anything wrong stripping the DRM. Because I can strip the DRM, I've bought more eBooks then I would have otherwise. So in my case, stripping the DRM has put more money in the pockets of authors and publishers.

[JSWolf]

Originally Posted by sirbruce

The PID is not "part" of the DRM scheme. It's a public identification number used as a reference key. The fact that it's somewhat obscured on the Kindle is irrelevant. Most people don't know the VIN number on their automobile or their MAC address, either, yet those are both numbers used for security and authentication purposes.

The PID is part of the DRM. it's what's used to be the key that fits the lock. The PID is used as the key for encoding the DRM.

[slayda]

Originally Posted by JSWolf

The PID is part of the DRM. it's what's used to be the key that fits the lock. The PID is used as the key for encoding the DRM.

This may just be a technicality but even though the PID is used as a part of the "individual" DRM for any particular machine, it is a stand-alone item, separate (in general) from the DRM. If it were a part of the DRM then your/my credit card number would be part of the DRM for ereader ebooks. My credit card number belongs to me and my financial institute. If someone "chooses" to use "my" CC # (or my PID) to DRM "my" ebooks, that does not automatically make it a part of "their" DRM. It still belongs to me and I have full rights to both know it and use it. They use it with my "implicit" permission. (Although in some cases - i.e. the Amazon Kindles, the owner - sometimes - doesn't even know that they have done so.)

[Thomas Ryan]

Originally Posted by slayda

This may just be a technicality but even though the PID is used as a part of the "individual" DRM for any particular machine, it is a stand-alone item, separate (in general) from the DRM. If it were a part of the DRM then your/my credit card number would be part of the DRM for ereader ebooks. [...]

Clever, but a PID represents the device; it is a computer generated name for a device. Your cedit card represents "you" , "or your account". If someone uses your credit card against your wishes to buy a $1000 toy, you would not be happy.

Mobi DRM locks content to devices via PIDs.
If you use a PID to change the locking mechanism inside a book that you bought and "own" (do you think you own it, or is it licensed?), then I think someone has asserted this violates the DMCA, and you seem to agree (almost). But who is unhappy? Do they have a "right" to be unhappy? Are they harmed?

You can see where this goes (and was going). The summary points are -

Is it against the law technically? If it is, but if the law "is an ass", do I have a "moral right" that allows me to violate it? Especially if there is no "victim", and/or if it makes me happier? But is there a victim? Does kindlefix make Amazon a victim? [ How about underfed babies of starving authors? - couldn't resist, or Harry T?, sorry]

There are about 6 or 7 questions in there. Flip a bit for each. I simply wanted to fix the first bit, which seemed to be the best starting point. That still leaves a pile of different possible positions. None alike, most argued from opinion.

I don't think we'll resolve this.

This is great fun over a cup of coffee in the morning, but it feels like it is time for me to move on to another thread. TTFN.

[RickyMaveety]

If I may wander into the fray for a moment, I'd like this opportunity to jot down a few thoughts on this subject.

It seems to me that there are a number of issues to be considered. And, they should be dealt with individually. This may be a long post, but stick with me, please.

First, we have the device. The hardware that makes up the Kindle (I or II, it matters not);

Then, we have the code that runs the device, including the PID imbedded in that code;

Finally, we have the digital book itself.

Amazon clearly owns the rights to the hardware, although, once you purchase the hardware, I don't think anyone would argue that you don't own the hardware. What you don't own is the right to manufacture copies and sell them.

Looking at the code. Amazon has the rights to the code that runs the device, and the user has a license to use that code. So, I do not have the right to change that code. If I did change the code for my own personal use, and never distributed the altered code, I doubt that anyone would complain. If I wrote a completely new operating system for the Kindle and distributed that or sold that .... no one could complain because my OS would be independent rather than derivative, and the user owns the hardware. For example, if I purchase a Toshiba computer that comes with Windows, and strip Windows off the machine and decide to run it with Linux, Toshiba can't complain and neither can Microsoft. But, if I altered the Kindle OS and then distributed that altered code. That would be a violation of the DMCA.

Looking at the digital book, which is actually two parts .... the DRM code embedded in the digital book and the text of the book itself.

I don't think anyone would argue about who holds the copyright to the text of the book. That's a non-issue. So, the sticking point here is whether altering the code embedded within the book is a violation of the DMCA. The problem here is whether it is enough merely to alter a piece of code for my own personal use. I certainly can't use either tool to circumvent copyright because I had to pay for the book. I also can't distribute the altered code because all it does is allow someone to read a book that I bought on my digital reader.

The heart and soul of the DCMA is to prevent digital piracy. In this situation, however, the consumer pays for both the device and the content. No copyright is circumvented. The author and publisher of the book and the maker of the device are all paid. Nothing is pirated. Further, nothing that is altered is distributed. DRM is not stripped by either of the python codes, you still have to have the device with the proper PID in order to read the book that you bought. Correct me if I'm wrong here.

So, let's move on from that part of the discussion and consider Amazon's "right" to control content read on their device. I think that's the real problem for the folks at Amazon ... they would like to complete control all content viewed on the device that they manufacture.

Unfortunately, they can't, and I submit that they do not have that right. As noted above, while I may only have a license for the OS that runs my Kindle, what I choose to place on the device is no business of theirs. I could load it up with nothing but books from Amazon, or perhaps I never use the Amazon store and fill it with 18th Century PD porn. Amazon has no right to say boo about it.

