Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Microsoft

Using Palladium to Secure P2P Networks 286

Posted by timothy from the sauce-goose-gander dept.
user555 writes "The RIAA and MPAA have seen Palladium as a way to prevent piracy. But this article argues that ironically Palladium may actually make P2P piracy more widespread (PDF). They argue that the security features of Palladium could be used to create P2P networks that are more resistant to attacks from content owners."
This discussion has been archived. No new comments can be posted.

Using Palladium to Secure P2P Networks More

Using Palladium to Secure P2P Networks

Comments Filter:

  • Yeah, right. (Score:5, Interesting)

    by user no. 590291 ( 590291 ) on Monday June 02, 2003 @08:18PM (#6101528)
    Looks to me like a cleverly planted story to attempt to stem the tide of ill-will toward the "Next Generation Secure Computing Base," a.k.a. "the lockdown technology formerly known as Palladium."

    • Re:Yeah, right. (Score:5, Insightful)

      by inflex ( 123318 ) on Monday June 02, 2003 @08:43PM (#6101710) Homepage Journal
      Actually, I personally interpreted it as a story not to stem the ill-will, but rather generate ill-will in the opposing camp.

      Basically it's a counter 'warning' saying "P2P's can work your technology against your own intent".

      Certainly I don't see it as an attempt to pacify the anti-Palladium camp.

      • Re:Yeah, right. (Score:2, Interesting)

        by vegetablespork ( 575101 )
        But that can be eliminated by requiring MS signed binaries for network access in trusted mode--I don't believe for a minute that Jack, Hilary, Bill, and their minions will allow binaries which will P2P sharing of any kind to be signed with a Pd endorsement key.

        • Re:Yeah, right. (Score:5, Insightful)

          by inflex ( 123318 ) on Monday June 02, 2003 @08:54PM (#6101766) Homepage Journal
          Agreed. I wasn't citing the practicality of the idea, rather, the intent.

          I'm wondering what the hardware manufacturers are going to do - will they continue to offer 'normal' products like they do now ( HDD's, MB's ) without such devices built in - or, will they be forced to only make protected devices?

          Personally, I don't see their being sufficient market forces to push HDD and MB makers into dropping the 'insecure' hardware entirely.
          • I don't see the market forces, either. I think the industries' hopes are tied to legislation. Another possibility is that content will be so cheap that it's nearly free when these machines are first produced, until general purpose computers are driven out of the market, then prices increased once that happens.

        • Re:Yeah, right. (Score:2, Interesting)

          by qubex ( 206736 )
          You don't think they'll be releasing signed SMB binaries? FTP servers? If it is impossible to get binaries signed, then have no fear that we'll see P2P networks and functionality emerge from "trusted" protocols and ad-hoc scripting of OS features... to cite a simple example, a batch file that searches a given series of SMB-mounted drives for a given media file (MP3) and then proceeds to download it to the local drive. Automated "automounting" of peers' filesystems, etc... if it sounds messy, no problem: jus

    • What are you smoking? (Score:5, Insightful)

      by Faust7 ( 314817 ) on Monday June 02, 2003 @10:02PM (#6102153) Homepage
      It's a research paper. For school. It's not journalism, not a "cleverly planted story," it's a bloody academic essay. It is sitting in a student's directory on a Harvard server. The only "planting" I see is the link Slashdot provided to it in the first place.

      • This is shameful propaganda. (Score:5, Informative)

        by Erris ( 531066 ) on Tuesday June 03, 2003 @12:02AM (#6102877) Homepage Journal
        It's a research paper. For school. It's not journalism, not a "cleverly planted story," it's a bloody academic essay. It is sitting in a student's directory on a Harvard server.

        These three students must be some of those new "grassroots" Microsoft has been trying to buy on campuses. Harvard, that's almost as costly as Tulane, so these three must have been expensive to confuse or corrupt.

        Anyone who uses the term "piracy" for unauthorized file violation is clueless to begin with. Other midless gems from these three include:

        • "Napster was the first system to integrate the end user into the distribution process."
        • "industry would like to return to the days when investigation and legal actions were sufficient to counter a reasonably sized set of professional pirates."
        • And the critical flaw, "if Microsoft delivers on the promises of its next-generation secure computing base for Windows, then clients can also be assured of secure storage and curtained memory."

        The author's research is lacking. They reference 17 works, mostly popular press articles with one or two intersting texts. One reference they omitted is Microsoft's EULAs which require forced upgrading and Microsoft's right to search your files and delete those they considercopyright infringing.

        Anyone who considers the control Microsoft now demands of it's user's computers could not think that Microsoft would ever extend "protection" to user content or clients programs. They promise to do it now, despite a lack of tools. Chances are that Microsoft will delete all peer to peer client programs they find.

