Hacker News Reader

Comment by foxhill | Hacker News Reader

yikes. having written aax plugins for a while, i have to say, i’m kind of surprised this came from AVID. from what it sounds like (having scraped the surface), it’s not their editing software (Pro Tools, et al.) but their copy protection management tool/device driver - iLok.

i’m sure there are some very anxious engineers in the AVID offices today.

View on HN

A few of the Twitter replies say they've seen it on non-AVID devices, which might lend more credence to the iLok theory.

https://twitter.com/FamousJerry/status/1176422298535940097

I'm kinda hoping iLok is the culprit, because I've been refusing to buy any plugins that require iLok, even though that means avoiding some effects I'd really love to have & developers that I'd love to support. Thankfully iLok is optional for the iZotope stuff...

The iLok is just a repository of keys and can’t hurt anything by itself. It’s communicated with by code either built into a license protected application or in a “wrapper” added to an otherwise unprotected app. Pace AP (maker of the software and reseller of the iLok) is essentially in a never ending arms race with the warez crowd, and in the past has resorted to some gray-hat, rootkit-like techniques to prevent cracking. It wouldn’t surprise me if this was either some old Pace code going rotten or some sort of crack gone viral/rogue. I used to develop an iLok protected app and am still on their developer mailing list, but note that I haven’t seen any recent alerts from them so it’s entirety possible it’s something else.

Yep, after I posted I realized that if this is really widespread & iLok related, surely someone would have posted on Gearslutz complaining about it by now. So far I can't find any threads about it there.

In my iLok case years ago, it was a problem with the iLok KEXT kernel extension drivers causing my Mac to kernel panic at startup that put me off. That would've been around the Mac OS X 10.5 / 10.6 era.

> but their copy protection management tool/device driver - iLok.

Maybe Hollywood will learn that DRM hurts legitimate users.

But they probably won't, I won't be shedding any tears either way.

Ironically film tools have some of the most stringent copy protection systems, and big studios break the licenses agreements without hesitation when they need to get something done.

I wonder if Hollywood is so obsessed with DRM because they themselves are such f'ing pirates. The entire culture of Hollywood is around stealing (e.g. the endless so-and-so stole my script idea lawsuits) and defending oneself from having one's stuff stolen. Maybe they're projecting and imagining that everyone is constantly trying to steal everything.

As a normal movie and TV viewer I will always look for an option to rent, buy, or stream stuff because I like to support the production of stuff I like and because the time it takes to jank around with pirated crap is generally worth more than the cost of just paying. The only time I've turned to piracy in recent (post-broke-college-kid) memory is when something is literally unavailable by any other means. I suspect I'm typical.

DRM has zero effect on my behavior. If anything DRM encourages me to consider pirating because it adds pain and hassle. In the case of actual purchases (vs streaming and virtual renting) I really despise DRM since I purchased a copy and should be able to play it on any device I have and store it for posterity. I generally will not outright purchase DRMed content.

Since we're talking Hollywood, what's your success rate in being able to buy movies that don't have DRM? I can't think of any way to do that, really. Or are you saying that you basically can't, and therefore don't buy movies and instead stream or rent?

Physical media has DRM but it's pretty much completely cracked. I can rip Blurays and even UHD Blurays now and end up with a non-drm-ed movie. It's not nearly as convenient as streaming (initially) but I can "own" the movie in a non-drm-ed form for as long as I can keep the bits alive.

How can you rip UHD (4K) movies? MakeMKV doesn’t support them last I used it (a month ago)

MakeMKV does support them, but you need a UHD drive with specific firmware. On the forums you can figure out which drive will work the best and which is the easiest to flash old firmware on. Either way requires a hacked firmware updater because the drive makers have to give it their best shot to avoid downgrades (to satisfy DRM licenses).

Also you can decide between old stock firmware or new firmware that has been modified by the MakeMKV team. I opted for the old stock firmware, I'm not really sure what the modified firmware buys you.

It seemed overwhelming at first, but after an hour of reading and searching on Amazon I figured out what the easiest route was. Once the drive arrived, the flashing was simple—I plugged the drive into my Windows box and ran the flashing code, then plugged it into my Linux Plex server and it worked right away.

Music yes, movies no... you are right. That's why I don't buy many movies.

A huge color company out in the valley is notorious for calling up 120 days past the invoice date on NET30 terms and only offering to pay on a credit card. I swear some of these companies would spend a dollar to screw you out of 50 cents.

It would be fun if those affected companies put a nice lawsuit for the downtime they're facing, but they might not want to rock that boat

I hope you don't think that the people dealing with issues like this are anywhere near the discussions on DRM of digital video. It isn't as if MPAA board members are also in a basement somewhere editing films.

I bought a plugin from UVI and had to use iLok for the first time recently and the experience was atrocious.

Not only that, if you want to sell and transfer your iLok license you have to pay $20.

I will never buy anything that requires iLok.

Ironically, the folks pirating the software didn't run into any interruption because there is no iLok

iLok has been extremely effective at stopping cracks or at least slowing them down enough to where the software is obsolete by the time a crack appears. The pirates don't have access to this software in the first place.

We can debate the merits of DRM all we want, but PACE's stuff actually works (at stopping pirates, and sometimes paying users)

It is truly a cancer and the worst part about using Avid tools. I wish they would get rid of it.

