Why Rosyna Can't Take a Movie Screenshot

I'm not sure I understand what that means. Any deal they make to license the movie is a distribution agreement, by definition.

... or studios have found a sweet spot they're happy with (or at least, not totally unhappy with) where spending more on DRM wouldn't be justified by the incrementally smaller increase in sales.

i.e. if you double your spending on your copy protection and it lasts an extra week before getting cracked, how much that extra weeks worth of sales is worth depends a lot on how many previous weeks there were before the crack. At some point the ROI curve stops making sense.

I suspect it's not pure business though - people in the media live off their creativity and seeing people pirate your stuff can be emotionally difficult. I would not be surprised if some places over-invest in DRM because they feel a moral and emotional imperative to defend their work from piracy as much as they can.

BluRay DRM is probably as good as you can technically get for movies distributed on discs. For movies distributed via the internet it's easier. But the economics of DRM are tricky - the key thing that hurt BluRay DRM (and the designers were fully aware of this problem) is that movie producers have a strong financial incentive to push player prices low, and player manufacturers have a strong financial incentive to push movie prices low. Movies and players are "compliments" of each other in the economics jargon. Not surprisingly, player makers make the absolute minimal effort when it comes to DRM and that's one reason why cracks keep happening.

One of the most obvious tension points here is PC software players. They're much harder to defend. But they increase the size of the player market (and therefore the movie market) a lot. So movie studios ended up deciding to allow them, despite knowing it'd weaken the DRM.

BD+ was designed to try and resolve this problem by allowing movie producers to spend the money on copy protection rather than player manufacturers, and it was remarkably effective for a long time. BD+ ended the era of open source players for good, only full time reversing teams that are willing to keep up continual effort on a disk-by-disk basis can break it. But in the end it wasn't enough for a fully convincing solution.

If politicians took a stronger stand against the tactics of media companies, then I most likely wouldn't need to cheat.

For example, I don't have any issue with remote power control. A secure form of Wake-on-LAN is wonderful, as long as the public keys are fully enumerable and totally under operator control, and the feature can be decisively disabled if desired.

To your point about packet processing, to keep with the Wake-on-LAN example, it's perfectly easy to share a physical port and keep the traffic fully visible to the OS as well as a separate processor.

If a remote party has permission to completely own my system, I want to see their name (public key) listed every time the machine boots, like the warning you get any time you access a government system;

  You are accessing a [Company Name] information system, which includes (1) this
  computer, (2) this computer network, (3) all computers connected to this network, and
  (4) all devices and storage media attached to this network or to a computer on this
  network. This information system is provided for [Company]-authorized use only. 

  Unauthorized or improper use or access of this system may result in disciplinary 
  action, as well as civil and criminal penalties. 

  By using this information system, you understand and consent to the following:
  
  You have no reasonable expectation of privacy when you use this information system;
  this includes any communications or data transiting or stored on this information
  system. At any time, and for any lawful government purpose, the government may,
  without notice, monitor, intercept, search and seize any communication or data
  transiting or stored on this information system. 

  The government may disclose or use any communications or data transiting or stored on
  this information system for any lawful government purpose, including but not limited
  to law enforcement purposes. 

I'm not an expert at vPro or Intel AMT by any stretch, but upon cursory investigation, it appears the trust model (a.k.a all you need to completely own a system) is an easily obtainable certificate, and control over the DNS and DHCP server. It looks like the only thing that protects a system beyond this is a vendor-specific "remote configuration timeout" which would have to be reset by a local agent after it has expired. [2, 3] However, some Intel documentation claims that TLS-PKI "...allows a client system to be provisioned with zero physical interaction. Remote configuration is ideal for systems that have already been deployed into an environment..." which implies some way to overcome the remote configuration timeout... (See 'Alternate Path #2' on footnote #5)

[1] - https://software.intel.com/en-us/blogs/2009/10/07/intel-amt-...

[2] - http://h10032.www1.hp.com/ctg/Manual/c03455054.pdf

[3] - https://communities.intel.com/docs/DOC-1989#SECFAQ8

[4] - http://downloadmirror.intel.com/21729/eng/RemoteConfiguratio...

[5] - https://software.intel.com/en-us/articles/intel-amt-use-case...