Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Adobe Flaw Allows Full Movie Downloads For Free

Soulskill posted more than 6 years ago | from the it's-not-a-bug-it's-a-feature dept.

Movies 166

webax writes with this excerpt from Reuters: "[An Adobe security hole] exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience. 'It's a fundamental flaw in the Adobe design. This was designed stupidly,' said Bruce Schneier ... The flaw rests in Adobe's Flash video servers that are connected to the company's players installed in nearly all of the world's Web-connected computers. The software doesn't encrypt online content, but only orders sent to a video player such as start and stop play. To boost download speeds, Adobe dropped a stringent security feature that protects the connection between the Adobe software and its players." webax also notes that the article suggests DRM as a potential solution to the problem.

Sorry! There are no comments related to the filter you selected.

Ixnay ehtay olehay iscussionday (5, Funny)

Anonymous Coward | more than 6 years ago | (#25174759)

Eriouslysay.

Re:Ixnay ehtay olehay iscussionday (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#25175239)

I'm sitting around jacking it. Anybody up for some late night cocksucking or ass fisting?

-- Rob

Doublethink (5, Insightful)

QuantumG (50515) | more than 6 years ago | (#25174765)

Wow, so even Bruce Schneier is subject to the DRM double think now? What part of this is hard to understand? You have to give the viewer the key so it can decrypt the video stream and play it to the user.. if the user can see it, the user can record it. Game over. No amount of "encryption" can change the facts.

Re:Doublethink (5, Informative)

The Iso (1088207) | more than 6 years ago | (#25174781)

Schneier didn't write the article. He is only quoted briefly.

Re:Doublethink (4, Funny)

Anonymous Coward | more than 6 years ago | (#25174799)

From TFA:

To boost download speeds, Adobe dropped a stringent security feature that protects the connection between the Adobe software and its players." webax also notes that the article suggests DRM as a potential solution to the problem.

Whoa. Just...whoa. Friday night cognitive dissonance too much to handle!

Re:Doublethink (1)

lysergic.acid (845423) | more than 6 years ago | (#25174933)

hey, i know the best security method if you don't want people having unfettered access to your video content--don't stream it over the internet.

Re:Doublethink (1)

electrictroy (912290) | more than 6 years ago | (#25176457)

Exactly. Even if Adobe had encryption, there are still ways to capture anything shown on the screen. One solution uses software to do screen image captures 10, 15, or 30 times a second. If that doesn't work, a less-elegant but still workable solution is to point a camcorder at the screen and press record.

Although, I'm not sure why somebody would even *want* to capture streaming video. (1) Its bitrate is low and poor quality (typically 500 kbit/s). Plus (2) you can buy the content cheaply ($30-50 per television season) so it's not worth the effort to try to capture it (imho). Clicking "buy" on amazon is so much easier.

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25175079)

Whoa. Just...whoa. Friday night cognitive dissonance too much to handle!

It's Presidental Debate Night, duh.

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25175541)

<step away from the books>

I repeat:

This is the TGIF police department

<step away from the books>

Re:Doublethink (2, Funny)

QuantumG (50515) | more than 6 years ago | (#25174801)

I know, I actually read the article. Strange to be sure.

Its good not bad actually. (1)

LogicallyGenius (916669) | more than 6 years ago | (#25174815)

Give people what they want

Re:Doublethink (1)

The Iso (1088207) | more than 6 years ago | (#25174843)

I should assume such. You are marked as a friend, so evidently I judged at some point that you are an intelligent man. Still, I don't see how you could infer from this article that Schneier endorses DRM. He calls Adobe's design "stupid" without going in to detail, and isn't mentioned again.

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25174853)

That he would say their design is stupid suggests that he believes *some* design exists to do what they want, which is not stupid. His comment, if any, should have been "that's not possible anyway, so Adobe's design is as good as any".

Re:Doublethink (1)

Free the Cowards (1280296) | more than 6 years ago | (#25175031)

A design which does not stream the entire movie to a user before he's even paid any money could qualify as "not stupid".

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25175399)

Which would still, in no way, stop the user from copying the film.. which is the point of the article. I don't know where you got the idea that they were just trying to stop people from getting more than the teaser.

Re:Doublethink (5, Insightful)

squiggleslash (241428) | more than 6 years ago | (#25176495)

Well, there are many points to the article, but one of them is that someone can watch the movie for free because Adobe's server software is set up to continue streaming the movies after showing the free "clip". That, indeed, is "stupid", it relies upon trusted client software. DRM is one solution to this problem, but another is not to stream content to people's PCs they haven't paid for.

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25175459)

Rrrright

The guy whom every slashdotter quotes when they want to show why DRM is theoretically infeasible would just suddenly change his mind and announce it in a subtle and off-hand comment quoted as a sound-bite in an article with a focus on a peripheral topic.

