The Engadget Interview: Viodentia, creator of FairUse4WM
By Ryan Block 
posted Sep 25th 2006 1:03PM
posted Sep 25th 2006 1:03PM
Instead of our usual run of interviews with industry luminaries and the like, today we're aiming the camera a different direction. We had a few things to ask the person whom we've identified as Viodentia, the creator of FairUse4WM -- the thorn in Microsoft's (and Yahoo's, and Napster's, and Real's, etc.) digital media business for a month now. Seems at once likely and not that the big DRM scheme developed by the largest software company was broken and broken again by a single person, but here we are -- and here's what Viodentia had to say about the digital music business, where Microsoft went wrong with PlaysForSure, and what s/he thinks about this latest memo and patch.Thanks for granting this interview. So FairUse4WM caused quite a stir. How long did it take you to crack Microsoft's PlaysForSure DRM? Was anyone else involved?
Finding a way to extract key information took about a couple of weeks of spare time. Going from a prototype to a more general tool took a couple of months. I am the only developer, although my friends served as early beta testers and sounding boards, and with the initial release I've gotten to know some very helpful people.
So apart from any ideological or political distaste you may have for DRM, do you have any personal reasons for wanting to crack Windows Media DRM? Like, are you a Rhapsody or Napster subscriber?
No, due to geographic location, I'm unable to subscribe to those services. Only my selfish rationale is the challenge in pitting my skills against the industry leader.
Without revealing the secret sauce, what were the fundamental flaws with PlaysForSure that allowed you to break it? Did Microsoft know about these flaws?
Once code is released, there's really nothing secret anymore -- Microsoft didn't follow standard security practices, and left sensitive data unencrypted on the stack while calling routines out of kernel32.dll. Even when they fix this by changing malloc() to alloca(), it'll still be a big task to audit other sensitive routines for DLL calls. On a theoretical level, they have to send the decryption keys outside of their control, and their only defense is through obfuscation.
Microsoft apparently has teams working around the clock to fix the vulnerability -- and on the legal front they've started getting their lawyers involved, sending C&Ds to places hosting the software. What do you think of their responses to FairUse4WM?
I think they're fulfilling their contractual obligations, and I'm looking forward to their improved obfuscation technology. I certainly disapprove of Microsoft claiming copyright to my program, but realistically I can't do much about that. Nor can I advocate that folks mirror my program against their local laws.
Presently Microsoft has yet to been able to fix this vulnerability -- is it possible for them to repair PlaysForSure without totally starting over?
As soon as I release something, Microsoft can certainly patch around it. I can do the same. I don't believe that either of us has a nuclear option.
What do you think of Microsoft's latest memo, which claims to patch version 1.2?
I'll reserve full commentary until I've had a chance to examine the new IBX in more detail. I'll release a new version sometime this week.
How do you think FairUse4WM affects the industry? Do you worry that cracking PlaysForSure is going to lead to the end of subscription-based services?
I think FairUse4WM is a good thing for the industry -- it demonstrates that the entire world doesn't turn upside down when there's no effective protection on content. I doubt subscription based services are impacted -- programs exploiting the analog hole were already widely spamvertised. The value of a subscription is the continuing access to new titles, which isn't dependent on the protection. I wonder if any subscription company will publicly admit that FairUse4WM was good for them.
Microsoft supposedly has a new DRM scheme they've cooked up for their forthcoming Zune media player. What do you think about their jettisoning PFS for their own device, and this new DRM system of theirs?
I don't have any insight into the politics at Microsoft. If I come across a Zune, I might have more comments on their DRM system at that point. :)
I know a lot of people at Microsoft and its PlaysForSure partners read us -- what do you have to say to them?
I think the biggest mistake with the PlaysForSure / WM design is that it's targeted too broadly. By incorporating forced product obsolesence and platform restrictions, it misses the mark in managing content rights. My suggestion to future designers is simple: don't bother with weak client-side decryption. Instead, provide a public specification for licenses using digital signatures, manage the PKI through a not-for-profit organization, and apply social and legal pressure to programs that don't comform. Accept that folks can trivially patch around the system, but if the restrictions aren't onerous most people won't go through the hassle. If WM files were already interoperable and the license terms were clearly communicated, there wouldn't be anything left for a program like FairUse4WM to accomplish.
