Developments in DRM

[darryl]

I had hoped that we might see a slow move towards so-called Social DRM. After all, the industry has not collapsed despite Apprentice Alf. Nor have Vendors/Authors choosing not to use DRM been bankrupted.

Instead, current indications are that encryption type drm is not going to vanish anytime soon. The following link is to a story from Nate's Blog, The Digital Reader:

http://the-digital-reader.com/2016/0...adc-ebook-drm/

This refers to Sony's relatively new DRM system, which as far as I know has so far neither been cracked nor reverse engineered.

However, the first comment to that post is by a developer working on something called Readium LCP. This is the first time I have come across Readium, an open source project. I was quite surprised to read this Developer's description of Readium LCP as:

the open-source standard DRM being developed for EPUB3

My first thought was "Open source DRM?" A look at the FAQ on the project's web page seems to indicate that licensees will receive:

in a very secure process, certain secret “keys” which will enable the operation of the DRM. Those keys will be distributed in a very secure way by a third party - NOT the Readium Foundation.

The answer to the question as to whether the source code will be made available is "Yes. With some caveats". I take this to mean that at least some of the source code relating to the DRM will not in fact be made available.

Personally, whilst I understand the reasons why such a project may like to offer DRM, I find the whole concept of "open source drm" to be an abomination. Is there really such a thing? Can it truly be called open source if not all of the source code is made available?

[JSWolf]

Nothing to see here. Please move along to the original thread at https://www.mobileread.com/forums/sho...d.php?t=273234

[cvkemp]

The key as I see it is that I remove DRM for my personal use. I do not give the books away. And seeing my wife and I enjoy different types of reading we do not even share our books, except for maybe a few Christian books. I see it as my right to have my ebooks, and if I decide to get a different type of ebook reader or app I can still have my books.

[fjtorres]

Go back to Nate's morning coffee for monday and you'll find this piece:

https://copyrightandtechnology.com/2...in-challenges/

The search for the "perfect" DRM continues apace, this time the focus being on using blockchain tech (the underpinnings of Bitcoin-style digital currencies) for authentication.

The good news is that with so many new "standards" popping up the odds none will prove commercially viable are pretty good as long as politicians aren't conjured into the mix.

[latepaul]

Originally Posted by darryl

The answer to the question as to whether the source code will be made available is "Yes. With some caveats". I take this to mean that at least some of the source code relating to the DRM will not in fact be made available.

That's not how I read it. FAQ goes on to explain what the caveats are, namely:

a) The licensing is such that you can see the code but to use it you need to obtain a license from the Readium foundation.

b) The keys - which are really data and not code - will not be made public.

(source: Readium FAQ)

Personally, whilst I understand the reasons why such a project may like to offer DRM, I find the whole concept of "open source drm" to be an abomination. Is there really such a thing? Can it truly be called open source if not all of the source code is made available?

Well as I say I think all the source will be available. But it's also important to point out that "open source" is a software development methodology not a statement of principle about acceptable ways to (attempt to) enforce copyright.

I think as long as there are libraries lending ebooks some form of DRM is needed. Making it inter-operable across different devices/apps takes some/most of the sting out of that. And making an open source DRM standard makes that more likely.

As long as it gains the necessary traction. As with all standards that's a chicken and egg problem and often something proprietary comes along and becomes the de facto standard.

Ho hum.

[eschwartz]

Originally Posted by darryl

The answer to the question as to whether the source code will be made available is "Yes. With some caveats". I take this to mean that at least some of the source code relating to the DRM will not in fact be made available.

Personally, whilst I understand the reasons why such a project may like to offer DRM, I find the whole concept of "open source drm" to be an abomination. Is there really such a thing? Can it truly be called open source if not all of the source code is made available?

What is so abominable about it?

A true open-source DRM is that much more easily broken.
And if some of the source code is kept hidden then it isn't really open-source at all, so we can just point and laugh at the latest proprietary DRM scheme that no one uses. It doesn't really matter what they call themselves in an attempt to hype things up.

[tomsem]

This is more about 'enterprise' DRM than 'consumer' DRM, e.g.:

Bluefire, for example, is using Sony DADC DRM in its new CloudShelf "shared library" service. This is not a retail platform but instead is a way for an organization to create and manage a shared library of ebooks which can only be accessed by its members. (The service is in beta. Contact Bluefire for more info.)

In such environments, they need a more robust (and cost effective) solution than what Adobe offers.

[Alpha o]

If it gets as far as Sony and its music CDs, it will be a pain.

Sony had it that you could only play a CD in the device that first used it. If you used it on your computer, you couldn't play it in the car.

https://en.wikipedia.org/wiki/Sony_B...ootkit_scandal

I don't think leopards do change their spots.

[Patchicat]

Ever since Sony's rootkit stunt, I have refused to purchase anything with Sony's name on it. They have proven that they are not trustworthy. And when Amazon pulled their stunt of recalling legally purchased ebooks from customers' Kindles without warning because they were selling versions they had no legal right to sell, I took Kindles off my shopping list. I may purchase ebooks from Amazon, but they get future proofed almost immediately. Once a retailer proves it cannot be trusted, why should I reward it? And I'm rapidly moving toward the same attitude regarding Barnes & Noble. Fortunately, there are other sources of ebooks to feed my addiction out there.