> their copy protection management tool/device driver - iLok

MacOS Catalina makes running kernel extensions hard, they probably were testing new iLok version for Catalina.

Catalina major change is ANY dll should know pass through security. That's why notirisation also for software plug-ins is needed meaning also runtime hardening in future and proper entitlements by host and plug in

Your comment is a bit hard to parse. Would you mind clarifying it a bit?

I’ve started to write something but here is a good tl;dr - https://forums.developer.apple.com/thread/122566

Right, Library Validation is tightened when you opt-in to Runtime Hardening.

> MacOS Catalina makes running kernel extensions hard

So it has bad compatibility?

Is that a good thing which we’re excusing now?

OT, what plugins? I’m a keen Pro Tools user!

> their copy protection management tool/device driver - iLok.

They're still using that? These things were successfully cracked in the nineties, I was convinced nobody uses hardware dongles anymore.

The new Mac Pro tower has an internal USB-A port, explicitly for this reason [1].

1: https://appleinsider.com/articles/19/06/04/apples-new-mac-pr...

I look at what the industry has allowed itself become and cringe.

Oh, it's not just Avid. Some audio production software such as ReFX Nexus still uses a USB dongle. There is no way to use the software without it plugged in.

It also has a policy where if you damage the dongle, you have to buy again and get a 10% discount off the FULL price of the VST.

In the age of people gigging on laptops, I'm not entirely sure how they think they are gonna sell any more of them. I fancy it myself as it has quite a few 'familiar' sounds on it, but not with all the downsides.

The problem is, there are some industries where the piracy rate would be 100% if it weren't for dongles. Music production software, for one. And another surprising one is church software! (They feel they shouldn't have to pay because they're a "church" and serve a higher purpose.)

I go to the NAMM (musical instrument manufacturers) trade show every year and work with music, sound, and church software vendors.

Embroidery software is another ( https://www.wingsxp.com/ )

To add to that, it's not just media production.

In the medical field, almost all software for performing and analyzing EKGs, X-rays, MRIs etc. comes by default with some sort of dongle-based protection. Apparently, it's not enough that you need the biggest dongle in the world (i.e. the machine itself!) to use the software. Some vendors do offer alternatives if you fight them hard enough but the default still is a trip to dongle town.

Ah, but they need to control that CD recording device on the workstation, just in case you're handing out CDs to your patients WITHOUT A CD RECORDING LICENSE. They have the weirdest licenses.

So there is software on a medical device concerned with users copying a Billy Joel CD?

They sell every functionality as an aditional "license" or "plugin".

So, for example, it's not unusual that, by default, your half a million USD scanner, that includes a powerful workstation to control it (the one the technician uses behind the window) will only let you write CDs (for example, to give your patient a copy of his/her scan) if you pay an additional "CD Writing license"

Now, with PACS and centralization that have changed a bit, but still...

Thanks for the explanation. Still gross but not as bad as RIAA checks being performed somehow.

> In the medical field, almost all software for performing and analyzing EKGs, X-rays, MRIs etc. comes by default with some sort of dongle-based protection. Apparently, it's not enough that you need the biggest dongle in the world (i.e. the machine itself!) to use the software.

Actually, it's not.

Some idiot will get the idea that they can just "transfer the hard drive immediately" because they didn't pay enough money on their support contract to get 4 hour response rather than 48 hour response. The dongle prevents that.

Medical devices are certified for the entire device--that includes the specific PC and the specific version of operating system running on it.

Apparently, it's not enough that you need the biggest dongle in the world (i.e. the machine itself!) to use the software.

Same for a lot of other industrial equipment. In my (admittedly limited) experience, they get cracked pretty quickly by the owner, either before the factory ever gets any downtime, or right after the first time.

This is fascinating, thank you for sharing it. Medical technology fascinates me, but I am nowhere near the industry. Same with things like CarPlay et al.

I used to work with cat scan machines a lot, and I found out how to emulate their dongle - you just returned 0 when it called for the check...

> There is no way to use the software without it plugged in.

This is only true if the software hasn’t been crack?

Thing is, the majority of iLok protected software has never been cracked, or if it has been cracked, only very old versions that aren't exactly relevant anymore.

Ah, right, fair enough :)

Actually the current generation of iLok hasn't been cracked yet (and from what I've heard it's unlikely that it ever will be).

There was a time a few years ago when the wrapper got cracked but as far as I know the security itself is still strong.

Buy your third-gen iLok today for only $49: https://www.avid.com/licenses/ilok

iLok doesn't require the hardware dongle anymore, licenses can be installed onto the hard drive now. Some people prefer the dongle because they can carry their licenses from machine to machine, studio to studio etc.

But as a user, I still much prefer the old-school serial number unlock without internet activation, though.

It depends - a lot of software still requires the hardware dongle and it's much more secure than the machine licensing option I'm told.

I believe the current generation is stronger.

Steinberg Cubase uses these aswell

Cubase uses eLicenser, not iLok, and it hasn't been cracked since a version about 10+ years ago so it does a pretty good job - even if that does mean cubase has fallen in popularity.

yes, they are still an industry standard.

Reply on news.ycombinator.com