Thanks!
awsome stuff!! its great that people like you find ways to circumvent corporate ownership! without stuff like this i think the world would be very beige..
Fairuse4WM helps in transferring purchased .wma files from a windows wma type music store to Apple's iTunes as an mp3. If Microsoft/Apple offered a tool to transfer my licences from .wma to aac in iTunes I'd be happy.
to the best of my knowledge Apple is very protective of the iPod/iTunes ecosystem and does not release any more interop functionality than would be to their benefit. It also seem that providing functionality for conversion between protected formats also provides more potential vulnerabilities in their protection schemes.
beautiful
LONG LIVE Viodentia
Awesome interview! Great to see the thoughts from the developer directly! Cutting edge!
I wouldn't be surprised if Microsoft tried to hire this guy.
Right, but only AFTER they tried to sue him out of existence...
There are content and consumer electronics industry initiatives to provide a cross platform inter operable DRM and FairUse4WM may push them to fasttack initiatives like the Coral Consortium now Microsoft has left them high and dry with the Zune .
http://www.coral-interop.org/
Great interview, guys!
After staring at the picture for a while, I have determined that Viodentia is none other than....REGIS PHILBIN!!!
V for Viodentia!
I really enjoyed this article! I believe Viodentia is very brave and provides a much needed check on those that try to exert excessive control. After going through the hassle myself of finding a PFS device and signing up for a compatible subscription music service, I one day brought the device to work and first thing in the morning got a message that I could not play my content because the licenses were expired and I had to resync the device. There was no timer to let me know, hey, you need to resync soon. This was extremely frustrating and I had to wait till I got home to resync. That was the last day that happened to me as I sought alternatives.
With respect to the impact on music subscription services, I strongly agree with Viodentia. People will continue to pay subscription fees for access to new titles but I also think a HUGE part of the reason they will stay is the excellent organization of content they provide. Anyone who knows anything can find a particular music file for free download somewhere on the net if they really want it but they cannot download the organizational scheme. To provide artist reviews and history, album art, links to similar artists one might enjoy, user created playlists, etc, all in one convenient, easy to use interface is awesome and worth the subscription price alone. I have never enjoyed listening to music more! But when it comes to playing what I like where, how and on what I like, there should be no burdensome restrictions and with bright individuals like Viodentia, hopefully there never will be.
-E
can we hear this interview in FLAC yet? ;)
"Seems at once likely and not that the big DRM scheme developed by the largest software company was broken and broken again by a single person, but here we are -- and here's what Viodentia had to say about the digital music business, where Microsoft went wrong with PlaysForSure, and what s/he thinks about this latest memo and patch."
The first part of this sentence, leading into your interview, is as confusing to be as is DRM. Can you re-write or explain, please?
Mike G.
Hit up some reading classes, get your reading level up to 10th grade or so and it all makes perfect sense. In fact, my efforts to rewrite or explain it seem to be no clearer.
It's pointing out the irony of multibillion dollar microsoft being 'beaten' by an individual with no monetary motivation. Of course no company would do something like FU4WM so the only one TO beat microsoft is an individual. Oh, and he did it twice.
Excellent interview. Great work getting this, it gives the site credibility.
A message to Viodentia-
Thank you for creating a program that allows me the freedom to put any music on my iPod. You've done a great thing, not just so that I can do something somewhat futile, like put my music wherever I want- but you've just kicked some industry ass. I'm sure I speak for many when I sincerely say "many thanks."
?
