Feeds

CPRM creator blasts The Register

Wotta lotta double-spiech

  • alert
  • submit to reddit

Top three mobile application threats

The scientist behind the CPRM copy control caper took a swipe at The Register in a lecture at Stanford University yesterday.

Unfortunately Jeff Lotspiech, manager Content Protection Technology Group at IBM's Almaden, marred an otherwise excellent talk on the subject with a display of selective amnesia.

The billing promised to debunk the CPRM 'myths': "an object lesson for the media naïve researcher."

But how well the debunking stands up to debunking itself, you can judge for yourself.

"A lot of press reports came out and said this evil thing is going to be put on everybody's hard drive," said Jeff. Which might well happen, of course. Informed soundings we've taken suggest that the initial outcry may have won only a temporary reprieve.

Although Lotspiech has been quiet since the CPRM story broke, he hasn't been idle. In fact, he's assembled an entire man, made out of straw.

"The first article that appeared implied that the way this thing worked was an IBM server somewhere [sic], that your hard drive connected to, and this server judged whether or not the file you were going to record on your HD was worthy of being recorded," he said.

Of course the first article that appeared didn't suggest anything of the sort. It's here , as way of reference. The rights management in a CPRM system is in a wrapper around the content. It looks for local keys, not over the Internet, and that's very much the point. We did describe how business users might benefit from implementing a centralized key infrastructure, but that isn't the same thing at all. And that idea was commended to us by ... IBM.

"That got people upset, but of course it was nonsense."

Compounding the felony, Jeff suggests that the intention was never to 'standardize' CPRM. Which, even allowing for some double-jointed semantic gymnastics, doesn't accurately describe the sequence of events last Autumn. The first submission to the ATA T.13 standards group specifically described CPRM as the content mechanism. The um, clue's in the name: "Content Protection for Recordable Media (CPRM) Proposal" After the October T.13 meeting, the proposal was made more generic, but the name remained the same. And T.13 is a standardization committee.

We thought we'd well and truly debunked Lotspiech's point that the proposal was only ever optional. It was, notionally. But the certainty that optional commands would remaining optional in a command spec that only covers a tiny subset of commands, and the lowest common denominator at that, has been rejected by Bruce Schneier, amongst others.

The audience was more concerned with finding out the cryptography worked, rather than apologias. Which Lotspiech explains admirably: it's recommended viewing if you're puzzled about the issue. Or even if you aren't. For CPRM is in its own twisted way, jolly clever.

One attendee at least found Lotspiech's stab for martyrdom "quitely convincing" ... although whether he means it was "quite convincing" or "quietly convincing" we're not sure. But the author, QuantumG, tells us he thinks "zdnet started all this crap about harddrives, slashdot propogated it". Which we suspect is a rapid way of losing your /. link, we guess.

Your correspondent wasn't able to make the talk, catching the video playback instead. Passing our regards to Jeff via proxy, the good man described The Register as "my biggest problem".

Which is the most flattering thing anyone's said about us for ages. And mirrors our concerns about CPRM exactly... ®

Related Links

Almost Full CPRM on ATA coverage

3 Big data security analytics techniques

More from The Register

next story
Sorry London, Europe's top tech city is Munich
New 'Atlas of ICT Activity' finds innovation isn't happening at Silicon Roundabout
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.