December 27, 2024

Posts Comments

Archives for 2005

Sony Plans to Emulate Apple, in a Non-Apple-Like Way

March 31, 2005 by

Sony says it wants to create a system that does for movies what Apple’s iTunes does for music, according to a CNET story by Stefanie Olsen.

Unfortunately Sony doesn’t seem to understand what Apple did:

“We want to set business models, pricing models, distribution models like (Apple Computer CEO Steve) Jobs did for music, but for the film industry,” Michael Arrieta, senior vice president of Sony Pictures, said at the Digital Hollywood conference here.

What Apple actually did was to think about what customers wanted and then strive to provide it. Customers wanted one-click buying, ownership of songs rather than rental, tranferrability to different devices, and an attractive price. Apple couldn’t provide customers’ dream service, but they got pretty close. Apple realized that it didn’t have carte blanche to choose the business model, pricing model, and distribution model that Apple would like best. This is what is supposed to happen in competitive markets – market pressure forcing companies to give customers what they want.

Compare to Sony’s own digital music strategy, which looked like an attempt to construct Sony’s dream world. Customers didn’t want to live in that world, so they didn’t buy into Sony’s system. If Sony wants a different result this time, it’ll have to change its strategy.

Filed Under: Uncategorized Tagged With:

Welcome to Alex Halderman

March 28, 2005 by

I’m pleased to announce that Alex Halderman, a second-year graduate student who works with me, now has a byline here on Freedom to Tinker. Alex works on computer security and infotech policy, and has done interesting research on topics such as compact disc copy protection and privacy-enhancing technology. He plans to attend the Grokster oral arguments tomorrow; I hope he will be able to give us a firsthand account of the arguments and the early-morning linewaiting/campout experience. I have also invited him to post on other topics as he sees fit.

Filed Under: Uncategorized

A (True) Story for Grokster Eve

March 28, 2005 by

Recently I met a promising young computer scientist, whose name I will withhold for reasons that will soon be evident. He has developed a very interesting network software system that would be useful for a great many legitimate applications. I was impressed by his system and wondered why I hadn’t heard of it before.

The reason, it turns out, is that he isn’t sure he wants the public to find out about his research. He says this, even though his work would probably be of interest to many people, and could be useful to far more. The problem, he told me, is that if too many people find out what he has done and realize its value, some of them may start using it for illegal purposes. He doesn’t want that kind of trouble, so he is avoiding bringing his work to the attention of the broader public, publishing it in research venues where a small community of experts will see it, but avoiding any further disclosure.

It’s hard to blame him, given the unsettled state of secondary liability law. If some people start using his system illegally, will he be liable? Will he have to redesign his system to try (probably fruitlessly) to make illegal uses impossible? How many redesigns will be necessary? Will he have to face the same uncertainty that Bram Cohen, creator of BitTorrent, faces? He doesn’t want any of that

Filed Under: Uncategorized Tagged With:

Coming: Mobile Phone Viruses

March 23, 2005 by

Clive Thompson at Slate has a scary-sounding new piece about cellphone viruses. As phones get smart – as they start running general-purpose operating systems and having complex software interfaces – they will tend to develop the kinds of software bugs that viruses can exploit. And as phones become more capable, virus-infected phones will be able to do more harm.

What will the viruses do after they break in? Thompson predicts that they’ll make expensive calls to overseas pay-services, running up the victim’s phone bill and transferring money to the pay-service owners, who presumably will be in cahoots with the virus authors. That might happen, but I don’t think it’s the most likely scenario.

The best bet, I think, is that cellphone viruses will look like PC viruses. In the PC world, many viruses are written for kicks, with no specific intent to cause harm (though harm often results when the virus spreads out of control). I would expect to see such mostly-harmless viruses in the cellphone world; and indeed that is what we apparently see with the CommWarrior virus described in the article. Other PC viruses aim to spy on the user, or to install a bot on the computer so that it can be commandeered later to send spam or launch denial of service attacks. All of this is likely in the cellphone world.