        Shame on Harvard. I've got to give this student paper an A for effort and the fluent ability to state the obvious but an F in research and critical reasoning. The music and film industry blinders these students wear prevent them from exploring the use of P2P for anything but "piracy". The whole idea of "trusted computing" aiding "piracy" is a juvenile conivance of wishful thinking. It lacks all the things Universities are supposed to be full of, honesty and critical thinking.

  • Conclusion (Score:5, Interesting)

    by (54)T-Dub ( 642521 ) * <[tpaine] [at] [gmail.com]> on Monday June 02, 2003 @08:18PM (#6101531) Journal
    It's a long read, but i think the conclusion sums it up nicely To thwart piracy the entertainment industry must keep distribution costs high, reduce the size of distribution networks, and (if possible) raise the cost of extracting content. However, if 'trusted computing' mechanisms deliver on their promises, large peer-to-peer distribution networks will be more robust against attack and trading in pirated entertainment will become safer, more reliable, and thus cheaper. Since it will always be possible for some individuals to extract content from the media on which it is stored, future entertainment may be more vulnerable to piracy than before the introduction of 'trusted computing' technologies.

    • Re:Conclusion (Score:5, Insightful)

      by Malfourmed ( 633699 ) on Monday June 02, 2003 @09:00PM (#6101800) Homepage
      To thwart piracy the entertainment industry must keep distribution costs high, reduce the size of distribution networks, and (if possible) raise the cost of extracting content.
      How about: To thwart piracy the entertainment industry must lower prices and decrease access times (eg movie and TV international release dates) to the point where the costs of piracy (time, hassle, lower quality, fake product, no support) isn't worth it for most people.

  • Now the RIAA has reason to hack Palladium... (Score:4, Funny)

    by Mawen ( 317927 ) on Monday June 02, 2003 @08:19PM (#6101543) Journal
    ..and get sued under the DMCA.

    Perfect!

    • Not with a warrant (Score:2, Interesting)

      by yerricde ( 125198 )

      The DMCA doesn't necessarily keep investigators from circumventing encryption when monitoring alleged pirate networks. Law enforcement can get a judge's approval to violate 17 USC 1201 [cornell.edu], in a document called a "warrant":

      (e) Law Enforcement, Intelligence, and Other Government Activities. -

      This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivisi

    • Actually, its not that funny, its insightful. You encrypt the files you distribute with your own encryption schema. You will just not to choose to prosecute people breaking it. But if the MPAA comes to court, you point out that their obtained evidence illegally by breaking the encryption. So the DMCA actually should protect software/movie/music piracy.

  • It makes no real difference (Score:5, Funny)

    by McAddress ( 673660 ) on Monday June 02, 2003 @08:21PM (#6101555)
    Palladium score:
    Good: 1
    Evil:50
    • Even if media companies, those who traffic in ever more available ideas, are able to score at a rate ten thousand times that of punk kids, they're still screwed. There are a lot of punk kids. Now they're going to grow up idolizing a spoonless Ted, hating The Man, singing avril lavigne's lates singles "He Connected Thru The Exploit of My Heart" and "1 0w3d j00 (Like A Linux Box)"
    • Like I've argued before, no technology can be considered entirely good or entirely evil. Only the way it is used can be.

      There's a technology out there that, in the US alone, costs people trillions of dollars a year from damage to property, and kills hundreds of thousands of people yearly - against, just in the US. Should such a technology be banned?

      If so, then let's head back to the Stone Age, because you just outlawed fire! Sure, it can be used to kill people, but it can also be used for numerous good
    • Palladium score: Good: 1 Evil:50

      Sooo...would you say it's a Dark Palladium? ;)

    • A-ha... (Score:3, Funny)

      by Faust7 ( 314817 )
      Palladium may actually make P2P piracy more widespread

      Good: 1
      Evil:50

      I'll assume you're placing P2P piracy in the Evil category, and something else in Good... right?
  • Microsoft might just hobble Windows ulnder palladium, so that it can't do certain things without RIAA/MPAA aproval.
    This would be another win for Linux.

    • Re:On the other hand... (Score:3, Interesting)

      by mark-t ( 151149 )

      Microsoft might just hobble Windows ulnder palladium, so that it can't do certain things without RIAA/MPAA aproval.

      This would be another win for Linux.

      Yeah, until the platforms are set up to not even allow you to run Linux on them, and ISP's won't allow you to connect if you're not using a platform that is recognized as secure.

      If the mindset that the RIAA and MPAA currently have had been around in the 60's, and they had their way, really, the personal computer never would have existed at all.

  • piracy...? yeah, of XP (Score:5, Insightful)

    by davebarz ( 546161 ) * <david AT barzelay DOT net> on Monday June 02, 2003 @08:23PM (#6101567) Homepage
    "Palladium may actually make... piracy more widespread."

