Archive for July, 2004

29 JulProprietary Hardware and DRM Threats from Apple

RealNetworks recently announced that their new RealPlayer with Harmony Technology would allow users to “Get your music anywhere. Transfer to any portable device” including Apple’s iPod. That sounds great for users, huh? Well, Apple doesn’t think so.

Apple’s so irked by the idea that users might have the freedom to buy music from someone other than them and still be able to play that music on their iPod that they’re considering suing RealNetworks and they are strongly hinting that they are going to break this feature in the next iPod software forced downgrade, I mean “update”. Kinda takes the polish off the ole Apple, eh?

In one way, it’s an odd position for Apple to take. iPod owners can currently transfer music they’ve burned from their own CD collections or downloaded off peer-to-peer networks to their iPods without a hitch. The difference here is that Real made it possible to also transfer songs bought at Real’s music store. It’s not hard to see that Apple is merely opposing its competitors at the expense of its users.

Now for the real twist. Apple is probably right! That is, they are probably right that RealNetworks broke Federal law to do this and that Apple could win a lawsuit on this point. That’s just how screwed up the Digital Millenium Copyright Act (DMCA) is!

You see, Apple’s Digital Rights Management (DRM) software that controls the copying of songs you buy from Apple’s iTunes store is what the DMCA would call “a technological measure that effectively controls access to a work.” Sec. 1201. And the DMCA makes it illegal to circumvent such DRM (in most cases) or to make available software or devices that circumvent such DRM. And while it’s not perfectly clear how Harmony works, if it makes it possible to copy Apple iTunes-purchased music onto any portable device, then it is inevitably circumventing Apple’s DRM.

What a mess. This is why I want a portable music player that runs GNU/Linux and plays non-DRM’d .ogg format music files. Then I can mostly ignore stupid laws like the DMCA and company in-fighting that hurts users and just enjoy my music in peace. Someone with financial backers and a manufacturing plant could make a mint selling open hardware running open software to fed-up consumers who just want to take back control over their music.

21 JulHow to use p2p to Share Verifiable Government Documents

Thad Anderson of outragedmoderates.org is outraged at how the Bush Administration is trashing true American values. He’s set up his site to share government documents that reveal the misdeeds of the current American regime.

He also is providing the documents through peer-to-peer (p2p) networks more famously known for sharing music files. Ernest Miller, who is usually dead-right about most anything he writes on, criticizes Anderson for his use of p2p.

Miller’s complaint is basically that in this instance, since Anderson could just host all the documents on his site directly, using a p2p network makes no sense, and just adds an unnecessary layer of complexity. Miller goes so far as to say, “There are legitimate uses and needs for P2P. Particular functions where it makes sense. This isn’t one of them.” I think he’s dead wrong about that. Here’s why:

What follows is an e-mail I just sent to Anderson of outragedmoderates.org.

[Intro snipped]

Your idea to provide government documents via p2p networks is a good one, and one I have thought about myself. I have a suggestion for you.

If a project such as yours were to remain on a small-scale, then the use of a p2p network would just be a gimmick, for you could host versions of all the documents on your site, and people would not generally have doubts about their authenticity. There would be no need, in such a case, for introducing a p2p distribution system, because it also introduces the questions about document veracity that you address by suggesting people search for your username on the p2p networks.

But, in a large scale government documents project, the bandwidth and hosting space necessary for an enormous amount of government documents becomes more than any single individual, who’s only spent $220, can bear. This is where a p2p distribution mechanism would make an enormous difference. It would allow others to share your load. The problem, in such a case, to solve then, is the problem that end users have of verifying the veracity of the documents.

Fortunately, this is easily solved. Alongside each document that you list on your site, you should publish the md5sum “hash” or “fingerprint” of that file. This number can be generated by the md5sum program, which is available for every major operating system.

