Sony Rootkit Included FairPlay DRM Encoding Ability?

[MacRumors]

While the internet has been rumbling in recent weeks over Sony's Rootkit DRM for Windows, one unannounced feature of the software installed apparently included open-source code to apply Apple's FairPlay DRM to included tracks.

The inactive code apparently supports conversion into FairPlay from a wide variety of file formats: MP3, MAV, RAW audio, and standard unprotected audio CDs. A breakdown of chicken/egg reverse engineering is found on this blog entry.

CNET's John Borland says Princeton researchers found the code while deconstructing the rootkit.

The use of FairPlay would allow copy-protected music to be played on iPods, which isn't possible with other DRM schemes.

 

[WM.]

Hmm. I don't think there's such a thing as a "RAW audio file"...

 

[lordj4000]

Hmm. I don't think there's such a thing as a "RAW audio file"...

Aren't .wav and .aiff files raw audio?

 

[WM.]

Aren't .wav and .aiff files raw audio?

Well, yeah, in some sense. But why the all-caps?

Okay, admittedly, I was also kind of excited to get first post and it was the first thing I noticed.

 

[D3LM3L]

So what does this mean?

 

[WM.]

So what does this mean?

The rootkit's ability to add FairPlay DRM to existing audio files doesn't seem all that significant (certainly no more than Real's software that does the same thing). The fact that they did it by including GPLed code, though, further reinforces what a cluster**** this Sony rootkit situation is. Cripes...

 

[Tulse]

I asked this on the Freedom to Tinker blog, and I'll ask it here: How can folks get upset about a violation of the GPL for software that violates a commercial license? If the GPL has any legal force at all, it has it for the same reasons that Apple's iTMS Terms of Service does, and works in the same way -- you agree to use the software only according to the licensing terms, and if you don't agree to that, you don't use it. Worrying about GPL violations for software that cracks DRM you agreed to seems to me to be bordering on hypocritical. If you can violate Apples ToS, why can't someone else violate the GPL?

 

[Makosuke]

Worrying about GPL violations for software that cracks DRM you agreed to seems to me to be bordering on hypocritical. If you can violate Apples ToS, why can't someone else violate the GPL?

I'm really not quite sure what you're saying, but I read it as people who are using X software to break Apple's DRM (and therefore ToS) have no right to complain if X software violates the GPL.

If that is what you're saying, how does that relate in any way to this story? Sony's rootkit had nothing at all to do with users trying to violate Apple's ToS at all--it was installed automatically by the autorun disaster that is their commercial music CDs for the purpose of protecting their music.

The fact that there's Fairplay code in there only indicates that the software was originally designed with the option to allow music it has control over (i.e. stuff that Sony is trying to prevent you from ripping in an open format to put on your iPod) to be put on an iPod. This feature isn't even turned on, and if it were I'm not sure whether it'd violate Apple's ToS or not--I'm reading it to mean it can "fariplay-ize" music, not "un-fairplayize" it.

Certainly it wouldn't violate the ToS from your point of view, only Sony's--you have rights to use the music on your iPod, and the software would theoretically give you that ability without forcing you to break any agreements.

What this really means is that the incompetent company that wrote the rootkit had the clever idea of reverse-engineering Fariplay to let their software, Real Rhapsody-style, move protected tracks to the iPod while keeping them protected. Except they were either so incompetent, or so lazy, that they didn't even bother doing the work themselves, instead bogarting some code from an open source project and of course not crediting them.

It's indicative of a serious lack of competence, ethics, and respect for any sort of law... not that this was in any doubt to begin with. The fact that it's Fariplay is interesting, but not particularly meaningful.

 

[iMeowbot]

Well, yeah, in some sense. But why the all-caps?

It's a bit of absurdity brought over from the photo industry. It's not even an acronym

Hmm. I don't think there's such a thing as a "RAW audio file"...

That would be the stream of numbers that you could feed directly to the audio hardware, without WAV of AIFF formatting. You can save that to a file if you like, but it's not very portable.

 

[nagromme]

I'm glad Apple had nothing to do with those Sony discs... the headline had me worried for a second

 

[Tulse]

I'm really not quite sure what you're saying, but I read it as people who are using X software to break Apple's DRM (and therefore ToS) have no right to complain if X software violates the GPL.