Or

There is a larger context to the quote, but you've typed yourself into a corner and can't just suck it up and admit you made a dumbass comment and then let ... it ... go.

Re:Doublethink (0, Flamebait)

QuantumG (50515) | more than 6 years ago | (#25175625)

Huh? Bruce Schneier has shown numerous times that he's a complete dick who is on par with Dvorak in his trolling and whoring self promotion. This is the guy who said for years that strong encryption was the bee's knees of security and we need not concern ourselves with all those lowly details of implementation, etc. He had to make a public apology for his blasé attitude to matters of security outside his personal little kingdom of encryption when he was shown up for commenting so stupidly outside his field.. then weeks later he was once again claiming the rock star security guru title. I think a lot of people buy it simply because he has a nickel more common sense when it comes to security matters than the average bear but he's not infallible.
 

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25175773)

Cite it or get off the pot.

But regardless, attacks on his character are not even close to be a plausible rebuttal.

I think you are off your meds again.

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25175825)

Meh, you suggested that I was somehow "typed into a corner" and so I needed to make up some reasoning for why the great Bruce Schneier might be wrong. I was simply explaining that I've always thought he was wrong on most everything he says that isn't just plain common knowledge of professionals in security fields. He has said that DRM is "in principle" just not a workable idea.. and he has commented on particular DRM schemes and why they are broken. His general stance is common knowledge.. it also happens to be naive. There are plenty of places where client-side restrictions *can* be effective - if the implementers are willing to shoulder certain costs - namely, changing the mechanism regularly. This is the kind of technique that encryption experts call "security through obscurity" or "mere obfuscation" and look down on as unworkable.. but it is workable - it's just not very cheap. His specific commentary on DRM solutions, when not completely obvious, is typically misguided. That is to say, whenever he tries to say something that is actually of any worth - he gets it wrong. This is my opinion. Yours may differ. But don't go saying that I'm lying to "get out" of a corner or something.

BTW - if you're just trolling me, congratulations.. I don't know why I keep responding to ACs. Just glutton for punishment I guess.

Re:Doublethink (1, Troll)

KGIII (973947) | more than 6 years ago | (#25175909)

On /. DRM doesn't mean what it really means and they won't bother checking the beloved wikipedia. DRM != Copy Protection but Copy Protection is one form of DRM. They will ignore the meanings and say it is "Digital Restrictions Management" because they don't like the real meaning. I can't, and wouldn't, presume to speak for Bruce so I won't. Either way, here it means something other than what it means in the real world.

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25175921)

Copy Protection is one form of DRM, yes.. I haven't seen anyone on /. suggest otherwise. Bruce typically refers to "client side restrictions" instead of saying "DRM" is any case.

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25175915)

Where is this public apology you freaking dissembling fruitcake?
Where?
You just keep painting and painting and that clear space in the corner keeps getting smaller and smaller.

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25175947)

I don't have bookmarks from YEARS ago asshole. Go find it yourself. For fuck sake. It was comedy value at the time but it was hardly worth putting in my scrap book. Fucking hell.

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25175987)

http://www.schneier.com/crypto-gram-0008.html [schneier.com]

"I came to security from cryptography, and framed the problem with classical cryptography thinking. Most writings about security come from this perspective, and it can be summed up pretty easily: Security threats are to be avoided using preventive countermeasures.

For decades we have used this approach to computer security. We draw boxes around the different players and lines between them. We define different attackers -- eavesdroppers, impersonators, thieves -- and their capabilities. We use preventive countermeasures like encryption and access control to avoid different threats. If we can avoid the threats, we've won. If we can't, we've lost.

Imagine my surprise when I learned that the world doesn't work this way."

Imagine how unsurprised the rest of us were.

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25176009)

Lol THAT is a "public apology" for a "blasé attitude to matters of security?"

You clearly have a reading comprehension problem, which I guess would explain why you started this thread in the first place.

Re:Doublethink (1)

QuantumG (50515) | more than 6 years ago | (#25176081)

well, that's the only link I could find.. and frankly, I can't really tell if he's just faking ignorance to claim that he had some kind of epiphany that you too can share, if you just go buy his book. In fact, the apology is likely in said book which was considered hilarious by everyone in the security industry at the time. "Bruce Discovers Cryptography Can't Cure Cancer" and such. I guess you've gotta have someone to say the obvious things.

Re:Doublethink (1, Funny)

Anonymous Coward | more than 6 years ago | (#25174863)

Or maybe you marked him as "friend" in order to taunt him after he temporarily marked you as a foe.
He's an easy tweak like that.

Re:Doublethink (0)

Anonymous Coward | more than 6 years ago | (#25176019)

I know, I actually read the article. Strange to be sure.