As an analogy. I purchase a digital TV set. It has a digital DVD player. Both the set and the player are devices for viewing digital media, both have some sort of encoding software within them. I own the hardware and I have a license to use the software.

Now, the manufacturer of the TV/DVD player tells me that they have the right to control what content I view. I can only hook up to a cable provider that they control. I can only watch stations that pay them a license fee. I can only watch those shows that they approve. Oh yeah, and I can only watch those DVDs that I purchase directly from them.

How many people would purchase a TV/DVD player combo with those sorts of restrictions? Show of hands?? How many people would purchase an ereading device with the same restrictions in place?

Now, consider for a moment the pieces individually again ....

Hardware ... Amazon is paid in full for the Kindle by the consumer.

Kindle OS .... neither python script in question does anything to alter the OS, it simply pulls out the PID embedded in the OS so that the consumer (who owns outright the piece of hardware that the PID identifies) can see what the number is. That is not a violation of copyright. No alteration and no distribution.

Digital book .... who ever wrote and published the book is paid when the consumer purchases the book, so again ... no copyright issue.

DRM embedded in book. First, who holds the copyright to that particular piece of code? Is it Amazon? If not, then Amazon has no standing to complain when the code is altered. If, for example, BoB or Fictionwise are the ones that put the DRM in place, then they are the ones with a complaint. But more importantly .... they've got to show that they are somehow damaged by the alteration of the code.

You can't have a cause of action without damages. You simply can't. It's one of the most basic tenants out there.

So, I own my Kindle outright. I paid for it and it is mine.

If Amazon thinks they have the unfettered right to control the content I view on my Kindle, they've got another think coming. Further, if they take that tack, the advertising should make it absolutely clear that no content other than that purchased directly from the Kindle Store may be read on the Kindle. No converting your own documents .... no taking PD books and copying them over via USB.

If I purchase a book from another vendor, and choose to read that book on my Kindle, which I own, and the author is paid, and the publisher is paid, and the device manufacturer is paid .... then who the hell is damaged??

If either of these scripts actually stripped off the DRM and allowed me (evil consumer that I am) to rip all these books onto a CD and sell the CDs at a swap meet, then there would be a case for damages. Neither of these scripts does that .... they don't go any further than allowing me to read a book I bought on a device I bought.

I will stop now because my left hand is beginning to twitch uncontrollably, so clearly it is tired. Note, this post is not intended as a response to anything anyone has posted previously, so sorry if I restate something that someone has already said .... but if any of you think I am missing some glaring point, please feel free to set me straight.

[InlawBiker]

Ricky I think you nailed it with many more words than I'd care to write... so I distill it down like so -

Did Amazon intend for us to use non-Amazon DRM books? No, obviously not. Do I care? Nope. It's my device. I have no agreement with them, nor am I obligated to use the device only to view Amazon's books.

Are authors or publishers hurt by this? No, I'm still acting under the terms set by my local library.

Is Amazon hurt? They'd have a hard time proving that they are.

Do they have any legal grounds to stop this practice? I don't know, I'm not a lawyer.

Will I still buy from Amazon? Yes.

If they try to stop me from reading *library books* I'll get rid of my Kindle and never buy anything from Amazon again.

[slayda]

Originally Posted by Thomas Ryan

Clever, but a PID represents the device; it is a computer generated name for a device. Your cedit card represents "you" , "or your account". If someone uses your credit card against your wishes to buy a $1000 toy, you would not be happy.

Mobi DRM locks content to devices via PIDs.
If you use a PID to change the locking mechanism inside a book that you bought and "own" (do you think you own it, or is it licensed?), then I think someone has asserted this violates the DMCA, and you seem to agree (almost). But who is unhappy? Do they have a "right" to be unhappy? Are they harmed?

You can see where this goes (and was going). The summary points are -

Is it against the law technically? If it is, but if the law "is an ass", do I have a "moral right" that allows me to violate it? Especially if there is no "victim", and/or if it makes me happier? But is there a victim? Does kindlefix make Amazon a victim? [ How about underfed babies of starving authors? - couldn't resist, or Harry T?, sorry]

There are about 6 or 7 questions in there. Flip a bit for each. I simply wanted to fix the first bit, which seemed to be the best starting point. That still leaves a pile of different possible positions. None alike, most argued from opinion.

I don't think we'll resolve this.

This is great fun over a cup of coffee in the morning, but it feels like it is time for me to move on to another thread. TTFN.

Just to clarify - my post was only concerning whether the PID belongs to the owner of the DRM. I maintain that it belongs to the owner of the hardware device, i.e. the Kindle owner. It had nothing to say about what you can legally do with that PID. I apologize if that was initially not clear.

[RickyMaveety]

Originally Posted by InlawBiker

Ricky I think you nailed it with many more words than I'd care to write... so I distill it down like so -

Did Amazon intend for us to use non-Amazon DRM books? No, obviously not. Do I care? Nope. It's my device. I have no agreement with them, nor am I obligated to use the device only to view Amazon's books.

Are authors or publishers hurt by this? No, I'm still acting under the terms set by my local library.

Is Amazon hurt? They'd have a hard time proving that they are.

Do they have any legal grounds to stop this practice? I don't know, I'm not a lawyer.

Will I still buy from Amazon? Yes.

If they try to stop me from reading *library books* I'll get rid of my Kindle and never buy anything from Amazon again.

Well, I am a lawyer, and no matter how I dissect the matter, I don't see how either of those python scripts does anything in violation of the DMCA.