[SPM]

http://www.grc.com/sn/SN-074.htm
Steve Gibson: Right, well, it generated a lot of controversy because it became clear from the article published by Peter Gutmann, who’s in New Zealand, a New Zealand-based, very well known, good reputation security analyst. He took a look at the consequences of essentially putting this AACS, the Advanced Access Content System, which has been assembled by a number of hardware companies in order basically to appease the interests of Hollywood, in order to say, look, this is the way we’re going to protect the next generation of content.

As we saw last week – and the reason we spent last week’s episode was to create some historical context for both the legislative side and the technical side. And I talked last week about basically AACS is a phenomenally complex technology that involves state-of-the-art encryption. It involved some stuff you just can’t even get your mind around. I mean, I will never try on Security Now! explaining the subset difference tree system for allowing keys to be revoked by keeping those specific players from being able to perform the decryption. It’s mind-numbing, what they’ve done.

And so it’s one thing for that to be in an HD-DVD player. And in fact we’ve already seen, consumers have seen the consequence of that when they stuck a DVD into their first-generation players, it would take up to or in some cases more than a minute for the player and the disk to negotiate all of the crypto going on just internally within the player. And Leo, I was thinking about how you had commented that, when you stuck your HD-DVD on your Xbox 360, it didn’t take long.

Leo: Well, it’s got a faster processor.

Steve: Exactly. Well, talk faster, that’s a monster.

Leo: It’s got three 3GHz Power PCs...

Steve: Exactly. Exactly. So it’s a very different platform there than a typical consumer drive, where they’re trying to keep the cost as low as possible.

So anyway, I’m excited. We’re going to have Peter joining us here in a moment from New Zealand because we wanted to talk to him, get his side of this, talk about what the paper that he wrote is about. And I just wanted to sort of give a little bit of a preface and explain that basically Microsoft has decided that they want Vista to be able to deliver this kind of content. And what Peter’s paper is about is essentially the cost of delivering this content. And what it means is that so many aspects of our PCs, which have been fully documented, been public domain, been anyone could develop a display card, for example, that’s no longer the case. If you’re going to have any foot in this next-generation game, you have to sign up and apparently pay hefty license fees just to participate. And if you don’t get certificates, which are subject to spontaneous revocation, if you then subsequently misbehave, or in fact I read one of the AACS organization documents said that you could be revoked if you failed to pay your annual dues.

Leo: Your card would stop working in my PC.

Steve: Exactly. The hardware that the consumer purchased could be shut down.

Leo: Never buy a card from somebody who’s about to go bankrupt.

Steve: That’s a very good point.

Leo: I mean, the whole thing is nuts. This is just nuts. We’re going to talk to Peter in just a bit and get the details.

Looks like Vista's DRM may make it an OS customers would be wise to avoid. Disabling your hardware if the manufacturer falls out with Microsoft is a nice touch I thought. Vista is also looking more and more like a specialised multi-media home PC operating system rather than a general purpose OS like Windows XP - I can't see business users buying into the DRM crap unless they are forced into it by withdrawal of support for Windows XP.

[Dersaidin]

Agree.

Theres always Linux.

[Colourless]

*yawn*

Nothing to see here, move along.

Seriously, all this DRM crap with Vista only matters when you are playing AACS protected content... i.e. you are playing a HD-DVD or BluRay disk. Thats it, no other time will it have an effect. Does it stop you from playing unprotected content at full detail. Of course not!

It's not like playing AACS protected content on WindowsXP or all other operating systems, which is pretty much MacOSX only as you'll probably never see a legal HD-DVD/BluRay player for Linux, will avoid these problems. The players HAVE to comply with the rules as well or they get their license revoked.

Microsoft is just making it 'easier' for companies to write compliant players for Vista by handling a lot of the stuff in the OS itself.

[Skrying]

Agreed Colourless, there's a lot of Microsoft bashing over things that they really have no control over if you want to be able to play back HD DVD and Blu Ray.

[Bouncing Zabaglione Bros.]