[MGlitch]

B&N is off my list because of how annoying they have made it to download ebooks. I'm 'lucky' in that I used Nook Study with my account prior to them abandoning it. It seems new accounts and/or accounts that never used it are locked from it. Granted this is based on only a handful of accounts. And while there are tweaks for older eink Nooks with SD card slots which allow you access to your purchases, the current line up of Nooks prevents it without rooting.

The last I heard they were trying to focus more on being a content provider, which is odd since their actions fly in the face of doing that. Rather they are locking people down to their devices. Although it's hard to keep what B&N is actually focusing on versus what they say they're focusing on, versus what they'll say in two months.

[darryl]

There have been some interesting posts and I am going to make some brief comments on each of them so far.

@jswolf. The other thread certainly overlaps with this one, though this thread is more general and also refers to the Readium DRM. If the mods feel it is appropriate I have no objection to this thread being closed or merged with the other thread.

@cvkemp. I see no problem with removing drm for personal use or to enable use on other readers. But the main issue to me is trust. I am simply not confident that I will have continued access to my ebooks in the future whilst they remain encumbered with DRM.

@fjtorres. Thanks. I must have missed this on Monday. I will go back and have a read. I agree with your comments on commerial viabiliity and on Politicians. I might add the oft-quoted point that even very effective DRM will not stop piracy. Scanning of books is certainly not unknown. Nor is re-typing a whole book. OCR gets better and better. And these are not the only possibilities. Whilst a book can be read, it can be copied. The key to a viable industry is to keep prices reasonable and make purchasing easy and convenient. Otherwise DRM in fact encourages piracy.

@latepaul. You could be right, but I don't agree with you based on two things. If the only thing not released is the keys, which, as you say, are not code, then the question could have been answered yes without any caveats. And, as eschwartz pointed out, if all of the code is released the DRM is much more easily broken. Having the algorithm so easily available certainly does not do any harm to the hackers seeking to break it. On your other point, I think you are confusing the open source model of software development with open source in general, and the open source definition. Incidentally I don't claim that development of drm in open source products is excluded by the letter of the definition. I do, however, believe that it is against the spirit of the open source movement in general, given the aims of DRM. I don't profess to be an expert on the matter, and in fact would be quite interested in what those who are think about the issue.

@eshwartz. I think drm is against the spirit of the open source movement but not the letter. I agree with everything else in your post. Interestingly enough, abomination or not, if we must have drm the truly open source variety is something to be encouraged.

@tomsem. I don't see that the distinction between enterprise and consumer drm is relevant. Many of us do, however, have more sympathy for the need for DRM in an environment where ebooks are "lent" rather than "sold". Unfortunately, whilst a particular product can be developed to operate only in this environment, its potential operation beyond this environment cannot be excluded.

@Alpha o and @Patchicat. I agree so far as Sony is concerned. However, particularly with Corporations, leopards do change their spots from time to time, sometimes for the better and sometimes worst. For instance, much of the criticism of Amazon is about what it may do in the future under different management. However, there is no indication at all that Sony has changed for the better. Amazon did indeed make an egregious error with 1984. However, it did correct the matter promptly, realised its seriousness and there has been no repetition. Whilst I don't personally think it is necessary to avoid purchasing Kindles, I do think it is necessary to "future proof" ebooks purchased not only from Amazon but any Vendor that uses DRM.

[darryl]

@MGlitch. Forget B&N. In my opinion they have acted with total contempt for their customers, and may well be on the way out anyway, at least as a major player in the ebook market.

[eschwartz]

darryl, when you say DRM is "against the spirit of open-source", that isn't really true.

It is against the spirit of free (libre) software. The free software movement is an ideological development policy founded on user freedom.
It is not against the spirit of open-source software. The open-source movement is a practical development policy with the goal of crowd-sourcing better code.


Assuming arguendo that open DRM is somehow not an oxymoron, there is no conflict with the spirit of open-source software. The Free Software Foundation would have a major ethical problem, but the developers clearly don't identify with the free software movement.
And they certainly seem to believe it isn't an oxymoron, see the developer's comment on Nate's blog:

There are ways of making a DRM system reasonably robust even if the source code is open source, which are being incorporated into the architecture of Readium LCP. Contact me separately for details. Does this mean it’s hackproof? Of course not, no such thing.

[darryl]

@eschwartz. My understanding is that the term open source came into use essentially as a result of a deliberate decision to try to avoid the "taint" of activism attached to the Free Software Foundation. In light of this and on reflection your view of the matter is probably the better one.

[tomsem]

@darryl. I do think distinction about application is relevant. The requirements are not the same for enterprise and consumer. There is no 'one size fits all' DRM.

We have not even seen any retailers deploy 'hardened' Adobe DRM since that's been available. There would be no benefit to retailers in doing so, and potentially, risk of consumer backlash.