Apple's iTunes DRM Cracked?

joekra writes "The author of DeCSS is back in the spotlight with a new application called QTFairUse. The new application attempts to convert DRM'd AACs to non-DRM'd AACs on Windows machines. MacRumors has done some limited testing on it and has found it doesn't yet work as advertised... but they do offer a look into how it works."

Also discussed on Hydrogen Audio

thread here [hydrogenaudio.org].

QuickTime hacked, not Apple DRM cracked

I read the comments on MacRumours, and basically this program is not an Apple DRM crack but a hack for QuickTime (windows version) which dumps the decrypted AAC stream to disk before it is sent to the AAC. This is done by patching QuickTime and writing the data in memory to disk. It is easy for Apple to change QuickTime to make this app useless, but it is nevertheless an interesting approach.

That said, it is certainly possible to reverse-engineer the decryption routine in QuickTime instead of hacking the application itself. It is just a matter of time.

Re:QuickTime hacked, not Apple DRM cracked

You can't beat an army with a stronger will and with greater numbers. It's why the US lost in Vietnam and why things will always be cracked. You can't beat an army of pirates (some perhaps academics) willing to crack for free.

Unless, of course, DRM makes it into all hardware, computers are sold with locked operating systems that can not be overridden, and Hollywood sees its dream of a completely controlled computer come to light.

Re:QuickTime hacked, not Apple DRM cracked

Dear Mods-Are Us Customers,

We appreciate your business through all these months, but sadly we must inform you that MAU is closing shop. we recently ran into some Dastardly, Mean, Cunning, And awful leagal problems that have run our business deep into the red. We regret that we are unable to continue service, but we look forward to being able to provide other services to you in about 10 to 20 years.

Sincerely,

The Mods Are Us crew

Re:TCPA loophole?

As long as there's one link out there that is not controlled

Yeah, you can try to find an ISP that doesn't force Trusted Computing on you. It can be a major problem though. But you are still going to be locked out of any websites and other things that use it.

And once a signifigant number of ISP's use it they can enforce it end-to-end for the entire internet chain. Any ISP that doesn't use it could be locked out.

there will be workaround drivers, etc that will provide the challenge/response mechanisms of TCPA without the DRM bullshit.

I'm a programmer and I've studied the design. You can't work around it with drivers. The challenge/response mechanism is cryptographicly rock-solid and relies on keys locked in the hardware. Every ship has a different key and those keys can be revoked individually or every key from a given manufacture can be revoked en-mass if one of them botched their design.

Barring a major mathematical breakthrough or fully functional quantum computers, the only way to defeat the system they've designed is a serious hardware hack. One method would be to dig your key out of the crypto chip. Chemically strip the chip and read your key with a high-power microscope. You could then run an emulated TCPA system and have total control over your computer. The other approach would be to allow the crypto chip to function normally but to seize control over signals on the motherboard. I think digging the key out is probably the easier option.

Either method requires a pretty well stocked lab. A student could probably do it in a college lab. The problem is that either method really only "fixes" a single computer at a time. If you try to use the same key on multiple machines they could detect that and revoke the key. That forces you to dig out a seperate key for each computer.

The REAL fix is for the news media to pick up on the real story and for the public to reject the system. There was an uproar that killed the Pentium3 CPU serial numbers, this is far nastier. The problem is that they are going to spend a fortune on disinformation and propaganda campaign claiming that it is a good thing.

Every single argument in support of it can be shot down with a single argument: There is no possible jusification to forbid the owner from knowing his master key. Given identical hardware you still get every claimed benefit when the owner has his master key, and having your master key eliminates every possible way the system can be abused against the owner.

It is an easy and non-technical concept that the public can understand:
(1)The owner should be able to know his master key.
(2)The mere fact that you know something cannot reduce your computer's ability to protect you.
(3)Knowing your master key means that no one else can take control of your computer and use it against you.

There is absolutely nothing wrong with "new hardware", but the owner MUST be allows to have his master key.

Of course the Trusted Computing Group will never willingly agree to do this, their defininition of "trusted" is that you can't control your computer. They want to trust the computer to enforce DRM against it's owner. Their whole strategy is to market the benefits of new hardware while ignoring/concealing the fact that it does not justify denying the owner his master key.

They are/will be advertizing how good and nutritious apples are. Pointing out that they are packing cyanide pill inside isn't good enough. If we argue against poison apples we'll lose. People will buy the advertizing and take the good with the bad. We need to hit them with the argument that they are simply refusing to sell apples without poison pills. It will be a difficult argument because it is a technical issue, and they will do everything they can to dodge it. They are going to present it as an all-or-nothing package deal.

-

Re:TCPA loophole?

there is an easy crack. Two PCs, one secure, one not. insecure transparently forwards the challenge to the secure and sends back the response.

It doesn't work. You'd capture the entire conversation, but it is pure encrypted garbage. The data is encrypted with a key locked inside the crypto chip on the "secure" PC. The computer transparently forwarding the data doesn't have the decryption key thus it can't understand any of the data passing in either direction.

The only way to beat the system is with an extremely sophisticated hardware hack to the motherboard or by chemically peeling your crypto chip and reading your key out with a microscope.

-

Re:TCPA loophole?

Clever a troll you are.

No, and I DEFY you to refute anything in this post.

fabled rights breaching technology?

Do you have any idea how Trusted Computing works? I'm a programmer. I have read the design specifications.

It is a very technical issue and there is bad information flying around on both sides, but I have boiled it down to one simple and unbeatable argument. There is absolutely nothing wrong with the "new hardware". The sole problem is that the "new hardware" keeps your master key locked up inside and the owner is forbidden to know his master key. This leads to three points:

(1) Assume two identical computers with identical hardware. The first one is "Trusted Computing" and you are forbidden from knowing your master key. The second one is "new hardware" and you know your master key. There is NO POSSIBLE WAY that the first computer can protect you that the second one can't do just as well. The second computer preseves EVERY claimed benefit.
(2) If you do not know your master key then others can control use your computer against you, such as enforcing DRM. If you know your master key then YOU have control over your computer and it can never be turned against you.
(3) The owner of the computer has every right to rip the chip open and read his key out with a microscope. Yeah, it takes a decent college lab to do so, but you have every right to do it. Once you have dug out your master key then you have total control over the system as I described. If the owner has every right to dig his key anyway then why the hell shouln't the owner simply be GIVEN his key up-front?

So (1) giving the owner his master key presevres every benefit to the owner, (2) it eliminates every abuse, and (3) the owner has every right to get it anyway.

I have no objection to the "new hardware", but there is no POSSIBLE way to justify the design specification forbidding the owner to get his master key. The only possible reason for that requirement is to take control of the computers away from the owners. That requirement can only serve abusive purposes such as enforcing DRM against the owner.

The TCPA design specification specifically reffers to securing the system against "rouge owners". If the system were in fact designed for the owner's benefit then there would be no such thing as a "rouge owner".

These chips will be industry-standard for all motherboards. Microsoft has stated that the TCPA-chip is a component of their Palladium system. This is not a "crock conspiracy theory" - this is corporate press release. It is no conspiracy theory that the Cisco routers deny the end user an internet connection unless they are Trusted Computing compliant, it is corporate press release.

There isn't any press release about ISP's using these routers, but it *is* blatantly obvious. They are being promoted for fighting viruses and worms, what ISP doesn't want to fight viruses and worms? It will be promoted to fight spam, what ISP doesn't want to fight spam? It will be promoted to fight hackers and pirates, what ISP will refuse to fight hackers and pirates?

The only signifigant leap is about the possibility of backbone routers using it. Well, that is up to the handful of corporations that run the backbone routes. Assuming a signifigant number of ISP's have already switched over there is nothing to stop them. There will be all sorts of pressures for them to do so for all of the reasons listed above. The routers can check for far more than just anti-virus software. They can be used to enforce all sorts of contract provisions with ISP's - access rules, billing systems, bandwith limitations, anything. They have countless motivations to do so. They won't use these routers as part of a "conspiracy", they will do it out of self-interest!

But fine, lets say this never reaches the backbone. You still have a situation where all new PC's come with this hardware built in. You have ninty-odd percent of the public running whatever operating sys

Re:TCPA loophole?

Or do you claim that communication with the Internet of the future will require the TPM to be turned on?

Cisco, Symantec, and Trend Micro have issuded press releases about new routers that will deny you an internet connection if you aren't running Trusted Computing.

Of course they advertize it as an anti-virus measure. Even the slashdot story got it wrong: Cisco Working to Block Viruses at the Router [slashdot.org]. These routers do not block data. They require you to be running Trusted Computing and then they can be further programmed to check that you are running specific anti-virus software using remote attestation.