There has been talk about how easy it would then be to simply treat all non-licensed content as not playable. Therefore everything is licensed by the cartels, and anything which doesn't have a licence would not be allowed. There would be a general "small producer" type licence where you would have to sign up (maybe paying a small fee) to get a licence for your home movies so that you can then play or distribute them.

It's a good way for the cartels to (say) stamp out bands that don't want to sign to a record label, because they would be treated as businesses, rather than private individuals, and would be hit with a bigger licence fee, thereby making them unable to actually make any money from their own songs - unless they've signed up with one of the music cartel members to do it for them.

Vista puts a lot of technology into place that isn't just for anti-piracy, but for content lockdown and to prevent smaller content producers from being able to cut out the cartels and to sell direct to the public.

[ANova]

DRM can be sugarcoated any number of ways, in the end it's only purpose is to make more money, and to do that it locks out anyone that doesn't buy for any and everything. Licenses are just an added income to it all. All this crap only protects content distributors, no one else; especially not consumers. The added unnecessary encryption, decryption, added processes, etc lead to more system resources being used for no reason, period...end of story.

[Bludd]

Those tilt bits are damn scary.

[SPM]

Originally Posted by Colourless

*yawn*

Nothing to see here, move along.

Seriously, all this DRM crap with Vista only matters when you are playing AACS protected content... i.e. you are playing a HD-DVD or BluRay disk. Thats it, no other time will it have an effect. Does it stop you from playing unprotected content at full detail. Of course not!

It's not like playing AACS protected content on WindowsXP or all other operating systems, which is pretty much MacOSX only as you'll probably never see a legal HD-DVD/BluRay player for Linux, will avoid these problems. The players HAVE to comply with the rules as well or they get their license revoked.

Microsoft is just making it 'easier' for companies to write compliant players for Vista by handling a lot of the stuff in the OS itself.

This isn't Microsoft bashing at all. What I find particularly horrifying about Vista is that you can buy an expensive graphics card that handles AACS content in good faith, and later the maufacturer goes bust, or decides not to manufacture Vista PC cards any more and the annual subscription is not paid, then the card you paid for will no longer work through no fault of your own. This is unlike anything we have seen before in the computer industry. I mean we have had Microsoft shutting down Windows XP and MS Office 2003 if you install new hardware on an OEM machine, but shutting down other companies hardware is something new.

Also you make it sound like it will only affect AACS content. Not true, it will affect everything on the sound card. Also if a manufacturer decides not to pay it's subscription for Vista DRM licensing, do you think it is going to spend time and money developing a non DRM Vista driver? Far simpler to develop a one full protected content driver which is what the user pays for when bying the card, and just let Microsoft shut everything down if they go bust or stop producing Vista DRM cards. Would it make financial sense to do otherwise?

Leo: If you spend money on S/PDIF, it won’t work because it has to be disabled because there is no protection on that.

PETER: There’s no protection whatsoever, yeah. And that’s the nasty thing with sort of audio fanatics or anybody who basically wants to produce high-quality audio from a PC or use some sort of digital interface and maybe even optical output, connected to some expensive amplifier or whatever. And because there’s no protection involved in the audio output, that has to be disabled.

Leo: Now, we should make that clear. It’s disabled only when you’re playing back protected content like an HD-DVD or a Blu-ray DVD. I mean, it’s not always disabled.

PETER: It’s not always disabled, no. On the other hand, it’s problematic because, if you look at the Windows specs, sorry, the Microsoft specs for the content protection, let’s say you’re playing – you’re making a Skype phone call and in the background you’re playing some protected-content music of some kind. Because that all goes through the same sound output system, that kind of infects everything. So the protected content infects every other content that happens to be going through the system at the time.

Leo: We in fact wouldn’t be doing this interview now because I use optical outputs. So they’d be shut down.

