RIAA Tracking Songs by MD5 Hashes 779
aSiTiC writes "Apparently RIAA has obtained some technical experts in their prosecution of file swappers. Currently they are tracking traded mp3 files from the Napster network by matching MD5 hashes. This seems quite interesting but I was under the assumption that identical hashes could be created with identical rips and id3v2 tagging. Now may be the time to update your illegal mp3 file MD5 hash sums."
gee? (Score:5, Funny)
ya think? and here i thought it was the magical mp3 fairy who put mp3s on my hd...
Comment removed (Score:5, Informative)
Re:gee? (Score:5, Interesting)
Lost in a Fire? (Score:5, Insightful)
Just out of curiosity...Did you have insurance? Did they write you a check for the CDs you lost in the fire? I doubt it, but if it had happened, would still feel you had already "paid for" the CDs, and simply thumb your nose at the RIAA and Big Insurance and download the files, as you'd already "paid for" them?
I promise, I'm not begging to be flamebait. I'm really curious.
Where does the line get drawn between physical property and intellectual property, and what rights do you have if you HAD purchased it, but it's gone now? I mean, I can't go to the lot and get another car because mine is destroyed in a fire. Of course, I could go take a picture of it...but I could do that anyway.
I'm curious.
Re:Lost in a Fire? (Score:3, Interesting)
Re:Lost in a Fire? (Score:3, Interesting)
'Fair Use' isn't the same as 'reasonable' (Score:4, Insightful)
Fair Use is about the right to quote portions of one work within another, as a means of making commentary, criticism, or parody. See Standford's explanation [stanford.edu] or Title 17, Chapter 1, Section 107 of the Copyright law [cornell.edu].
You might argue that it's 'reasonable' to download an MP3 file that corresponds to a track from a CD that you own, but it's simply not 'Fair Use'.
Re:gee? (Score:5, Interesting)
Unless she had an OC-48 or two going into her home, she didn't make the files available for download by *millions* of strangers. When the resource is limited, the magnitude of the crime is likewise limited. If you offer a stolen watch on the streets of New York, you can't be charged with trying to sell it to MILLIONS of people, cause there's only one watch. Likewise, in this case there's only enough bandwidth for a certain number of potential downloads, and speaking of millions here is plain misleading.
If the people who downloaded files from her spread them further, that's THEIR crime and not hers, much as the guy who sold a stolen watch won't be found guilty for the watch buyer illegaly selling it to someone else.
And in this case, it's even less severe, as it's not a theft, but a copyright violation.
Regards,
--
*Art
Re:gee? (Score:5, Insightful)
I thought I remembered seeing something about how you have to have a certain $$ amount before getting a felony. $2000? ANyway, they then said each song was worth about $200. I think it was something like $20 per song, times 10 people. 10 people being the gestimate of people you magically distributed it to, because obviously more than one person can download a song from you. Anyway, 10 songs and you're a felon.
Anyway, these numbers don't add up. The RIAA likes to paint a screen of terror by saying that your one song you shared, can then be shared exponentially after that. Sure, it's true. You share it to 2 people. They share it to 2. By the end of the day, 1,000,000 people have it. But why would you be responsible for the 2nd thru 20th level of distribution? You only gave it to 2 people. And if it's "worth" $1 on iTunes, why isn't the damage $1 per song per download?
It's this magic number system the RIAA counts by that causes them to sue 4 students for 47 billion dollars. It would have taken the RIAA 5 years of GROSS profits to hit 47 billion dollars. How can a search engine running for a couple months on a campus amount to 5 years of GROSS profits?? It doesn't...make...sense.. you must acquit.
Re:gee? (Score:5, Interesting)
Re:gee? (Score:5, Informative)
Re:gee? (Score:3, Interesting)
Well, except that most decent rippers these days use paranoia [xiph.org] or something similar, using algorithms to interpolate the corrupt stuff. The interpolation is going to sound good but it's almost certainly not going to be the same bit-for-bit. And bit-for-bit is what matters.
Re:MD5 hash "posers" (Score:4, Informative)
If that were possible, it would destroy the value of an MD5 hash immediately and everyone wouild quit using it faster than you could blink.
The purpose of CRC hashes is entirely different. They are designed to detect a burst of bit errors in a stream of data, the type of error that is most likely to occur in a network transmission. They are not meant for fingerprinting files.
I doubt that anyone with any degree of sophistication in cryptology would attempt to use CRC and MD5 hashes interchangeably.