Don't worry, you'll get the hang of this place soon: post FIRST (and FIRST POST if you can), RTFA... never! :-)

Re:Doublethink (3, Insightful)

lysergic.acid (845423) | more than 6 years ago | (#25174917)

yea, i think Adobe did the smart/sensible thing by leaving the stream unencrypted to boost download speeds. performance and speed are major considerations for streaming media.

like you said, you ultimately have to give the user access to the unencrypted data so that they can view the content. so if they had done what the author suggests they should have done, then they would have just ended up with a streaming technology that's slower & wastes more bandwidth, and the DRM scheme still would have been easily bypassed by hackers.

it's pointless to apply DRM to web content, as it is with offline content. it's always amusing to see website developers try to prevent visitors from saving images from the site--which is especially annoying when they use JavaScript to disable right-clicking, as if that'll stop anyone from saving an image to disc when it's already on their hard drive. these petty tactics simply insult visitors to the site and create a major annoyance for anyone who simply wants to access a command from the context menu. but i guess driving visitors away and decreasing the traffic to your site would reduce the chance of people steeling your precious lossy, lo-res jpeg images.

Re:Doublethink (4, Interesting)

David Jao (2759) | more than 6 years ago | (#25174963)

The dumb part here is that they send the whole movie to your computer even if you're just watching the free two-minute preview. The two-minute restriction is only enforced in the flash applet. Now, no amount of DRM can stop a paying customer from copying the movie, but a smartly designed system could certainly make the customer pay for the movie before giving the whole movie to them.

Re:Doublethink (5, Insightful)

Spy der Mann (805235) | more than 6 years ago | (#25175299)

The dumb part here is that they send the whole movie to your computer even if you're just watching the free two-minute preview. The two-minute restriction is only enforced in the flash applet.

Web programming 101.
Children, repeat after me: When you program for the web, NEVER, EVER trust the client.

Re:Doublethink (4, Insightful)

TubeSteak (669689) | more than 6 years ago | (#25175301)

Now, no amount of DRM can stop a paying customer from copying the movie, but a smartly designed system could certainly make the customer pay for the movie before giving the whole movie to them.

Having the preview show you a preview length clip is not a "smartly designed system" it is basic common sense.

Any site that try to protect their content with stupid tricks instead of creating separate content for the preview honestly deserve what comes their way.

I guess content providers have to make a decision as to which is cheaper &/or better:
1. Licensing DRM
2. Buying extra hard drives to store preview clips instead of streaming from the full movie/audio/whatever

Re:Doublethink (1)

WTF Chuck (1369665) | more than 6 years ago | (#25175585)

2 minute clip, 2 hour movie. If I didn't know what the movie was about, and didn't like the preview, I'd be awful pissed at wasting the bandwidth to DL the whole thing. I'd probably go the extra yard though, wasting a lot more bandwidth, and torrent the thing just for spite.

Not that Adobe's method is perfect, but (3, Informative)

MichaelPenne (605299) | more than 6 years ago | (#25175785)

Any site that try to protect their content with stupid tricks

Actually, what they did was trade-off stream security for the user experience - if the stream does pre-load, then the viewer can start viewing the movie much faster after they pay.

Its a good trick if most of your users do pay, as they get the video they pay for much faster (since it's already pre-loaded) than would be possible if the paid content was sent in a separate stream that did not start until after the payment was processed.

Mainly, this is an artifact of delivering video via http/progressive download vs. rtsp - you have a few options:
1. deliver one stream - tradeoff - geeks can view for free
2. deliver two streams - tradeoff - slow, annoying start up while you wait for the second stream to load enough to start playing
3. use rtsp - tradeoff - reduces the quality of the video to match minimum bandwidth between the server and the viewer

For really secure video, you'd use either RTSP or DRM (or both8-0), but they both have other problems with quality and user experience.

I guess a system designed by a video geek would probably lean towards providing the best quality viewing experience while making it possible for a geek to get the video for free:-).

Re:Doublethink (1)

MichaelPenne (605299) | more than 6 years ago | (#25175819)

Any site that try to protect their content with stupid tricks

Actually, what they did was trade-off stream security for the user experience - if the stream does pre-load, then the viewer can start viewing the movie much faster after they pay.

Its actually kind of a _good trick_ if enough of your users do pay, as they get the video they pay for much faster (since it's already pre-loaded) than if the paid content was sent in a separate stream that did not start until after the payment was processed. Faster viewing may = happier viewers = more use of the service.

Mainly, this is an artifact of delivering video via http/progressive download vs. rtsp - you have a few options:
1. deliver one stream - tradeoff - geeks can view for free
2. deliver two streams - tradeoff - slow, annoying start up while you wait for the second stream to load enough to start playing
3. use rtsp - tradeoff - reduces the quality of the video to match minimum bandwidth between the server and the viewer

I guess a system designed by a video geek would probably lean towards providing the best quality viewing experience while making it possible for a geek to get the video for free:-).