Will cellphones be able to resist viruses more effectively than PCs do? Thompson suspects they will:

Phone executives like to say that it’s easy for them to contain worms because their networks are gated communities. Verizon and Sprint can install antivirus software on their servers to automatically delete infected multimedia messages before they reach their victims.

…

The mobile-phone industry could solve the viral problem by developing an open-source, Linux-style cellular operating system. But that’s about as likely as Motorola and Nokia announcing that all your cell phone calls are going to be free.

I’m not as hopeful. Phone execs like to think of their networks as gated communities; but in the smartphone world all of the action is on the smartphone devices, not in the networks themselves, and the providers have less control over smartphone software than they think. Their communities may be gated, but the gates will have well-known holes (that’s how viruses will get in), and there will be plenty of third-party application software coming in and out. A smart device is only useful if it is configurable, and configurability is the enemy of the sort of regimented configuration control that they are invoking. Third-party services and applications provide tremendous value to users, but as users switch to such services the network providers lose control over users’ data.

The open-source argument is pretty weak too. An open-source operating system may have fewer security flaws (and even that is subject to debate) but the claim that it will have no known flaws, or nearly none, isn’t credible.

The more useful smartphones get, the more they will adopt a software structure like that of PCs, with all of the benefits and problems that come with such a structure – including viruses.

Filed Under: Uncategorized Tagged With:

Apple Closes iTunes Store "Security Hole"

March 22, 2005 by

Last week, DVD-Jon and two colleagues released PyMusique, a tool for buying songs from Apple’s iTunes Music Store (iTMS) site. This got some people upset, because songs bought with PyMusique were not encumbered by any copy protection. Now Apple, predictably, has updated iTMS to make it incompatible with PyMusique.

The standard narrative about this goes as follows: (1) DVD-Jon and friends discover a security hole in iTMS. (2) The write PyMusique, which exploits the hole to get unprotected music. (3) Apple fixes the hole and iTMS is secure once again. The standard narrative misses the point entirely.

For starters, the security mechanisms of iTMS were, and are, well designed. A system that does what iTMS does will necessarily be unable to prevent unauthorized copying of music. That’s just a fact. Apple, to its credit, didn’t overinvest in fancy anti-copying technology that would be defeated anyway. Instead, Apple built a more modest and – here’s the key point – user-friendly system that gave users freedom to make legal use of music and provided speed bumps to steer consumer behavior, but didn’t pretend to stop determined infringers. There was no point in trying to stop determined infringers, because (a) there was nothing Apple could do to stop them from ripping iTMS content, and (b) all of the songs that might be ripped from iTMS were already available on the darknet anyway.

iTMS security is a bit like the lock on your screen door: it’s not very strong, but it doesn’t have to be, because the screen door around it is inherently vulnerable anyway. Putting an expensive lock on your screen door is a waste of money because it doesn’t make you any safer. Similarly with iTMS: spending more on copy protection would have been a waste, because it wouldn’t have reduced infringement.

Rather than owning up to its savvy engineering decision not to overinvest in fruitless copy protection, Apple apparently feels compelled to pretend publicly that iTMS is “secure” in the sense that heroic effort is required to illegally redistribute content bought from iTMS. That’s obviously untrue, but Apple is unwilling to admit that in public. (The famous reality distortion field plays a role here.)

So DVD-Jon and friends came along and released software that let people buy music that wasn’t wrapped in the usual weak iTMS copy-protection mechanisms. It was always possible to get such music, by buying it via the normal methods and then stripping off the copy-protection in one of several well-known ways. So PyMusique didn’t prove anything that we didn’t already know; but it didn’t really harm Apple or anybody else either.

Still, Apple apparently wanted to maintain the pretext of iTMS security, so it updated iTMS to make it incompatible with PyMusique. It’s still possible to make a new version of PyMusique that lets people buy music from iTMS and end up with that music in uncopyprotected form; but at least Apple can give the impression of policing its security perimeter.

We haven’t seen the end of this charade. Expect more iTMS “bugs” and more “fixes” from Apple.

UPDATE (7:50 PM): As predicted, DVD-Jon has reverse-engineered Apple’s fix and says he can now reenable PyMusique. That was quick!

Filed Under: Uncategorized Tagged With: