DRM is a bit of a red herring. [LWN.net]

DRM is a bit of a red herring.

Posted Feb 11, 2007 12:46 UTC (Sun) by drag (subscriber, #31333)
In reply to: Recommendation: no GPLv3 for Solaris by mmarq
Parent article: Recommendation: no GPLv3 for Solaris

Alright take Tivo, since that is the most famous example.

Right now Tivo has hardware built into every machine they build that detects weither or not the code it's running is the same as they ship from the factory. If the software the machine is trying to run isn't the same as what it ships with or what is updated from Tivo itself then it won't run.

So the reason they do this is for several reasons... To ensure a user experiance, to enforce digital copyright restrictions, to make sure people can't circumvent their channel data subscriptions, etc etc. They do this by prorgamming the software to enforce these restrictions, then making sure that the software can't be changed.

This is against the spirit of the license that RMS and GNU and the FSF folks want. They want you to be able to study, modify, redistribute the software you get, and then redistributed the modified software you made.

Tivo CAN use GPLv3 software if they wanted, too. They would just have to design the DRM slightly differently.

So say they use Linux with GPLv3 userland. They supply keys to allowed modified software to be ran and that won't interfer with any functionality (provided you don't add bugs.)

Right now Tivo uses hardware to capture TV signal, encode that signal into mpeg4, then use more hardware to decode that stream as it gets sent to the TV show. This allows it to use a weak CPU and maximize harddrive capacity.

Well what they could do then is just add a extra step were as the data is being encoded into mpeg4, that it's also encrypted. The files are then saved to the disk and managed by Linux-based userland. Then that same key is used in the decryption.

Then they can also put it into the hardware firmware that it requires a encrypted packet from Tivo to be sent to it by the Linux-userland. If it doesn't get it then it will assume that you've stopped your monthly subscription and would shut off access to their subscription services.

So this way Tivo can use strong DRM to manage their systems and still be completely in compliance with the GPLv3 since it's no longer depends on keeping the userland umodifable.

So GPLv3 can work with DRM if you want it to. You just have to devise a system which allows people to modify the software.

Beleive it or not TiVo DRM and GPLv3 CAN be compatable. Just not in it's current state.

Sure this is inconvient and would be a added expense for Tivo. So it's still bad from Tivo's point of view, but it's not something that is nessicarially going to cause Tivo to avoid GPLv3-licensed software.

So the question isn't weither or not GPLv3 is worth it for you to make what Tivo does illegal, it's weither or not GPLv3 is worth making things much more inconvient for Tivo.
(and the many numerious other companies that are doing this sort of thing. Tivo isn't alone in this)

And who knows. If Tivo opens up the software more it may lead to more possiblities... like downloadable Java-based arcade games for your Tivo and stuff like that. When life hands you lemons, you make lemonade.

(Log in to post comments)

DRM is a bit of a red herring.

Posted Feb 11, 2007 20:49 UTC (Sun) by mmarq (guest, #2332) [Link]

"" So the reason they do this is for several reasons... To ensure a user experiance, to enforce digital copyright restrictions, to make sure people can't circumvent their channel data subscriptions, etc etc. They do this by prorgamming the software ""

And firmware and possibly "hardware craved" in the future too..

"" So say they use Linux with GPLv3 userland. They supply keys to allowed modified software to be ran and that won't interfer with any functionality (provided you don't add bugs.) ""

See... they are somehow incompatible. Im a proponent of a modified GPL with no legal holes too, say GPLv3. But GPL is a contract between distributors, lets say as example TIVO, and the a community of sotware developers and other distributors.

No such license can deny TIVO the possibility of freely contract with their own costumers, if they dont break other licences. I dont belive that would be legal either in most of countrys. Lets say TIVO adopts GPLv3:

And they say:- ok here are the keys, you can do as you please, i accept the GPLv3 contract. But... if you remove or change our code, all guaranties are void. Not only that but we have signed our binarys also. The data channel will be looking upon those signatures and if it dosent find them no connection will be allowed.

You say:- hey, i want to be able to use those functionalitys, that is why i bought a TIVO, and i want to be able to run my modifications with them.

