Judge Allows Sony to Unmask Anyone Who Visited GeoHot Site
wired.com
wired.com
$ telnet geohot.com 80
HEAD / HTTP/1.1
Host: geohot.com
User-Agent: Dear Sony, I heard you would be reading this log. Because of the way you treat researchers like GeoHot, and your own customers, I will never buy a Sony product again.Decisions like the one this judge handed out makes it more and more clear that corporate interests trump those of everyday folks.
Referer: http://www.sony.comWhat is next? Telling every kid not to open 'a system' to figure out how things worked? Or may be lets ban engineers to be engineers?
EDIT: #shameonsony twitter handler. http://twitter.com/#!/srinikom/status/43853556645761024
The government may be allowing them to do this, but it isn't making them do it.
Voting with your dollars is the most powerful way that you as an individual can express your opinion in a corporatocracy.
"What is next? Telling every kid not to open 'a system' to figure out how things worked?
Or may be lets ban engineers to be engineers?"
I sincerely hope that we will see a backlash against corporate control of consumer goods.
The more we know about what we own, the more we can learn, the more we can modify things suit our needs, and the more we can reclaim. Fixing something means it won't enter the waste stream. The sort of individualism that hackers embrace imparts a strong sense of ownership over possessions (and code). Think Ikea. Part of the appeal is the pleasure and sense of ownership that come from assembling furniture yourself. Why should electronics be any different?
I have a project in the works to help spread knowledge about the inner workings of things:
It is what it sounds like. Sign up if you like, and I'll send a single email when it launches.
Seems relevant right now. Vote with your money.
E.g. IP hits from Google's bots out of Mountain View should not count as "those who downloaded Hotz’ hack reside in Northern California".
Edit: http://arstechnica.com/tech-policy/news/2011/02/court-confir...
I guess they don't want to sue the visitors just reveal identity? This seems like shaky ground for Sony.
Anyway, I think we all wish companies would take their revenge in the form of actual violence so that they would actually get in trouble, but they are smarter than that. Emotional pain hurts more than physical pain.
They aren't looking for identifying information. They are looking for location information to prove that San Francisco is an appropriate venu. IP addresses will give them pretty strong location evidence, regardless of who was behind that IP.
Well my IP is there. I don't own any Sony products, was considering a PS3 (since the price is right), and I almost never mod those kind of devices, but out of principal I don't think I could justify getting one now.
GeoHot's blog, geohotgotsued.blogspot.com, specifically mentions that his hack got very little attention outside of the standard homebrew hacker scene up until the point he was sued and every tech blog and publication linked to him. These actions are just absurd. GeoHot even states that he has come across means to restore the cryptography on the device, which could effectively shut out piracy. I doubt he'd ever hand it over though. There's no reason to be nice to the guy who's kicking you in the crotch.
"If you read the legal ruling, it's very clear that this judge's ruling is being done so that any information found is designated as Attorneys Eyes Only, meaning that it is restricted to anything relevant to the case (and specific matter being challenged) at hand is disclosed, and anything else summarily forgotten. Hell, the document makes clear that this information is for jurisdictional discovery only, which determines whether or not Geohot can be tried in California."
"Relevant case law allows Sony to subpoena records to determine jurisdiction. They can subpoena Geohot's host because it's pertinent to whether or not his hack had an impact in California, and that the distribution of the key took place. They're allowed to subpoena his tweets to see how many people in California read them. The same goes for the other handful of companies they've subpoenaed."
This won't stop me from boycotting Sony from now on, though. I was actually planning to buy a PS3 to play blu-rays and maybe start playing video games again. No more.
Q: Why doesn't the EFF fund this?
A: Ask them. They have offered to provide some legal help though, which is much appreciated.
[1] http://www.wired.com/images_blogs/threatlevel/2011/03/efflet...
[2] http://www.wired.com/images_blogs/threatlevel/2011/03/speror...
As stated --- The approved subpoena requires the company to turn over “documents reproducing all server logs, IP address logs, account information, account access records and application or registration forms” tied to Hotz’s hosting. ---
I'm pretty sure they would need to apply for another subpoena in order to uncover any IPs coming from a VPN. Now this could be done if it was warranted, but most of the time I doubt it would be pursued and it might even be hard to prove it was warranted for each VPN?
Now just for fun, let's say you're tunneled to a VPN that's tunneled to another VPN, to another, etc. While you could still be chased down, it probably not practical in most situations like this. I wonder if one company could provide a service that uses multiple routings like this through different registered entities requiring the authorities to request records for each of the different entities in order to track down just one account. Then implement this on a large scale...
