Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

161–170 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#161

Earlier quoted context omitted.

The people who profit from all this are mostly not those who can claim that it is their own creative work.

Finish the thought. How do they profit from someone else's creative work? Is it a) by just taking it because they can? or b) by mutual agreement with the original creator?

By being in a dominant economic position whereby they can force predatory terms onto content creators who cannot avoid them if they want any chance of getting anything at all, or reaching a significant audience.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#162
post #97
post #91

Earlier quoted context omitted.

That wont work. You can't tech your way out of this short of brain implants instead of screens. If there's a screen/speakers it's going to be pirated full stop. Games, okay that's a different story sure but they're already going down that path with online only games anyways.

Because the idea of brain implants is so far-fetched?

As a requirement to watch Netflix? Yes, it is.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#163
post #23

Earlier quoted context omitted.

Yeah web-dls might be hit or miss but webrips are such good quality that it's irrelevant for most folks anyways, since it's nearly the same quality you'd see on your TV.

I think you have terminology wrong here. by definition, WEB-DL is the exact encrypted video/audio content that is served, but unencrypted of course. You literally cannot get higher quality than a proper WEB-DL.

That's what I said, you might not be able to get a webdl depending on if the stream is cracked, but at least webrips (which are captured from capture cards) are good enough quality anyways.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#164

Earlier quoted context omitted.

That's all beside the point. Hardware belongs to the user and should be under the user's control. Treacherous computing should be highly taboo and illegal. The "sustainability" of Disney's profits are not important. To suggest otherwise on a site literally named Hacker News is comical.

Why would bringing up sustainability of any business be comical at Hacker news? How do you make money? Why should it not be for free? Your sustainability is important? We agree on hardware belonging to the user by the way.

You're still missing the point, and I believe intentionally so.

> We agree on hardware belonging to the user by the way.

You absolutely do not or you would not engage in the work you do. Actions speak louder than words. Being dishonest only makes it even worse.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#165

Earlier quoted context omitted.

Another complication for LVDS capture is that HDR content is always tonemapped/filtered (OLED ABL etc) before it is sent to the panel, and that processed version is what you would get with LVDS capture. It might be usable, but it would be a downgrade from other capture or decryption methods which grab the unprocessed HDR video.

With a $20 HDMI grabber you get 4K HDR video with full Dolby Vision or HDR10 metadata, without any tonemapping applied, én masse. Combine that with some software mods to hide the UI at all times and you've got a perfect recording. Re-encoding is the slowest and most annoying part of this process, but release groups re-encode everything anyway, so that's not an issue either. DRM only hurts the legitimate customers, no…

>> I have to rip media from bluray because the streaming version only has audio or subtitles available in the local language

This. It's a huge problem for us expatriates living outside of their native countries - I want my son to be bilangual and as part of that I try to at least play cartoons in my native tongue - but Disney/Netflix/Prime usually only have the local language option, even though as soon as we are physically in my home country magically the same shows have dubs in local language. So all of these corporations have these options available, but decide not to show them for whatever reason. So more often than not I have to ask family to send us actual DVDs/Blurays of kids shows so we can watch them in the language we want to watch them in.

And no, VPN doesn't always help - it's flaky, it's frustrating in its stability, one day it works the next day it doesn't, it's not the thing I want to mess with nearly every other day just to play some cartoons.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#166
post #82
post #46

Earlier quoted context omitted.

If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

>>So, you could enjoy it at zero cost, from the original provider in high quality, with no commitment. That night our anti-piracy team took down 20,000+ illegal streams, serving a large audience.

And....was it worth it? Do you think literally anyone from those 20k people actually signed up for your trial?

Re: Microsoft PlayReady – Complete Client Identity Compromise

#167
post #82

Earlier quoted context omitted.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

I used to be the chief DRM guy at another large streaming service. I can say 100% that the company did not want DRM as it was unreliable and customer-unfriendly, but it was the rights-holders that were badly educated and informed and would demand it in their contracts. I would suspect that is the case at a lot of other streamers too? (the cost of the DRM was near-zero at our company)

Absolutely, I have to review contracts on almost a weekly basis, all of which say what I have to do and it's usually waaaaay worse than anyone here would want.