If that is what you're saying, how does that relate in any way to this story? Sony's rootkit had nothing at all to do with users trying to violate Apple's ToS at all--it was installed automatically by the autorun disaster that is their commercial music CDs for the purpose of protecting their music.

You've misunderstood me. I certainly wasn't suggesting that users who installed this would be violating Apple's ToS. My issue is instead with the vigorous defense of the GPL for DVD Jon's DRMS software, which clearly violates Apple's ToS (or at the very least that anyone using his software is violating Apple's ToS, presumably including Sony). What I find a bit strange is how legalistic some folks get about open-source software license violations, while at the same time applauding that software because it violates a commercial ToS. As I understand it, it's the same basic legal foundation for both.

So, to rephrase your paraphrase, people who support X software breaking Apple's DRM (and therefore violating the ToS) have no right to complain if X software's GPL is itself violated.

 

[dubbz]

What I find a bit strange is how legalistic some folks get about open-source software license violations, while at the same time applauding that software because it violates a commercial ToS. As I understand it, it's the same basic legal foundation for both.

Maybe because the GPL has no effect whatsoever on the end users.

If anything, releasing something under the GPL give *more* rights. Using DRM take *away* rights (and most EULAs also attempt to take away rights).

Also, the whole deal with EULA's and DRM cracking is not on solid legal ground in many contries. EULA's may or may not be valid, and cracking DRM in regards to fair use have been ruled legal in, amongst others, Jon's (previous?) home country.

Well, for now, anyway....

 

[BlueRevolution]

good. I hate monopolies, even when it's Apple that is the one with the reins for a change. I'd be very happy if iPods could play music bought from other online music stores, and if other MP3 players could play iTMS music. if only the industry could get their act together on standardizing DRM...

edit: ok, I so misread that. Sony has lost serious points in my eyes for the way they have done that, but my point still stands even if it has nothing at all to do with the topic at hand.

edit 2: my eyes have points?

 

[Tulse]

releasing something under the GPL give *more* rights. Using DRM take *away* rights (and most EULAs also attempt to take away rights).

Releasing something under GPL doesn't give more rights that releasing without that encumbrance, or else people wouldn't be complaining about its violation.

And my point isn't about whether GPL is good and DRM is bad, but about the legal foundation of both.

Also, the whole deal with EULA's and DRM cracking is not on solid legal ground in many contries.

As I understand it, shrink-wrap EULAs may be problematic, but I don't know of any regular EULAs that have been invalidated in any major jurisdiction. And, to put the shoe on the other foot, I don't know of any court that has upheld the GPL, or anyone who has successfully sued for its violation (if anyone has more information on either of these, I'd be happy to be corrected, as I am definitely not a lawyer).

cracking DRM in regards to fair use have been ruled legal in, amongst others, Jon's (previous?) home country.

Sure, but presumably those who use Playfair aren't all located in Norway.

Perhaps I spend way too much time on Slashdot, but I continually see people saying "Down with DRM! Information wants to be free! I should be able to do whatever I want with my music! Screw frickin' copyright! Screw the Terms of Service!"...while at the same time arguing incessantly over the most painful minutiae of GPL vs. LGPL vs. BSD licenses, and what is and isn't permitted, and how anyone who dares violate them should be sued for all they're worth.

 

[dubbz]

Releasing something under GPL doesn't give more rights that releasing without that encumbrance, or else people wouldn't be complaining about its violation.

Compared to standard copyright (which it whould fall back to if ever the GPL was invalidated) it does give more right. I'm not sure how it could be any encumbrace. It doesn't take away any rights.

And my point isn't about whether GPL is good and DRM is bad, but about the legal foundation of both.

The GPL or DRM, Good or Bad, was just to show why people might be more likely to be defensive of the GPL. Generally, people don't support things that can restrict what they do. (Re: The What I find a bit strange part of your post)

As I understand it, shrink-wrap EULAs may be problematic, but I don't know of any regular EULAs that have been invalidated in any major jurisdiction. And, to put the shoe on the other foot, I don't know of any court that has upheld the GPL, or anyone who has successfully sued for its violation (if anyone has more information on either of these, I'd be happy to be corrected, as I am definitely not a lawyer).