Cisco's Network Admission Control program would enable companies to install on every PC and mobile device a client, called the Cisco Trust Agent, which could attest to certain levels of security... [com.com]

However, the technology won't work unless security software can tell the Trusted Agent application the current state of security on the computer or mobile device.

The technology might also spur sales of PCs and devices that use trusted-computing hardware--controversial technology that uses encryption, special memory and security software to lock away secrets on a PC from prying eyes...

"We need a trust boundary between the network and these devices, and the system needs hardware and software to do that,"

Sure, they are advertizing it for corporate network use, but can anyone really doubt that ISP's will start installing them and requiring you to run Trusted anti-virus software as part of the terms of service?

If you don't submit to Palladium / TCPA / whatever, then you will be denied any internet connection at all.

-

Re:QuickTime hacked, not Apple DRM cracked

What's interesting about this (from a fair use standpoint) is that it only lets you get the AAC data if you have a computer that will play the protected file. This means that you can now play the AAC files with non-Apple hardware/software.

However, it doesn't let you play someone else's DRMed .m4p files. They person who is licensed to play them would need to decripple the files first using this tool.

Therefore, it's questionable whether this is really circumventing a copy-protection mechanism, since this method only allows the "rightful licensee" to extract the AAC. If that's not fair use, then I don't know what is.

Re:QuickTime hacked, not Apple DRM cracked

It makes piracy a hassle for whom? Certainly not the pirates. They'll just go on sharing perfectly unenecrypted files.

DRM only inconveniences the people who are paying for their music.

Exactly. In reality, there are only a few types of people out there in terms of music, and piracy in general:

• Die-hard Piraters: These people will pirate whatever they can, from whatever source. They pay for nothing, ever, be it software or music, movies, etc. VERY legally Liable
• Convenience Piraters: If it's easy, and they think that the legal way of getting it is too expensive/inconvenient/restricting, they'll pirate stuff, but only at near-zero risk of getting caught. Only really liable to RIAA, and not worth pursuing.
• Non-pirates, but Hackers (us): Won't do it because their morals actually tell them that even if it IS easy, if there is NO chance of getting caught, it's still wrong, and so they don't pirate anything because of morals, but wanting to help the little guy too.
• RIAA and MPAA Lackeys: These people are the absolute angels to people like the MPAA and the RIAA. Do what you're told, buy our things at our terms, and we'll all be happy. Ya right, but they do exist, and at least they are safe from lawsuits (probably, but DMCAv2 and other things may make even the innocent guilty).

The first group are NOT in large supply, but do provide a fair amount of content you otherwise wouldn't see, like movies out before they are in theatres, cracked full versions of expensive software tools (almost any Adobe product), etc. These people are NOT going to be stopped by anything short of MASSIVE inconvenience to pirate something, or uselessness even if they did. CD Keys for Online Play are a good example of foiling these people, at least to a degree. Games that have MOST of their value online (Quakes, *Craft, etc) will lose relatively fewer players to piracy, since the CD Keys will keep the online stuff straight (for the most part. I know that there are workarounds, etc, but this is in general).

The Second group, of what I call "Convenience Piraters" is quite a large group. Most people who download music that they didn't buy fall into this catagory. They are also the group that is most easily targeted by Online Music Services like iTunes. Most times, the things pirated by them they see as not hurting anybody, and/or that it's overpriced anyways (music fits this perfectly). A moral discussion about this is a whole topic in itself, but most of these people don't see what they are doing as really "wrong", or else they probably wouldn't do it, because they are basically good people.

The Fourth group of Lackeys is self-explanatory.

US! Some of us sometimes fall under Convenience Pirates, but most of the time we don't. But most of us believe in Fair Use, and we make many great tools that let us use our LEGALLY obtained media and other things. MPlayer should be completely legal everywhere, as any other "player" should be. Same thing as DeCSS. The first group of rampant pirates use tools like DeCSS to pirate and hurt people, but people like us use them for playing our stuff, not distributing it to 100k people.

We are the most misunderstood group, but also often the easist to target with lawsuits, like Jon Lech Johansen with DeCSS, and recently with the iTunes crack. [nanocrew.net] We want to use our legally purchased stuff however we want, and even though bad apples (that first group again) will misuse it, that doesn't mean that it should be illegal.

It is ironic how Sony went to bat for the consumer in the BetaMax case with VCRs, and is now on the RIAA's side for music. These companies need to realize that if iTunes distributed music in OGG format, that piracy would not go up much, if at all. People would be HAPPY with what they have, and any distribution of such files would be 100% illegal, with NO legal middle ground. (For those who don't know, in the early da

Re:"If that's not fair use..."

You also don't seem to know what fair use is.

Fair use is anything that, in light of the four factors listed in 17 USC 107 (or via judicial tests that predate that codification) is fair.

The examples given in 107 are NOT blanket allowances. They're illustrative of the sorts of things that might classically be fair use. That's why it says 'for purposes such as' and not 'only for purposes of.'

Reproducing and distributing otherwise infringing copies on street corners may not be infringement if it's fair per the four factor test. And yet there have certainly been educational and news reporting infringements that were not fair uses.

Re:QuickTime hacked, not Apple DRM cracked

That comment shows why DRM is nothing to do with fair use.
If you bought a DRMed track then fair use probably allows you to re-encode it as a non-DRMed track for personal listening on a machine that can't cope with DRMed tracks.
However, being able to remove the DRM from a file doesn't give you the right to redistribute the content (via kazaa or whatever) whether you bought the track or not.
DRM systems that can be rendered useless by the breaking of a single version of a single player application are useless as a means of prevention of the redistribution of copyrighted material - you can bet that if a vulnerable application exists the big-business pirates will get a copy of that application. As it stands the DRM on DVDs has been rendered useless; the DRM on Apple's AAC files may be about to be rendered useless; I wouldn't bet against Microsoft's WMA being broken at some point (it only takes one faulty version of Windows Media Player, remember). DRM has not, does not and will not prevent commercial 'piracy'; it just restricts the utility of digital media formats to the average consumer.
This is why, even back in the day, the DeCSS case[0] was so important. It demonstrated that DRM mechanisms were only as robust as their most fragile player application (and therefore, given that software is inherently buggy, fundamentally unsound as an honest business method).

But its probably irrelevant...

Because if you're intent on pirating commercially, you'll just buy the CD in the first place. What's $12 for a CD if you're intending on ripping off the thing and selling it illegally?

This is kind of a tempest in a teapot, really.

Re:QuickTime hacked, not Apple DRM cracked

the DRM on Apple's AAC files may be about to be rendered useless

I'm of the opinion that it was already useless. iTunes allows you to purchase the DRM'ed music, burn it as an Audio CD, then rip it as AAC, MP3, whatever you want without any DRM on it at all. The cost is a blank CD-R that, once done, is perfectly playable in any CD player, so its not even a wasted CD.

All this is possible with iTunes right out of the box without any special tools. All this "FairUse" tool does is save you one step.. and one CD-R.

Re:QuickTime hacked, not Apple DRM cracked

So what if Apple updates Quicktime? Unless they change the AAC format to break the current version what's the incentive to update if you have a version which allows removal of DRM from AAC?

Well, they can just "update" iTMS and force all users to upgrade iTunes (and QuickTime at the same time). This will at least make it even more time-consuming to convert the AACs.

(I see QTFairUse just as a proof of concept, but it shouldn't be difficult to write an easy-to-use application which uses QuickTime to convert the files with just a few mouseclicks.)

Maybe they'll figure this out someday

One day they'll figure out that computers have made the marginal revenue for producing a song ~= $0. The whole music industry needs to undergo a revolution to stay profitable and I don't think anyone has figured out what that revolution needs to be.

Re:Maybe they'll figure this out someday

I don't think anyone has figured out what that revolution needs to be.

making good music would be a start.

Re:Maybe they'll figure this out someday

I don't think that computers remove the profit from producing music, just from distributing it. As long as there's a demand for music, artists can sell it for some price and make a living from it. But with iTMS, Amazon's recommended lists, fan bulletin boards, and so on, there's no need any more for a massive information and distribution network like the RIAA. People can find what they like and hear about other music from people with related tastes, and they can do this on their own. I think that's probably the biggest threat to the RIAA: informed consumers.

But I guess as long as they have money and are able to buy politicians, they'll stick around.

But the profit can be removed from producing

with digital audio editing programs. Long gone are the days that require million dollor studios to be able to create a polished piece of work.

Now, a talented producer/sound guy is still needed and still requires skills. But anyone with a natural sound for music and practice can be damned good.

Re:But the profit can be removed from producing

I think you are wrong. If you had ever tried to self-release a CD (like I have), you'd soon realize that it is expensive as hell to do so.