Tivo say :- No... we abide by the GPLv3, and here are the keys. But the guaranties and channel are for "private" contract between us and our costumers (the guarantied entity).

I have a great admiration for the work of FSF and RMS. But the illusory part with the big free software push, is that software dont have any guaranties, but hardware and private services, do. And they must be by their intrinsic nature of the "private" kind.

*BUT THIS DONT HAVE TO BE A WAR*

FSF can say :- TIVO, you cant abuse the work of a community for private gain, you must allow us to modify and re-distribute the code you are using.

TIVO say :- OK, here is the full source code and keys to DRM. But you cant force us to trust everybody from Geenland to Antartica, which might happen to be running those modifications, with a guaranty or acess to our services. Run those boxes as second hand whiteboxes without our channel, and or find a service with free acess, but stop bothering us.

The same will happen with those big juicy server vendors.

"" So GPLv3 can work with DRM if you want it to. You just have to devise a system which allows people to modify the software. ""

Oh yes it can... like a bleeding swimmer with a white shark. See, if every kind of box end up beying using DRM in the future, GPLv3 will be pledging and in need of those keys. DRM by the actual IT scenario wont be needing GPL. If the DRM master decide that no key will be given, GPL will die of starvation.

What FSF and GPL can do to avoid abuse, by contract, is saying that if someone dont give the keys or allow the DRM to be turn off, in order to run modifications of the code, the licence is void, and no GPL software can be used.

** THE ONLY SOLUTION TO DRM, WHICH IS NOT EXACTLY OF THE TECHNICAL NATURE, IS TO CO-OPT THE GENERAL HARDWARE INDUSTRY, INTO THE GPL CAMP, CATIVATING THEM BY ALLOWING SOME TINY BINARY MODULES OF THEIR MOST FEARED SECRETS TO RUN WITH GPL KERNELS. GPL KERNELS DONT HAVE TO BE TAINTED IF THOSE ARE WRAPPED AND OR PUSHED TO HYPERVISOR LAND... ALLOWING LINUXBIOS AS AN OPTION **

Ok, i can almost hear the indignation screems from here... and i can say that im not a technical expert.

But the strategy is to give one step back, that will allow to give two steps foward. When the general hardware industry will taste it, they will free, freely, much much more.

One solution might be AGESA:
http://www.linuxbios.org/data/LinuxBIOS%20AMD%202006%20Fi...

DRM is a bit of a red herring.

Posted Feb 12, 2007 0:11 UTC (Mon) by drag (subscriber, #31333) [Link]

"""And they say:- ok here are the keys, you can do as you please, i accept the GPLv3 contract. But... if you remove or change our code, all guaranties are void. Not only that but we have signed our binarys also. The data channel will be looking upon those signatures and if it dosent find them no connection will be allowed."""

Well according to the GPLv3 draft the second part would be invalid. Running cannot automaticly result in a decline of the functionality of the system.

In other words it's against the license to disable functionality if it detects modified code. In the GPlv3 draft they gave two examples, one example was online services.

However it's perfectly valid, according to the license, that mofidying the code would void warrentees and garrentees. It's not reasonable at all to blame broken software you made on the hardware vendor you got the machine from.

They are trying to make a distinction between practical functionality software-as-a-tool and stuff like warrentees and such.

DRM is a bit of a red herring.

Posted Feb 12, 2007 1:43 UTC (Mon) by sepreece (subscriber, #19270) [Link]

This is in highly speculative territory.

I personally doubt that a court would find that the distribution license could limit the distributor's right to make contracts with its customers, including contracts that bound the customers to NOT do things the license would allow them to do. But IANAL.

Beyond that, even under a broad reading of the license terms, the service presumably IS allowed to authenticate the proprietary software that it works with (in the TiVo-like case, the software that runs on top of Linux). The system may be designed so that software can work with the hardware without relying on (or trusting) the GPLed software. Then the system can allow the GPL software to be replaced without actually opening up the system's interesting functionality.