The GPL's been validated in Germany. SCO tried to invalidate it but didn't get far (and, ironically, they'd be screwing themselves if they had succeeded..). The relative lack of suits related to the GPL could just be that many (most?) developers that release under the GPL doesn't have the financial resources to do anything about it. They're often dependant on other ways to enforce the license.

As for EULA's I've remember seeing cases of both validations and invalidations in various articles (though no link, and i don't remember if they where in major or minor jurisdictions, so feel to disregard this). IMO, they're certainly questionable since they pretend to be a contract but are hardly anything like it.

Sure, but presumably those who use Playfair aren't all located in Norway.

True. But the previous Norwegian government proposed a change to various laws regarding music rights, sharing, etc. IIRC, even amongst the very consumer unfriendly changes to the law, it included the specific right to break copy-prevention on CDs for transfering it to other devices. Considering that Norway is required to implement the EUCD (Euro DCMA) directive, it whouldn't be far fetched to think that similiar rights be applied in other European countries whenever they implement new EUCD compatible laws. (I think a good part of them have implemented it by now, but admittedly I'm not sure how they stand regarding DRM breakage. I'll have to read up on that).

Perhaps I spend way too much time on Slashdot, but I continually see people saying "Down with DRM! Information wants to be free! I should be able to do whatever I want with my music! Screw frickin' copyright! Screw the Terms of Service!"...while at the same time arguing incessantly over the most painful minutiae of GPL vs. LGPL vs. BSD licenses, and what is and isn't permitted, and how anyone who dares violate them should be sued for all they're worth.

Well, yeah, I read Slashdot daily (painfully as it may be at times), so I know what you're saying. But it's not like ./ is some kind of Borg Hive Mind, even though it may seem so at times. There's people there with different opinions and the ones who's vocal opponents of DRM might not be the same one's who's doing the rallying call for a torchdown of some GPL Breaking Company's HQ... (unless you've detected some pattern. Admittedly, I rarely pay much attention to the poster's nick).

As for...

I should be able to do whatever I want with my music!

Well, why not? I bought it, didn't I?

 

[Sunrunner]

The rootkit's ability to add FairPlay DRM to existing audio files doesn't seem all that significant (certainly no more than Real's software that does the same thing). The fact that they did it by including GPLed code, though, further reinforces what a cluster**** this Sony rootkit situation is. Cripes...

It means that this whole DRM debacle has fried Sony in the PR world for the near term. They are burning up a lot of goodwill with the public due to this...

 

[ecoli]

gpl

Releasing something under GPL doesn't give more rights that releasing without that encumbrance, or else people wouldn't be complaining about its violation.

Releasing binary code under the GPL gives more rights than most other licenses. Releasing source code under the GPL may give fewer.

 

[savar]

Worrying about GPL violations for software that cracks DRM you agreed to seems to me to be bordering on hypocritical. If you can violate Apples ToS, why can't someone else violate the GPL?

I don't think you understand what Sony did. They violated a license agreement by using GPLed code...in fact they violated a number of terms of the license, not just a few. Try reading through it and see what they did.

The point is that its IRONIC that Sony violated a license agreement, when they've spent the past 7 years actively prosecuting music downloaders for license violations and intellectual property crimes. They are complete hypocrites, having been caught with their pants down.

It has nothing to do with the application of that code, which is DRM, or anybodys attempts to crack said DRM. If a music pirate came and made this claim, then yes they would be a hypocrite too. But copying music to your computer and/or MP3 player or backing up a CD should be part of your fair-use rights, AT A MINIMUM. So its not being hypocritical for most users on this form to call Sony on their violations/crimes.

 

[andrewm]

I suppose, then, that what we are arguing is:

- Sony violated the terms of the GPL.
- The GPLed code in question violated one or more EULAs.
- The EULA(s) in question are, in the eyes of some people, too restrictive, and it is up to the majority to take things into their own hands.

I could go either way here. Legally, the GPLed code was a work unto itself, so certain parts of it that Sony may have swiped clearly land Sony into territory that is illegal by the standards of most industrial nations.

If any of that code violated the copyright laws of those nations, then I believe that Sony performed no illegal action by reverse-engineering it, since the code had no expectation of protection under the terms of sovereign government.