Re:Doublethink (2, Interesting)

Antique Geekmeister (740220) | more than 6 years ago | (#25176387)

Lots of folks here need to review the Palladium toolkit, renamed 'Trusted Computing'. It's designed to lock files to applications to hardware, in a triad specifically set up to control what users can do with their files and make them unavailable except for owner authorized software with centralized key management. This sort of thing is _precisely_ what it was designed for: the security enhancements it provides are potentially useful, but DRM is clearly its fundamental purpose.

Re:Doublethink (1)

zip_000 (951794) | more than 6 years ago | (#25176235)

I visited a site a few months ago that had all the standard annoying things...the ones that I remember now are the disabled right-click and not working in anything other than IE. So, I sent them an email explaining why this was such a bad business decision - thinking that it would make me feel better even though they would never change anything. I had to go back to that page a few weeks ago, and amazingly, they had fixed everything that I complained about. I was stunned.

Re:Doublethink (1)

Free the Cowards (1280296) | more than 6 years ago | (#25174971)

He may have been commenting about the part where they send people the entire movie before they've paid for it, so that it can start playing sooner once they pay. That is a truly boneheaded move regardless of what you think of DRM.

Re:Doublethink (1)

peter (3389) | more than 6 years ago | (#25175189)

As others have said, streaming un-paid-for unencrypted video is dumb.

You could send the first couple minutes unencrypted since anyone can watch it free (preview). Then start streaming the rest encrypted, and send the decryption key when the user pays. It doesn't have to be DRM, it could just decrypt the file.

Re:Doublethink (4, Insightful)

logicmethod (785495) | more than 6 years ago | (#25176373)

Flash Player has had the critical flaw of not being able to cancel HTTP requests for years. This causes all kinds of problems for Flash / Flex developers across the board, not only for media streaming applications. Adobe has finally implemented a fix in Flash Player 10--which should be out of beta in the next few weeks--that allows the developer to actually cancel a request and stop the stream. The development community has been bringing this to Adobe's attention for years, and why it has only yet to be addressed is beyond me--it seems so basic. I agree that it isn't a great idea to use the actual media for a preview versus creating a separate preview version, but this flaw makes it extremely easy to grab any file that Flash requests.

Ming boggles... (5, Insightful)

PineGreen (446635) | more than 6 years ago | (#25174803)

...at how fuckin dumb this all is. If you can see it, you can copy it, maybe it is more difficult, but not impossible. Do these idiots never ever learn?

Re:Ming boggles... (2, Interesting)

clarkkent09 (1104833) | more than 6 years ago | (#25174937)

Yes you can, but yes it's more difficult so not as many people do it and those who do will not do it as often. I guess that's the thinking, if you can't stop it altogether, making it even a bit harder is a step in the right direction from their point of view and it does make some sense

Re:Ming boggles... (3, Insightful)

Vladus2000 (1363929) | more than 6 years ago | (#25174939)

The key isn't stopping everyone, its stopping your average stupid computer user from doing it. That is all they need to achieve. When even John McCain can figure out how to pirate something, then the copyright holders are really screwed.

Re:Ming boggles... (3, Insightful)

Anonymous Coward | more than 6 years ago | (#25174999)

The key isn't stopping everyone, its stopping your average stupid computer user from doing it.

Average Stupid Computer User will not be doing it, anyways. He will go to something like The Pirate Bay and download it from there, after one Above Average Stupid Computer User did it and put it there.

Re:Ming boggles... (1)

lazy_nihilist (1220868) | more than 6 years ago | (#25174979)

Do these idiots never ever learn?

Apparently not. I RTFA and was amused to hear the CEO of a DRM company say how the lack of DRM was threating all business models. Ironic, given I don't see how DRM can "protect" any online video content that can be viewed on a computer. More snake oil.

Re:Ming boggles... (2)

Firehed (942385) | more than 6 years ago | (#25175445)

You expect that the CEO of a DRM company wouldn't suggest that his product is necessary for everyone? We know that not using DRM only threatens HIS company's business model, but DRM has been ineffective from the start, and has only served to inconvenience paying customers. Nobody doesn't know this by now - it really only exists to kill off second-hand sales and because of some misguided decisions from some ignorant CEOs.

Snake oil or not, it'll probably be around for a while longer until it's made clear that only products without DRM succeed in the market. I'm doing my part. Are you?

Ming boggles... (0)

Anonymous Coward | more than 6 years ago | (#25175027)

...at how fuckin dumb this all is. If you can copy it, they will try to stop you, maybe it is impossible, but they will still add DRM. Do these posters never learn?

Re:Ming boggles... (4, Funny)

gardyloo (512791) | more than 6 years ago | (#25175095)

He's also Merciless!

