DRM: where Microsoft's priorities lie

[piratePenguin]

http://www.wired.com/news/columns/0,71738-0.html?tw=rss.index

If you really want to see Microsoft scramble to patch a hole in its software, don't look to vulnerabilities that impact countless Internet Explorer users or give intruders control of thousands of Windows machines. Just crack Redmond's DRM.

Security patches used to be rare. Software vendors were happy to pretend that vulnerabilities in their products were illusory -- and then quietly fix the problem in the next software release.

That changed with the full disclosure movement. Independent security researchers started going public with the holes they found, making vulnerabilities impossible for vendors to ignore. Then worms became more common; patching -- and patching quickly -- became the norm.

But even now, no software vendor likes to issue patches. Every patch is a public admission that the company made a mistake. Moreover, the process diverts engineering resources from new development. Patches annoy users by making them update their software, and piss them off even more if the update doesn't work properly.

For the vendor, there's an economic balancing act: how much more will your users be annoyed by unpatched software than they will be by the patch, and is that reduction in annoyance worth the cost of patching?

Since 2003, Microsoft's strategy to balance these costs and benefits has been to batch patches: instead of issuing them one at a time, it's been issuing them all together on the second Tuesday of each month. This decreases Microsoft's development costs and increases the reliability of its patches.

The user pays for this strategy by remaining open to known vulnerabilities for up to a month. On the other hand, users benefit from a predictable schedule: Microsoft can test all the patches that are going out at the same time, which means that patches are more reliable and users are able to install them faster with more confidence.

In the absence of regulation, software liability, or some other mechanism to make unpatched software costly for the vendor, "Patch Tuesday" is the best users are likely to get.

Why? Because it makes near-term financial sense to Microsoft. The company is not a public charity, and if the internet suffers, or if computers are compromised en masse, the economic impact on Microsoft is still minimal.

Microsoft is in the business of making money, and keeping users secure by patching its software is only incidental to that goal.

There's no better example of this of this principle in action than Microsoft's behavior around the vulnerability in its digital rights management software PlaysForSure.

Last week, a hacker developed an application called FairUse4WM that strips the copy protection from Windows Media DRM 10 and 11 files.

Now, this isn't a "vulnerability" in the normal sense of the word: digital rights management is not a feature that users want. Being able to remove copy protection is a good thing for some users, and completely irrelevant for everyone else. No user is ever going to say: "Oh no. I can now play the music I bought for my PC on my Mac. I must install a patch so I can't do that anymore."

But to Microsoft, this vulnerability is a big deal. It affects the company's relationship with major record labels. It affects the company's product offerings. It affects the company's bottom line. Fixing this "vulnerability" is in the company's best interest; never mind the customer.

So Microsoft wasted no time; it issued a patch three days after learning about the hack. There's no month-long wait for copyright holders who rely on Microsoft's DRM.

This clearly demonstrates that economics is a much more powerful motivator than security.

It should surprise no one that the system didn't stay patched for long. FairUse4WM 1.2 gets around Microsoft's patch, and also circumvents the copy protection in Windows Media DRM 9 and 11beta2 files.

That was Saturday. Any guess on how long it will take Microsoft to patch Media Player once again? And then how long before the FairUse4WM people update their own software?

Certainly much less time than it will take Microsoft and the recording industry to realize they're playing a losing game, and that trying to make digital files uncopyable is like trying to make water not wet.

If Microsoft abandoned this Sisyphean effort and put the same development effort into building a fast and reliable patching system, the entire internet would benefit. But simple economics says it probably never will.

@Windows users: That's what you're paying for: MS-security fixes, not end-user-security fixes.

There's another reason a free (as in freedom) OS might be safer - developers of no free OS I know of are spending time and money on DRM. Copy protection costs not only inconvenience to every customer, it costs money too - money that could go towards more important things like end-user-security.

[H_TeXMeX_H]

That's awesome ... go hackers !!! Rip DRM a new one

[worker201]

Nice article.

making digital files uncopyable = stopping the world from wanting to use drugs (the war on drugs) getting rid of every teenage Arab who feels like he got a raw deal (the war on terrorism) = making water not wet

[mobrien_12]

Apparently I got beaten to the punch by PiratePenguin, so here's the comments from my thread    
OH and the slashdot article on this is good too.
http://yro.slashdot.org/yro/06/09/07/1814232.shtml

Maybe you heard that someone cracked MS DRM.

So guess what? They released a patch. Three days. They have #@$%!@ security holes sitting around for years and do nothing. Critical security holes and they make people wait for patches.

