Kreme

 

There’s a lot in the news currently about piracy, what with the attempts to pass two Internet-destorying bills (SOPA and PIPA) in the name of saving hundreds of billions of dollars in lost sales and three-quarter of a million jobs. Those numbers, provided by the media shills trying to get these draconian bills passed, are completely made up and have no basis in fact. They could have easily said eleventy trillion dollars and 800 billion jobs and been just as accurate.

The simple truth of the matter is that media piracy has been around for more than a hundred years (Edison complained about it back in the days of wax rolls), and while Lars Ulrich has fond memories of his media piracy days, swapping tapes in his friends basements, when the piracy became digital suddenly that became bad. It’s especially ironic that Metallica, a group that built its fan-base almost exclusively on the backs of tape-trading, concert bootlegs, and other piracy activities should have become the frontmen for the music industry’s war on the Internet. A little known facts that during this time the RIAA also tried to shut-down the used record market, claiming that reselling a record was “exactly the same as theft” and also tried to make it illegal for people to digitize their own copies of CDs. This is the industry we were dealing with, thugs and bullies, liars and cheats. Basically, the scum of the earth.

The music business in the late 1990′s a was corporate machine that was designed to fleece as much money as possible from the consumer. Despite astonishingly lower costs on producing CDs than the costs of the newly defunct vinyl records, media companies continued to charge a premium of about 50% for CDs over records. Additionally, the records that did come out more and more had recycled content and a couple of new songs, or were records with only one or two songs anyone wanted, but you had to spend the $18 for the entire disc.

Of course, a lot of the music we already owned on vinyl and we simply wanted to be able to listen to it on our computers where we worked all day. Short of patching your stereo into your computer and recording at 1:1 speed, it was simply more convenient to download another copy of the music you wanted. Lost sales here? None.

But that’s all in the past, the distant mist-shrouded days of legends and dragons in Internet time, where are we now?

First of all, piracy is much easier than it’s ever been. Bandwidth is higher so downloads are faster and it is trivial to find pretty much any song, album, of movie. And yet, the iTunes Music Store is selling billions (yes, billions) of songs. How can this be? Well, the prices are reasonable ($10 for a ‘CD’ or $1 a song instead of the $15-20 more valuable 1995 dollars a CD cost), the convenience is stellar, and for the most part people are not feeling forced to re-buy their existing collections.

Now, let’s look at another segment of the piracy world that I have some personal experience with, the world of Japanese Animation known as anime. Back in the 80s and 90s there was a lot of piracy of anime productions from Japan. There were entire networks of people across the country who traded VHS tapes of shows like Urusei Yatsura. Now, this was a little bit different because the Anime was simply not available in the US at all, or it was un-dubbed and un-subtitled imports, or it was adulterated garbage like RoboTech (a mashed up collection of garbage ripped from Macross and mashed up with a couple of other Anime series.) Robotech was terrible, but only if you’d seen real anime. For people who’d never seen any, Robotech was brilliant. But I digress.

So in the 80s and 90s we had people who ‘smuggled’ VHS tapes from Japan, edited them to add subtitle tracks, and then produced a few hundred master tapes that went out across the country (and even in to Europe). These tapes would be recorded over an over onto new tapes and so the distribution network spread. These people were spending many hours, sometimes hundred or thousands of hours, translating the Japanese audio into English text and using their Amigas and Video Toasters to create professional grade subtitles. Why? Because they were fans.

And what these fans did was built a fan base in the US for anime. Sure, Robodreck helped, but by the time it came along there was already a healthy pirate distribution network and a burgeoning fan base. Today there is a healthy industry in the US for English-language Japanese animation and Manga, all thanks to ‘pirates’.

A few years ago in the UK a new band put out their first album. The album was leaked onto the Internet months before its scheduled release and quickly became the most downloaded album in the UK. Millions of downloads. There were so many downloads that the label rushed the production and put the CD out early to try to prevent a total melt-down of sales. Sound like a rep ice for disaster, doesn’t it. Except that the Arctic Monkeys “Whatever People Say I Am, That’s What I’m Not” was the highest selling debut album in UK history. It sold more albums in one day than the number 2-20 albums combined.