Do these idiots never learn? (3, Funny)

symbolset (646467) | more than 6 years ago | (#25175257)

Actually I do have a bulletproof method of DRM that customers will accept. There's no patent - it's currently a trade secret. I could show them how it works without revealing the secret, and they could license it from me.

I only want $40m cash up front, and 10% of the back end.

I'm calling it MP[34]. Of course with licensing comes naming rights. I think "Plays For Now" is not yet taken.

Oops (1)

symbolset (646467) | more than 6 years ago | (#25175367)

That was MP[34]XOR-B3

Sorry about that. MP[34] is already taken.

Re:Oops (1)

symbolset (646467) | more than 6 years ago | (#25175383)

I also have alternate methods MP[34]XOR-AF and MP[34]XOR-00.

This is valuable intellectual property here.

Re:Ming boggles... (1)

Libertarian001 (453712) | more than 6 years ago | (#25175267)

"Do these idiots never ever learn?" If history has taught us anything it is that we do not learn from history.

in case you hadn't noticed (5, Insightful)

drDugan (219551) | more than 6 years ago | (#25174817)

sadly, axxo and fxg and their black market friends already figured out years ago how to get movies for free to most anyone willing to look for them. it brings the end of an industry in it's current form.

There are better models: allow people, if they choose, to take media without paying for it, but give them credit, additional access, and membership benefits when customers do sponsor/pay for the media they consume. It is really not that complicated... find something you can sell because you can no longer technically control the distribution of your product.

Major media producers cannot change the progression of technology with policy and lawsuits. They would be so much better off to adopt what tech can enable, and build effective business models around providing customers with real value when they do pay for media, instead of using fear and lawsuits to force them to pay when they don't have to.

Re:in case you hadn't noticed (1)

Pichu0102 (916292) | more than 6 years ago | (#25175337)

Major media producers cannot change the progression of technology with policy and lawsuits.

No, but they CAN get revenge by ruining people's lives through them. Which is probably what it's really about, seeing as how it doesn't seem to have any other effect.

Some companies seem to get it... (1)

GradiusCVK (1017360) | more than 6 years ago | (#25175759)

On a related note, no doubt the maker of Replay Media Catcher, Applian, has seen a bump in both sales, and online warez activity. Their solution to combatting the latter?
http://www.applian.com/replay-media-catcher/crack.php [applian.com]
Umm, while researching the information in this article... *cough*... I discovered this. It shows up very highly on google.
In my opinion, this is a truly insightful move by Applian. It appeals to the vast majority of minor-league pirate types who really just don't want to pay for something (probably less appealing to the types of people who believe everything should be free)... people who are much less likely to value their privacy a highly as many of us here on Slashdot do. I say, bravo Applian.

Re:in case you hadn't noticed (1)

maestroX (1061960) | more than 6 years ago | (#25176347)

It is really not that complicated... find something you can sell because you can no longer technically control the distribution of your product.

Well, I think the complication is business-minded people tend have a bad relationship with technical issues and try to negotiate on matters that are actually based on technical merits and involve binary choices.

No need to try and convince in words, just put your money where your mouth is and refuse DRM, the productive argument is: out of business.

My humble opinion, you're free to choose otherwise, I'm just not gonna pay for watching senior-housed Sly and Apollo beating each other senseless in yet another Rocky revival.

Switcheroo (2, Insightful)

Jimmyisikura (1274808) | more than 6 years ago | (#25174837)

Normally they overdo security, now they are lacking in basic security that protects legitimate content creators. The question is how long until they fix it.

Re:Switcheroo (4, Insightful)

fuzzyfuzzyfungus (1223518) | more than 6 years ago | (#25174861)

Typically, DRM related security bugs get fixed markedly faster than do security bugs that threaten the security of the computer the software is installed on. Just to remind you who the customer is, and who the consumer is, y'know.

DRM can't be a solution (3, Insightful)

D4C5CE (578304) | more than 6 years ago | (#25174873)

the article suggests DRM as a potential solution to the problem

Restrictions pitting a computer against its owner (and wasting time and energy to further a business model built on distrust) are always a problem [wikipedia.org] , and the proof that some technologies can be inherently evil.

Re:DRM can't be a solution (0)

Anonymous Coward | more than 6 years ago | (#25175419)

Hey, I got a better idea than using DRM to solve this problem. How about not sending the ENTIRE FUCKING MOVIE to the users who only want to see a 2-minute preview?

From the article (3, Insightful)

superphreak (785821) | more than 6 years ago | (#25174879)

The free demo version of Replay Media Catcher allows anyone to watch 75 percent of anything recorded and 100 percent of YouTube videos. For $39, a user can watch everything recorded.
One Web site -- www.tvadfree.com -- explains step-by-step how to use the video stream catching software.
[snip]
Forrester analyst James McQuivey said he doesn't believe the video stream catching technology will entirely derail the advertising-supported business model used by the networks for online video.
"It's too complicated for most users," said McQuivey, noting that file-sharing services like BitTorrent already exist but only a small percentage of people use them.