PETER: Well, they’re not exclusively shut down. Again, reading the specs, I think probably what most manufacturers would do is just shut it down. But what the specs say is that, depending on how much protected content is present, you partially shut it down. So, for example, if you’re playing protected content, and it’s very quiet, then some of it will be shut down; and as the volume increases, more of it gets shut down.

Leo: There’s also this issue – and this is to prevent the analog hole, I gather – of disabling or really reducing quality of other outputs so that, if you don’t have HDCP, you can watch it, but it’s really only 480i.

PETER: Right. So Microsoft say that any display device that has a resolution of more than 520K pixels, which in practice is a resolution of about 800x600, has to have its output degraded. Now, if you look at the Vista specs, in order to run Aero you need a resolution of 1024x768. So basically it means that anything connected to a Vista machine running the Aero interface will have its output degraded.

Another worrying aspect is that the specification for the DRM seems to be written in a way as to give Microsoft a mandate to abuse it's desktop monopoly and extend it to other fields like consoles and standalone content players.

And these issues affect not only users of Vista, but the entire PC industry, since the effects of the protection measures extend to cover all hardware and software that will ever come into contact with Vista, even if it’s not used directly with Vista, for example hardware on a Macintosh or on a Linux server. Then the executive-executive summary: The Vista content specification could very well constitute the longest suicide note in history. You read all of that stuff, Peter?

This may prevent hardware that is used in Vista PCs from being used in consoles or standalone players (except of course Microsoft consoles with Vista built in). This is bound to make both Vista PCs, consoles capable of handling HD content and players more expensive if Vista catches on.

The vague way in which the contract is worded - in other words if you don't prove your credentials and follow the Microsoft party line is also worrying especially given Microsoft 's monopoly position and it's past convictions and current prosecution for exactly this type of anti-competitive practices. The license could easily be leveraged to effectively allow Microsoft to block development of drivers and new HD capable hardware for all competing operating systems and competing consoles.

PETER: I think it’s a bit of both. I mean, Hollywood has this huge wish list of stuff that they’ve been pushing for years and years. And, you know, people have analyzed the technical side of things and see that what they’re trying to do is impossible, you know, in terms of closing the analog hole and making content uncopyable. There’s a wonderful quote from Bruce Schneier saying that trying to make content uncopyable is like trying to make water not wet.

Leo: I love that.

PETER: And there’s a whole lot of legal CYA in there in the specifications where they say device manufacturers must demonstrate their commitment to the party line. Rather than saying you must do this, this, and this, they say you must demonstrate that you’re strongly committed towards content protection. And I think probably what Microsoft is doing is the same thing. They want to demonstrate to Hollywood that they’re really, really committed towards content protection.

Leo: That’s a lousy specification, not telling you what to do, but just saying prove it.

PETER: Right. But...

Leo: Prove you care.

PETER: Yeah. But the problem is a lot of this, I think, is driven by legal worries. And so if they say you must do this, and then it gets broken, they’re in trouble.

[ronin-2]

I have a hard time believing anything in that "report" I saw it a week or two ago doing the rounds on anti-Microsoft sites, no major or credible site has picked up on it because I assume they don't want to give that report any more attention than it's worth.

The fact that Steve Gibson who is a joke in the security community picked up on it is no surprise crackpots love this kind of stuff.

FYI I've being using the final build of Vista & here is my experience;
Ripping/DRM removal programs work just fine - Vista does not attempt to shut down such programs.
Vista treats DRM video/audio the same way XP does it doesn't go roving the system trying to apply DRM.
DRM free videos work in the exact same way under XP as they do in Vista you can do anything to them.

The key revocation of AACS only applies to software HD-DVD & Blu-ray players like Cyberlink or Intervideo not the OS or the hardware, the idea that they would disable hardware in the system is ludicrous. When a player is compromised the only thing that will happen is that it wont play newer generation discs with updated keys until the player itself has been updated.

That report is bullsh*t in my eyes and full of hot air.

[Albuquerque]

The problem is, it's still anti-microsoft rhetoric. Anything and everything they're slinging at Vista will be equally true on any other operating system that is capable of playing AACS-protected content.