Also, the license only requires providing keys; there is no basis for figuring out what happens if the means of authenticating the software isn't "a key". If the service or proprietary software calculates a checksum, for instance, that is not a key.

And, of course, virtualization may be the ultimate way to allow using the GPL software for untrusted functions and using only authenticated software for things the system needs to trust (like interaction with remote services).

DRM is a bit of a red herring.

Posted Feb 12, 2007 16:04 UTC (Mon) by Arker (guest, #14205) [Link]

You may doubt it, but you're wrong.

Under copyright law, they have no right whatsoever to use the code. If they don't like the terms it's offered under, their remedy is not to use it. Simple as that.

DRM is a bit of a red herring.

Posted Feb 12, 2007 17:19 UTC (Mon) by sepreece (subscriber, #19270) [Link]

You're oversimplifying.

The distribution of the software is controlled by the software license. Selling you a box with the software in it is subject to the terms of the license. I'm assuming you can buy the device without buying the service.

Buying service (whether for a TiVo, cable box, or cell phone) is a separate arrangement. Assuming you buy the device, and get to keep it regardless of whether you get the service, there's no interaction with the license terms. The contract terms for the service could require using a specific version of the software and that requirement would have nothing to do with the distribution licensing.

A possible refinement of this would be to have the device provider provide only core, GPL software. The service provider could then provide the proprietary client software that enables use of the service. That software could then tie to a specific version of the GPL software. For instance, a DVR vendor could ship boxes with DVR functionality based on Linux and MythTV, and TiVo could ship their proprietary software to run on top of the Linux, replacing the software that shipped with the device.

DRM is a bit of a red herring.

Posted Feb 12, 2007 17:47 UTC (Mon) by drag (subscriber, #31333) [Link]

Ya.. that could be possible. As long as that propriatory bit of code being sent by Tivo isn't violating the GPL (which I assume is not violating it) when they sent it.

The GPL has absolutely no restrictions on the sort of stuff people do to it themselves, it never has and hopefully never will. If end users want to add propriatory code to impliment some sort of DRM then that would be valid and without conflict with GPLv3.

(although that sort of drm would be almost certainly be trivially easy to crack)

DRM is a bit of a red herring.

Posted Feb 12, 2007 2:57 UTC (Mon) by mmarq (guest, #2332) [Link]

"" In other words it's against the license to disable functionality if it detects modified code. In the GPlv3 draft they gave two examples, one example was online services. ""

Confess i havent read those. But it dosent. At least from the client side, from that TIVO box it never will. If you have only somehow unrestricted acess to Online Services, you will never have acess problems from your modified TIVO box.

GPL v3 can say that no license will hold, if the covered code is used to restrict functionality upon modification.

But nevertheless i cant see how the GPL can impose legally on Online Services Providers an authentication method. If those acesses require a token in the form of a DRM checksum, simply by modifying the code it will generate a different checksum... TIVO will say that is not their fault... i dont know but it seems complicated...

Specialy because that DRM token restricting funcionality, will not be most probably generated from any v3 covered code, but from the BIOS level. Watch next bios capable of playing online games while you load an online OS ftp://download.intel.com/technology/efi/docs/pdfs/IDF04li...

DRM is not about security, is about control, and protected by the DMCA. If that security BS message is passed sooner or later there will be huge FUD campaingns stating that because all the source code must be available, GPLv2 or V3 makes systems easely crackables, in fouling an Online Service, by any expert "kid".

In the general matter i'm on the side of FSF and RMS, but i belive the rug has been pulled out off their feet on this, and i cant see clearly how they gonna prevent this legally by means of a licence !...

That is why i sugest the provision of making those DRM features turn off upon user whish, that is, mandatory as an optional feature because v3 holds also for every "online" binary covered... but would that be DMCA legal ?... and inclusion of LinuxBIOS as an integral part of a Linux System... would vendors buy it ?

DRM is a bit of a red herring.

Posted Feb 12, 2007 17:37 UTC (Mon) by drag (subscriber, #31333) [Link]

"""GPL v3 can say that no license will hold, if the covered code is used to restrict functionality upon modification.