See? He (whoever he is...) thinks piracy won't be a problem... it's too complicated to pirate stuff... people would rather pay... something like that anyway. And he's an analyst, so that makes it official, right?

Re:From the article (1)

CaptainPatent (1087643) | more than 6 years ago | (#25175219)

See? He (whoever he is...) thinks piracy won't be a problem... it's too complicated to pirate stuff... people would rather pay... something like that anyway. And he's an analyst, so that makes it official, right?

Really?

Lemme throttle down bittorrent so I can load that article.

Re:From the article (1)

superphreak (785821) | more than 6 years ago | (#25175263)

Yes I was being quite sarcastic. Bittorrent isn't very difficult to figure out...

Re:From the article (1)

rts008 (812749) | more than 6 years ago | (#25175687)

Firefox + dwhelper extension has handled this for some time now...any 'media' on the site, audio, video-captures youtube flash vid's just fine!

I just have to wonder.. (1)

cyberjock1980 (1131059) | more than 6 years ago | (#25174899)

I just have to wonder what it's like to be in the shoes of the person that wrote the code that's flawed. Maybe i'm mistaken, but this seems like something that the coder did knowing that if anyone ever figured it out, it was game over for the DRM. Surely this person is now explaining why it is how it is to his supervisors, who are probably banging their heads against the wall thinking "OMG".

Re:I just have to wonder.. (1)

WoollyMittens (1065278) | more than 6 years ago | (#25175443)

It very likely is just the opposite way around. A middle-manager ordered the loophole to save time and effort against the protests and better knowledge of the developer who is going to get fired over this.

Re:I just have to wonder.. (1)

mikael (484) | more than 6 years ago | (#25176045)

I am sure a whole design team plus management would be involved in this. They would have had to get a specification written, have it approved by the legal department (to ensure no patents were being trampled on and that user's privacy wasn't being invaded) and by sales/marketing (to ensure that the software would run on the majority of computer systems) and then by accounting (to account for the salaries of the application developers).

Impressive(ly pathetic). (3, Interesting)

fuzzyfuzzyfungus (1223518) | more than 6 years ago | (#25174913)

As we all love to repeat, DRM is folly, giving a man a locked box and the key, security through obscurity, mere obfuscation, inevitably cracked, etc. So, a story about yet another broken DRM system is hardly exciting.

What is amusing, in this case, is that we have a DRM system so broken that it includes a vulnerability of the kind that is theoretically fixable. Essentially, Amazon streams the first couple of minutes of whatever it is to you for free. To get more, you have to pay. However, thanks to this bug, Amazon doesn't actually stop streaming at two minutes, just sends a command to the player to stop playing. The video that you aren't supposed to see ends up, inadequately obfuscated, somewhere on your system.

That is the pathetic bit. It is ultimately impossible to control what another computer does; but it is merely a matter of good engineering to control what yours does. Server access control vs. DRM. Here, the system is so broken that Amazon's servers are essentially handing out video that they don't want copied to anybody who asks for it, at which time it is protected only by the usual doomed local DRM. Thanks to badly designed DRM, the system is less secure than that ever so early 90's "on payment, we email you a one time use link to a direct download" content protection scheme. Ha-ha.

The internet enables free downloads. Seriously. (5, Funny)

xigxag (167441) | more than 6 years ago | (#25175017)

You know what else allows full movie downloads for free?

THE INTERNET.

   

Re:The internet enables free downloads. Seriously. (1)

martin-boundary (547041) | more than 6 years ago | (#25175791)

Shh, don't tell the lawyers, or they'll try to ban the users.

This is new? (4, Insightful)

Toonol (1057698) | more than 6 years ago | (#25175021)

Doesn't everybody know that all flash video is easily accessible? Most of the time it's just a case of dragging it out of the cache. Sometimes you need to jump through more hoops, but I thought it was common knowledge that you could download it all.

You have to re-encode it if you want to, say, burn it on dvd, but that's not too hard. I use winFF (yes, I use windows).

Re:This is new? (1)

mgblst (80109) | more than 6 years ago | (#25175243)

Common knowledge amoung whom? Slashdot crowd, yes. Competent IT people, yes. The majority of internet users, no.

Re:This is new? (2, Insightful)

totally bogus dude (1040246) | more than 6 years ago | (#25175613)

I think the news part is that Amazon sends you the entire movie when you play the 2 minute "preview". Most people would assume the preview would in fact be a two minute clip without the rest of the movie attached.

Re:This is new? (1)

Gunstick (312804) | more than 6 years ago | (#25175779)

every idiot has a network traffic monitor, even if it's only the LED on the router. So if it still shows traffic a long time after the 2 minutes preview has finished you can conclude that there must be the rest of the movie coming down the line.