The Content Cartel likes to claim that every pirated movie, game, album, or TV show is a ‘lost sale’. A moment’s thought will show that this is absurd, but another moments thought will reveal that it is a self-serving ploy to inflate the problem. The Arctic Monkeys success shows us that piracy is a vehicle for publicity, and it is a far more effective vehicle than adverts or even radio play.

For a more recent example, let’s look at Louis CK, an American comedian who recently decided to conduct an experiment and release a new concert video on the Internet, at very low cost, and without any of the draconian DRM that most media comes with. How’d he do? Over a quarter million sales, despite the video being available the instant he put it up for pirates to download and share.

And one final example.  A few years ago a new game came out for Windows that had such draconian and absurd DRM built-in to it that for many people, including a good friend of mine, it was impossible to install the game on their computers. This happens a lot more often than you think, and the clever people at the Content Cartels have made it legally impossible to return software. My friend was out $60 and had a game that he simply could not use. At least not until he got a cracked version of it from the Internet with all that DRM removed. I know many people who have had to download a movie they owned on DVD or BluRay because their new player won’t play it, or the DRM is preventing it from displaying on their computer screen because they have the wrong cable (I couldn’t make this stuff up if I tried).

So, what’s the truth about Piracy? It’s complicated, but here’s a few of them:

  1. Pirated content is almost never a lost sale. Either it would never have been bought, it has already been bought, or it cannot be bought.
  2. Piracy increases exposure. Think of it as digital word of mouth. Increased exposure translates to increased sales.
  3. Pirates tend to be fans of what they pirate. When you alienate your fans, you cost yourself money. Ask Lars Ulrich if he regrets some of his comments during the whole Napster ordeal. He does, because he and his band lost a lot of their core fans once they started referring to them as thieves. I know several ex-Metallica fans personally, including one who has made a point of sharing the entire Metallica discography online for more than 10 years now; before that he went to 15-20 Metallica concerts every time they toured.
  4. People don’t like jumping through hoops to access their property. Games that force you to keep a DVD in the drive to play them are going to pirated much more than games with no DRM at all simply because some people like to travel without their entire collection of install media, but also because when you piss people off, they tend to stay pissed off. I found the security measures on Valve’s Steam product so offensive that I refuse to buy any Valve/Steam product, ever. I found SecureROM so contemptible that I stopped buying Sony products as well (I recently bought a new TV and never even looked at the Sony offerings). This is besides the fact that the Steam installer under Windows is essentially a root-kit that gives Valve/Steam complete unfettered access to your entire computer and allows installed games to also install root-kits on your machine.

There aren’t hundred of thousands of jobs lost to piracy, and there’s not billions of dollars in lost sales to piracy, these numbers are fabrications. There’s no evidence that media piracy has ever costs anyone a job, in fact.

In closing, take a look at this image:

I know a lot of people with small kids who routinely ‘pirate’ the DVDs they bought for their kids simply to get around all of this sort of crap. One complained that the unskippable advertising on the DVD was actually longer than the actual content, with over 20 minutes of previews, trailers, and ads for a video that was less than 20 minutes long.

 

longer password are better than short random passwords XKCD is a web comic that is often brilliant, always geeky, and occasionally very useful even for non-geeks to understand some of the issues that face us in our increasingly geeky culture.

This recent strip really laid-bare the entire problem with passwords in that currently people are being told to memorize short gibberish passwords that are fairly easy for modern computers to crack.

But there is another issue that is not covered here and that is that most websites have very low limits on the length of passwords. Many sites will require ‘at least 8′ characters, but will have a maximum of 12-16 characters, making the ‘difficulty to guess: HARD’ in the strip above unobtainable. MSN.net (and hotmail and Windows Live and all those associated services) has a maximum of 16 characters. Using ‘human’ characters of simply letters and spaces, this works out to somewhere in the 25-30 bits of entropy range, or about the same as a very hard to remember password of 9 characters. Adding in a non alphanumeric word separator helps a lot,”Alive&Springy94″ is a lot better than “Alive Springy”.

The other thing that is difficult to understand is that each additional bit of entropy DOUBLES the security of the password. this is exactly why we were told to use random passwords, because extending the pool of characters to chose from made a dramatic difference in the strength of the password. Even in 1995 “Shiva” was a terrible password, but “Sh/va” was basically uncrackable because adding all the non-alphanumerics to your password cracker meant instead of taking 2 days to crack it now took 8 days by adding two more bits of entropy, and who could devote 8 days of computer time to crack one password?