    Yeah, piracy of Windows XP when no one wants to buy Windows Palladium Edition. It astounds me that the population in general is so ignorant and apathetic toward the loss of their rights.
    • XP will get Paladium anytime they feel like giving it to you. The EULA clearly states that you must accept windows updater uploads. So why would you use, much less "pirate" XP?

      What's more astonishing that you would claim the general population is so ignorant, yet advocate the thing you fear. Then again, three harvard students bought into this whole bogus notion. This is my review of their article [slashdot.org].

  • How quickly we forget...so which is it this week? (Score:5, Informative)

    by djupedal ( 584558 ) on Monday June 02, 2003 @08:23PM (#6101570)
    24/06/2002 - The Register... [theregister.co.uk] Starting with a Newsweek exclusive which [msnbc.com] wonderfully quotes His Billness as saying: "It's a funny thing, we came at this thinking about music, [theregister.co.uk] but then we realized that e-mail and documents were far more interesting domains." Which is cute, because it suggests that Microsoft's original plans to produce a secure PC that will protect the music companies' stuff from us have been spiked in favour of something much more positive and progressive.
    • Which is cute, because it suggests that Microsoft's original plans to produce a secure PC that will protect the music companies' stuff from us have been spiked in favour of something much more positive and progressive.

      What the hell are you smoking? You realize that the application to email is making messages that your computer won't allow you to quote, copy, filter, or print (spammers will love that - it has nothing to do with secure communication since that doesn't require anything user hostile) and that
      • Chill Napoleon. That entire blurb was cut/paste from the article that I quoted elsewhere....follow that link and go postal over there, if you really want to stomp someone, ok? :)

        Or is this some tribal territorial coming of age thing, where you just lash out at the nearest shadow and the naked-to-the-waist women react with approval at your prowess? Because if it is, then I'm on your side, and I'll act all put down and stuff so you can get some later in the tent...it's cool...just tell me, 'cause I can rec

  • Faulty assumptions: (Score:5, Interesting)

    by Pituritus Ani ( 247728 ) on Monday June 02, 2003 @08:23PM (#6101573) Homepage
    That those producing the locked down machines won't:

    • have the ability to impersonate any Pd machine.
    • cooperate with the *AA by either sharing that ability or acting on their behalf to intervene in the P2P networks

    That, and the authors give away their toadyism to the "content industries" by referring to P2P networks as "peer to peer pirate networks," as if they have no possible legitimate use save to board ships on the high seas, murder the crew, and plunder the vessels.

  • Use Palladium for secure P2P? This is probably the only time you'll hear Microsoft say "That's not a feature, that's a BUG!"
    • Funny, but I don't think that Microsoft have a lot to lose from ordinary user-piracy, and potentially, lots to gain. A great majority of people would be running Linux right now if Microsoft had made Windows unpiratable in 1995. And Linux would be awesome, a lot better than it is now.

      The threat from Free software is only going to get more serious for Microsoft, and pirated software is their covert way of fighting it. They can get fat enough off the rich people who don't want to bother pirating and the corp

  • Palladium secures P2P networks through... (Score:5, Funny)

    by dduardo ( 592868 ) on Monday June 02, 2003 @08:26PM (#6101597)
    the implementation of the evil bit! MUHAHAHAHA

  • Uhh.. prolly not (Score:5, Interesting)

    by doormat ( 63648 ) on Monday June 02, 2003 @08:29PM (#6101618) Homepage Journal
    1. MS holds all the keys to Palladium. I'm sure its got backdoors (either because they write insecure code or they intentionally want a back door).

    2. The APIs for this will probably be under lock and key. The next Jon Johansen wont have access to the API calls to interface with palladium.

    3. Why use palladium when you can use waste or something similar.

  • First of all, it suggests that P2P networks are by nature about piracy. I am a huge fan of BitTorrent and have used it for nothing other than downloading cool movie trailers. While piracy has always been common online, you can't blame the cables for the content.

    The second issue I take with this submission is the phrase "more resistant to attacks from content owners." I assume you're talking about the RIAA because security from artists who want to be paid for their work is not something most people ever want. Sure, cut the thieves in the RIAA out of the equation but few people will ever begrudge the artists their $1 or $2 per album. It's the oligarchy that is the RIAA that people are mad at.

    • The content creators are not necessarily the content owners. The flaw in this phrase is the thought that the trusted computing scheme would somehow expand the uses of a computer instead of reducing them.

      I always thought that we already had ways of transmitting data securely between two points. How would the introduction of a company owned passport server help the user?

      And I agree that hardly anyone will begrudge the content creators for wanting to earn money, but right now you can't hurt the RIAA withou

      • right now you can't hurt the RIAA without also hurting the artists.

