Hacker News Reader

Comment by knaik94 | Hacker News Reader

I agree with the sentiment implied by the author, but I would reword it slightly. If you don't have the freedom to share something, you don't own it.

I disagree with the interpretation that it needs to be held physically. Digital ownership is still ownership. I go out of my way to find music on Bandcamp, games on GOG, and rip movies myself using MakeMKV.

I wish I could encourage people to continue embracing physical media but most people value convenience over true ownership. And most companies value market capture and "security" over user rights. In crypto the sentiment of "not your keys, not your wallet" is held a core truth, yet people use 2factor authentication and Passkeys without respecting the same truth. I am not arguing against the use of 2factor, but at the same time certain accounts can not be logged into freely without push notifications in Duo or Microsoft. I still don't see a universal ability to export Passkeys, and I believe that's by design.

I hope laws catch up to modern technology in terms of digital goods. I can't imagine companies choosing to open up their walled gardens otherwise.

View on HN

We should really just abandon the notion of ownership when it comes to data. When I own data, sometimes it refers to data I created. Other times it refers to data about me. Other times it's something I've been sold. Other times it's my responsibility to ensure that data's accuracy. There are probably a few I'm missing.

I happen to like the notion of ownership that you're describing, but I think we'd all have more fruitful discussions about data if we dispensed with: "_____ is not ownership because of _____" and instead just came up with entirely different words for each kind of relationship one can have to data. Then stasis could move away from arguing what words mean and closer to doing something about the problems that arise around data "ownership".

Agreed. I'd go further. This obsession with ownership has always struck me as a peculiarly American thing, perhaps related to the absolutely central role of private property in the USA's history. In other cultures the concept of private property is often diluted somewhat by social obligations and counter-obligations. But that aside, the term is already very imperfect for the reasons you describe.

Perhaps the better word is just "control".

Isn't it the same thing?

Stuff you fully control is stuff you own fully.

Stuff you don't fully control is stuff you don't own fully.

Stuff you fully own is stuff you fully control.

Stuff you don't fully own is stuff you don't fully control.

As I mentioned, "ownership" is not always such an absolute concept outside the USA, which began as a freewheeling frontier society. For example, the French translation of "company" is "société", and the thing is understood to be a bundle of obligations rather than a discrete object to be bought and sold. Even in England, houses are commonly sold on leases rather than the "freehold" which is intrinsic to ownership in the US.

IMO the verb "own" is only fully unambiguous in the case of non-fungible physical goods. Which clearly data is not.

So by your logic, if I steal something, I own it?

I've been asked to own several microservices, yet I'm not allowed to share their code with people, am I therefore barred from actually owning them?

If I have my DNA sequenced, there's a possibility that the company that did the work made a copy. Do I not own that data because of the mere possibility that they could share it with somebody in the future without my consent? Is the only way to retain ownership of that data to do the sequencing myself?

If I record a song, somebody copies it, and then something destroys the original, does the copier now own it instead of me?

It all seems very inconsistent to me. Better to just drop the word all together when it comes to data and handle each case independently.

In the case of data it should be more aptly described as "possession" rather than "ownership"

These are different things, and this is precisely the point here. You do have the possession of the data when you stream a movie, but you do not have the ownership. When someone makes a picture of you, they do posses it, but they do not necessarily own it, that would be you.

I also don't agree with your parent, because ownership is precisely the correct term here.

> We should really just abandon the notion of ownership when it comes to data. When I own data, sometimes it refers to data I created. Other times it refers to data about me. Other times it's something I've been sold. Other times it's my responsibility to ensure that data's accuracy.

We should really just abandon the notion of ownership when it comes to food. When I own food, sometimes it refers to food that I harvested for myself. Other times it refers to food from me. Other times it's food I have bought from someone. Other times it's about my responsibility to ensure the edibility of food I sold.

> I disagree with the interpretation that it needs to be held physically. Digital ownership is still ownership. I go out of my way to find music on Bandcamp, games on GOG, and rip movies myself using MakeMKV.

Files on a hard disk that you own are still files that you physically own. The only difference between those files and, say, a DVD, is that the encoding is more space-efficient.

The parent's point is that possession of a physical good is a bright line separation. For digital files, there's a huge difference between [Files you own] on a hard disk, and files [on a hard disk you own]. There are files you can put on a hard drive that you don't own and will ultimately kill themselves when specified criteria are met, like DRM'd ebooks.

I would argue that the files on your hdd that can expire or made unusable by some remote third party are as incomplete as a book that is missing half the pages. For example a keepass file without the password/key-file is incomplete, the same goes for Audible aax files that can not be played without per-user 'activation bytes.' You have possession of the file but you never owned its contents.