I spend way too much time pushing back on over zealous requirements.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#168
post #82

Earlier quoted context omitted.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

I understand your points and I wish you all the best with your job. But please tell your bosses to let me buy single episodes of the series I like or every movie in history. No monthly subscriptions. I stay months without watching anything, then maybe two or three series at once, one episode per week each. The industry business model doesn't fit my habits.

I believe Amazon and Google have the ability to buy single episodes or single series, or rather I'd say I've seen it in the past.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#169
post #95
post #81

Earlier quoted context omitted.

Some of the games you mention were already cracked but not by the scene.

Which ones? My list has nothing to do with scene or otherwise.

Well I checked and the list is correct.

There is a closed beta copy of SF6, a leaked dev build of Atomic Heart, and an arcade dump of Persona 4 Arena Ultimax but these are unrelated to Denuvo.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#170
post #124
post #82

Earlier quoted context omitted.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

The argument from the other side is at least as frustrating. > ...nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not have issues with piracy proliferation > That night our anti-piracy team took down 20,000+ illegal streams You already have enormous issues with piracy proliferation. The money you spend on DRM may be "relatively insignificant", but it's still money being wasted on "protection…

What I will say in response to that is that I empathise with people who have no physical ability to access content. If the rightsholder doesn't have it available in a territory and/or no distributor is willing to carry it? Who am I to say it's wrong for it to be available elsewhere.

The contrast to that is that you're not obligated to watch everything out there and just because you can't watch something isn't an offense to humanity. It's leisure, not the top of the pyramid of the hierarchy of needs.

The real problem for us is with freeloaders, people who will steal to avoid paying for the work we put in. It's not some nebulous Scrooge McDuck money pit, streaming is really hard and costs a lot of money to do right. I get to see our cloud computing bill, it is eye watering. Then you have to employ people to build and maintain 30 different apps for every smart TV, smart phone, games console, set-top box, browser, tablet, etc. Then you need people to build and maintain hundreds of backend services to provide catalogues, account management, billing and metadata. Then you need people to run the media processing, encoding and distribution. Then you need an operational support team to ensure 99.999% availability because people are passionate about what they watch. You need a rights team to get the deals, you need a legal team to arrange contracts, you need a finance team to pay everyone, you need infrastructure and IT support for all that.

Oh, and to top that all off, I have to spend significant amounts of my time dealing with patent trolls who want a slice of the action.

One thing I am looking at is a way of removing DRM, by adding invisible watermarking which would attribute every leak to an individual. But when what happens? I turn off DRM and someone releases it online. I know who did it, but am I going to get my pound of flesh? Unlikely.

One of the main reasons I have DRM is because it's contractually required. It does certainly provide a mechanism to prevent casual piracy, it provides me a control point, somewhere I can restrict playback and attribute it to a certain situation. Most people have to jump through hoops to get around the restrictions provided by DRM and that's a good thing because it does reduce proliferation. I'd actually support an alternative to DRM, some kind of trust anchor where I can trust that code run in a browser is not tampered with so I could just use things like mTLS and tokens, but there's plenty of people out there who would block such a thing and instead we have to go with commercial solutions that sit outside the standards.

I don't have any desire to treat anyone but pirates like the enemy, and it's certainly not our intention, our intention is to make everything as friction free as possible within our contractual responsibilities. But when people just want to burn the whole thing down around you and have a wild west, it's not reasonable. If you want to argue, then show me how it can be done, show me how I can protect our assets without DRM? The group I am within the business used to be called the "Revenue Protection Unit", because ultimately it was about protecting ourselves. Not to make us rich, but to make the business sustainable and unless you've seen how hard it is to make a streaming business sustainable, it's really hard to appreciate it.

Post reply on HN