Security quote of the week

[Posted December 13, 2023 by jake]

But it's worse than that. When a tech company designs a device for remote, irreversible, nonconsensual downgrades, they invite both external and internal parties to demand those downgrades. Like Pavel Chekov says, a phaser on the bridge in Act I is going to go off by Act III. Selling a product that can be remotely, irreversibly, nonconsensually downgraded inevitably results in the worst person at the product-planning meeting proposing to do so. The fact that there are no penalties for doing so makes it impossible for the better people in that meeting to win the ensuing argument, leading to the moral injury of seeing a product you care about reduced to a pile of shit: https://pluralistic.net/2023/11/25/moral-injury/#enshittification
But even if everyone at that table is a swell egg who wouldn't dream of enshittifying the product, the existence of a remote, irreversible, nonconsensual downgrade feature makes the product vulnerable to external actors who will demand that it be used. Back in 2022, Adobe informed its customers that it had lost its deal to include Pantone colors in Photoshop, Illustrator and other "software as a service" packages. As a result, users would now have to start paying a monthly fee to see their own, completed images. Fail to pay the fee and all the Pantone-coded pixels in your artwork would just show up as black: https://pluralistic.net/2022/10/28/fade-to-black/#trust-the-process

— Cory Doctorow

Security quote of the week

Posted Dec 14, 2023 7:22 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (5 responses)

> As a result, users would now have to start paying a monthly fee to see their own, completed images. Fail to pay the fee and all the Pantone-coded pixels in your artwork would just show up as black

The models can be opened if the user has Pantone Connect subscription. It's a pity that it's no longer bundled with Adobe.

And wait until he hears that you need to regularly buy updated _physical_ Pantone books because the colors slowly fade.

Security quote of the week

Posted Dec 14, 2023 12:00 UTC (Thu) by bovinespirit (subscriber, #88348) [Link]

Our user has some very long, tedious meetings ahead of them when they try to explain all this to the bean counters. In summary: Colour (like security) is way more difficult and expensive than you thought.

Security quote of the week

Posted Dec 14, 2023 21:55 UTC (Thu) by Karellen (subscriber, #67644) [Link] (3 responses)

> As a result, users would now have to start paying a monthly fee to see their own, completed images. Fail to pay the fee and all the Pantone-coded pixels in your artwork would just show up as black

The models can be opened if the user has Pantone Connect subscription.

(emphasis mine)

Yes. Isn't that the point that Doctorow was making? That you need an ongoing subscription to keep being able to open your own images? Or, rather, another ongoing subscription, as this is only an issue with the Adobe products in their software-as-a-service model, and never happened (could never have happened) when you actually bought a copy of the software to run locally.

Security quote of the week

Posted Dec 14, 2023 22:15 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

Except that Pantone invented the subscription model long before SaaS and most software. Users pay for the ability to get the _exact_ same colors, and that requires a periodic cost to replace the physical folios with swatches.

You can trivially convert Photoshop models to use regular CMYK colors, and you'll have them forever.

Security quote of the week

Posted Dec 14, 2023 23:03 UTC (Thu) by Karellen (subscriber, #67644) [Link] (1 responses)

Except that Pantone invented the subscription model long before SaaS and most software.

Sorry, is it the case then that either:

a) Old standalone versions of Photoshop never had access to Pantone colors? or

b) Old standalone versions of Photoshop had internet-enabled, subscription-only access to Pantone colors, which could be revoked while the rest of your Photoshop editor kept working?

(Apologies. I have never owned, or even used, any version of Photoshop. My intuition for how I think software "ought to" work is often wildly wrong-footed by the dark patterns and anti-features that make their ways into proprietary software.)

Security quote of the week

Posted Dec 15, 2023 11:07 UTC (Fri) by farnz (subscriber, #17727) [Link]

It's complicated:

Really old standalone versions of Photoshop never had access to Pantone colours.
Other standalone versions of Photoshop had access via a paid-for plugin, where you were contractually obliged to keep renewing it, or stop using Pantone.
More recent standalone versions of Photoshop came with the Pantone colours integrated, but still with contractual obligations on you if you used the Pantone colours. These were not checked by software - it was handled on a trust basis.
Current versions of Photoshop check whether you've paid your Pantone subscription, and refuse to show Pantone colours if you haven't.

What's going on here is that you had contractual obligations to Pantone (per your Photoshop license agreement) if you used Pantone colours. People were widely ignoring those obligations, which upset Pantone, so Adobe is now enforcing a subscription to keep Pantone happy.