Thanks to Viodentia, we can also see better in MS scheme for music domination. His suggestion of going through management of the PKI through a not-for-profit organization would also give its commercial partners the feel that anyone could do it. Maybe it's actually time to do so for some of the actors of the music business that are a bit forgotten: the musicians. If they'd manage the PKI through some association or not-for-profit cooperative structure, they might be able to revalorize their position in this business, and disable market domination by actors that come from the technological side of things. Some are (including me) getting tired of this monkey business around music distribution, a small site has actually been opened to express this in 'better words'. http://unzune.net The Zune is just a symbol and opportunity to stick to news, but it also certainly aims at Apple and the iTunes/iPod thing. ;-)
The question is simple: It is the same old chat, always the big guys want to restrict everything, and a hacker comes with a simple (?) solution for they great protection system. How much time will be needed and how much protections will have to be broken to everyone undestands that a level of protection is good, but without interoperability and COMFORT FOR THE USER, no protection system will work? I'd glad to buy MP3 online if I had a shop IN BRAZIL with REASONABLE PRICES and the downloaded file could WORK IN ALL MY PLAYERS, with CLEAR RULES , DEFINITIONS AND PROHIBITIONS. I'm buying a right to listen to the music I like, and not buying a right to use my music on my ipod, or zune, or whatever. And what if my player breaks, and I want to use my music imediately on another player?
I'll spend money in something that brings me something good. And never spend in something that restricts my pleasure.
awww! poor M$,what are they going to do now?,they keep losing $$$ like this they are going to punish everybody with overpriced BS,like making people subscribe to superfluos services,oh ,wait ,they already do that!or they will charge hundreds of dollars for a cheap ass cd w/ windows on it,no,wait they ALREADY do that too!or they will try to make money by taking over the video game indusrty with a stripped down junk computer they call a console!
am i the only one that has my priorities in order?
i refuse to pay for music/movies,hell i dont even listen to the radio,or watch tv. listening/watching commercials cost too much for me.i think it insults my intelligence how advertisers think we are all so stupid that if we dont see/hear their retarded commercials every 5 minutes we might forget their products exist!
advertising std meds during cartoons,WTF?!
so whats the alternative?xm/satelite/cable? no thanks.hell no!
piracy?why bother,all you get is virus,that make you have to purchase anti-virus apps.how convenient.
oh and by the way microsoft is responsible for creating and releasing most virii.
i know i used to dissect them!
maybe its time for people to wake up and realize how useless entertainment really is,and put it in its place,all too many people put it too high on their stack of priorities.
food for thought,one ball playing idiot makes more money in a season than a school full of teachers in a year.
want more?
one movie star gets paid more money for acting(acting=making an ass of them selves publicly on a massive scale)in one movie than a school full of teachers in a year!
need i say more?
its time for this world to pull its pants up over their underware like they are supposed to be,and grow up!!!
all of you have been dumbed down by your parents/teachers/bosses/government for tooo long.
so long in fact that you are all proud of your anti-intellectualism.and happy to spend your lives working away like a slave to the entertainment indusrty.shame,shame,shame.
can anyone name a single evolutionary benifit of it all? i didnt think so.
learn to read-read to learn.
@ ROBOGAMERX
For an "intellectual" you sure make a lot of typographical, grammatical, and even basic structural errors. Ah, conspiracy theorists.
I subscribe to Urge and am prefectly happy using it with a Sansa. I don;t really care about ownership, I love being able to dial up a band and download an entire album. The only reason I use the DRM stripper is to move songs to my girlfrien's mac. He's right... if there were an open, cross platform DRM sceme I would have no issues at all with it. Right now I am 95% satisfied with Urge.
I like FairUse4WM, but I have to say that FairUse4QT sucks :)
"He's right... if there were an open, cross platform DRM sceme I would have no issues at all with it."
The obvious problem with this line of thinking is that it's akin to saying "as long as there's no DRM, I have no problem with DRM." DRM's entire reason for existence is to lock content into a specific metaphorical box. It is specifically *intended* to keep you from doing certain things with your content that the creators of that content don't want you doing.
Before anyone says "but it's not YOUR content", name me one other product that you can buy and that the creator can post-purchase tell you how you can and can't use it. (I'm not talking about using products as part of committing some other crime, i.e. handguns, I'm talking an otherwise legal use that the manufacturer locks you out of just because they feel like it.) I can't think of a single one. I can buy a $3,000 TV and use it as a paperweight if I want; that's my prerogative. I can give it to my friend, I can loan it to somebody. I can re-sell it. I can do these things because I *purchased* it. The creator has no say in the matter.