Want to record? Well, you need something to record with. A 16-track hard disk record will run you about a thousand. About the same to get an RME Hammerfall Lite used and a pair of eight channel Analog to Digital Converters (still around $800 just to do eight tracks at a time, which is more than enough). Then you need software which is expensive as hell. Or you can go down the Free Software route and use Ardour (which is entirely reasonable for a demo, EP, or first album). So then you need equipment to record with. Mics run about $90 a piece for SM58s ($85 if you know the pro-audio guy at the local shop) and $80 for SM57s ($75...). Then you need cables, stands, monitor speakers, etc.

So now you've just spent about $4000 (assuming $0 for software costs) on a rig that can be used to record at most a five piece drum kit. Of course, you can rent this system...and if you have a live sound PA the equipment you need overlaps very nicely (out of the $4500 in live sound stuff I have about $3700 worth of it [basically everything except for my PA cabs and monitors] can be used in a recording rig). Or you can just go and get a pro to do your recording at around $30 an hour (and that is on the low side). You'll probably end up spending a good fifty or sixty hours in the studio to lay down the tracks for a four or five song EP (assuming four minute song length).

Going down the paying-something-else-to-do-it route is cheaper in the short term (but having all of that equipment is more fun). Recording turns out to expensive, but getting cds pressed costs about the same. If you want a run of 1000 discs with one color printing on the disc and a two color single page booklet with two color inserts in the jewel case you are looking at around $1300. Anything less and the per-disc price becomes a bit...obscene. And I left out the money you have to spend on getting the artwork ready for press (even if you do the artwork yourself you still need to pay a print shop to pre-press it, and they charge an arm and a leg for their services).

Then comes the promo for the album...in the end, it costs a lot of money and only established bands that play fairly often to decently sized audiences can afford to do it without killing the members financially (because, quite honestly, if you are in a band that is self-publishing an album you more than likely still have a day job and that job is going to be low paying but allow you flexible hours so you can tour and whatnot).

Or you can go the cheapass route and record stuff in your friend's basement on his computer (in all the glory of two-tracks-at-a-time) and then get someone to burn you a few hundred discs, print a sheet of labels, photocopy said label sheet onto more label sheets at Kinkos, and then do the same for the booklet pages. Then you have your friends stay up all night in someone's room cutting out the booklets and stapling them together and building your jewel cases...ahh, good memories. Personally, I'd do that with a four or five track EP-length album to get the money up to press a short run of seven inch records and then use the money from the seven inches to get a real album recorded.

Then again, I'm used to being a part of the Hardcore Punk scene where one normally releases a split 7" record with another band (usually with the first run on some colored vinyl to make people want to buy it) before going on to record your own 7" and then an album or demo depending on how well the 7" did. I'll probably be looking at doing the same thing again in a month or so...

Re:Maybe they'll figure this out someday

The problem is that our money based economy is becoming dated and it's beginning to show. A money economy is great when it takes work to produce goods but as the work it takes to make stuff goes down (invariably due to the reliable automation of many of our industries) the price will drop as well. When the cost of food, shelter, and entertainment drop to all time lows the demand for the amount of work that needs to get done will drop. Soon everyone only has to work 7 hours a day to keep the food and goods coming in, then 6, 5, 2, 1, and in time 0.

This shifts an incredible amount of power and responsability onto the goverment and corperations. Another paradigm that will come into being is that media produced 20, 200, or 2000 years ago will still be popular today. Can you imagine the amount of music that can be created in this timespan? When demand is satiated, there is no demand. So why creat more media, for example, if there is already more than enough to last any one human their entire lifetime?

What will need to take place is a fundemental shift from a greed and need based economy, to a curiousity based economy. If all the things a person needs are free, then there is no reason to work for them. Therefore, one would learn how a machine works because they are curious and want to while a class of elietists would be kept to ensure the system would be maintained.

This may not happen for another thousand or two years, and may involve bloody uprisings and insurgencies, but it'll happen one way or another.

Re:Maybe they'll figure this out someday

Today's wants are tomorrow's needs. You really ought to read some Adam Smith.

The desire for goods and services will never go away. When food becomes free, people will take that money and spend it on other things. When those things become free, people will spend it on yet other things.

If robots manufactured every material thing in the world for free, people would pay money for ideas. Or for the human touch of service, or for the nostalgia or curiosity of non-robot manufactured items.

To want is a basic foundation of human nature. To say that some day we will never want (which is basically what your post maintains), is to completely ignore a fundamental human trait.

Re:Maybe they'll figure this out someday

If robots manufactured every material thing in the world for free, people would pay money for ideas. Or for the human touch

Hey now, some of us already pay for the human touch... or are you saying that sort of thing might be made legal?

Re:Asking for trouble AND vague description. Wow..

It's being compared to an analog hole attack because it doesn't actually solve the encryption scheme, but instead lets QuickTime do the decryption, and then captures the plaintext AAC file that is stored in memory.

Truely, it's still digital at that point, so it should be called the "plaintext hole".

Negative Impact..

Hopefully this doesn't have any negative impact for the end users. It's always sad when the generic end user gets screwed because someone decided to hack/crack a product to give them additional functionality.

Re:Negative Impact..

How does hacking like this negatively impact end users?

Let's try this example: iTMS AAC is cracked. Apple fixes. Cracked again. Apple fixes. Cracked again. Apple fixes, but RIAA says game over. Now, people like me who like iTMS and use it legitimately can't use it anymore. I'd call that a negative impact.

Re:Negative Impact..

What about DVDs? They were cracked, and DVD sales are just the same as before. When CDs were created, nobody expected equipment to rip and burn them would be accessable to consumers, and yet CDs are still around. Audiocasette recorders caused legislation reinforcing a consumer's right to make personal copies. There was legal controversy about the Xerox machine, and about player piano tapes.

Ever since there's been 'content,' there's been demand to copy it, and human ingenuity has 'cracked' whatever protection there was. But this doesn't harm the medium, in fact, it makes it more valuable to honest people. There will still be a demand for iTunes and friends, so the MPAA won't stop. There isn't a consumer demand for draconian hardware DRM, so I don't think it'll happen. This is driven by greed, but in the end, consumers want cheap, legal downloads with minimal (hopefully nonexistant) DRM, so that's what'll happen.

This 'crack' won't affect Apple's relation with the RIAA, nor the service, nor even the software, in any way. Why? iTunes lets you burn CDs, and CDs can be ripped. This crack only gives people slightly better quality and saves them a CD-RW. It also makes it a bit easier to get the files off a Bochs or VMWare system. Even if it did allow something that wasn't trivial before, it wouldn't impact iTunes sales or piracy significantly.

Re:Negative Impact..

quick, we better make CDs illegal!

He must enjoy court

Why release it with your name attached to it? Didn't he learn something after the whole De-CSS trial?

Re:He must enjoy court

Why release it with your name attached to it? Didn't he learn something after the whole De-CSS trial?

Yep. That his lawyer need only reach for his notes for applicable case history should Apple- or anyone else for that matter- choose to try him again.

The next step

I am the person who did the original testing for MacRumors. Here are the final steps:

The raw aac file that QTFairUse produces can be played in a windows app called foobar [foobar.com].

To play back in itunes is a little harder. One must run an application called faad.exe to fix the "atoms?" of the aac file. After that is done one must add the MPEG-4 wrappers using the program mp4creator found in MPEG4IPutils [hydrogenaudio.org]. Make sure to use the -optimize tag, or else the file will triple in size. After this is all done you end up with a m4a file with the decrypted aac content in a MPEG-4 wrapper playable in itunes.

Re:The next step

Don't you mean foobar2000 [foobar2000.org] using the AAC plugin [foobar2000.org]?

Jon was probably more careful this time

For any question related to DeCSS or QTFairUse, you can reach Jon at [e-mail]

Here's a photo of his new place of residence [demon.co.uk] incidentally ...

Next up

DRM in iTunes is changed. Please repurchase all of your old songs. Seriously, the DRM with Apple's music wasn't that bad. Why make it so that they have to change things around? Remember iTunes Music Sharing? You use to be able to stream from any computer to any computer. Since people didn't use it for personal use, they forced it to only work on the same subnet (thereby not allowing users at work to access music from their home machine). I wouldn't say Apple is perfect, but they're more on our side than Microsoft is.

Re:Next up

Apple has consistantly had a stance against DRM, and this is the first time I've ever heard of the copy-protection in iTMS as DRM.

I suppose at SOME level, every copy protection qualifies as DRM, but come on. I view DRM with the connotation of "draconian" restrictions on what a user can do with it.

Apple doesn't prevent you from making a backup copy of the file, or distributing the file to other computers, it just restricts certain computers from playing it, if they haven't purchased it.

I personally don't see anything wrong with such an approach, it's called LEGAL.

Now, writing a system that breaks the second you touch the file with anything but a DRM approved player, or for that matter, working it into the OS so you CAN'T do anything with it at all. That's stepping over the line.