If the AACS license says that you must shutdown that hardware, then it isn't Vista -- it's AACS. Which means your MacOS 11 (or whatever), Solaris 13, and whatever else you have that somehow plays AACS content will be responsible for taking the same actions.

Once again, this is just a bunch of anti-Microsoft mudslinging that has zero to actually do with Microsoft --- be it Vista or otherwise.

[digitalwanderer]

I disagree with most of you. DRM is a great baby-eating evil that will spread its foul black cloud until it engulfs all it can, RESIST IT!!!

[Skrying]

Originally Posted by digitalwanderer

I disagree with most of you. DRM is a great baby-eating evil that will spread its foul black cloud until it engulfs all it can, RESIST IT!!!

I would say most of us hate DRM, but this is not really Microsoft's fault and blaming them makes no sense. Its either MS complies or they do not get to add what everyone wants to Windows, its really that simple and they have no choice.

[Bouncing Zabaglione Bros.]

The media cartels basically insisted on DRM or else they would not licence or provide their content. Now everyone has to join in because they don't want their product to be the one that breaks the chain and fails to support the required DRM standards.

Personally, I think it's horrible and there will be a backlash as the content lockdown bites, and people can't play the content they have bought where they want. It's already that way for the music industry and DRM laden tracks that you can't move from one device to another (and getting worse) and we're going to see the same for video too.

As soon as the cartels figure out how to push a pay to play model, they will, and then you'll see people abandon music and movies as hobbies altogether.

[ERP]

Originally Posted by digitalwanderer

I disagree with most of you. DRM is a great baby-eating evil that will spread its foul black cloud until it engulfs all it can, RESIST IT!!!

While agree to a point...

In Vista's case it's DRM or no BLU-Ray/HD-DVD, Honestly I hope the excessive DRM kills both formats.
Vote with your wallet don't buy DRM'd media, it's the only thing that will be heard.
I won't buy music from the I-Tunes site because I can't easilly listen to it elsewhere and Apple has some of the less draconian DRM around.

Oddly I have no real problen with the DRM on my cable box or even on 360 content because I simply don't have an expectation to be able to watch elsewhere.

[pascal]

Originally Posted by digitalwanderer

I disagree with most of you. DRM is a great baby-eating evil that will spread its foul black cloud until it engulfs all it can, RESIST IT!!!

I tend to agree with you.
This technology will probably not stop piracy and will only make the PC/appliance owners life like hell.

We will pay for a technology (DRM) that is a big mistake and we dont get something much more important for us like Robust Engineering in our properties. Where are the scratch proof media? The robust and reliable electronics? The 100.000 MTTF appliance? The lightwheight and robust software? etc...

[digitalwanderer]

DRM is the devil, the very devil satan his ownself.

[SPM]

Originally Posted by Albuquerque

The problem is, it's still anti-microsoft rhetoric. Anything and everything they're slinging at Vista will be equally true on any other operating system that is capable of playing AACS-protected content.

If the AACS license says that you must shutdown that hardware, then it isn't Vista -- it's AACS. Which means your MacOS 11 (or whatever), Solaris 13, and whatever else you have that somehow plays AACS content will be responsible for taking the same actions.

Once again, this is just a bunch of anti-Microsoft mudslinging that has zero to actually do with Microsoft --- be it Vista or otherwise.

The problem is that AACS is that it doesn't belong on a computer - the right place for AACS and other content protection is on dedicated media players - if it is at all feasible to create copy protection that works, it is on a closed box like a media player.

Forcing people who don't want DRMed content to pay for hardware they don't want, software they don't want, and increased risk of software breaking and loss of personal data all of which they don't want is unacceptable. On top of that, they can and intend to turn off the end user's paid for hardware (by disabling the drivers) when the manufacturer or OS vendor or RIAA/MPAA cocks-up DRM security. Given what happened to CSS on DVDs, Sony's root kit and reports that AACS has already been cracked, this is going to be a common occurance.