        Then I suppose I will hurt them both. I will not give my money to support an organization that treats its customers as thieves and expects us to come begging for more. I buy 1-2 albums a year now and only ones where I think the artist categorically deserves my money. Do Bush, Puddle of Mud, Metallica, Madonna, or Ricky Martin genuinely expect me to spend my hard-earned money to keep them in business??? I will listen by radio, thanks v

  • Nothing is inherantly wrong in trusted computing (Score:5, Insightful)

    by grahamsz ( 150076 ) on Monday June 02, 2003 @08:34PM (#6101653) Homepage Journal
    It could kick ass for servers. I could sign all the binaries my system runs using a secondary (unnetworked) system and then so long as i control all the keys then it becomes very difficult for someone to install backdoors, rootkits, and viruses.

    I'm quite psyched about the control it provides. Sadly most of the public are probably too ignorant to even want that control.

    • Re:Nothing is inherantly wrong in trusted computin (Score:5, Insightful)

      by deranged unix nut ( 20524 ) on Monday June 02, 2003 @08:48PM (#6101727) Homepage
      You can already do this with Windows XP and Windows Server 2003. There is a security policy that allows you to prevent the system from running any binaries that you didn't sign.

      The downside is that you also need to individually sign the patches too, and that can be time consuming.
      • You can already do this with Windows XP and Windows Server 2003. There is a security policy that allows you to prevent the system from running any binaries that you didn't sign.

        There is a huge difference between this and what a Palladium based system could potentially do. Software Restriction Policies in XP and Win2003 are not bulletproof. They can protect users from accidentally running a trojan/virus but they cannot guarantee that somebody hasn't modified the OS itself.

        This is a fundamental problem with

        • Agreed, there is a gigantic difference between a software feature and a hardware enforced software feature.

          However, if a sysadmin wants a moderate confidence that a junior admin hasn't installed software that shouldn't be running, or that a user hasn't installed unauthorized games on a critical system, the Software Restriction Policies are a good additional safety feature that can be used in addition to other security techniques.

      • The difference is who has control. In the office, the sysadmin deserves to have control over who can run what. At my house on my computers, only I deserve control. I'd better be able to do anything I damn well please on my own equipment. The security policy in Windows XP and Server 2003 lets this happen. Palladium/NGSCB, on the other hand, puts this control in Microsoft's hands. It's their security, not ours. I think "trusted computing" should be me trusting my computer to do what I say, not Microso

      • We all know how well Microsoft security works. All this mechanism does is give a cracker a new tool to hose a system that's insecure by design and incompetence. Between Excell playing sound files linked in from the web (hypothetical flaw based on Outlook's doing the same) and Windoze updater, there is no security on M$. Paladium is simply going to be another set of inconveniences to the user that do little else than get in the way of working and enjoying media files and running free software.

  • Won't work (Score:5, Insightful)

    by smiff ( 578693 ) on Monday June 02, 2003 @08:34PM (#6101654)
    In order for software to be 'trusted', Microsoft has to sign it (that's what Palladium is all about. Microsoft has a monopoly over what is or is not trusted). Microsoft is not going to sign software unless it serves Microsoft's agenda. If p2p software hampers Microsoft's plans to monopolize the online media distribution channel, they will either demand the software be crippled before they sign it, or simply refuse to sign it at all.
    • Remeber that insecure activex control that they signed and couldn't revoke?

  • The trick is... trust (Score:5, Insightful)

    by Mordain ( 204988 ) on Monday June 02, 2003 @08:34PM (#6101655) Homepage
    As the article in many more words states, It is not simple for DRM enabled sytems like Palladium to differentiate between whats actually illegal or not.

    They require that the software that will interact with the DRM features actually be 'trusted'. Unless they want all software written for Palladium to be 'MPAA/RIAA' approved, anyone can write 'untrustful' code. Only one link in the chain has to be broken for it to fail completely.

    So, write 'trusted' p2p file sharing.

    I am afraid that someone like MS will require you to pay in the future to have the right to write 'trusted' code, or any code won't run at all.

  • Erroneous Conculstion (Score:5, Insightful)

    by appleLaserWriter ( 91994 ) on Monday June 02, 2003 @08:37PM (#6101675)
    Schechter, Greenstadt and Smith write that "to thward piracy the entertainment industry must keep distribution costs high, reduce the size of distribution networks and raise the cost of extracting content". While that may be a true statement, it is as useful as Saddam Hussein's military advisors recommending that Iraqui aviation enginners be sent to major American defense contractors to increase fuel consumption of US bombers and reduce the accuracy of their communication systems.

    Since the entertainment industry does not own fiber, switches, PCs, or consumer CD burners they must take Schechter's advice and invert it to suit the networks that they do own.