People have to make money at this at some point, and for the almost painless restrictions that iTMS puts on their music, it's one our side, and their side. A good comprimise in convienence and protection, where if you REALLY want to get it free, then you can get online and grab it anywhere else easier than you can break their protections. And they make money because you pay for the convience of being able to just *click* and download.

Re:Next up

The "CD hole," besides being annoying, is absolute proof that you've been lied to, repeatedly, by the RIAA.

They claim DRM is about stopping piracy. This is a blatent lie - obviously, pirates can just burn, rip, and redistribute. Or buy the CD, or check it out from their library. That the system allows burning to CD is clear evidence that pirates are not the target.

The target is your fair use rights. Many companies had tried to sell DRM music with draconian restrictions, but they were a step backwards from the freedom of a CD, so they failed. The RIAA realized they needed to start slowly, offering a DRM system with very few restrictions. The restrictions will slowly be made more draconian, and nobody will notice. With a complete lack of competion in the industry, nothing will stand in the way.

Enter iTunes. People vehemently defend Apple now, and they will continue to do so when Apple and the MPAA remove ripping rights. "You can still play the music on your iPod," they'll say. "We would love to let you rip, but piracy was too much of a problem," the RIAA will lie. But they will have won: there will be a point where the DRM infrastructure will be mature enogh to support whatever restrictions the RIAA wants. Consumers will have nowhere else to turn, they will have given up their freedom, not even for their safety, but for their convenience.

Re:Next up

with anything but a DRM approved player

You mean like iTunes downloads, which you can only be played in an approved player? iTunes *does* use DRM. You cannot do anything with the file that the DRM system and DRM players do not specificly enable. Just because their system allows you to play the file on three appoved computers does not change the fact that it prevents all other perfectly legal use.

Lets take an example. Some people like to play their music backwards looking for hidden satanic messages. Some bands have even included such backwards satanic messages for laughs. Playing the music backwards is perfectly legal use. This use is impossible with the approved DRM players, and it is a violation of the DMCA to "traffic" in circumvention of the DRM - circumvention that is required in order to make a player that can play it backwards.

Maybe you think that is a silly example, but it makes the point that ALL USES are blocked, other than uses specifically enabled by the DRM approved player. The data is encrypted, you can't do ANYTHING with encrypted data.

the almost painless restrictions that iTMS puts on their music

Yeah sure, it's "painless" so long as you only try to do the few things they programmed their DRM player to do. The restrictions become a painful brick-wall the instant you want to do any other perfectly legal thing.

-

Why do this?

By breaking the means the industry hopes to use to make their business viable you are only going to force them to cancel future projects which make music and other media easy for consumers to buy. Not everything can be free. Do you expect to get paid for a days work? And if Apple is forced to end their service because everyone just steals the music, then what will be left with? I will tell you. Microsoft will push a DRM-based protection scheme which is based on hardware and locks out non-Windows users.

Stop screwing these companies!

Re:Why do this?

Consider the issue of DRM-enabled music from the perspective of someone who doesn't download illegal music, but who has a mix of devices (home stereo, desktop PC with CD player, MP3 player, laptop PC, car CD stacker, ...) that they use to listen to music. At a guess, there are quite a few people who fall into this category.

There was a time just a few years ago when, if I bought a music CD, I could play it anywhere. I could play it at home, on my computer, in my car, in the PC at work... - whereever I wanted to play it, it worked. I could copy it to tape and listen to it in my Walkman, and it was all totally legal.

Today, the record company model appears to be based around consumers buying music for use in exactly one device. Music CDs are now "enhanced" to try to prevent people playing them on their computers; paid-for, downloaded music is now DRM-wrapped so it can't be burned to music CDs and played on home stereos or in cars. Based on this, you have to assume record companies expect people to buy multiple copies of the same piece of music if they want to listen to it on a mixture of devices.

That would be fine if I could buy several copies of a piece of music (as is now necessary to play in all my devices) for the same price or less than I used to pay for a single music CD that I could play on all of them. In fact, it would be a great thing if there was some music (e.g. music that I only listen to while working out, and not on my home stereo) that I only wanted to listen to on one type of device - I wouldn't need to buy the version that played on my home stereo, so I'd be saving some money.

What the record companies have done, however, is to charge full price for each piece of music on each medium. Whereas before I could buy a single music CD for $X and play it anywhere, now I need to buy the music CD and download the DRM-wrapped WMA or AAC file and it costs more money than it did before.

A lot of people would get upset at that point, but even that situation might be tolerable if (a) the record companies offered a bundle of both CD and WMA/AAC files at a suitably discounted cost, (b) they made the purchase process a particularly enjoyable experience, (c) they offered me some bonus over and above the music I'd paid for, such as maybe cheap/free concert tickets or a DVD of a few tracks, (d) any combination of the above. Unfortunately, none of these are happening.

In a nutshell, people are expected to pay multiple times for something they used to pay for once. Not only that, they're told they're "stealing" if they don't, and are faced with ridiculous laws and enforcement techniques.

Re:Why do this?

"Music CDs are now "enhanced" to try to prevent people playing them on their computers; paid-for, downloaded music is now DRM-wrapped so it can't be burned to music CDs and played on home stereos or in cars."

But in this case, music purchased from iTMS can be burned to CD and played on home stereos and in cars.

Perhaps the question is "what specific problem does this hack address?". For practical purposes, the big one is:

1. iTMS users were prevented from taking the music they'd downloaded, and then distributing it freely and widely by e-mailing it to all their friends or posting it on Kazaa.

Are there any others? Is there something I'm missing? I'm aware that the iTunes software requires you to re-order your playlist after burning it ten times, but is downloading a DRM stripper really a better solution than just reordering your playlist?

For now, I'm siding with what some others have said: Apple has gone out of their way to create a usable, affordable service with easy-to-live-with DRM. Their success has hopefully helped convince rightsholders that online distribution can work. Apple doesn't deserve to be pissed on like this.

Re:Why do this?

My key point is: if I'm going to have to download AAC files (which costs me money), then burn them to CD (which also costs me money) in order to listen to them on my other systems.

You paid for a digital file. If you had paid for the CD, you would have had to rip the CD, then transfer it to your MP3 player of choice or whatever. There are costs involved in going from one device to another whether it be in the form of time or money. The world is built on many incompatible standards.

However, at US$0.99 a song from iTMS, multiplied by the number of songs on a typical CD, it's awful close to the cost of buying a CD from the shop *and* I've now got less than I used to get buying a physical CD.

Most albums on iTunes Music Store are $9.99 (or less) for the entire album whether it had 11 songs or 18 songs or however many that were on the CD. If the album had 2 CDs, you pay more ($17 or so were a few). If the CD had less than 10 songs, you pay only $0.99 multiplied by the number of songs.

I'm not too sure where you live but most CDs in the US are $13-$15 just by doing casual shopping. Getting the full CD for $9.99 plus the cost of one CD-R ($0.15 or so if you buy in bulk) is hardly that huge of a cost. The only things you lose are the liner notes and the album art (well you get the front cover art as a BMP but I don't think many people will print it out) and maybe the jewel case if you're nitpicky.

The record companies haven't had to create a physical CD, ship it to store, and the bricks-and-mortar shop hasn't had to pay the expense of floor space to have it displayed somewhere. The non-existent shop hasn't had to train and employ people to handle the exchange of goods for cash, nor deal with stock control and cash flow issues that come from operating any physical-goods-for-money business. I'd like the record companies to acknowledge this and pass on these savings via lower costs for purchasing downloaded music.

Are you saying that you're just magically getting the files and that bandwidth is free? Apple provides the servers, service, software (for free even if you don't download songs and it's a fair audio media player at the least), bandwidth, etc. Imagine all the non-tech-savvy people calling the tech support lines to find out how they can share files and whatnot. That is costly. They went and got the actual audio masters and ripped it directly instead of just ripping a CD. The record companies still (need to) do promotions for the artists. There are still some costs involved.

Also, you get to preview 30 seconds of any song that way you can also decide if you want the entire album or just the single song that got you interested in the first place. I've personally abused this feature by checking out various albums to see if I would like to get the whole thing or just the single. You get to buy individual tracks when before you only had the option of buying the single CDs that were out before and if an album contained a song that wasn't available separately, you were stuck wasting more money. You have search features, easy recommendations, top 100 lists, celeberity playlists (I find them useless but others I know like the feature), exclusives, you didn't have to drive somewhere to buy the CD, practically no wait times, etc.

The record companies are probably charging an arm and a leg more than they should. You do get somewhat of a cheaper price for the music, and for me, I didn't care too much for the physical media laying around so it works out for me. I just wanted to say that there are still plenty of costs involved. Looking at other Internet businesses, while there are surely great savings to be found, for the most part, the real advantage is the free shipping and no tax in certain stores.

iTMS isn't perfect by any means. I don't like DRM but the personal usage rights actually are decent. I don't like the idea of paying tax on an Internet purcha

Re:Why do this?