The power of the movie and music holds over politicians and legislators is ridiculous. Why is it that in the US, the RIAA and MPAA which only accounts for a tiny fraction of the US GDP, can trump every person's legal rights and every other industry? It is amazing what the RIAA and MPAA have managed to pull in the past - they were allowed to actually levy taxes on blank cassette tapes from everyone buying cassette tapes including those with no intention of using it to record copyrighted music. In that case though at least the majority though not all of those who bought blank cassettes recorded some kind of music on them (although fair use allowed backing up on cassette). In the case of computers, although only a minoirity use them for copyrighted music and movies, RIAA/MPAA is trying to impose a tax and mandate DRM with negative consequenses on stability, complexity and data recovery, on the majority who won't want their damned music or movies anywhere near their computers. What other industry gets this kind of special treatment? It is like the government changing the law to allow banks to impose a tax on all road vehicles to cover bank losses and requiring owners to fit tranceivers supplied by the banks to all vehicles at the owner's expense, on the grounds that road vehicles are sometimes used in bank robberies.

Business users don't want users downloading and playing music and porn at work or sneaking in and playing movies at work but content protection will forced on them. End users don't want denial of their fair use legal rights. Industry other than the movie/music media companies don't want it because it increases their computing costs. So who are these US politicians/legislators who are shafting the majority of the population actually representing? I am starting to suspect that "USA" in the USA government in actually stands for "United Studios of America (TM)" - (a wholly owned subsidiary of the RIAA/MPAA cartel).

[Mariner]

Incidentally, AACS must have been compromised to a certain extent even this early in the day as several HD-DVDs have already been cracked. A number of 1080p EVO files are available on torrents for those willing to download 25GB of data!

Took even less time than I expected although it sounds as though this may be a temporary 'crack' which the production companies can overcome with software changes. The rumour is that (once again) all the necessary encryption data is not particularly well hidden within some PC software for running HD-DVD disks.

[Albuquerque]

Originally Posted by SPM

The problem is that AACS is that it doesn't belong on a computer - the right place for AACS and other content protection is on dedicated media players - if it is at all feasible to create copy protection that works, it is on a closed box like a media player.

Forcing people who don't want DRMed content to pay for hardware they don't want, software they don't want, and increased risk of software breaking and loss of personal data all of which they don't want is unacceptable.

Whoa whoa whoa...

Stop.

Breathe.

Listen.

You don't want DRM content? That's fine. Tell me, who's forcing you to buy new software? Who's forcing you to buy new hardware? Who is forcing you to buy all new media / content that is DRM-enabled?

Nobody.

You are not required to buy Vista. You are not required to buy a Bluray or HD-DVD drive. You are not required to buy new anything because nobody is forcing you. And if you do buy Vista but don't ever play DRM-protected media? Then you'll never EVER have a problem with draconian DRM causing your hardware to not play back a file.

The hardware isn't going to self destruct, or remove itself from your computer, or even stop functioning. The fear-mongering posted above is just that -- fear mongering -- and none of your hardware will magically stop in it's tracks when AACS decides that hardware must die. The worst that might happen is your hardware would stop playing back AACS-protected content. And if you aren't playing AACS-protected content? Then absolutely NOTHING will change for you.

Idiots on this forum (and obviously in real life) continue to somehow buy all this fear mongering as 100% gospel truth -- it's far from. Quit trying to defend the fear mongering, and instead do a bit of research on your own.

I'm not here to somehow gloss over the evils of DRM, it's evil and will ultimately be the demise of RIAA and MPAA. But that's a different thread. In this thread, we're talking about Vista and DRM -- and the two really aren't linked in the way that people are suggesting.

[pascal]

Originally Posted by Albuquerque

Whoa whoa whoa...

Stop.

Breathe.

Listen.

You don't want DRM content? That's fine. Tell me, who's forcing you to buy new software? Who's forcing you to buy new hardware? Who is forcing you to buy all new media / content that is DRM-enabled?

Nobody.