For instance, I downloaded the first document linked on your site, Halliburton Contract ‘coordinated w VP’s office’ Email which came in at 39,454 bytes and produced an md5sum fingerprint of: d22b6c8827d6a8437beab1bb66da03ef

You can check this yourself. To run md5sum on Windows, get to a dos prompt and just type ‘md5sum filename’ without the quotes and replacing ‘filename’ with the actual filename, 030503.pdf in this case. In Linux or Mac OS X, you use the same command from any shell/terminal prompt.

If you acted as a central repository of the md5 hashes of each file that you seed into the p2p network, then when you host a document on the p2p networks, the first wave of downloaders will get it from you, check the hash on your site against what md5sum tells them, and then they in turn can host verified copies of the documents on the p2p network, and the next person who comes along can get the file from either of you, check the hash against your site, and also know that the file remains unchanged. You just reduced your bandwidth needs and gained an army of helpers.

Also, by monitoring the p2p networks for verified copies of the files, you could at some point even stop “sharing” them yourself as plenty of other good versions would be out there.

Hopefully this makes sense. Feel free to lift from my explanations above if you decide to adopt this suggestion and want to explain it on your site. In any event, your up to something good! Keep it up.

So, the reason I say Miller is wrong to criticize this idea is that there are lots and lots of government documents and lots and lots of people who might want to download them. Asking one individual to host all those on a single web site is asking them to have a bandwidth-deathwish.

Instead, there is a valuable service someone could provide, perhaps outragedmoderates.org, of being a central repository of all the md5sum hashes for such documents. Then we only have to trust a single site not to alter the documents before creating the hash. After reading his “About Us” page, I think I trust Thad. I hope he, or someone, will adopt this suggestion.

09 JulPatriot Act Provision Defeated, Then Undefeated

This story from the Boston Globe reports on the tactics used by the Bush administration to pressure House Republicans to change their votes, once it was clear that they were ready to restore your privacy in public libraries by amending one of the most offensive provisions of the misnamed PATRIOT Act.

The amendment seemed to pass, 213-206, as the 15-minute voting time expired. But, the time for voting was extended and Republican House members were told that terrorists had recently used public library computers. It worked. Our representatives were pressured and scared into changing their votes, swinging the margin back and keeping this provision of the Patriot Act intact, 210-210. (If you’ll notice, 419 members voted on time and only one additional member voted in the additional 23 minutes provided. So, it’s just false to claim, as Rep. Hastert did, that “the roll call was extended only to give more time to members who had not cast their votes.” Bull.

But here’s the real problem: This was “…an amendment that would have required law enforcement to go to a regular court — instead of a secret court — to get permission to demand library and Internet access records of people it is investigating.”

So even if the Justice Dept.’s pressure tactic is true and “…as recently as this past winter and spring, a member of a terrorist group affiliated with Al Qaeda used Internet services provided by a public library. . . to communicate with his confederates.” all this amendment was doing was requiring law enforcement officers to go to a regular court to get their warrants so that Congress and the public can monitor the number of such warrants requested and ensure that our government doesn’t go overboard and start spying on the library habits of innocent citizens. When they go to secret courts, we never find out about it. Nothing in this amendment would prevent law enforcement from doing their jobs when they actually have probable cause to monitor the activities of a suspected terrorist. This is a shameful day for the U.S. House.

Civil liberties for ordinary Americans: 0
Overbroad secretive powers for the FBI: 1

(If only the score were that close…)

Update:The Washington Post also has a good story on this and the Seattle Post-Intelligencer reports that “Democrats identified eight Republicans who switched their votes: Michael Bilirakis of Florida, Rob Bishop of Utah, Thomas Davis of Virginia, Jack Kingston of Georgia, Marilyn Musgrave of Colorado, Nick Smith of Michigan, Tom Tancredo of Colorado, and Zach Wamp of Tennessee.

One Democrat, Brad Sherman of California, also switched his vote to nay, officials said. In all, 18 Republicans joined Democrats in supporting the measure, while four Democrats crossed party lines to oppose it.”