    I'll restate their conclusion as follows:
    To thward piracy the entertainment industry must keep distribution costs low> , reducing the total cost for consumers to acquire legitimate content. When it takes less total effort (purchase price + effort) to acquire legitimate media the users will abandon piracy. This approach has been clearly demonstrated with Apple's iTunes product.
    • But this generally is not what is happening. They percieve an mp3 download of a song as a loss (I still haven't quite figured out how you can lose what you never had to begin with and most likely never would have had regardless) and so they factor those "losses" into the price of music.
      • Well the loss thing is a nifty bit of accounting that is nothing more than a stall tactic until they really figure out how to milk the digital music industry. Unless you are a shareholder who is taken in by the theft argument, it is largely irrelevant as digital theft is clearly not isomorphic to real world theft (See my other post in this thread for details).

      • The "mp3 download of a song as a loss" is what they say in public. They perceive the low cost and easy distribution of music as creating competition--which is a huge loss for them.

    • This approach has been clearly demonstrated with Apple's iTunes product.

      You mean the iTunes Music Store. It's statements like these that got me confused between the two in the first place.

      iTunes == crappy Apple 'jukebox' software.

      iTunes Music Store == cool (cooler than most) online music store

  • irony (Score:3, Interesting)

    by MacOS_Rules ( 170853 ) on Monday June 02, 2003 @08:40PM (#6101689) Homepage
    First the RIAA IM bombs much of Kazaa, and now they support "trusted" P2P?

    Why that's like reading [this] Slashdot [article], and finding this ad

    http://m2.doubleclick.net/viewad/790463/mrs03001 _m ult_336x280_18k.gif
    • Damnit! That was supposed to be funny! What do I have to do to get a laugh?!? ...

      Win2k5:"I'm sorry, Mike, jokes aren't allowed on the untrusted internet."

      Clippy: Do you want help in upgrading to the new MSN Trusted Communications Portal for only $39.95 a month?" ...

      "NOOOOOOooooooooooooo!" =)

  • knee jerk reaction hurts us all (Score:5, Insightful)

    by astrashe ( 7452 ) * on Monday June 02, 2003 @08:43PM (#6101709) Journal
    In a previous article (with quotes from ron rivest?), it was pointed out that the question is whether or not people will be able to control the signed code that runs on their machines.

    If you need an official MS signature on the code, things like p2p networks probably aren't going to fly.

    Unfortunately, the knee-jerk "MS is the devil" reaction hurts everyone. Technology that allows other people to trust information coming out of your machine is useful. This paper describes a good example of an application for that technology.

    The problem is going to be in the details -- specifically, as rivest (I think) pointed out, whether or not you need an MS signature to load the code on your machine.

    Instead of saying "palladium is evil", we should be pushing for comparatively open implementations. Any system that runs trusted code on my machine ought to be under my control and transparent. I ought to be able to decide what I want to run, and how that code will communicate with the rest of the world.

    Unfortunately, that's not going to happen, because everyone is taking a simplistic view of the issue. No one is engaging MS seriously on this, and because of that they're going to deploy a system that's not under user control, and that's not transparent.
    • . Technology that allows other people to trust information coming out of your machine is useful.

      Yeah?

      Instead of saying "palladium is evil", we should be pushing for comparatively open implementations.

      No, Palladium is evil. You can't get around the fact that Microsoft's planned hardware domination is evil by wishing it did things it won't. M$ does not deserve to be "engaged" because, as a condition of using their software, they have demanded the right to seach through your files and delete those they f

    • Thinking bastards can be trusted hurts us all (Score:4, Interesting)

      by moncyb ( 456490 ) on Tuesday June 03, 2003 @12:55AM (#6103126) Journal

      Simplistic view? In the past, M$ has proven they will lie, cheat, and steal to control their users and to try trapping everyone into using their product. It is like working with Hitler. Making a compromise or alliance with such people is suicide. Just ask Stalin.

      What good would "open implementations" of DRM do? Allowing others to control what your computer does with their file/data is the entire point of DRM. When that fails, M$ and the MPAA will create a censorship system under the guise they need to delete infringing files. To do so, a M$ controlled DRM system will need to be in place--to trap everyone into only using M$ systems, and/or to hide the fact they are censoring people.

      An open implementation would defeat the entire purpose. An open implementation would not even be good for most of the other purposes touted for DRM. Anyone would be able to counterfeit Eca$h, or copy those secret emails. A trusted third party would be required to control your computer. I will never trust M$, only a fool would.

  • They're forgetting one thing.... (Score:2, Interesting)

    by Anonymous Coward
    All they need is an offer they can't refuse and Microsoft will get in bed with the RIAA/MPAA and allow them to have priveleged access to Pallidium secured items.

    If you were able to peruse the source code for Longhorn, you'd see function calls like:

    __riaa_checkvalid_song()
    __mpaa_is_movie_pirate d()
    __xxaa_set_torture_flag()

    and so on.

    One thing academia can't account for is good old politics and strange bed-fellows.

