Category: Connections

Straight out the 402

I was disappointed to notice My Morning Jacket, Louisville band turned critical darling and national success, on the list of Sony CDs carrying MediaMax DRM software, which has recently shown to cause vulnerabilities as badly as the infamous XCP rootkit. I knew the band probably had little input in whether their CD would be DRMed, but it was still bad news. Then the EFF blog brought to my attention that MMJ is offering their own recall–a more ethical, more friendly and more business-sensible path to their audience than the one their own label has taken. I am positively flush with Louisville pride.

BellSouth–among many other providers of broadband pipe–wants to be allowed to charge for discrimination. That’s not how they’re selling it, of course; they make reasonable-sounding analogies like “If I go to the airport” and “I can get two-day air [shipping] or six-day ground.” It almost works.

But bandwidth isn’t a service–it’s a resource, closer in application to electricity or water. Can you charge more money for people who use more of those? Sure. Can you charge more to guarantee that when other people lose access to electricity or water, you’ll still have it? Nope. Telcos build over and under public and private land to run their wires, which means they’re doing it under public license. That in turn means they must provide equal priority to all uses, public and private alike.

Google is on the right side of this fight, predictably, as are Amazon, eBay, et cetera. Seeing Google’s name attached to this discussion makes me think, though: how long until search is a resource rather than a service? Until they stop being good at it, is my guess, or until it stops being a top-layer application (ie shipping uses roads; roads are a bottom-layer resource, shipping is a top-layer service; roads are regulated and shipping isn’t).

I’ve said before that I think Google will end up under government control, but their diversification over the last couple of years (and their reputation, at least, for business ethics) might forestall that. Then again, Microsoft almost got split into Ops and Apps. I wonder if Google will end up facing a choice between Search and Labs.

I think the killer app for Mechanical Turk is already out there. Think about it: what’s very simple for a human, very hard for a computer, shows up everywhere and acts as a gatekeeper from potentially greater value?

That’s right: those little “verify you’re a human” image boxes that make you transcribe a series of bendy, obscured letters and numbers in order to leave a Blogger comment, or get an LJ account or a GMail address. (Less awkwardly, more annoyingly, they’re called CAPTCHAs.) Yoz Grahame pointed out like a year ago that these are a solved problem: you just go to a CAPTCHA page, grab the image, and put it in front of porn on one of your other sites. Step three: profit!

The only problem with that scenario is that, well, there are ways to get porn without all that tiresome thinking, and most porn-seekers will take them over your time-consuming verification step. It’s easier to type BRITTNAY SPEER NUDE into Google Image Search than it is to decipher Ty$23YiD.

But if MT’s model works (and I’m not saying it does; right now only Amazon uses it, and you’d have to work hard and boringly to make five bucks an hour), and if it gets sufficiently popular that the site’s admins won’t notice spammers slipping CAPTCHAS in, this could be a viable crack. Sign up for an account, pay Random Human two cents to verify it, and spam, spam away. It’s okay, say the servers you’re using to link your herbal V1agra incest mortgage. I know that’s not a bot!

CAPTCHAs are the least bad solution to bot-signups out there right now, but I hope the tech startups that are built around providing that kind of authentication don’t get comfortable. They’ve never been more than a stopgap.

The second time I’ve ever linked Slashdot. Via Downhill Battle.

Okay, so DC beat me to posting about Sony’s big fat recall, but now I’m scooping him: the rootkit contained GPLed de-DRMS code by DVD Jon! I know that makes no sense. Give me a second.

“DVD” Jon Johansen is a Norwegian hacker who likes to take things like DVD encryption and Apple’s iTunes digital rights management (DRM) software and meet them in a steel cage (and win). He releases the software he writes under an open-source license called the GPL, a legally binding agreement that says “hey, you can freely look at and reuse this source code, but only if you release code derived from it under the same license.” Like the Creative Commons license I use, the GPL is just working within existing copyright law.

Now, the XCP software that’s causing such a fuss–because it installs itself on your computer without your consent when you pop in a Sony music CD, is very difficult to find or remove, deprives you of your fair use rights and makes you vulnerable to a whole new brand of virus–needs a way to interact with the CD-ripping functionality of Apple’s iTunes. iTunes creates AAC files when it rips a CD, which are locked to specific authorized computers (although some of those restrictions may be lifted for ripping–I’m not sure, as I haven’t used it to rip CDs myself). XCP doesn’t want you to authorize any other computers to use the copies you make, though. It doesn’t want those copies to leave the ripping computer ever, at all. So the people who wrote it used DVD Jon’s open-source code for messing with iTunes DRM to make that happen.

In doing so, they created derivative software and kept it closed-source. They did not release it under GPL, violating the terms of the license under which they obtained the code. And they sold it millions of times over.

Here’s the point: this is a massive act of copyright infringement and piracy, on the same scale as the giant duplication rings of Southeast Asia that record labels and movie studios have been trying to stomp out for decades. First4Internet Software, which developed the technology to “stop piracy,” is one of the single biggest software pirates on the planet. Sony BMG paid them millions to be so, and distributed the results.

The Slashdot post I linked above says this comes from the “when-will-it-end dept.” This story is amazing. If we had plotted a fantasy scenario to bring down a record label, we probably couldn’t have come up with anything this good.

I fully expect you to correct this, interweb

I’ve tried and tried, but I cannot find a way to be cynical about the $100 laptop initiative.

Update 1348 hrs: But the interweb can, in “Problems with the $100 laptop” and the reaction from MetaFilter (both via Henry McEuen).

The arguments in the Fonly paper don’t change my stance, though. High saturation would lead to a pretty pathetic gray market, especially when you can eBay an old Compaq laptop (but not a million) for twelve bucks. And no, the requirements haven’t been met yet, and we don’t know what the consequences will be. Of course we don’t know what the consequences will be. That’s called the Law of Unintended Consequences. But we know what the consequences of broadening gaps in education and communication will be, and in this case I’m eager to let the proverbial street find its own uses.