All that aside, it was my understanding that they wanted to remake their Internet image as a privacy haven of sorts -- the kind of place someone like Assange/WikiLeaks could safely host their service. I'm having a spot of trouble finding relevant primary sources; can anyone else help point me in the right direction?
After some more digging, I found a few relevant links, the most direct of which is [1]. A number of other articles re-hashed the same points described there, but I did find a few like [2], which also describe Iceland's connectivity -- it's far better than I'd thought. As of a year ago, they had on the order of 8 tbps in undersea cables, stable ping times of around 100ms to the US (and, presumably to the EU, if not better), 100% geothermal power, and a climate that would enable passively cooled data centers.
I couldn't find anything directly relevant to whether access logs would be subpoena-able, but the reading I get from what I did find is that their focus is more on being a transparency haven than a privacy such. Whistleblowers, journalists, and their sources are clearly very well protected by the IMMI (which appears to have passed unanimously). It's also, however, explicitly stated that the new law won't change anything in the current law WRT child pornography and copyright infringement, usually the big bugaboos of the "we need to control the interwebs" crowd. (Not to say those aren't problems; they just aren't the problems they're usually made out to be.)
So, net, I'm not sure Iceland's the answer to these kinds of shenanigans, but it's clearly a step in the right direction.
[1] http://immi.is/?l=en&p=intro [2] http://www.technewsdaily.com/iceland-promoted-as-future-data...
(EDIT: fugly run-on sentence.)
This way Sony will have to try the case in NJ.
I started to see this pop up in some posts recently:
* apple's hardware...they have the right to do what they want * sony's hardware...they have the right to do what they want
I don't exactly know when this started but I think it's worth correcting and trying to stop. No reasonable person would assume that you could buy any physical device and NOT be allowed to do whatever you want to it. There may be usage restrictions (you can't modify your car w/ a jet pack and expect to drive it on a public road...), but if you are doing something for educational/experimental purposes, I can't see how it would be illegal.
Anyone care to comment? I'm open to having my position changed if someone can show me why.
Land of the free indeed.
Sony, Apple, and others who want to deny people these rights obviously see things differently.
I don't know anyone who would question a hardware owner's right to do as they please with it.
http://blog.readability.com/2011/02/an-open-letter-to-apple/
Plenty of other examples here:
The summary of the exception with respect to video games said this:[1]
>(4) Video games accessible on personal computers and protected by technological protection measures that control access to lawfully obtained works, when circumvention is accomplished solely for the purpose of good faith testing for, investigating, or correcting security flaws or vulnerabilities, if:
>>(i) The information derived from the security testing is used primarily to promote the security of the owner or operator of a computer, computer system, or computer network; and
>>(ii) The information derived from the security testing is used or maintained in a manner that does not facilitate copyright infringement or a violation of applicable law.
[1]http://www.copyright.gov/1201/2010/Librarian-of-Congress-120...
17USCs1201 (added by the DMCA) says: (a) Violations Regarding Circumvention of Technological Measures. - (1)(A) No person shall circumvent a technological measure that effectively controls access to a work protected under this title. The prohibition contained in the preceding sentence shall take effect at the end of the 2-year period beginning on the date of the enactment of this chapter.
So the technological measure must "effectively control access to a [Copyrighted work]".
Jailbreaking a games console does not circumvent the technical measures that prevent copying - at most, it might circumvent technical measures that prevent someone from circumventing technical measures.
The Court of Appeals for the 9th Circuit (including California) has a precedent that makes the anti-circumvention provision rather broad (more than a plain language interpretation of the law would otherwise imply); other circuit court rulings have interpreted the law to be much more narrow and not cover circumvention that doesn't allow / involve copying; presumably this is why Sony wants it heard in California and Geohot wants it heard in New Jersey (under the jurisdiction of the Court of Appeals for the 3rd Circuit).
For instance most people find it reasonable that you can't:
-Modify/bypass emissions equipment on your car.
-Saw off the barrel of your shotgun, or modify semi-auto -> Full auto
-Buy one copy of a movie then show it to the whole neighborhood and charge admission
The gun example is the only one I can refute
Movies are licensed not sold. You own the disk, you can hack saw the disk all you want you just aren't supposed to make a copy and sell it.
Again, INAL, but I thought you could modify a semi-auto and saw off the barrel as long as they were used at the shooting range (for instance...probably a state by state law as well).
And I'm fairly certain you can bypass the emission on the car to modify to make it a track car, for instance, or make it farm equipment. Again, not really up on the law, more anecdotes I've seen in my personal life.
Nope, it's a federal law that prohibits you from possessing a short-barreled shotgun or a full-auto anything. This is since the National Firearms Act of 1934. Selling such a shotgun (after being goaded into it and entrapped by a ATF agent) was what precipitated the Ruby Ridge massacre.