I don't understand everything your aiming at.

But if you want to use GPLv3 in a machine you want to sell to people that you want to impliment DRM then bypassing the userland and going straight to firmware is a perfectly valid way to do it and it wouldn't conflict with the GPLv3. Also running non-GPlv3 code along side GPlv3 code in order to impliment DRM is valid also.

The goal of the GPlv3 here isn't to eliminate DRM or make GPlv3 software incompatable with DRM, it's just to make sure that people don't use DRM to circumvent the GPL license and limit 'four freedoms' that are suppose to be garrenteed for Free software.

As long as a paticular form of DRM does not require that software be unmodifiable to work then there isn't any problem with it being used with GPLv3 as far as the license goes.

DRM is a bit of a red herring.

Posted Feb 12, 2007 23:50 UTC (Mon) by mmarq (guest, #2332) [Link]

"" I don't understand everything your aiming at. ""

.-Means tivoization will continue

.-It will be possible to disable functionality, if modified code is detected, most notorious on Online services, because those most logicly, not implementing the specific restrictions by using GPLv3 code, are not bond to the distribution licence terms... IANAL, but it seems logic to me.

But though, im getting confused myself. 3 pertinent questions arise on these tivoization and functionality clause:

Why isnt installing or replacing a binary program, or a binary derivative (plugin, library...) also be considered a modification upon the original program, which must be allowed to run ?

Just following the precedent question here providing key for "in sito" compilation and signature is completely wortless, as is i belive, transfer that key and source code to a 3th capable part without transfering the machine which that key is exclusively attributed ?

DRM is a bit of a red herring.

Posted Feb 11, 2007 22:28 UTC (Sun) by b3timmons (guest, #40286) [Link]

2. people are already writing various tweaks and tools to run on the tivo. this 'evil company that's useing DRM' isn't preventing it. I have over a TB of shows that I've copied off of my tivo

Of course, this is all illegal under the DMCA and no consolation if you want to be lawful, even with such repulsive, stupid laws. This only strengthens the case for GPLv3.

DRM is a bit of a red herring.

Posted Feb 12, 2007 0:30 UTC (Mon) by drag (subscriber, #31333) [Link]

I agree with that statement.

No form of 'DRM' is practical at all, when your goal is to control what people do with their own hardware and software. (you encrypt the data to 'protect it', but you have to give them the keys, hardware, and software nessicary to decrypt it, but depend on secrets to control their usage of it.)

The only way it works is through legal enforcement. With out DMCA then it would be profitable for businesses crack DRM and sell software and devices to do that.. the more stronger the DRM the more profitable cracking it would be. It would be so weak that invensting large amounts of money into it would garrentee business failure.

In the long run cracks and such will almost certainly always be aviable. Once those cracks are codified into redistributable software then it's trivial for people to use them..

but by breaking the law it's pretty much useless to people that want legetimant uses of their hardware and software that they do own themselves.

DRM is a bit of a red herring.

Posted Feb 12, 2007 1:45 UTC (Mon) by sepreece (subscriber, #19270) [Link]

"Of course, this is all illegal under the DMCA and no consolation if you want to be lawful, even with such repulsive, stupid laws. This only strengthens the case for GPLv3."

Note, though, that the GPL cannot make legal what the DMCA makes illegal...

DRM is a bit of a red herring.

Posted Feb 12, 2007 16:09 UTC (Mon) by Arker (guest, #14205) [Link]

In this case, it can, actually. Just as v2 hacked copyright law for freedom, v3 is hacking the DMCA for freedom. The moment a vendor like Tivo, assuming they use GPL v3 code, attempts to assert a DMCA claim, they are in violation of their license and lose their permission to use that software.

DRM is a bit of a red herring.

Posted Feb 12, 2007 17:23 UTC (Mon) by sepreece (subscriber, #19270) [Link]

If TiVo made such a claim, they might be in violation of their license. If the MPAA made such a claim, the user would still potentially face criminal prosecution.

Also, of course, the clause only applies to "the covered work". They're still free to prosecute if you try to hack any associated proprietary software or services.