Re:gee? (Score:5, Insightful)
It is also possible that, as someone else suggested, the magical mp3 fairy left those files behind on her hard drive. In fact, I would propose that the mp3 fairy theory is even more likely.
The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit.
It is not possible (okay, unlikely, but unlikely enough for me to say not possible) to have two different files with the same MD5 hash. And definitely not likely by accident.
If even one single bit of the file is changed, then approximately 50 % of the bits of the MD5 hash will change. What cryptographers call "good diffusion properties". Good enough to trust for digital signatures, secrets, etc. You sign the MD5 hash of a document, because nobody else will have a document with the same hash.
To preempt one of the inevitible replies let me state: yes I know that you could have two different files, in theory that have the same MD5 hash. After all the files are much larger than the MD5 hash of 128 bits. Multiple files hash to the same value.
But the whole point of the design of MD5 is such that you can never create or discover any two such different files that hash to the same value.
If you were to examine 2^127 different files, then you would have a 50% chance of one of them giving you the desired MD5 hash. Do you know how large 2^127 is?
I would say that there is better than a 2^127 chance that the mp3's were left behind by the magical mp3 fairy.
Re:gee? (Score:3, Informative)
For loose definitions of "fairy", yes. eg child, friend, etc
>> "The only way that the MD5 hashes could be identical is if the two files are absolutely identical in every single bit."
Try the following: Install some CD ripping/encoding software. Leave it at the defaults. Use CDDB to generate the ID3 tag
Re:gee? (Score:3, Interesting)
You may be right. I'm not sure. I have some doubts about the ripping process being as exact as you say. I agree that the mp3 encoding process is exact. Same input file, same settings, ---> same output file.
Hashes and Compression (Score:3, Interesting)
I was under the impression that hashes are not reversible like compression algorithm's are, but that they try to add as much chaos between slightly different variations of the original. (The same way the telephone company racks up money by having area codes be very distant from each other; a typo in the area code probably means big bucks for a wrong number)
My spreadsheet of 1997 budget information could produce
Re:gee? (Score:5, Interesting)
So did I, so I just ran the experiment:
Looks like under identical conditions (same drive) it'll rip consistently. Ripping off a different drive might give different results, that's more hassle than I want to try right now. If anyone wants to compare, the disc/track I ripped is Pink Floyd's Dark Side of the Moon, Capitol's catalog # CDP 7 46001 2, DIDX 226. (Different recordings will almost certainly give different results.)Oh, and to make RIAA happy:
;-)Re:gee? (Score:4, Funny)
al%
ha nice try, we know the only way to delete something is to highlight it and click delete, and then empty the trashcan!
You can't fool us!
Re:gee? (Score:5, Interesting)
Different drives, with the same disc, and identical software, certainly do give different results. Just tested. Identical versions of cdparanoia live on both systems.
I also ran lame with default settings (makes a 128K CBR) on both WAVs and got different sums there as well.
No tags involved.
Re:gee? (Score:3, Interesting)
This part is not at all surprising. Even one single bit difference in two files would give radically different MD5 hashes.
Different drives, with the same disc, and identical software, certainly do give different results. Just tested. Identical versions of cdparanoia live on both systems.
This part is the really interesting result. Two different rips, same software, same CD, give different
Re:gee? (Score:3, Interesting)
Right, but I figured, maybe the bit differences might disappear in the encoding, some wacky things you can only determine empirically :-)
Not sure about "digital jitter" myself, but I do know that pretty mu
Re:gee? (Score:3, Informative)
I wouldn't expect two different WAV's that sound exactly the same to give the same mp3. But I wouldn't have bothered to test it either.
As I think about it, your theory is interesting. Since mp3 compression is based on the perception of audio, or getting rid of everything that you don't perceive, then there is some argument that two very similar WAV bit patterns that
Re:gee? (Score:4, Interesting)
Well there are several things that could stop you. You could get the latest MISD (Microsoft Internet Social Disease), etc.
But if you don't, then short of other things stopping you, such as getting run over by a truck, you merely need to change one single bit in the file to have a very different MD5. That bit does NOT need to be in the ID tag. You could just decode one single mp3 frame, randomly selected from the file, alter one bit of the sound, and then re-code that single mp3 frame.
It is even possible that someone might be inspired to write a tool to do this. It would defeat a lot of the previous Slashdot discussions about using MD5 to indicate "good" downloads before you download them. But maybe trust relationships of the P2P swappers themselves, using private keys, is a better idea than trusting the download file.