In fact -- and you'd think this would fall foul of the 1st Amendment -- it's illegal to distribute a pamphlet that tells someone how to convert their rifle to full auto.
I think this is a key point. Is it the government telling you that you can't do something (that is against the law) or a company using the law to prevent you doing something that they don't want you to do. I would guess that the former would be governed by criminal law and the latter by civil law - please correct me if I am wrong.
In this case, it is Sony using the law to try to prevent people learning how to root their PS3s and doing so through civil courts.
On cars from 1995 an up all cars had to have an OBDII compatible port that lets car manufacturers read out the codes, but it was primarily designed to speed up emissions testing. Instead of putting the car on the tread mill now all they have to do is plug in the computer and get the codes back from the car. The car is continuously monitoring its output anyway to get the right fuel/air mixture to get the best possible gas mileage.
The way it does this is with a series of O2 sensors that are placed near the exhaust port on the engine and continuing down the exhaust for one or two more.
The thing is that if one of those sensors is faulty or dirty it will return that code, however since cars also have to run when the sensor has broken or just isn't installed the computer will completely ignore it and not fire a code for it at all. On my car all of my O2 sensors were broken, and I didn't know it until I brought it into a mechanic as I didn't think it was running correctly. I had passed emissions since my computer said everything was fine, but if it had been put on the tread mill (which would have cost me the same $27.50, so the state makes the same money whether they computer it or run it) it would have had "high" emissions because the fuel/air mixture was not right and I was basically dumping unburnt fuel into my exhaust.
After the O2 sensors were fixed my car ran much better.
It surprised me that my car didn't throw a code for the O2 sensors being completely gone as far as the computer was concerned, but it just goes to show that some things are easy to bypass.
Large companies need to realize that they're actually engaging in asymmetric warfare when they do this. The worldwide hacker community that's aware of Sony far outnumbers the internal dev group that did their security.
What's more, Sony suffers from the typical company illusion of hiring the top 1%:
http://www.joelonsoftware.com/items/2005/01/27.html
But groups of hackers on the internet have none of the friction that exists in corporations, and so are operating in a purer, less-diluted meritocracy. As a result, companies doing DRM are generally outnumbered by more qualified opponents.
The basic rule of asymmetric warfare, is that you don't take on your opponent in a head-on fair fight. That's absolutely the worst thing to do. You need to turn the situation on its head, like the IRA did. Usually, the outlaw is in the position where, "You have to beat them every time. They only have to catch you once." But the IRA had that turned on its head. They only had to get away with something "once," and the British authorities had to catch them every time.
Companies can deal with pirates, but they have to realize that they are the underdogs, not the big guy in this fight. The best thing for them to do is to figure out how to win without fighting. Failing that, they need to figure out how they can be the ones who "only have to win once."
(I've been figuring this out, and yes, it can be done.)
[1] The minds behind original PSJailbreak dongle (which enabled backups and piracy) do deserve credit for their brilliant USB exploit. Back to my main point, many have said that the PSJailbreak crew was only able to start their work after geohot exploited the PS3 hypervisor and documented how to do so.
That's just plain wrong. All Sony is going to do is to drive all the hacking completely underground. All of it will be black hat.
That's not what I meant about "only winning once." That's just another whack of the whack-a-mole mallet. Here's how you "only win once" while you are forcing your enemy to "win every time."
1) Let people copy and run your game, but require them to pay when connecting to the official company servers.
2) Devote all of your technology and development resources to only detecting pirates, but don't ever take any direct action against them. Don't even let them know immediately if they've even been detected.
3) Ensure that all of the highest glory, fame, and bragging rights in your userbase go to winners of tournaments on the official servers.
4) Take indirect action against pirates, but only in ways which are hard for the pirates to substantiate. Never lock them out, outright, but start degrading their gameplay experience in ways which make them look like they're "whiners." Attack their gameplay experience, but only periodically and when it will hurt them the worst. Start rumors that various cracked versions of the games have bugs. Ban pirates and warez users, but only from the big official tournaments on the official servers, perhaps many months after they've been detected as pirates.
5) Continually update the game, including the detection technology.
In this scenario, those running your software illegally are the ones who will always be looking over their shoulder, wondering if they've been caught. At least at first, no one will have strong motivation to crack the detection technology, since they can run the game anyways. Be continually changing the detection technology, so that any given crack only lasts a month or so. One can even compartmentalize the detection technology, such that any given crack will only work on a fraction of the installed base. If done correctly, you can convince people to simply pay for the game.
This isn't "getting medieval." It's "getting Machiavellian."