Feeds

CPRM creator blasts The Register

Wotta lotta double-spiech

  • alert
  • submit to reddit

Internet Security Threat Report 2014

The scientist behind the CPRM copy control caper took a swipe at The Register in a lecture at Stanford University yesterday.

Unfortunately Jeff Lotspiech, manager Content Protection Technology Group at IBM's Almaden, marred an otherwise excellent talk on the subject with a display of selective amnesia.

The billing promised to debunk the CPRM 'myths': "an object lesson for the media naïve researcher."

But how well the debunking stands up to debunking itself, you can judge for yourself.

"A lot of press reports came out and said this evil thing is going to be put on everybody's hard drive," said Jeff. Which might well happen, of course. Informed soundings we've taken suggest that the initial outcry may have won only a temporary reprieve.

Although Lotspiech has been quiet since the CPRM story broke, he hasn't been idle. In fact, he's assembled an entire man, made out of straw.

"The first article that appeared implied that the way this thing worked was an IBM server somewhere [sic], that your hard drive connected to, and this server judged whether or not the file you were going to record on your HD was worthy of being recorded," he said.

Of course the first article that appeared didn't suggest anything of the sort. It's here , as way of reference. The rights management in a CPRM system is in a wrapper around the content. It looks for local keys, not over the Internet, and that's very much the point. We did describe how business users might benefit from implementing a centralized key infrastructure, but that isn't the same thing at all. And that idea was commended to us by ... IBM.

"That got people upset, but of course it was nonsense."

Compounding the felony, Jeff suggests that the intention was never to 'standardize' CPRM. Which, even allowing for some double-jointed semantic gymnastics, doesn't accurately describe the sequence of events last Autumn. The first submission to the ATA T.13 standards group specifically described CPRM as the content mechanism. The um, clue's in the name: "Content Protection for Recordable Media (CPRM) Proposal" After the October T.13 meeting, the proposal was made more generic, but the name remained the same. And T.13 is a standardization committee.

We thought we'd well and truly debunked Lotspiech's point that the proposal was only ever optional. It was, notionally. But the certainty that optional commands would remaining optional in a command spec that only covers a tiny subset of commands, and the lowest common denominator at that, has been rejected by Bruce Schneier, amongst others.

The audience was more concerned with finding out the cryptography worked, rather than apologias. Which Lotspiech explains admirably: it's recommended viewing if you're puzzled about the issue. Or even if you aren't. For CPRM is in its own twisted way, jolly clever.

One attendee at least found Lotspiech's stab for martyrdom "quitely convincing" ... although whether he means it was "quite convincing" or "quietly convincing" we're not sure. But the author, QuantumG, tells us he thinks "zdnet started all this crap about harddrives, slashdot propogated it". Which we suspect is a rapid way of losing your /. link, we guess.

Your correspondent wasn't able to make the talk, catching the video playback instead. Passing our regards to Jeff via proxy, the good man described The Register as "my biggest problem".

Which is the most flattering thing anyone's said about us for ages. And mirrors our concerns about CPRM exactly... ®

Related Links

Almost Full CPRM on ATA coverage

Providing a secure and efficient Helpdesk

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.