Re: DRM and freedom

[Martin Schoenbeck]

Bas Wijnen wrote:
> On Thu, Nov 10, 2005 at 07:15:32PM +0100, Martin Schoenbeck wrote:
>
> > Marcus Brinkmann wrote:
> >
> > > So, we have three issues here:
> > >
> > > * The technology question if DRM and privacy are inseparable or not.
> >
> > It depends on who has control over the system. To implement DRM, there 
> > must be parts of the system, where no one, who's not a trustee of the 
> > requiring industry, has access.
>
> No.  There must be parts that can be put *by the user* in a state where he can
> no longer access it. 

Yes, but after being put by the user into this state, there are parts, 
he will no more be allowed to access. That's what I wanted to say.

> It does not transfer control to the DRM supplier, it
> only allows the user to do business with people who would otherwise refuse
> that.
´
ACK

> > > * The strategic question if it makes a difference if we have a structure
> > > that makes implementing DRM easier.
> >
> > I think, it will. If you have privacy and a user can tell, whether the 
> > system is trustable, the DRM software can, too.
>
> No.  The DRM software is started by the user, with the restrictions the user
> gives it.  If it doesn't allow access to the chip, it will not run.  If it
> detects that it can be debugged by the user, it will also not run.  If it
> demands access to your whole system, it's a bad idea to run it (with that
> access).  But it's the user's choice to do it, it cannot take these rights.

Actually I didn't read the question of Marcus correctly.

> > The difference is, that for the DRM software it's necessary, to be able to
> > ensure that for any given system without help of any untrusted people while
> > the user has to be able to do it for his system only. If the system is build
> > that way, that is is *possible*, to create a single system, which get the
> > DRM subsystem evaluated, nobody will really create such a DRM system.
> > Perhaps this possibility could be implemented in a way, that a user will
> > detect it, while software could not.
>
>
> I don't understand what you're saying.  You seem to be saying that not
> implementing the tpm/tcpa support will prevent DRM to be implemented.

No, I think, that won't change anything.

> I don't
> think this is the case.  They will take the released system, add the support,
> and certify that.  Then they will push all the users to use that in an
> unchanged form.

Yes. The only way, to prevent this, is to have them alter the system for 
this purpose in a manner, that's another system on which other software, 
which is as essential for the user won't run. I don't know, whether 
that's possible and I fear, it's not.

> > The hardest is a balance between the second and third point.
> >
> > Yes, but we should also keep in mind, that DRM on the hurd will only 
> > occur, if it has big market share. And at that point, there perhaps will 
> > be somebody, implementing the missing features.
>
>
> This is what Marcus said.  If we want to prevent it, we need to remove all
> security from the system really.  I think this is not an offer we should make,
> but we can discuss it if there are people who defend it.

And I think, even then it may be provided by somebody else, if the 
demands are big enough. The effort may be higher then, but the 
probability, that there will arise any demand at all be much lower, 
because nobody needs another unsafe system. ;-)
> > Even if installing that than is a break of the GPL, who will sue user
> > installing that, if it's distributed in form of patches.

> At least for GPL v2, there is no reason that this would be illegal.

If I didn't misinterpret you, the result is, that there is no reason to 
implement weak privacy or security, because it all wouldn't help to 
prevent from DRM being implemented. The only way to prevent open source 
software (whether free software or not) from being changed to support 
DRM are legal actions. And if the GPL doesn't give a hook for this, you 
couldn't prevent it.

Martin