For Audible I use OpenAudible which converts the aax files to m4b when I download them.

> The only difference between those files and, say, a DVD, is that the encoding is more space-efficient.

Also that it's (depending on the format) perhaps not illegal to use the content in the file wit any viewer you choose.

Which does not depend on the data being on a DVD at all, but the details of contract of purchase. When you buy the data on a harddisk, the exact same terms would apply.

I think the idea is that with a book or a DVD you're not allowed to copy it. You're allowed to lend or sell it though.

Is that the state of things? I thought you could copy a legally purchased thing, just not distribute it?

Depends on your country.

In my country I can legally make copies of for example books, movies, CDs etc, as long as the copies are only for personal use.

I can even legally privately share copies with family and close friends. As in close real life people that I have a personal relationship with.

A copy made for personal use cannot later be used for a different purpose. And a copy made for personal use must be made from a legal source in the first place.

The copy of The Matrix that a friend burned on a CD (DivX encoded file under 700 MB, that I would watch on the computer) and gave to me years ago, would have been illegal today because he got that movie from his brother who got it from a torrent tracker.

But if instead of downloading the movie from a P2P network his brother had borrowed The Matrix on DVD from the local library, and ripped it himself, and given a copy to his brother, who then gave me a copy, then my understanding is that this would have been completely fine and legal today in my country.

It’s all pretty weird.

In other countries, the laws are different.

My understanding is the laws you describe are mostly limited to a few European countries, while most of the rest of the world are more restrictive?

Also, with with the limited right to make copies like that comes quite high fees on recordable media that is paid to the music and movie industries as compensation through organizations like CopySwede here in Sweden.

>I hope laws catch up to modern technology in terms of digital goods.

I fear the opposite is more likely. cars are already getting government-mandated connectivity.

Isn’t it interesting that you can purchase a movie, rip and transcode it… but if you download the same transcoded version for the movie you already own, you have committed a crime?

I'm on team convenience. I don't like it, I get how the media ownership situation sucks a times ... but I don't want to drag a bunch of cds, or blue rays or manage files on some personal server because I want to watch movies.

> people use 2factor authentication and Passkeys without respecting the same truth.

Passkeys are still your keys. You can put them on hardware authenticators you control entirely offline separate of other services. You can store them in software vaults you manage.

that's not true. Passkeys have an optional remote attestation capability, which second parties can use to completely enforce aspects of your keys, such as them being non-transferrable or not usable without a screen touch etc.

This doesn't change the fact it can still be your physical device that remains in your personal control.

I can stash them on a yubikey or similar device and still meet those requirements. It's still only my device, it doesn't rely on other services, etc.

There are also non-transferrable passkeys which can't be copied between two secure devices, so it'd be hard to get some passkeys onto your yubikey in the first place.

Furthermore, I personally feel that if you can't actually access the bits, you don't truly "own" it.

> so it'd be hard to get some passkeys onto your yubikey in the first place.

It's as easy to get a passkey on it as it was to originally create the first passkey. That's the thing with them. You can make a bunch. It was just as easy to add the first passkey as it was the second and third and fourth and fifth and....

The point is to not reuse the same passkey everywhere. Same idea as not using the same password everywhere and not reusing the same SSH key everywhere.

> Furthermore, I personally feel that if you can't actually access the bits, you don't truly "own" it.

So if a certificate authority uses an HSM to sign certificates do they not own those keys? Who does own it then, nobody?

If one uses a hardware Bitcoin wallet do they not own those keys?

Isn't being the exclusive one to operate with the key material with hardware entirely in your possession and control the same as owning it? Why is reading the raw bits the only true level of ownership? Just trying to really understand your perspective.

Okay let me withdraw slightly. What I mean is: if I choose of my own free will to not be able to access the bits (e.g. via a cryptoprocessor) then sure, I can still "own" it. And that's the case for certificate authorities. But when vendors force me (with remote attestation) to not be able to access the bits, then I see that as me not having control => me not owning the key.

I'm still just trying to fully understand the delination here. Let's walk through two scenarios.

Service A allows a wide variety of authenticators to store your passkey, it doesn't do any checks at all for the requirement. You choose a USB hardware authenticator. We both agree you own the key in this from what I understand.

Service B allows a stricter list of types of authenticators, and does some checks to ensure you're using an authenticator with a least a certain level of security guarantees. Your USB hardware authenticator meets these requirements. Now this key that is stored in the same place on the same hardware using pretty much the same process is now no longer "yours"?

An interesting perspective to me.