  • surprised? (Score:5, Insightful)

    by shird ( 566377 ) on Monday June 02, 2003 @08:57PM (#6101781) Homepage Journal
    I hope not. It is well known that the fundamental problem with P2P systems is the inability to trust the client. What does palladium offer? - an ability to trust the client. duh

    Surely even Microsoft could have put the 2 together - this would not be news to them, or anyone else really (except journos).

  • Missed the real threat (Score:5, Insightful)

    by dmeranda ( 120061 ) on Monday June 02, 2003 @09:03PM (#6101824) Homepage

    Unauthorized copying (sometimes called piracy) is not the real threat against the __AA, but it is the easiest to defend. What they really fear is the ability of independents from creating and distributing their own content without their aid. They want to eventually force all technologies to only play content that was blessed by one of their sacred keys. Think about the CSS keys in DVDs...I am unable to produce a DVD containing my own content which is protected by CSS because I don't have access to one of the magic keys. But is my content which I own a copyright on any less deserving of full copyright protection under the law? Well, certainly the DMCA doesn't protect my content because I've been locked out of even using the popular circumvention technologies.

    Well, Palladium and the like are the step towards eroding my rights as an independent creator even further. At least with DVDs, I could given enough capitalistic force create my own alternative to CSS with which I could protect my own content. But with an enforced technology, I don't even have that option open to me. Content creators will be forced to publish only through the evil media oligopoly.

    BTW, on an unrelated crypto subject. What about an idea of taking advantage of what is traditionally viewed as fair rights. Say it's okay to just extract 3 seconds of media. I can then publish on a P2P network an article which includes an except of seconds 7.2 through 9.8 of a song. If enough different (and independenly-acting) people publish fair-use derived content with different 3-second extracts, one could in theory reproduce the entire original. There are also crypto techniques such as secret splitting, but the simple 3-second method may be more defendable in the interests of expression of fair rights as long as there is no collusion among individuals. Just a thought, not that I condone unauthorized copying.

    • I don't think the biggest threat to the MPAA is independent content producers, I really don't. The fact that CSS protection is not available for anyone but the major film studios is that, in all likelihood, nobody else even bothered to ask for them. Back when it first came out, there were not nearly as many independent filmmakers as there are now, when everyone has DV camcorders and a copy of iMovie. Besides, how would you or I possessing a CSS key stop Universal or Warner Brothers from protecting their
      • "I don't think the biggest threat to the MPAA is independent content producers, I really don't. "

        There are millions of artists, yet the RIAA represents a very small fraction. Second, technology is making it much easier for an independent artist to record their work and distribute it. Technology is helping independent artists and one day even video creation will be at the point that creative individuals will be able to produce works that could be hard to distinguish from high expense Hollywood films. Why
  • The trust system can be easily broken with the assistance of any of the manufacturers.
    1. Content producers threatens legal action against Microsoft to get access to untrustworthy (user controllable) copies of Windows.
    2. P2P app thinks it can trust the OS
    3. CP obtains keys to app
    4. CP free to produce trusted apps and continue attacking the network (or they could just use the real P2P app and manipulate it on the fly)

    I believe the Content Providers will be able to coerce MS into providing the tools to carry this

  • What were they thinkin'? (Score:5, Insightful)

    by Geek of Tech ( 678002 ) on Monday June 02, 2003 @09:55PM (#6102104) Homepage Journal
    Okay... Trusted computing... Just running programs I trust... Kinda like not running an attachment just because it's there... Great...

    Question though... what's to keep MS from trusting a piece of software that I don't? ex. Bonzi Buddy, Xupiter, Save Now...
    It just so happens that I don't trust those apps. I don't really care for anyone to tell my computer that I trust these programs. Because I really don't.

    But legally, can Microsoft only trust who they want? Wouldn't they have to trust almost everyone? Can they legally say "We're not going to sign your programs as trusted" to anyone? Wouldn't that be anticompetitive, almost?

    It isn't okay to run spyware/adware/malware on my system.
    Is is okay to run programs that I have written myself.
    So why has MS done the exact reverse of this!?

  • The obvious flaw here is that the RIAA can take legal action against certification athorities for facililitating the sharing of copyrighted materials. If networks respond by allowing anyone to become a certification athority, then this opens the loop hole of trust all over again. Furthermore, the whole idea of trusted computing (as outlined in this paper) is fundamentally flawed, because you could still have a virtual machine from the BIOS on up, and who's the wiser?

  • The gist of what they're saying (Score:5, Interesting)

    by Otto ( 17870 ) on Monday June 02, 2003 @10:34PM (#6102372) Homepage Journal
    Okay, in summation:

    How to attack a P2P network (aka, find 'em, fake 'em, and kill 'em):
    1. Find 'em: Break the confidentiality. If you can sniff the network, and gain access to it, then you can find who has stuff being shared and thus sue them out of existence.
    2. Fake 'em: Break the data's integrity. Basically, shove in tons of fake data to piss off other users.
    3. Kill 'em: Break the availability of the network. Screw with the protocol, drop packets, generate thousands of fake clients, flood off other clients with search requests.