Re:gee? (Score:3)
I didn't say to destroy the quality of your mp3.
Decode one single 11 byte frame. Alter one bit. Re-encode it. In fact, as I understand things, the sound is stored as the sums of frequencies (FFT) or something like that. (Not an expert on this.) Yo
Re:gee? (Score:4, Interesting)
If you just alter the ID3 tags without altering the mp3 content, then they can nail you. If simply altering id3 tags becomes commonplace because everything thinks it is the easy, trivial implementation, then they will nail you by checking the hash of the content. Identical content with trivially altered ID3 tags is a very good argument that you got this file from the thousands of other people who have the same hashed file with trivially altered ID3 tags.
I'm proposing a non-trivial, but not that conceptually complex alteration to the content that alters it in an imperceptable way. In fact, whether the alteration seems complex to you is irrelevant. After all, it is just a command line tool to you anyway, just like altering ID3 tags. You don't care how it is done. Run this tool on your mp3 file, it randomly affects an imperceptable alteration to one of the gazillions of 11-byte frames in the file.
However I doubt that they will go to such trouble -- if they have access to your files you're pretty much caught red-handed. A different MD5 checksum won't get you off of the hook here.
They might have access to your files if you are sharing them.
I think the original argument is that Jane Doe was sharing files. Jane claims the sharing is unintentional. Jane claims that the mp3's on her hard drive are her own rips of CD's she owns. The MD5 hash proves otherwise. This sub-discussion is about altering mp3's so that hashing is now useless at tracking the source of where you got an mp3 from. In the Jane Doe scenerio, a comples mp3 alteration to foil the MD5 hash would actually be useful.
Merely altering the ID3 tag such that the RIAA can also alter the ID3 tag back to what it is in the wild, and get identical MD5 hashes is a very strong argument against Jane Doe.
Re:gee? (Score:3, Interesting)
How RIAA tracks downloaders (Score:3, Informative)
(Music industry discloses some methods used)
MD5-hashes (Score:2, Interesting)
Re:MD5-hashes (Score:3, Insightful)
Re:MD5-hashes (Score:5, Informative)
I did the same song three times. The first two times, all things were equal including all settings. The MD5 checksums were the same.
I swapped out my DVD/CD player for a different model. Reripped the track on the same computer with the same exact settings and the MD5 was different.
I am using Exact Audio Copy in secure mode and Lame for the encoding. The ID tags were recieved the first time and the same tags used for all three attempts (EAC remembers the disk).
I'm sure I could try many things like changing the read speed, comparing the wav files and not just the resulting mp3 etc.. but I do not have the time for more analysis.
Re:MD5-hashes (Score:4, Informative)
Theres issues of offset values (as with CD audio it is difficult to hit an *exact* location on the disk), plus the way the reader deals with C1 and C2 error correction, as well as how different extracting software interfaces with the hardware.
It would almost be safe to say two mp3s with the the same MD5 are one file copied twice (as opposed to two individually created mp3s), but that doesn't mean they are illegal...
Re:MD5-hashes (Score:5, Informative)
Uh, actually this is irrefutable proof. It will miss a lot of songs, but it is virtually guaranteed to not give false positives. This is much more solid proof than SCO had.
To think a month or two ago when SCO was insisting on an NDA many on
Obviously the RIAA's technical experts know what they are doing... its time to alter a few ID3 tags like the story suggested.
What if... (Score:5, Interesting)
In other news, all songs produced by RIAA artists in the last 10 years all have the same MD5 hash anyway, because they're all the same.
Comment removed (Score:5, Informative)
Re:What if... (Score:4, Informative)
Actually that's not true. They only care about the sharing because it leads to what they really care about: people listening to music that they didn't pay for. If everyone who shared mp3s had bought every CD of the songs they downloaded, no one would care because they would have already paid to listen to those songs. The problem is that most people don't own all of the CDs for the songs they download, and the RIAA doesn't like it when you try to wriggle out of their money trap. If the actual sharing was the problem, the distribution itself, then we wouldn't have radio stations playing music either, because that also lets people listen to music they didn't pay for, but it's a bit different because you don't really get a choice of what you hear. But now if you go and start recording songs you hear on the radio, so you could listen to them whenever you wanted, you're getting into that grey area. Of course the RIAA doesn't really care about that because they know that radio quality is shit, so there won't be widespread radio recording anyway.
Re:What if... (Score:3, Informative)
Now here is where it gets good - the downfall of mp3.com was exactly becau
Re:What if... (Score:2, Insightful)
Is that illegal? Am I a fellon?