" paid-for, downloaded music is now DRM-wrapped so it can't be burned to music CDs and played on home stereos or in cars"

This is exaclty what apple prevented. I dont think you even know what you are talking about. How about you go use itunes before you make a generic /.-type statement like that.

DRM Will Not Work

By breaking the means the industry hopes to use to make their business viable you are only going to force them to cancel future projects which make music and other media easy for consumers to buy.

It is not possible for DRM to work. That's what researchers have been saying since day 1. If I can hear it, I can record it. These cracks aren't happening because people are unethical, they're happening because DRM is an inherently flawed idea. It's like asking people not to use pop-up blockers. Using an inherently broken technology in a way that is unpleasant to the end user is not ever going to stand the test of time. Even should police force be used it won't last forever - eventually the economic will of the consumer will be satisfied.

This is not unlike the lesson learned from the dot-coms. It has to be both technologically practical and an improved satisfaction of wants or it will not work. Having one and wishing really hard that the other was true is like trying to sell the electric cars from the 1980's.

The economic model behind music has got to change. Per-copy sales is not possible when copying has an arbitrarily close to zero cost. You can't charge for something that costs nothing.

Re:Why do this?

Must fight the temptation to feed the trolls.....

>If people aren't willing to pay you for the music you make, do you really deserve to make any money just because you spent a few hours playing guitar and singing?

Its not that they are not willing to pay. Its that they are TAKING the music and paying nothing.

Re:Why do this?

Yeah. And when duplication of property has the same economic ramifications as theft of property, it should carry the same penalty. A lot of really talented musicians have been fucked by bootleggers...hell, J-live's first record was so heavily bootlegged that his record label wouldn't even release it. Instead, they released him from his contract. And this was just tapes in 1995!

Re:Why do this?

However, assuming that the song in question is a recently produced song, say, within the last 14 years or so, the original framers of copyright would certainly have wanted the person who created that song to get due compensation.

This is clearly untrue. Copyright didn't encompass musical compositions until 1831; copyrights date back to 1710. Nor just anyone; it took until 1891 for foreigners to be eligible to receive American copyrights.

The purpose of copyright was to allow the creator of a work to have sole control over its sale for a limited time, or something to that effect.

No. To quote from the Constitution, "Congress shall have Power ... To Promote the Progress of Science and useful Arts, by securing, for limited Times, to Authors and Inventors, the exclusive Right to their respective Writings and Discoveries."

Madison, in discussing this with Jefferson during the framing of the Constitution wrote that he believed that while monopolies such as this were wicked, it might yet prove useful, since in a democratic government, their perniciousness could be moderated. "Where the power is in the few it is natural for them to sacrifice the many to their own partialities and corruptions. Where the power, as with us, is in the many and not in the few, the danger can not be very great that the few will be thus favored. It is much more to be dreaded that the few will be unnecessarily sacrificed to the many." Sadly, he didn't foresee RIAA et al.

Even as far back as the Statute of Anne, we see that the Act was intended to promote public learning; not to help authors. Helping authors was merely a means to an end.

By way of analogy, think of public schools. We have public schools purely in order to educate children. They also happen to employ a lot of teachers, but they're not really intended to -- that employment is just a side effect, a means used to achieve the real goal. If we could educate kids without the teachers, we probably would; certainly we don't seem to be in any great hurry to pay teachers more money, or to get more of them.

Thus, the purpose of copyright was, and is still, to promote the progress of knowledge -- a goal that benefits the public. Since authors are members of the public, it benefits them too, but not especially more than others.

When you examine the issues, you quickly find that there are two public interests intertwined with creative works. First, the public wants to spur the creation of new works -- original, derivative, whatever. We want more. Second, to be wholly unrestricted in our enjoyment and use of these works; to use them, copy them, preserve them, distribute them, make new works based upon them, etc.

Authors are particularly benefited by that last, since by relying on the work of others, they reduce the amount of work that they themselves need to do. And since the public is interested in new derivative works, there'll be an audience. See, e.g. most Disney cartoons, which are mere retellings of age-old stories that come as no surprise to anyone who goes to watch them. But we watch them anyway, because we _like_ seeing their take on the familiar classic.

Copyright strives to fulfill all of these benefits by, ironically, denying most of them initially in order to focus effort by authors on new original works. But the restrictions aren't pervasive, and over time they go away and we can fully enjoy the works and base derivatives off of it, which themselves are partially eligible for protection.

If we are within the limited time, then why should the artist not get paid?

Because it might not suit the public interest. That's also the reason for whether we're even in the limited time -- we might reduce or expand it, in either case trying to best serve the public interest. The fortunes of authors will hinge upon it, but even were there no copyright (as was the case for most of history) there's always going to be artists. Nor do we merely want the most arti

Re:Why do this?

You're assuming the laws against theft exist to protect one's profitability - that's just not the case. They exist to protect one's property (which in the case of a copy you still have). There's is no "right to be profitable" (or at least their didn't used to be). Of course anymore the solution is just to buy enough lawmakers to legislate your profitability, but I digress.

If you can't make money selling something people can get for free, that's your fault for not having a good business plan. For example, bottled water companies couldn't claim H2O as their intellectual property (and make it illegal to drink tap water), so they had to rely on marketing - this has been successful. What record companies need to realize is they can make money by selling the *image* not the song itself. After all, this is more or less what happens already. Just give the CD some extra fancy packaging and market owning it as a status symbol and you can continue to bilk the masses of of their money for years to come!

Re:Why do this?

People just want to use their personal private property which they bought and paid for in whatever way they see fit, such as playing their songs on a non-Apple, non-Microsoft platform. What's the problem with that?

Bullshit. You can already do that within iTunes. Just burn to a CD.

Apple's DRM attempts to lock out non-Apple, non-Microsoft users.

Bullshit. Apple's DRM doesn't attempt to lock out anything. Burn it to a CD, and you can do whatever you want with it.

Re:Why do this?

Oh sure, if I want to listen to my music on linux I have to waste my time burning it to CD and then re-ripping it - because Apple has excluded non-Apple, non-MS platforms from playing the AAC files.

There's no evidence that Apple would never release iTunes for Linux. Likewise, Windows didn't get iTunes support until recently. That's just a limitation of resources, and nothing to do with excluding certain people.

Furthermore, what you just said reveals your REAL reason against the DRM. Not some political stance about Apple locking out other platforms (which is clearly untrue), but that you're too lazy to burn the songs to remove the DRM.

That's just... pathetic.

Whats the point?

There are plenty of programs out there that will capture your computer's audio output. WireTap for example is a free Mac utility from Amrbosia that does this. You can also burn your music to audio CD and re-rip it as an MP3. I don't see why this is a big deal. Apple's DRM is fair and people who buy songs from iTunes already have the opportunity of using something like KaZaA but have chosen not to. This isn't going to make any exclusive content available on KaZaA or anything. Reading the description I think the whole point is just to try to humiliate Apple and the music industry. If thats the case its a bad thing, because Apple is FINALLY turning the music industry around on digital music.

I don't know about this

Apple has been pretty liberal with their protected aac files compared to some other digital music retailers. Play on up to 3 computers, burn to cd, play on iPod. I've bought about 250-300 songs from iTMS and have never been inconvenienced by their DRM. Do you think their DRM being cracked might change any of this? I can just imagine the RIAA trying to use this as an excuse to implement some sort of draconian measures. For years now people have been screaming for fair online digital distribution. We finally get something that works well and is fair on both sides and some jackass cracks it. I sort of feel like next time the RIAA dupes some ignorant senator into introducing some insane bill that completely infringes on our rights we're not going to have a leg to stand on. Apple gave people what they asked for, then got shit on. What does everyone else think?

Re:I don't know about this

You don't have to use iTunes, you know. You don't have to buy Apple's music at all. What Apple is selling you is music that has to be listened to using their software and hardware. That's the ACTUAL product that you're getting. If you don't like the product, don't buy it, and don't ruin it for the rest of us. I hope Apple shuts this hole quickly so I don't have to put up with the RIAA imposing some draconian measure that only lets you play the songs on one computer during a full moon with four lawyers looking over your shoulder. It hasn't even reached Canada yet, and you're already trying to make it so that nobody has any right at all.

Oh, and don't give me the line that you're doing this as some sort of protest and this is all very altruistic. Altruists don't hide in their basement, quietly breaking the law. If you're going to protest, get on the news. Shout your name and address to the heavens, say that you're going to keep doing this until your rights are acknowledged, and music is as free as you believe it should be. Breaking your terms of agreement with Apple in the safety of your home doesn't impress anyone, and doesn't get anything done.