From the article: (5, Insightful)

jrockway (229604) | more than 6 years ago | (#25175035)

The problem exposes online video content to the rampant piracy that plagued the music industry during the Napster era and is undermining efforts by retailers, movie studios and television networks to cash in on a huge Web audience.

Uh, the pirates were already uploading the full HD rips to Usenet days before the movies were even released. No pirate would want the shitty version Amazon is offering.

Re:From the article: (3, Insightful)

Drinking Bleach (975757) | more than 6 years ago | (#25175135)

Exactly. This flaw, no matter whose fault, isn't going to make more pirated copies appear, or even more people to become pirates. Anyone that wants to pirate the films, isn't waiting for some security flaw in Amazon/Adobe software to allow them to do so.

Not really a flaw (5, Informative)

Wesley Felter (138342) | more than 6 years ago | (#25175043)

There are two separate issues mentioned in the article.

1. HTTP and RTMP are not encrypted and thus it's trivial to record any video sent over these protocols. This is well-documented and I'd hardly consider it a flaw. Flash 9u3 has DRM (RTMPE+verification), but most Web sites don't bother to use it.

2. Apparently Amazon's movie store server will send the whole video whether the customer has purchased it or not. This is a bug, but it's Amazon's fault not Adobe's and Amazon should be able to fix it easily enough. Also, they're apparently not using all the DRM features available in Flash so their videos aren't as protected as they could be.

AFAIK Flash DRM hasn't been cracked yet because no one uses it. I'm not an advocate of DRM, but as a practical matter I find it works better when you actually turn it on.

Re:Not really a flaw (2, Insightful)

Jah-Wren Ryel (80510) | more than 6 years ago | (#25175121)

I'm not an advocate of DRM, but as a practical matter I find it works better when you actually turn it on.

Unless the reason you are using it is to satisfy a checklist from hollywood.

Kind of like the TSA at the airport - "DRM theater" to make the frightened hollywood execs feel safe and secure even though they are still just as vulnerable with or without DRM...

Re:Not really a flaw (1)

Wesley Felter (138342) | more than 6 years ago | (#25175365)

Unless the reason you are using it is to satisfy a checklist from hollywood.

Yeah, and after Hollywood reads a Reuters article about how your system is cracked, you'll probably have to release a new version to convince them that something is being done. And the charade rolls on.

Re:Not really a flaw (1)

RichiH (749257) | more than 6 years ago | (#25175861)

Presumably, this checklist would involve turning the DRM on in production.

Re:Not really a flaw (1)

Anpheus (908711) | more than 6 years ago | (#25175167)

Actually, DRM remains perfectly secure only when you leave it turned off, and ideally locked away and never put under the spotlight.

Huh, that's funny, making DRM and general purpose PCs secure requires that you cut the network cable and bury them or lock them in a safe.

Re:Not really a flaw (1)

Spy der Mann (805235) | more than 6 years ago | (#25175331)

Actually, DRM remains perfectly secure only when you leave it turned off, and ideally locked away and never put under the spotlight.

Huh, that's funny, making DRM and general purpose PCs secure requires that you cut the network cable and bury them or lock them in a safe.

Just to be sure, let's pulverize and ionize them so we can feed their hadrons into the CERN collider while we can watch them go to 99.99999% the speed of light before blasting and turning into strange matter, and maybe one or two Higgs bosons. Bonus points for unrecoverability if they're turned into a micro-blackhole.

Summary of "news" story... (5, Interesting)

evilviper (135110) | more than 6 years ago | (#25175123)

In summary:

Amazon.com is staffed by idiots... They thought it would be safe to stream the ENTIRE MOVIE, to anyone, FOR FREE. The ONLY protection being that they send a command to the Flash Player to "pause" playback after 2 minutes for those that haven't paid to watch the whole thing. Cheap software and instructions have sprung up all over the web, and everybody knows Amazon.com is going to get a boot up the ass by the media companies, and fix this "security" issue any second now.

DRM is utterly redundant. They just need someone with 3-digit IQ in the company to teach them how to make a 2 minute excerpt clip that is free and publicly accessible, while keeping the full video password-protected.

This is about on-par with an Apache "security announcement" that even if you don't make a link to a document on your HTTP server, it's still accessible! The horror!

Re:Summary of "news" story... (0, Offtopic)

plasmacutter (901737) | more than 6 years ago | (#25175183)

2 minute excerpt clips from movies..

Even the worst turkeys have 2 minutes of compelling footage.

I could even find 2 minutes from something like the killer shrews [wikia.com]

Re:Summary of "news" story... (0)

Anonymous Coward | more than 6 years ago | (#25175245)

define "still accessible" for this webserving nOOb? i see no qualifiers so i ask.