Whoa whoa whoa...
There will be a day where ALL hardware/software will be forced to have DRM.
So, YES the economic powers are forcing the unorganized consumers into the DRM paradise.
This is just the beginning. The next Vista will be better.

We have an expression in portuguese: "dont worry baby, it will be only the head..."

[Tim Murray]

But DRM will always be cracked. So....

[digitalwanderer]

It's still the debil, the very debil itself!

The crackers are just the warriors of light fighting back the dark tide of ebil...

[demonic]

Originally Posted by Dersaidin

Agree.

Theres always Linux.

Actually, thats not true. Linux isnt yet, primetime for the desktop. When it is, I will agree with you 100% there.

[SPM]

Originally Posted by Albuquerque

Whoa whoa whoa...

Stop.

Breathe.

Listen.

You don't want DRM content? That's fine. Tell me, who's forcing you to buy new software? Who's forcing you to buy new hardware? Who is forcing you to buy all new media / content that is DRM-enabled?

1) The RIAA/MPAA has been trying to force through a law that would mandate that all computing devices in the US have DRM built in whether or not the computers will every be used for playing music.
2) The RIAA/MPAA has already pushed through DMCA laws in the US, and they are trying to use WIPO to impose it on the rest of the world. Rather than make the act of piracy itself illegal, DMCA makes it illegal to discuss or publicise the encryption and protection techniques scheme - even from a security or a legitimate data recovery point of view, without the risk of being sued. This contravenes basic freedom of information rights.
3) As we have already seen the government has already seen fit to grant the music industry tax collector status on blank audio cassettes on the basis that all it's citizens are criminals.

You are not required to buy Vista.

I will be required to buy Vista or give up computers when Microsoft decides to drop support for Windows XP around 2010, unless Linux takes over the desktop, all because RIAA/MPAA in collusion with Microsoft says so.

You are not required to buy a Bluray or HD-DVD drive.

So you are saying I should give up using Bluray or HD-DVD drives on computers if I don't want to play protected music or movies and don't want DRM with it. This is precisely what I was complaining about. As for non-DRMed Bluray or HD-DVD drives, and non-DRMed computers, just wait and see, RIAA/MPAA will be lobbying to have them banned when they find that their weak protection schemes can be cracked using non-DRMed drives on non-DRMed computers.

You are not required to buy new anything because nobody is forcing you. And if you do buy Vista but don't ever play DRM-protected media? Then you'll never EVER have a problem with draconian DRM causing your hardware to not play back a file.

You are saying that if I don't want DRM, I don't have to buy a computer, which is precisely the choice I am objecting to.
Since Microsoft has a desktop monopoly, and Microsoft will be forcing everyone to shift to Vista by dropping support for Windows XP in the future, I don't have any other choice.

I have no problem RIAA/MPAA protecting content, but they have no business distorting the entire computer industry and the majority of users around a minority issue. A better way of providing protected media content is to keep DRM within a closed box and off the computer - for example a Bluray or HD-DVD player, which can be controlled by a computer, but will only send unprotected content to the computer itself. Users seem to prefer ipod style embedded media devices anyway. The computer's video output would go through the Bluray or HD-DVD player and then to the HDTV display. Protected content would go direct from the Bluray player to the HDTV. This has a better chance of not being hacked, and if it is, your computer is stable, won't get shut down, and you computer data will be recoverable. Software based DRM doesn't work, unless there is no access to the system, and if anyone disputes this, there are hundreds of thousands of Windows viruses and exploits that say otherwise - Vista DRM will be hacked even if Vista tries to completely deny user access to the system.

[karlotta]

what i am saying is dont buy movies or music from the Industries at all. Ya have a life, fuck CD music or lame ass movies with stupid actors ect... Even if they took all the DRM off you would still buy it right?
You would still be puting money in the "mans" pocket... get the fuk over it already. My god you whine on and on. What the hell can you do? NOT buy it or buy it. Even if it didnt have the evil DRM you would NOT buy or buy it. I say shut the fuk up and dont buy it.