Re:I don't know about this

Ok, I'm sorry but this is a little short-sighted. Just because you happen to like iTunes doesn't mean that the rest of us do. People who use multiple OS's can't use the files. I can't use them in my MP3 player or in my Discman that plays MP3 CD's.

Jesus I''m sick and tired of hearing this shit over and over again. Look, the AAC files are designed to play on devices with AAC playback ability. If your portable won't play it, bitch at the manufacturer. Second, CDs won't play on my portable casset player, cassets wont play on my portable CD player and my CDs won't play on my iPod. You know what I do? I fucking convert the format like I always have and just like you can do with iTMS files. Jesus you people are whiney.

Re:I don't know about this

You've hit the nail right on the head; you should get modded up all the way. If I can pay a buck a song and be able to play the file on my computer, burn it to a CD, and listen to it on an iPod, I'd say that's a pretty good deal. But this guy (who really, really should have known better after everything he's been through) releases a tool to strip DRM info from a song, and putting the code and ideas into the the hands and heads of anyone who wants it, and for what reason? For free distribution, I assume, or lossless conversion to MP3 (as opposed to burning and re-ripping it). Neither of these grant you too much more freedom of action (without breaking any laws, at least) beyond what is allowed already.

So yeah, you're right, we cried and cried for a cheap and legal way to buy music over the internet, and now this idiot goes and cracks the DRM of the most liberal licensing scheme he could find. The RIAA is gonna scream bloody murder and foist more legislation on us, and I'm probably going to agree with them.

joys and sorrows

Joy: Being able to listen to any of my songs the second it occurs to me
Sorrow: having to "authorize" myself to listen to music that I love

Joy: sharing my favorite songs with my friends
Sorrow: Having to spend hrs giving friends tech support dealing with work arounds to stupid DRM measures that make them feel lost

Joy: finding new music that I love
Sorrow: fearing getting busted for checking out someone's recomendation

Joy: art, technology, freedom
Sorrow: greedy fuckers; the constant vigilance freedom requires

Joy: Cracking the shit out of IP
Sorrow: It's come to this: having to justify it to the stupid Slashdot consumers

Re:BFD

t's also noteworthy that similar code has been circulating quietly for quite some time on the Mac side. Anyone with even moderate knowledge of the QuickTime APIs could implement code to do this with minimal effort. It's trivial. I myself have written code that re-encodes the protected AAC's to MP3 so that I can play them on an old Rio that I still use sometimes.

No! No! No!

You don't think this is interesting because you do not understand what it does.

The Mac tools/code you talk of takes Protected AAC, decodes it to raw Audio (PCM/AIFF) and then Reencodes it.

This takes Protected AAC to Unprotected AAC. No transcoding (no loss of quality) involved.

Re:BFD

The hack allows you can get an unprotected AAC from a protected AAC losslessly. Using the audio CD method would require re-encoding and the use of a CDR. I agree that it's not as neat as DeCSS, but it does provide a better quality unprotection mechanism than was available before.

What DRM issue does this really fix, though?

I don't get it. You can burn your own CD from the QT files you buy from the iTunes store right? And after they are on CD you can make MP3s of them and do what you will, no DRM associated with them.

So, beyond the rather adolescent desire to hack the encryption, what problem does this solve? There's just no reason. Once they're on CD it's as if you bought them at the store.

It's just ego.

Re:What DRM issue does this really fix, though?

That is likely to aggravate the creation of mpeg-type artifacts.

wait a second...

I thought that Jon was innocent, that he didn't actually write DeCSS but had help distribute it?

Similar reason as for DeCSS available ?

I'm curious.. did he do this for a similar reason as the one he claims he created DeCSS for - namely to play back DVDs on Linux ?
I can't seem to find it in any of the articles, nor in his blog.

If there is no similar reason, does that mean that the reason of DeCSS's existence should be reviewed ?
Was 'hollywood' right, and he really just wanted digital dumps of the movies, just as - seemingly - he just wants a non-AAC'd digital dump of the music here ?

Not inciting a discussion on whether people should be allowed to do this in the first place - that's a whole other discussion :)

doesn't mean anything

Just because it's cracked doesn't mean a damn thing. Think about it, all of those songs are already available on P2P networks and newsgroups already. Most of them with superior bitrates.

Just because someone else puts up an AAC of the file on P2P doesn't mean that it's going to cause people to download more illegally. If someone was going to steal the music, they'd just do it with MP3 or OGG, or whatever flavor is already out there.

Think about it, this really does nothing to hurt Apple's business model. The percentage of people that are going to somehow benefit from a ripped AAC file and decide not to buy it from Apple instead is so low that it's insignificant.

What this does mean though, is that I can now play my purchased music on my Linux workstation, and possibly get a portable player that's not an iPod that will play these. I'd say QTFairUse is an excellent name for it, because that's certainly what I'm going to use it for.

Plus, why would one buy music from Apple, only to give it away to total strangers for nothing. I wouldn't. They way I see it, I paid for it, and if you want it, go buy your own.

Apples Fence

The _very_ nice thing about Apple is that this stuff doesn't matter too much. It would be simple to convert all those AAC's into something else (be it mp3, AIFF, or even a higher AAC and back down) to get rid of the DRM. It's called a fence, you can jump it or you can respect it. Unlike most schemes that require complicated check in and out Apple had the guts and financial sense to do something that will satisfy both sides. It will be interesting to see if the notorious Apple legal will go after this. From what I remember they didn't bust down on people that extended the iTunes music sharing beyond the LAN.

Compressor

(posted anyonymously for the usual reasons)

Another way to do this is with the Compressor program (by Apple) included with Final Cut Pro. Just drag the DRM'd AAC file into Compressor, choose AAC from the menu, and watch as it transcodes to unencrypted AAC. You can convert that to MP3 from iTunes if you want, or write up a little AppleScript to automate it. The only downside is that you lose the metadata tags (you could probably decode that format and write an application to convert them to IDv3 tags), but it works pretty well.

Note: I'm posting this not because of any hatred for Apple, but because I like to be able to listen to my music on my SliMP3 [slimdevices.net] and this is the only way to do so besides burning and ripping from a CD.

works with iMovie

No need for Final Cut Pro, you can do a similar thing with iMovie. To avoid being redundant, but at the expense of seeming narcissistic, I'll link to my earlier post [slashdot.org].

NO!

No, people, this is NOT a good thing! Can't people figure out when there's a good thing happening, that they should sit the hell down and let it be? Think about it. Apple's DRM was pretty easy to break, just write the songs to CD and rip them back, without DRM. But the RIAA will use this as an excuse to put more and more DRM, more and more legislation. They'll say, "Well, whatever the computer industry puts out, hackers break it, so we need more legislation." And the Senate, House, and Bush will sign anything into law! Come on people, this is a bad THING!

Re:NO!

FWIW, I completely agree with your post. Some folks are just so concerned with whether or not they can do something, they don't stop to consider whether they should, eh? I've always been fond of that saying, and it certainly applies in this circumstance. I'm afraid your dead on about the RIAA looking to use this as another excuse for even more legislation. Let's just hope they are too busy suing little Sally and all of her little friends to take notice.

I hope folks will be careful with what they do with this, in any case. Unless you put it on a T-shirt - I could alternate days between that and my DeCSS shirt!

Who are we joking. If this works, it'll spread across the net quicker than you can say "I set the socal fires". :(

Way to go

Apple does EXACTLY WHAT EVERYONE SAID THEY WANTED and they still get fucked over.

This isn't about fair use any more. This is about "fuck over any company that uses price tags."

This entire argument has lost every last shred of whatever legitimacy it may have once had.

Re:Way to go

This isn't about fair use any more. This is about "fuck over any company that uses price tags."

This is the most rational statement I've seen in this thread so far.

You are exactly right. The natural price of copies is zero. The market is moving toward that natural price (though you have found a more colorful way to express this economic identity). The cost of copying IP is zero. Therefore, the natural price of copies is zero (the natural price in an economic system is equal to the unit cost of production).

This entire argument has lost every last shred of whatever legitimacy it may have once had.

On this I must disagree. It is just now gaining the very first glimmer of legitimacy. When people were claiming that it was just a matter of having the right feature-set to make the consumer want to pay a non-zero price for a good with a zero unit cost of production, it had no legitimacy.

I'm not saying this is a good thing (though that is also true, but requires a much longer discourse on price theory), but it is as true as gravity.

kinda

Price isn't necessarily determined by costs, it's determined by what the market will bear. If the market will only bear 0 price music, then the system has broken down, and the opportunity cost of spending most of your time as an artist will become much steeper. We would dry up the primary pool of capital available that enables artistry as a profession instead of a hobby.

This is not, in my opinion, in the interests of society, it's a tragedy of the (creative) commons.