-- A.C.
No one knows (Score:3, Insightful)
Copyright lawyers said it remains unresolved whether consumers can legally download copies of songs on a CD they purchased rather than making digital copies themselves.
So it's still up in the air. But here's where I get confused:
For example, the industry disclosed its use of a library of digital fingerprints, called "hashes," that it said can uniquely identify MP3 music files that had been traded on the Napster service as far back as May 2000.
By comparing the fingerprints of music
What happen if (Score:5, Interesting)
Re:What happen if (Score:5, Informative)
On the other hand, if I were the RIAA attempting to identify common files in this way, I might be inclined to exclude the ID3 tag from the MD5 computation since it is so easily modified.
Any changes to the actual content, though, will ripple into the MD5 computation.
Short answer: "normalizing" the file for volume, or even chopping off a few seconds of trailing silence with something like CoolEdit will certainly change the hash and make it distinct from whatever their baseline hash value is.
Re:What happen if (Score:5, Informative)
If that's all you want to do, much better not to use Cooledit, which has to expand and recompress the file to MP3. Use something like MP3Trim [logiccell.com] which can chop off any given number of MP3 frames, or normalise the volume, by operating on the MP3 directly. Much much faster, and no expand/recompress quality loss.
MD5 Cannot stand up in court. (Score:5, Informative)
Re:MD5 Cannot stand up in court. (Score:2, Informative)
Re:MD5 Cannot stand up in court. (Score:5, Informative)
First of all it's very clear that two files can give same MD5 checksums. After all, MD5 is only 16 bytes (2^128 different possible). So if you have just 17 byte files (2^136 different possible), it's clear that on average every MD5 sum matches to 256 of all possible files.
It's just damn unlikely to get 2 files with same MD5, and if you wanted to brute force it, you would have to try average 2^64 different files before you found one with identical MD5 to another file. And this would take a long time (actually not that terribly long, a few years at most, and it parallelizes perfectly).
The page you link to implies that it's possible to "easily" fabricate a file that produces a given check sum, so instead of months of processing time, only days or hours would be needed to get a MD5 hash collision.
So all P2P users / software makers need to do to circumvent this, is to agree on a specific MD5 sum, then patch every file so that they produce this same MD5 sum
Of course the obivious solution for RIAA would be to use a more secure hash algorithm, with more bits. Unbroken algorithm with enough bits can't be faked, as it would take more than age of the universe to brute force it.
Though the basic problem with this RIAA method remains. If you rip with same software from identical CD digitally, and there are not bit errors at ay point, then you should end up with identical file, and therefore identical hash no matter how secure the algorithm is...
Re:MD5 Cannot stand up in court. (Score:5, Funny)
That would totally pooch clients such as E-Donkey that use MD5 hashes to actually figure out which clients have a particular file (whether just a portion thereof, or in their entirety), irrespective of how each individual client may have renamed it.
And trust me, there are fringe benefits to the hashing as well, such as making it apparent when someone is trying to masquerade a file as something that it's really not.
E.g., consider the following scenario...
1. You are searching for Red Hat ISOs.
2. You find a match called "Red Hat.iso" shared from one user.
3. You notice that there are 50 other users sharing the same file.
3. The other 50 versions are named as "Goatse.cx guy and tubgirl together at last.mpg"
4. Therefore, something is very very rotten in Denmark...
Mechanik
Re:MD5 Cannot stand up in court. (Score:3, Insightful)
Above is not very far fetched, now is it? And result should be identical files.
Re:MD5 Cannot stand up in court. (Score:3, Funny)
Now that I think about it, those two things actually sound alike also.
-prator
MD5 Hash (Score:5, Informative)
The only way for two files to have the same MD5 hash is for them to both be encoded with the same encoder, from the same WAV file, with the same bitrate and all advanced options, and to have exactly the same ID3 information, the same filesize, and to be identical to the last bit.
Otherwise, the MD5 will be nothing like the same, for two perfectly identical songs where one has a spelling error in one field of the ID3 tag. I imagine for any one song, there are many many different MD5sums out there, although perhaps one or another good quality version would exists on hundreds of different PCs...
Re:MD5 Hash (Score:2)
Even so, it sounds really impractical... unless they are trying to prove that "you got this file from that guy, that got it from that guy"...
Utterly useless in tryin to prove that any mp3 is in fact this or that song, without listening to it.