Someone cracks their DRM, and they patch it within 3 days.

The people that buy their software are in danger? @#$% em.

The RIAA's precious IP might get compromised, they patch it licketysplit.

Says a lot about them doesn't it?

[pofnlice]

The bank....nuff' said

[GenuineAdvantage]

*surprise-emoticon*x1000000

You are surprised by the fact that money is #1??

Don't you ever deal with old guys who run stuff? Well I do. You can learn a lot from them, like that not getting in the way of business is much more important than anything else, for the good of everyone! Even the abundantly and widely accepted by science fact about CO2 and global-warming / climate-change is unimportant by comparison - and it may just be a theory after all. These old fools are very wise, like sages, groundless sense of entitlement and all.

[H_TeXMeX_H]

I don't think so. I'm going to get in the way of business, because business doesn't care about the right things ... it only cares about money most of the time. Now a business should definitely take money into account if it wants to stay alive, but to make money the goal of the business (as M$ has done) is certainly not in everyone's best interest. It is in everyone's best interest to stand up and fight companies like M$, the ones interested purely in making a shitload of money.

[piratePenguin]

Making a shitload of money is exactly what business is about, isn't it?

Alot of the time, it works in the people's favor. But often it doesn't. That's why I'd prefer more of a community-developed OS and everything else when possible, to a company-developed one.

[Dark_Me]

Making a shitload of money is exactly what business is about, isn't it?

I think H_TeXMeX_H's point is that, yes in most cases this is true but it doesn't have to be. A buisness can be successful without only thinking of money. Probably more successful since they will actually care if their product is any good.

[piratePenguin]

I think H_TeXMeX_H's point is that, yes in most cases this is true but it doesn't have to be. A buisness can be successful without only thinking of money. Probably more successful since they will actually care if their product is any good.

A business would be more successful by putting success first

That means before customer satisfaction, morality etc... But OFTEN it is good business sense (as in, will result in further business success) to produce a good product, to satisfy customers, to do the right thing etc, but that's not always the case.

[H_TeXMeX_H]

When is it not the case ?

[piratePenguin]

When is it not the case ?

In Microsoft's case. If you think they're trying to be bad then I highly doubt that.. They're trying to be successful, and when you're already that far ahead, you can do all the bad things you want to become more successful.

[worker201]

Microsoft's "badness" is making them more successful now.  If you look up why monopolies and cartels are bad in an economics textbook, you'll get pretty much a verbatim description of why Microsoft is bad, and why they are making so much money being bad.  But it can't last forever.  Eventually, people will start to realize that they aren't being satisfied by Microsoft products, and it will start to affect their returns.  At that point, Microsoft might change its tune and start releasing better products with better service.  We've still got a long way to go, but I think in the end the market will punish Microsoft for being such a shitty business.  All we have to do is show people how Microsoft is screwing them, and point towards the alternatives.

[piratePenguin]

I think in the end the market will punish Microsoft for being such a shitty business.

The heads in Microsoft apparently reckon it'll be worth it. Are they smarter than you? I hope not.

[Calum]

pirate penguin, i am not convinced that a lot + often = only 100%.

That aside, i might point out that the components of success are supposed to be being good at whatever your business is. if your business is manufacturing then you have to be good at getting cheap raw materials, good at hiring the minimum of staff, good at paying the lowest wages possible, but good at keeping both your workforce and customer base satisfied enough that they don't cause you any problems (laqsuits, strikes etc), good at making components that are as functional as possible and don't break down, and good at getting your orders shipped on time, end result, you want to satisfy your customers so that your name becomes known as "good" (reliable, value for money etc).

Most of the above things break down once a company becomes a monopoly. for instance if you are successful at getting low cost raw materials then you will drive your competitors out of business and become a monopoly. then all of a sudden it is good business (for you) to make things that break, because everybody buys from you and so when their stuff breaks, they have to come to you to replace or fix it. you no longer have to worry too much about quality, or the welfare of your staff for the same (or similar) reason. once you actually are a monopoly, you can also start to make demands on your suppliers and those you supply. want to delay the european release of your product for five months? why not? nobody else is making them! in fact you could get your PR department to hype the eventual release and sell more units! similarly if you are the only buyer from your suppliers, then they have to meet your terms or go bust themselves!

this is why modern capitalism is a bad economic model. because it tends towards monopolies. and by the time a company has become a monopoly there's nobody who can touch them because they already have more money than everybody else (and sadly the "justice" system is run by money in our modern capitalistic system). a successful company are above the law or justice, and who's to say that's not why they became successful in the first place?