It's also possible that we might, by listening to our CDs, be accepting the terms of an agreement to cut off our left pinky finger when we turn forty-seven if that very night is a full moon, or some such. Contract law makes for murky cases, and I suspect that this could be a long, long thread--at least if we don't get things properly defined, like piracy and fair use. And me? I can't perfectly define those.

Any lawyers out there?

 

[Tulse]

I don't think you understand what Sony did. They violated a license agreement by using GPLed code...in fact they violated a number of terms of the license, not just a few. Try reading through it and see what they did.

No, really, I do understand what Sony did. Honest. And DVD Jon arguable violated a license agreement when he wrote DRMS, and certainly people who knowingly use DRMS clearly violate a license agreement. That was my point -- the situations are pretty much equivalent in terms of legal principle.

The point is that its IRONIC that Sony violated a license agreement, when they've spent the past 7 years actively prosecuting music downloaders for license violations and intellectual property crimes. They are complete hypocrites, having been caught with their pants down.

And I agree it is extremely ironic, and that Sony are hypocrites. But that wasn't my point. The point I was making was that it was hypocritical to applaud the violation of one license while fighting for the legal status of another. And not just hypocritical, but counterproductive, since it undermines the legal foundation of the open source license.

It has nothing to do with the application of that code, which is DRM, or anybodys attempts to crack said DRM.

From my perspective, it does. If the GPLed code were for, say, a driver, or some boring shared library, I wouldn't have commented. But I really do find complaining about how Sony violated the license of software that violates licenses a bit odd.

If a music pirate came and made this claim, then yes they would be a hypocrite too. But copying music to your computer and/or MP3 player or backing up a CD should be part of your fair-use rights, AT A MINIMUM. So its not being hypocritical for most users on this form to call Sony on their violations/crimes.

But Fairplay does allow you to copy music to your computer and back up to a CD. No, it doesn't give you the same freedom as does an unencumbered MP3, but I'm not sure that it doesn't give you enough rights to meet reasonable fair-use. In any case, what should be the case isn't always consistent with what is legally the case, and it was legality that I was talking about. I don't know how legally enforceable Apple's Terms of Service are, but I'll bet they're more enforceable, and on stronger legal ground, than the GPL. Certainly there's more legal precedent for such ToS than for the GPL.

Please don't misunderstand me -- I don't hate open source software, or think that the GPL is a rotten idea, or believe that Apple can do no wrong. I like the notion that someone can, if they choose, essentially give their software away with rather minimal restrictions. But it seems to me that the very foundation of the GPL is the notion that a creator of software can set the terms by which other folks use that software. I just don't see how one can uphold that principle for DVD Jon and not for Apple as well, at least not without courting contradiction.

 

[johnnyjibbs]

This is interesting. So someone out there is thinking about Macs..

I just hope we don't see any more of this style of CD.

 

[Choppaface]

The point I was making was that it was hypocritical to applaud the violation of one license while fighting for the legal status of another. And not just hypocritical, but counterproductive, since it undermines the legal foundation of the open source license.

Apple makes money taking our rights away, and DVD Jon makes no money giving them back. What is "a bit odd" about supporting the guy fighting big business for the benefit of the people? It's been done plenty of times before. Saying that those who support DVD Jon here are hypocrites isn't much of an argument but an observation, and one that eludes to your point of view. If you want to say that in the long run people don't benefit from what DVD Jon has done, so any defense of him is immoral, then that would be an argument.

The only reason you're hearing this kind of story though is because DVD Jon's stuff is open source and Sony trampled on that, so you kind of have to be open minded to those who believe in supporting open source till the bitter end. Otherwise, why not just turn off the TV?

 

[Photorun]

Please don't misunderstand me -- I don't hate open source software, or think that the GPL is a rotten idea, or believe that Apple can do no wrong. I like the notion that someone can, if they choose, essentially give their software away with rather minimal restrictions. But it seems to me that the very foundation of the GPL is the notion that a creator of software can set the terms by which other folks use that software. I just don't see how one can uphold that principle for DVD Jon and not for Apple as well, at least not without courting contradiction.

And you're missing/ignoring another huge point perhaps, if DVD John has a disclaimer so you know what's going on and Sony, basically, wasn't going to/about to tell anyone that they were for all intent and purpose putting spyware on your computer, that's infinitely more heinous an offense for Sony.