    How to defend a P2P with something like Palladium:
    Basically, it breaks down to not letting untrusted clients into your network. Since you can now trust that the hardware is secured, and since every client has to be vouched for in order to get in, you can stop all three of the attacks dead in their tracks. A P2P can be trusted in that other clients it tries to connect to will be able to verify that trust mechanism using the very same secure computing methods that this stuff gives you.

    Think of it like this. I trust Bob, so I let Bob connect. Bob trusts Cathy, so I can get a network of trust relationships going. Obviously, somewhere, someone could break that trust chain, but the existence of the trust chain is a new thing that hasn't been implemented yet. Combine it with encryption to prevent sniffing the network or at least make it way too difficult, and I can build a trusted network over which anything can be shared, *and* know that nobody is hacking my clients on either the software or hardware level, such that they can see or send things that they shouldn't.

    Find 'em breaks down simply by going through enough nodes to make it impossibly difficult to track down where the hell the data actually is. This is already a nearly solved problem anyway, with stuff like FreeNet's method of ensuring that even the clients don't know what they're sharing.

    Fake 'em is broken by the trusted architecture. I can trust, to some degree, anyone on my network because of the chain. I can trust the client isn't doing shit it ain't supposed to be doing. I can trust that the hardware hasn't been modified to some degree. I can revoke clients by breaking the trust links to them or creating an "antitrust" kind of link that other clients might use as well. If someone injects fakes onto the network, I put down that I don't trust them, and voila, that propgates to those who trust me and so on. Creates a closed circle.

    Kill 'em is broken by the same trust relationship to some extent. If the client can't get into the network, he can't inject things onto the network. Once someone doesn't trust that client, it finds that nobody trusts him anymore. If someone is attacking via flooding, obviously there's not much you can do except block them down the pipe, but the trust chain lets me tell others on the network that this guy is a jackass and thus they don't trust them either.

    And so on.
    • Think of it like this. I trust Bob, so I let Bob connect. Bob trusts Cathy, so I can get a network of trust relationships going. Obviously, somewhere, someone could break that trust chain, but the existence of the trust chain is a new thing that hasn't been implemented yet. Combine it with encryption to prevent sniffing the network or at least make it way too difficult, and I can build a trusted network over which anything can be shared, *and* know that nobody is hacking my clients on either the software or
  • Using Palladium to secure P2P would be a nice idea if, and only if, anybody could create applications that took advantage of the Palladium chipset. MS gives everyone the impression that this will be possible by saying things like "everyone will benefit from this technology", but the truth is that Palladium will be very protected by heavy, restrictive licencing. That's pretty much guaranteed.

    After all, this is one of the most important parts of the plan. You have to pay to write apps that use it, and this
    • Why would Microsoft have to authorize anything? Are you saying Palladium gives them a monopoly to choose the software you're allowed to install on your computer? What's next, leasing computers by the month and just paying a fee? As long as Taiwan exists there will be free "open" hardware we can run Linux on.

  • Haha! (Score:3, Funny)

    by Hard_Code ( 49548 ) on Monday June 02, 2003 @11:14PM (#6102657)
    You see, it's funny because they created something to slay a monster, but it just became a bigger monster! Laugh!
  • ...that on a system with Palladium hardware, if the machine doesn't boot with a trusted OS, the crypto service is locked down. This means that it's useless for someone running, say, Linux to try and join such an encrypted P2P network. So you can have your free files, in exchange for having them on a computer that won't allow you to do anything with them. Fun fun fun.

  • Isn't this already illegal? (Score:5, Insightful)

    by Nom du Keyboard ( 633989 ) on Tuesday June 03, 2003 @12:40AM (#6103055)
    the security features of Palladium could be used to create P2P networks that are more resistant to attacks from content owners.

    Excuse me, but isn't it already illegal to attack computers you don't own, even if you are the content owner? Nor, except for a few fake files, is it even happening?

    So it will be harder to do something that already is illegal, and already isn't happening.

    Boy, I just can't wait to upgrade my processor and OS to get all those benefits.

  • OH well (Score:4, Informative)

    by Pros_n_Cons ( 535669 ) on Tuesday June 03, 2003 @12:59AM (#6103149)
    It's alittle too late to get modded up but maybe one or two people will see this

    a few days ago I found a new p2p it uses SSL, proxys and tunnels though port 80. lots of other ways to trick the RIAA/ISP's from finding out what we'...ahem YOU are sharing.