DRM exists to take these fundamental and statutory rights away from you (and they are rights under the first-sale doctrine). So there can never be a case where DRM is *not* onerous. It will always be onerous; that is in fact its *job*.
well jeff,what can i say?
i think maybe its because public education failed,that people can actually let this kind of stuff happen to them.
capitalist want people dumb so they can keep using us to grease their machine.and since those capitalist run the education systems perhaps they have succeeded in their agenda of keeping people dumb,therefore predictable and controllable.allowing them to exploit us all.
Quote from Viodentia:
"...don't bother with weak client-side decryption. Instead, provide a public specification for licenses using digital signatures, manage the PKI through a not-for-profit organization..."
Anyone care to comment on how a non-networked PFS device would connect to this service? I thought that is why the decryption was done on the client.
...Just cuious
P.S. Viodentia rocks! Thank You for stickin' it to the man.
Dam, It is REGIS PHILBIN!
Hey Engadget, how about giving this guy a Zune??
to jdross;
thats because i dont care.
besides who are you my old english teacher?
(btw my iq was over 50 points higher than hers),which is bad because my iq is only 69)
"Ah, conspiracy theorists."
WTF R U TALKIN 'BOUT !?
my guess it was my comment about dissecting virii.
well its true,years ago when i was begining to learn programming i decompiled a few,found tags from the creaters,searched for them,then traced down their basic info,including their place of occupation,and previous employers,lo and behold it was places like ms.
i dont have proof any more,and that hobby got boring and i moved on to others,but for a little while i thought that stuff was fascinating
i wish i still had the proof.nowadays i try to avoid virii as much as the next person.
but any one with the inclination and know how,or at least the inclination to get the know how,are more than welcome to find out for yourself.
be my guest.
and now to stoop to your level,and do some real mature name calling.
sheep
69? That's far below average.
How 'bout putting all of the Microslut lawyers at the top of this list --->
http://www.whotohate.com
It would seem to me that the best path would have been an open dialog with vio instead of the path they took.
There is no such thing as PlaysForSure DRM. PlaysForSure is the marketing name for an ecosystem of devices, storefronts and the Windows Media Rights Manager.
The proper name for the Microsoft DRM product is the Windows Media Rights Manager not PlaysForSureDRM.
I think that were Mr. Viodentia to be a content owner who was trying to profit from his creation, he would be irrate that somebody arbitrarily determined he did not have a right to take all measures possible to protect his work and introduced a tool to devalue these works.
Mr. Viodentia you are harming thousands of small and large business alike with this tool. If you only knew the type of people who you are taking money from with your careless actions.
Your not making any more of a statement than someone who were to attempt to release Anthrax in public.
Your work should not be condoned but condemned.
Regards,
Christopher
Regards,
Christopher
Mr. Christopher,
Sorry to say you're wrong. Here's how the system works: You (or anyone, whatever their line of work, including creative writers or music or movie makers), spend time and work on something. Once you're finished, you are entitled to compensation, in exchange for the result of your work. After that, it is not yours any more. Real artists sell their original, at a huge price if their work is so valued, and don't possess it any more. If you prefer to sell your work to millions in the form of "copies" of your work, fine, but then 1) Those millions of "copies" have to be fairly priced so as not to overvalue the value of the work you've made, and 2) when that predetermined number of "copies" is sold, somebody (the law) should be charged to go ahead and destroy your original and prohibit you from making or selling any more "copies", because that's theft. Your work has been compensated. It has to have an end like everything else. If not, it's fraud.
So if there are to be any restrictions to "copying" or "using" works, they should be applied to the fraudulent producer, not to the consumer who pays for his meager "copy" 10 to 100 times its fair price.
So stop saying nonesense and embrace the opportunity to be rid of consumer exploitation, because you are one too.
neato
Uh, don't take this the wrong way, but how do we know, or how do you know, this is the guy or girl who did it?