Passkeys (as defined in the spec) by definition don't.

Non-passkey WebAuthn keys can have additional attestations.

You don't consider WebAuthn to be passkeys? Why not?

Passkeys are a subtype of WebAuthn keys, not vice versa.

be that as it may, when e.g. TicketMaster asks me if I want to "use a passkey," they are potentially referring to something with remote attestation capabilities.

> If you don't have the freedom to share something, you don't own it.

How does pre-DRM copyright affect the picture here? Do you mean it's been impossible to own copyrighted content since the inception of copyright?

You can still share pre-DRM copyrighted work without running afoul of any laws. Stuff like lending out or selling VHS tapes. Copyright is concerned about copying, not about moving. Digital media just makes the line between copying and moving sufficiently blurry that companies get away with making moving impossible under the guise of making copying impossible.

Exactly, which is why the article is right to focus on physical media, it's the only practical way to allow moving without copying.

By OP's framing, it seems so.

But I think there's more nuance here. I can buy a copyrighted book, read it, and then sell it or give it to you for free. The copyright holder's rights have not been violated: I've not copied it, the clue is in the name copyright.

It's not legal for me to go into a library, borrow a book, and then make a copy of it. It's a larger breach to then share that copy more broadly by making more copies.

In the digital era copying is cheaper, and distribution is broader. This caused panic within publishers of all media - they wanted to provide the convenience of digital distribution and consumption (and realise the cost savings), but noted that without DRM, copying would mean there was a risk they'd only ever sell one copy of a game, film, album or book.

This is a snap back to the extreme interpretation of enforcing copyrights. Publishers could structure their DRM and licensing to mimic physical media better. For example, the license could be irrevocable and provide a right to the user of a copy in perpetuity, so it can't be withdrawn. The license could be transferred to other owners: I could lend you my copy, you could then return it to me, digitally; I could donate it to a charity; I could sell my license to another individual; it could be part of my estate and bequeathed at my death.

Physical media has flaws, so does digital media. With a little vision and not much technology we could make digital media as awesome as physical media while retaining copyright to drive investment.

Or, we could go the way OP seems to be nudging towards: we try and grow the copyleft media industry to something economically viable and put the entire economic model of controlled distribution into a place of no longer being viable as a business. Big ask.

> I disagree with the interpretation that it needs to be held physically.

I mean sure, but you can think of it analogously that if the file lives on a hard disk/SSD that you own and can hold in your hand AND the file is in some open format that can be used with open source software (as opposed to some proprietary player that checks some external license to work), only then you own it.

I would emphatically not do this, because you're confusing legal ownership with physical ownership and only one can be guaranteed with reasonable certainty.

Honestly, I'm continually surprised at how badly people miss this even as, e.g. Sony et al just take away stuff you "bought."

So, to put directly. Do not reword it, you will screw it up.

You must be able to hold it in your hand.

>you're confusing legal ownership with physical ownership and only one can be guaranteed with reasonable certainty.

You mean legal ownership, right? Because people can illegally take your physical belongings.

Sony can only take it away because you didn't own it.

I digitally own SimCity 3000 Unlimited from Gog. The copy lives on my NAS. The NAS could break, sure, but so can a CD.

Can I hold it? Well, sort of. The same way I can back up my physical CDs to a hard disk, I can also back up digital things I truly own to a CD/DVD/BD or other media.

As long as the thing I'm holding in my hand is all I need to be able to make use of what was given to me at the point of sale, I see no issue.

On the other hand, Valve, who I think most would agree is a company that has been on the less bad side of digital distribution for the most part, has sold "physical" copies of games that actually still required Steam to install and use. And in that case, from the layperson's perspective, it sure seems like you can hold it, and yet you don't own it.

So IMO this argument just doesn't hold up to scrutiny.

When I brought half life 2 there was a lag of about 2-4 years before I could play it for the first time - I didn't read the fine print, and on a dial up connection I couldn't get past the steam client updating in a reasonable amount of time, mind you I was able to download much larger Linux ISOs over time frames of a month+ through resumable downloads.

Not really an issue these days but it certainly was back in the day

Steam's DRM is still an issue today and it means that you have to get cracked copies of most of the games you paid for in your library if you expect to ever own them. I spent some months without an internet connection only to find the steam games I'd been playing offline just fine suddenly refused to launch until I allowed steam to phone home to grant me permission to play the games I paid for. Steam could go out of business at any time and all your games would simply stop working.