Re:Summary of "news" story... (1)

Solra Bizna (716281) | more than 6 years ago | (#25175799)

define "still accessible" for this webserving nOOb? i see no qualifiers so i ask.

I'll bite.

Until this post, nothing on the Internet or my webserver linked here [tejat.net] . Now this post links to it, but even without this link someone could've typed that URL into a web browser and gotten to that important confidential document.

However, even though I am linking here [tejat.net] , you can't get to it. Rather than security through obscurity, that's real access control. (No such file exists; I have a mostly-empty /private directory that 403s almost everyone and 401s the rest.)

-:sigma.SB

flaw? (4, Funny)

theheadlessrabbit (1022587) | more than 6 years ago | (#25175175)

"Adobe Flaw Allows Full Movie Downloads For Free"

its not a flaw, its a feature!

Obvious question (2, Funny)

neokushan (932374) | more than 6 years ago | (#25175255)

What's the easiest and fastest way to take complete advantage of this?
I want links!

Re:Obvious question (0)

Anonymous Coward | more than 6 years ago | (#25175739)

1. Mentally select the film or show you wish to view.
2. Go to thepiratebay.org
3. ???
4. profit

This is what HDCP is for (1)

Skapare (16644) | more than 6 years ago | (#25175437)

Normally if you can play the video, you can capture it. So encryption/DRM is rather pointless. However, DRM can work (up to a point) if HDCP is used. The player has to be sure that the path from the internet to the display is full encrypted OR sealed. By doing the decryption in the video card, uncompressing it there, and re-encrypting it for HDCP over HDMI (audio, too ... so DVI won't work unless they want to give up the protection on the audio), you can be sure the video is safe all the way, as long as the content owner trusts the video card (it would have a player device key like a DVD player would, that can be revoked) and the video display device.

But there are still a couple analog holes. Internal electronics of the display could be tapped to get analog, which may have stair step levels that would allow determining original digital values. And then there is the camera on the screen method.

One big catch is, unlike the home TV market, few people have HDCP capable video cards and displays, and fewer still have it for HDMI that can support DRM audio through the video card. So deploying strong DRM for streaming video is not practical, yet.

Re:This is what HDCP is for (0)

Anonymous Coward | more than 6 years ago | (#25175879)

But HDCP is broken. [dataloss.nl]

Cache (1)

Skapare (16644) | more than 6 years ago | (#25175461)

Amazon starts to stream the entire movie during the free preview -- even though it pauses the video on the Web browser after the first two minutes -- so that users can start watching the rest of the video right away once they pay.

However, even if a user doesn't pay, the stream still sends the movie to the video catching software, but not the browser.

So that's why my SQUID caches were getting so big :-)

Encrytion 101... failed by most media bosses. (1)

WoollyMittens (1065278) | more than 6 years ago | (#25175477)

In encryption, person A wants to send something to person B without person C being able to read it. In DRM, person A wants to send something to person C who own computer B. It doesn't take an engineering degree to figure out, there's something wrong with DRM.

It's like 0-day shipping (5, Funny)

iabervon (1971) | more than 6 years ago | (#25175565)

It's just like their instant delivery service, available for items that you've put on your wish list in advance. The way it works is that, when you put an item on your wish list, they ship it to you. Then, if you buy it, they give you the tracking number, you go to the shipper's site, and find that the item is on your porch, at which point you bring it inside and open it. If you don't buy it, eventually the shipper notices that it's been sitting on your porch for a while unclaimed and brings it back to Amazon.

Doesn't work anymore. (On Amazon) (0)

Anonymous Coward | more than 6 years ago | (#25175575)

I know you were gonna try it for research purposes... But apparently they fixed the hole. (At least at Amazon.)

In related news ... (4, Funny)

dougmc (70836) | more than 6 years ago | (#25175621)

In related news, researches have discovered that Gutenberg's printing press [wikipedia.org] has similar flaws. By using modern technology such as photocopiers or cameras, or older technology such as monks and pens (or additional printing presses) criminals can create nearly identical copies of items printed with the press, depriving the original creators of the material of much needed compensation.

Gutenberg did not immediately return calls for comment, however it's theorized that he did not build in an encryption option to his printing press in order to boot comprehension speeds (Simple substitution ciphers [wikipedia.org] were well established at the time of the creation of the printing press, and Gutenburg could have easily applied their techniques in the creation of his press, however it's not entire certain how effective it would have been at preventing piracy. (Somewhat (at most) effective DRM techniques were developed centuries later.))

Re:In related news ... (-1, Flamebait)

crenshawsgc (1228894) | more than 6 years ago | (#25175803)

This post is very funny, because it reports centuries-old technology as new and modern, yet parallels certain recent developments. The author is witty and brilliant. oh wait no

defectivebydesign (0, Redundant)

wvmarle (1070040) | more than 6 years ago | (#25176359)

'nuff said
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?