On the face of it, there needs to be recognition that all intellectual works are services, not products. This recognition could imply free copies as the norm, not the exception. But then we have a problem: the master copy costs $X to make and such costs (plus profit, which is really just a future cost) must be covered to create an economic system.

The current system does this inequitably, but in an arguably much simpler manner than any potential alternatives: universal licensing, subscriptions, or perhaps, a capital-market model where you give the artist money after the fact to keep them making their art (whether software, music, etc.).

I haven't heard of other viable alternatives from this crowd.

Re:kinda

I wish I had points and could mod a thread I've commented on. Your post is excellent. A few public points, then I'm off to your blog to try to contact you.

Price isn't necessarily determined by costs, it's determined by what the market will bear.

You're talking demand side, I'm talking supply side. Both are upper limits on the price, and act independently.

On the demand side, I think that the market would bear higher-than-zero prices for copies (as demonstrated by music sales in the pre-MP3 era (PME, haha)). Assuming this is the case, the demand side can't explain current behavior.

On the supply side, if copying has a zero cost, a manufacturer will always step into the profit margin between zero and the current price of copies - new manufacturers keep appearing at a lower price until the profit margin approaches zero. This is exactly what the original Napster was, incarnated at Internet speed. It is also what the Southeast Asian piracy market is all about.

If the market will only bear 0 price music, then the system has broken down, and the opportunity cost of spending most of your time as an artist will become much steeper.

I think you've shifted in this sentence to talking about the natural price of music. I strongly believe that the natural price of music is extremely non-zero. It has both demand side value (I love music, and buy a lot of disks (yes, still - as it stands I don't feel personally justified in pirating)) and supply side value (I play guitar - there is definitely a non-zero cost of producing new music).

But then we have a problem: the master copy costs $X to make and such costs (plus profit, which is really just a future cost) must be covered to create an economic system.

Ahh, here we go, the supply side. Keep going, you're getting close.

a capital-market model where you give the artist money after the fact to keep them making their art (whether software, music, etc.).

Yes. YES. YES. You've hit the nail on the head. The problem is how? Well then, off to your blog.

Apple's DRM does get in the way

For most the limitations of the iTMS tracks probably isn't an issue, for me it is and as such I choose not to buy music from it, instead to buy a CD and rip to unprotected AAC. We have more than 3 computers I would like to be able to play music on. An older iMac hooked up to the stereo which is the main in-home music box. A computer that is destined to reside in the trunk of my car hooked up to the car stereo. A PowerBook that I use commonly to play music at work and an older iBook that gets used to play the music from the iMac elsewhere in the house. I can't use all 4 for Apple DRM'd music. Why not? They are our computers and its our music and I should be able to play the music on any of them. Why only 3 allowed? If the number were 100 it would be just as effective at stopping mass distribution and such a number really wouldn't limit legal owners of the music.

As such I look forward to a completed version of this tool and its availability on the Mac (though I presumably could run the Windows version in VirtualPC). Not to get music from others (as has been noted it wouldn't offer anything you can't already get via other easier means) but to allow me to use music purchased on iTMS as I see fit and without audio quality loss. Indeed the availability of this tool would make me reconsider purchasing music from the iTMS - currently there's compelling enough reasons to no do so and so I don't.

A legitimate reason for defeating DRM

Sometime in the Windows Media Player 7 or 8 era I decided to start ripping my legally purchased (or licensed?) collection of CDs for listening while at my computer. I did not share these files with any one else nor did I listen to it in two places simultaneously. At the time the default media encoder produced rips with DRM.

I then made the poor choice of upgrading from Win2k to XP with no expectation that it would have any effect on the hours I spent ripping my collection to my computer for my use. Perhaps it is the price of stupidity, but my online collection was rendered immediately useless because WMP decided I was on a new computer and therefore had stolen my rips from myself.

I have been a very satisfied user of iTunes/iTMS and have spent considerable money purchasing from iTMS. Under iTunes Advanced menu there is an item "Deauthorize Computer...". I fear even selecting this item and unwittingly invalidating hundreds of USD in iTMS purchases. I also have no idea what will happen should I decide to upgrade my CPU, add a drive, or even change the IP address of my machine. Or, perish the thought, have to reload XP because I have the poor taste to run Outlook or IE. Suffice to say, all of my iTMS purchases have been burned to CD-R because I'm not quite that stupid.

So here is one legitimate user who wants to not run afoul of the RIAA who may end up with direct losses because I don't have control over my purchased product.

When will they get it?

People are _obviously_ willing to pay (oh, say, about $.99) for good download speeds and high-quality encoding. Most people who use the Music Store don't care that it's "legal" or "right" or whatever. Apple just found the right price point for what they offer -- a better user experience than the free services like KaZaa, Gnutella, etc.

However... I have had some very annoying problems with the iTunes DRM recently. Got the main logic board replaced in my laptop (by Apple) and suddenly couldn't play my purchased music. Couldn't re-authorize because I'd already authorized three machines and now one was gone forever (didn't know in advance that they'd be replacing the logic board, or that I would lose my rights if they did). Had to email support and wait about 48 hours to get my music back by deauthorizing the other computer. And they warned me that "we don't normally do this".

Another time I wanted to email a song to a friend -- I thought he'd like it and maybe buy the album. Of course he couldn't play it. Nice.

More recently I purchased music and I was _never_ able to play it -- I'm told it's already authorized on three machines even though I've yet to play it once. Whatever. I guess I have to contact Apple support again.

I don't feel this is really Apple's fault -- they've done as well as you can with DRM, but the fact is that it just sucks. I now realize that I paid for an _inferior_ product to what I could have gotten for free. I would rather download a bit slower, get a lower bitrate, and be able to use my damn music like I can with any other medium!

Now, if they combined high-quality, fast dowloads, and free usage, then most people would STILL buy the the songs for $.99 and they would actually be happy with their purchase a year or two later when they've had to move it across machines or whatever other diallowed activieties that we normally do without thinking when using CD's or whatever. As it is, I think people will sour on this over time.

Okay -- I'm rambling now, but the point is that they'd be doing at least as well without the DRM, and customers would be happier longterm. That's how they should be competing with P2P -- not by putting out products that are superior in some ways and vastly inferior in others.

Stupid RIAA. I'm glad to pay for what I want if you offered it. As it is I think I'll go steal some RIAA music. Or buy some independent stuff.

Cheers all.

Re:When will they get it?

Another time I wanted to email a song to a friend -- I thought he'd like it and maybe buy the album. Of course he couldn't play it. Nice.

I think the word you're looking for is "Duh."

I don't feel this is really Apple's fault -- they've done as well as you can with DRM, but the fact is that it just sucks.

DRM is not in the shape it needs to be, but it looks like it may never be. There simply isn't a non-invasive approach that can still tell how many times you've used said goods, and where, and keeps track of it legally.

Apple has done the best they can, and it's certainly less invasive than Microsoft's own DRM.

I now realize that I paid for an _inferior_ product to what I could have gotten for free. I would rather download a bit slower, get a lower bitrate, and be able to use my damn music like I can with any other medium!

Firstly, you didn't pay for iTunes. You paid for the song(s). If you think they are an inferior product, stop buying them.

If you feel that you can jump on Kazaa and download a song, then that is your right. But you forked over your $.99 and, as a geek, you really have no room to talk as to how you were 'hoodwinked' into buying something inferior.

At this point I equate your rant to a child screaming for a piece of candy, then complaining about it when the candy got on his clothes. "They need to make better candy," the child would say.

WHY!!!! Do you WANT the RIAA to win???

Cause thats all a hack like this will do.

honestly we cant beat the RIAA, there is no way in hell unless california falls off the face of the earth (sorry to all those nice californians) , they are WAY too strong.

SO Apple plays nice, they give us fair use, but give them the controls they want, but ONLY controls that limit trading, really if you need your songs to be on three computers at the same time, you have problems, but you can burn them and put them on as man iPods as you want. It's your music, you just have to make sure it stays YOUR music.

So what do some of us do, PROVE that the whole lot of us are diviants and hack the freaking DRM, PROVING the RIAA right that they shoulkd have tighter control.

They win. They couldnt win if Apple proved a DRM model could work and still could give the users the rights they where garenteed to have. But this proves that people dont care, they are willing to hack things and now willfully break the law (since it IS illegal to hack DRM files acouding to the DCMA no matter how flawed the law is) letting the RIAA say "See we need more control," and getting it, instead of them saying "See we need more control," and being asked why cause there is a proven model that shows they dont need it.

WAKE UP EVERYONE, THE FREE NAPSTER RIDE IS OVER, If we want a feasable working internet media model that allows us to have films and music, and anything else, we have to make sacrafices.

It's just like free speech, we all want it but the minute someone says something we dont like we try to censor them, and we cant. IT DOSEN'T WORK BOTH WAYS.