    Unfortuanatly right now it only works on windows so i was hoping for some slashdot press so we could bug them to death with e-mails :D
    here is the site: http://www.earthstation5.com/homeweb.html
    if anyone has more information on this id like to hear it, all I know is what the developers want me to think since word of mouth hasn't spread yet.

  • author is clueless (Score:2, Interesting)

    by Anonymous Coward
    the author clearly has NO IDEA what palladium is all about. despite microsoft and AMD both releasing enough info publicly at a recent conference to prove that palladium will only allow code that has been audited and paid a hefty signing "protection fee" will be able to run under the new content protection level. (ie: consumer "rights" restricted video and music players/decoders)

    palladium has no other uses. its not being designed for that. in fact while your computer is not running rights-restricted cod

  • Uh, am I the only one? WAKE UP (Score:5, Insightful)

    by teamhasnoi ( 554944 ) <teamhasnoi AT yahoo DOT com> on Tuesday June 03, 2003 @01:49AM (#6103332) Journal
    How is this going to help piracy? Aren't all these programs, music, movies and whatever passes for 'content' for 'consumers' going to be *locked* to one machine? What is the use of sharing a hash of bits?

    Unless they are hacked, and then they won't be allowed to run on a Pull-a-DRM machine.

    Ever since DRM first reared its ugly head, I have been (hysterically, at times) hollering about how this is about 'content' control. Monopolizing the *abillity* to publish. (Subscribers can find many posts of mine dealing with that, amongst all the trolling I do ;)

    P2P will NOT be 'secure' on a Pull-a-DRM. It will not work! Even if the Pull-a-DRM system is broken by 3 lines of script, those who use the 3 lines will be sued or charged under some **IA brokered law. Sharing will be *restricted* to what the **IAs allow through their 'special' keys.

    Sure, copy, share, rip mix burn the newest crap as pushed on Clear Channel, but try and nab a homemade mix of some band you saw last night or a little video from your friend on vacation and it just won't work.

    Maybe MS has got it all figured out - somehow Pull-a-DRM just *knows* that Billy's video email is ok, but somehow I doubt it. Remember, YOU DON'T GET TO DECIDE - you are NOT TRUSTED.

    Everyone needs to realize that Pull-a-DRM will KILL what the net has done for independent musicians, filmmakers, artists, writers, and coders.

    It will be a cancer, slowly spreading. Mom will get the new PC "MSN 10" with the 'Super-Security'(for the kids). Things won't run, she'll bitch, more crap will be made to work ONLY with DRM. Boil the frog. It's what's for dinner!

    .
    DRM is NOT YOUR FRIEND

    • Obviously someone was too busy ranting to actually read the paper....

      How is this going to help piracy?

      By allowing p2p developers to lock out rouge apps that would tamper with their network. By tying reputation management to physical "trusted" hardware, so the (limited) damage possible by a user unmodified app can be attributed to that user in the future. Much the same way it will allow game developers to lock out cheaters with modified game software (IMHO, the only "good" thing that will likely result

  • You can't use the content (Score:3, Interesting)

    by zero_offset ( 200586 ) on Tuesday June 03, 2003 @06:42AM (#6104181) Homepage
    There are other flaws with this concept, but the main one is that the content being traded over P2P networks will also be DRM-ed into uselessness. In other words, if you're running Palladium (or NGSCSBSDCSN or whatever today's rename is), your machine is producing DRM-crippled MP3s, WMVs, and other files of intereste in this scenario. You can secure-P2P them to anybody you want. Or just e-mail them for that matter. The files won't play on the other end, because the MPAA/RIAA/XXAA already 0wns your box.

  • Who controls which P2P clients get signed? (Score:3, Interesting)

    by DickBreath ( 207180 ) on Tuesday June 03, 2003 @11:54AM (#6106103) Homepage
    Suppose I design a new P2P protocol. It includes all the l33t features. SHA1 hashes of each file. Reputation management. End to end encryption. BitTorrent like swarming. Other features to make traffic analysys more difficult. (You can't hack the trusted client, but you can still packet sniff the p2p traffic. So who provided the file?) Etc. etc. features.

    Assumption: Let's assume for the moment that Trusted Computing might turn out not to be evil. That is, I, me, anyone can sign an executable. The person who downloads it can authorize it to run trusted, and thus tamper resistant on their computer.

    I provide an implementation of my client. Signed and trusted.

    Now my protocol design and client really take off. Popular.

    My client and design are open. Others want to implement clients in other languages and for other platforms.

    Who signs these other new clients to make them trusted? I would assume that I would have to sign these other clients. Or alternately, all clients would have to recognize a certian set of signed clients as being trusted. If My client, Joe's client, and Jane's client are all trusted, then only me, Joe and Jane can build clients. Any other new clients must be signed by me, Joe or Jane, because all existing clients only recognize our three signatures.

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close