I'm aware, and I'm choosing GOG when I can now, though even then I see phoning home (or attempts to) happening (opensnitch is useful for that https://github.com/evilsocket/opensnitch) - I've paid for some titles 2-3x over which is frustrating, admittedly I don't have the physical media from the first time which is on me, but it's frustrating seeing single player games wanting to phone home

Is the GOG client the thing phoning home? I've refused to install it so far and I've just been downloading the installers directly.

No, I'm not using the gog client (I'm on Linux). It's things like the Witcher 3's launcher.

It's the steam version, but Crusader Kings also hangs for a bit if you block it's network access

Steam's DRM is entirely optional. It is up to the game publishers to use it.

AFAIK Steam really has three things you could consider part of the DRM strategy.

- The Steamworks DRM, which is a lightweight EXE packer. Seems about as simple as UPX. Presumably it goes and checks that you own the app ID via Steam RPC on startup.

- Checking that the user owns the app ID via the API. A simple check that's pretty simple to bypass using a Steam emulator.

- And then finally the ticketing system, which allows third-party servers to validate that a user owns a given game according to Steam.

Of them the ticketing system is the most serious: it's something you can't really bypass easily. However, it also is only applicable to things that require servers. I know in Valve's own games, its only something that comes up with game servers, and I don't even know if it's forced on in their dedicated server. It seems like a stronger version of dedicated servers that used to have CD key checks.

DRM is DRM, and these mechanisms impact your ability to use things the way that you should be able to. That I would never deny. However, I will say that because it's relatively lightweight, for software that sticks to just what Steam offers and doesn't try to get creative, they're mostly only going to prevent casual piracy, and I think the main purpose of these mechanisms is mostly to just clear the technical bar for being a copy protection mechanism by law. When it comes to preserving these games beyond the end of the Steam service, it probably won't be a big deal, and it will actually be third-party DRM options like Denuvo and SecuROM that are harder to deal with and could potentially pose a threat for preservation and keeping access to games you own.

So while I don't really like Steam DRM, severity matters. If "no DRM" was just simply not on the table, I'd take Steam-native DRM as a good second choice. It is still a problem that it is technically illegal to break those locks to just be able to use something you bought with your own cash, but I think that's something we need to fix in the law, and I think we can, and honestly, despite the direction things are going, I do believe we will. Just a shame that I'm less sure I'll live to see the day at this point.

ultimately it means that all of the games in your library will stop working as soon as your computer has been offline for whatever length of time steam feels is "too long". I recommend getting a cracked copy of every game in your library to make sure that you will still have access to what you paid for if steam shuts down or you lose your internet connection.

Well, the Steamworks DRM simply poses no threat: a skiddie can crack that one. There are tools that can do it automatically. For stuff that depends on the Steam API, you can probably keep a copy of one of the popular emulators; normally it's enough to drop them next to the EXE. If Valve disappeared tomorrow, I could go into my steam apps folder and fix the problem immediately.

Having to crack things at all just to play them is bad. But, if it's easy to do it yourself, it is still better than going the route of downloading stuff from dubious sources. There's a whole ecosystem you have to understand to know what you can trust with piracy and not everyone knows where to look.

For the ticketing system, it's kind of a non-issue because that's a server-side mechanism. If a game requires that, it requires a server and won't work offline at all anyway.

For Denuvo, SecuROM, Themida, VMProtect and others... Yes, that stuff is an actual threat, but Valve doesn't make people use those. (Valve also doesn't make people use Steamworks for DRM either, and there are in fact games in my library whose Steam depots are free of any DRM at all and happily run outside of Steam with no Steam needed.)

> Steam's DRM is entirely optional.

Not to the user it isn't.

The reason this is a worthwhile point is because it means games on Steam are not automatically DRM-encumbered and the steam apps folder for the game may just work as-is.

How big of a difference this makes definitely depends on the kinds of games you play. Obviously the triple A games on Steam are, with rare exception, DRM'd to the gills. The older games and indie games, a lot less so, sometimes none at all.

You have to check of course, but probably a good idea to do so before trying to find cracked/pirated versions.

I think you’re confusing your own file backup practices with ownership. If you purchase a DRM-free piece of software (say, a game from GoG), I’d say you own it just as much as if you bought the same game on a CD (assuming the CD was also DRM-free).

If you don’t keep a copy of the game yourself, and one day you can no longer access it because GoG ceases to exist, that doesn’t mean you never owned it. It just means you failed to back it up. You could also fail to backup a CD when it inevitably stops functioning.

> physical ownership

I thing the word you are looking for is possession. When something is physically in your possession, it does not mean, that you have "physical ownership", that requires you to have actual ownership, which is defined by the law, so "legal ownership".

Reply on news.ycombinator.com