My half-and-half take.

First, by the terms of service for the iTunes Music Store, you cannot do this. Attempting to circumvent the DRM renders your license to use iTunes null and void, and violates the terms of the Music Store, letting Apple cut you off. (Not that it matters to those who do this sort of thing.) Likewise, attempting to circumvent DRM violates the well-respected and highly loved DMCA, which could land you in jail.

Second, I feel that I have purchased this music, Apple phrases it as me purchasing it (rather than 'renting' it,) so I should be able to do whatever I want with it. The same as I can do whatever I want with a CD. As long as it doesn't break copyright law. For example, what happens if, god forbid, Apple closes its doors five years from now. It's very conceivable that I could still have my current Mac in 5 years, with all my purchased music. What happens when, two months after the doors close, I get myself a nice new G7 system at fire-sale prices? I obviously wouldn't be able to authorize that computer. And the RIAA wouldn't let Apple 'unlock' all music upon closure of Apple. So they only way to get my music to work on this new computer would be to use un-DRMed copies. So I can see a perfectly legitimate use for this.

As a note on my ethics: Once upon a time, I downloaded music off the internet. I downloaded movies off the internet. (And pr0n. LOTS of pr0n...) I downloaded software off the internet. (I also used Windows, which, to me, was the worst of my transgressions. :-) Nowadays, I don't. I don't agree with the RIAA, MPAA, and SPA, but I don't feel right violating copyright laws, either. I couldn't care less about my neighbors/friends/relatives/customers. If they feel like using an illegal copy of Windows, fine. (I'm a computer consultant, so it usually means more money for me fixing their computer.) But, I have ripped all my CDs to my computer, I have backup copies of all my software CDs (with the originals stored in a waterproof box in the basement,) and I often copy DVD-Videos to my hard drive so they are easier to watch later. So I like the ability to do what I want with my data, but I won't use those means to break any copyright laws. (Other than the DMCA, because I see the circumvention of DRM as a basic 'fair use' right, not as something that should be illegal.) One recent example is that I rented "Finding Nemo", but didn't get around to watching it before it was due. So I copied it to my computer, watched it the next day, then deleted it. That is considered fair use. I paid for the right to watch the movie for a limited time. I watched it, then 'returned' it (by both returning the DVD, and deleting the copy.) So I was within my fair use rights.

In closing, I will probably download this utility (or a final, fully functional version,) and just keep it on a disc somewhere, for the 'just in case'. Since everything I want to do with my purchased music falls within the limits of what Apple's DRM lets me do, I have no reason to use it. But, as in my example, if I ever have a need to move my music to a new computer, and the ability to authorize computers has gone away, I would want the ability to get around it. (Look at what happened to those Divx users. Some people purchased the 'unlimited' versions, and they're worthless now that the Divx service has closed. Not very unlimited.)

P.S. Yes, this violates the iTMS terms of service. Period. The terms of service say that doing ANYTHING to circumvent DRM revokes your rights. Even burning to Audio CD, and re-ripping into MP3 (or AIFF, or AAC...) can be considered a 'circumvention', because you did something expressly to rid the music of DRM. So all of you trying to justify it by saying that it isn't technically removing DRM need to re-read the terms of service (and the DMCA, for that matter.) ANYTHING you do that ends up with a non-DRMed file is circumventing DRM.

There goes a lot of good things...

Great. I bet this completely hoses the Thanksgiving vacations of a large number of Apple employees. I wonder how many people in legal, software engineering, QA, and the make-nice-with-the-record-companies departments just had their plans for the week yanked right out from under them.

Not to mention that this really damages a Good Thing.. even the most zealous anti-DRM person has to be able to understand that'll be easier to get the record industry to loosen their frantic grasp one finger at a time than to try to wrest their precious billions away from them and force drastic change. Yeah, bad for the big companies, big deal... but bad for the artists, bad for the Apple employees who worked their butts off to create this, bad for the end users when the record companies start calling it a failed experiment.

I have sympathy for those who have difficulty with Apple's DRM terms. I hit the 3-computer cap myself... 2 machines at work, 1 laptop at home, 1 desktop at home, my girlfriend's tower... However, I have NO sympathy for people who bitch about it like Apple's out to ruin them. That clause about Apple reserving the right to change the terms whenever they want? If a huge petition is delivered to Apple politely clamoring for that limit to be raised to 4 or even 5 computers, who's to say they wouldn't do it, or at least try to convince the record companies? People who complain about it not being international? If they missed it, I suggest they check into the news that Apple is in heavy talks to get iTMS launched for international customers. If they saw that news and ignored it, then they should STFU.

The iTMS isn't Apple out to rip off customers.. Apple has publicly admitted it's not a profit generator. It's there as an innovation, a jedi hand wave to get the record companies to realize there is a better way, to start them willingly down the path to change. I know a lot of people who spent 80+ hour weeks getting the iTMS launched, and their biggest fear was that someone would break the FairPlay system and bring it all crashing down.. while the impact to sales is hard to predict, how can these paranoid record companies who have til yet regarded online music download services as their big enemy (even if they're just a scapegoat for their own mistakes) learn to embrace this new technology that can be good for everyone?

Trying to force revolution upon the record companies will just make them lash out, act irrationally, and fight all that much harder. It's better to get them to decide that what consumers want really is the right path. They have to make that decision.. then they think it's their idea, and they're much happier to go along with it!

My opinion all boils down to one Japanese proverb about three feudal warlords:

What if the bird will not sing?

Nobunaga answers, "Kill it!"

Hideyoshi answers, "Make it want to sing."

Ieyasu answers, "Wait."

Which of these is going to be the most effective? I guess your answer has a lot to do with your personality and the techniques you use to attain your goals.. but in feudal Japan, I think it's fair to say that Nobunaga's power was dramatic but short lived, Ieyasu's was complete but he had to wait quite a long time.. in fact, until everyone else had disappeared... Hideyoshi's story was the most impressive as he rose from a farmer's son employed as a sandal-bearer to absolute ruler of Japan.

(OT: If that story intrigues anyone, check out the book "Taiko" by Eiji Yoshikawa -- he also wrote one about Musashi, the swordsman famous for his strategy and two-katana techniques)

Re:Sweet

On a Mac, try this:

#open itunes
#begin playing music
netstat | grep 3689
#look for multiple connections to the same computer, that's his address
#on the right and yours on the left
setenv him HISADDR
setenv me MYADDR
#en1 = wireless, en0 = wired
sudo tcpdump -i en1 -s 0 -w itunes.log src $me and dst $him
#begin playing each of the songs you want (only need to play a second or two)
#don't close itunes!
#hit ctrl-c in terminal with tcpdump running, it should say it captured some number of pkts
strings itunes.log | egrep "(GET.*update)|(GET.*databases)|Validation" > songs

#songs now has a list of magic cookies, each alternating line is the file or the password
grep GET songs > get ; grep DAAP songs > daap ; wc get daap
#the first two lines of first column should be the same (tested under iTunes 4.1.0)
paste get daap | egrep "GET.*items/" | sed "s|.*GET|./get_one|" > get_all
cat > get_one
#then type these next two lines, hit return, and hit ctrl-d
wget --header="Client-DAAP-Access-Index: 1" \
--header="Client-DAAP-Validation: $4" "http://$him:3689$1"
chmod +x get_one get_all
./get_all
#close itunes

#now to rename the songs to have sensible extensions
mkdir tmp
mv *mp3*session* *m4a*session* tmp
cd tmp
ls | grep session > old
tr '?=' '\t\t' < old > new0
cut -f1 new0 > new
cut -f2 new0 | sed "s|session-id|mv|" > new1
paste new1 old new > fix_all
chmod +x fix_all
./fix_all
rm old new new0 new1 fix_all
mv *.mp3 *.m4a ..
cd ..
rmdir tmp

#after loading into itunes, can use one of several applescripts to rename the filenames from 454.mp3
#some of the scripts rename *.m4a to *.mp3 - then the songs don't play. to rename them back
#move the *.mp3 AAC files to their own directory, then
ls *.mp3 | sed 's/\\/\\\\/g' | sed 's/\$/\\\$/g' | sed 's/"/\\"/g' |\
sed 's/`/\\`/g' > files
cat files | sed 's/^/mv "/' | sed 's/\.mp3/.mp3" "/' > old
cat files | sed 's/\.mp3/.m4a"/' > new
paste "-d\0" old new > fix_all
chmod +x fix_all
./fix_all
rm files old new fix_all

Re:I bet...

I bet Apple would like this to some extent. This could mean that content that people buy from Apple is worth even more to the purchaser than before, without any [direct] cost to Apple. I'm sure Apple would have wanted DRM-less content, but that would not have been a reasonable deal with the RIAA/copyright holders.

Maybe I'm wrong though.