But computers are so fast now that every single possible 8 character password can be checked in hours by a dedicated hacker. Every. Single. Possible. Password. 8 Characters isn’t secure, at all. Right now, 12 characters is about the minimum, but that won’t be true much longer, we’re fast approaching the 15-16 character password length, but that is assuming fully randomized passwords for maximum entropy.

So what’s going to happen?

You might think that passwords will simply get long and we’ll all move to the 4 random common words model in the xkcd strip, and that might happen. I don’t think so. Longer passwords have a definite diminishing return because people are stupid and lazy. I’m not being insulting, it’s how we are built. People presented with a password dialog that allows 8-200 characters will almost all type in 8 characters. And they will type in the SAME 8 characters at every single password prompt on every web page and every login. Sure, you might not do that. I don’t do that. But better than 90% of humans will do that.

And even if you don’t do that and I don’t do that, we have to have a way to manage those passwords. Sure, 4 random common words are easy to memorize for one login on one website, but I have 600 logins. I have google and web boards and banks and farcebook and webmail and AppleIDs and GitHub, and so on. It doesn’t matter how simple a process we have for generating easy to remember passwords, I can’t remember 600 of them; no one can.

So, let’s imagine five years from now. I have a new computer that I’ve just setup and I go to login to gmail. I fire up my web browser, I go to gmail, and I see a screen asking for logins and password. I go up and click on my password manager (exactly like I do now) and enter my master password. My manager fills in the use rename and the 15 character password, exactly like now.

OK. So this is all today’s technology, and instead of having 600 unique passwords I have 600 unique passwords that are all controlled by a single master password. This is pretty secure because my password manager is completely local to my machine and not something someone else easily has access to, but it is still a single point of failure.

So what will happen next is crucial. Gmail notices that I’ve never logged in from this commuter before and so, despite having my login information correct, it doesn’t log me in. Instead, it searches around my computer for my iPhone 6GS++. If it finds it, it used the NFC chip in the computer and the phone to verify that not only do I know my user name and password, but I have my phone. This is good enough to log me in. If it CAN’T find my phone (maybe I’m still using an old iPhone 4S+ without NFC), then it tells me to go get my phone/authenticator and enter the code from the Google Authenticator. Or it send a code to my phone viaSMS or voicemail. Once I do this, it logs me in.

Then it asks me if this is a computer I trust. Since it’s my computer, I do, and so Google won’t ask for my password again for a couple of weeks, or a month, whatever. Once that time is up I have to login again, and pass the “thing I have” test again. If it’s not a trusted computer, then it checks for the something I have every time I login.

The funny thing is, at least with Google, this is all possible right now, with the possible exception of the NFC negotiation. What will change is that in 5 years, a lot more people will be doing this as ‘normal’ passwords will be easier and easier to crack. This is called two-factor authentication and it is the future of passwords. It’s been around a long time, but the difference that will make it universal is the ubiquity of mobile phones and the ability to automatically and seamlessly manage the ‘thing you have’ check. Right now you have to pull out your authenticator or your phone and you have to manually type in the code and you have to do it pretty quickly before the code expires and it’s all a bit of a pain to do all the time.

Blizzard has been doing this for years with their World of Warcraft game, though it’s still a bit too clumsy and inconvenient for most people to be willing to do it. However, with NFC and the prevalence of mobile phones, this is definitely coming.

Oh, and if you’re using a password of less than 12 characters for anything important, change it now.

 

iTunes match limits you to 25,000 songs, but once you match you will find that many songs do not end up counting against your total. There is a very easy way to work around the limitation, however.

First, select a numb of songs that, when subtracted from your total, will bring that total unr 25,000. Get info on them and set the comments field to something like “unmatched”. Now, set the media type to podcast. This moves the files out of your “music” without deleting them, creating another library, or anything complicated.

Now, run iTunes match.

© 2012 Brain Drippings Suffusion theme by Sayontan Sinha

Brain Drippings is Stephen Fry proof thanks to caching by WP Super Cache