Re:MD5 Hash (Score:2)
That is exactly what they're trying to prove. They have MD5 sums from files traded over the Napster network, and they are sneaking around comparing people's files to those. If you have a file that matches, then that means you have one of the files that was traded on Napster, which means you're going to JAIL. YOUR ASS = MEAT
My problem with this is the assumption that any file traded over the Napster netw
Re:MD5 Hash (Score:2)
-
Re:MD5 Hash (Score:5, Interesting)
If two people used the same ripping software set to all its default settings (as many unsophisticated users do), got a perfect rip off the CD, and relied on CDDB information for tagging the song, then it's possible that they got mp3s identical down to the last bit, and thus identical MD5 hashes. BUT to make this a plausible defense, you'd have to show that your rip was in fact perfect. In other words you'd have to be able to recreate the mp3 independently. If the old Napster mp3 had any ripping errors, then it would be hard to claim that the later rip just happened to have the same errors - assuming errors are essentially random.
Where does it say MD5? (Score:5, Interesting)
Are we sure they're actually using MD5? The article doesn't even contain the string "md5" that I can see. It mentions hashes though, but there's something called Robust Hashing [google.com] which can be used to identify, or at least, compare content in a "fuzzy" way.
Re:MD5 Hash (Score:2)
I'm willing to bet that that will be being repeated tens of thousands of times for any one track - especially mainstream pop-crap like the lovelyiciouis Beyonce. Surely an identical MD5 comes out at least x% of the time!
Re:MD5 Hash (Score:3, Insightful)
Re:MD5 Hash (Score:3, Informative)
No!! That's definately not true. Making a perfect rip is something you have to WORK at, which not many rippers do. Especially years ago. Check out ChrisMyDen's Uber Network [chrismyden.com] on a detailed guide on how to make the 'perfect mp3'.
You need to use something like EAC's secure mode. It rips the cd twice and compares for exactness. Only then can you be assured your wav file has no err
Plumper porn (Score:2, Funny)
but will they target aol/tw? (Score:4, Interesting)
will they start sending subpeonas to aol/tw customers this time?
from the Napster network? (Score:3, Insightful)
Md5 hashes are also used for.... (Score:5, Informative)
Changing MD5 hashes on songs to avoid RIAA would also lessen the effectiveness of K-SIG. Trading hashes of know working files was one of the ways ppl on P2p avoided downloading those fake RIAA files.
Condoning illegal activity??? (Score:3, Insightful)
I sincerely hope this is tongue-in-cheek. For all the self-righteous, pompous sabre-rattling that goes on in here about how good Slashdotters only possess MP3's that are ripped from personal collections, I would certainly hope that we wouldn't stoop so low as to blatantly and openly be trading tips on how to avoid getting caught doing illegal things.
What's next? A HOWTO on setting up an encrypted file system for our child porn?
HOWTO: Encrypted partition (Score:5, Funny)
modprobe cryptoloop
modprobe aes
losetup -e aes
(input password)
mke2fs -j
mount -t ext3
enjoy!
Re:Condoning illegal activity??? (Score:3, Insightful)
Knowledge in itself is neutral. But it can be used for good or evil purposes. You might want to try, just as an exercise, to imagine five positive and five negative uses of encrypted filesystems or altered MD5 sums.
Re:Condoning illegal activity??? (Score:3, Insightful)
Yea maybe its illegal. But imho its NOT ethically wrong. Its kinda like back in time when you had to pay customs for crossing bridges.
For what do we pay the RIAA again? We pay them for maintaining a huge organisation which is dedictated to copy and distribute music. But, eh, we can do this by ourself now...!?
The RIAA was needed before mp3 and there was no
Job opportunities (Score:5, Funny)
After all, in these dot-bust days, it's still possible to get a nice highly paid job and be called an expert by putting the right spin to strcmp() in your resume
hashes are kinda pointless (Score:5, Interesting)
It is generally believed amongst file traders that it is legal to download an mp3 for a song, when you own the CD. In other words, you don't need to rip and encode songs from your own CD. However, this may not be true (I am not a lawyer).
The RIAA is using MD5 hashes as a basis for proof that the individual in question downloaded the files they are sharing, instead of ripping them from their own CD collection. This is supposed to show the individual is a willing participant in stealing and distributing music, instead of someone who is just sharing what they already own. But, see above.
I think this is mostly just a FUD tactic. They can talk to the media about how their MD5 hashes prove so-and-so is a big mean pirate hacker. MD5 hash certainly sounds scary, especially when the technology is described by the media as a tool used by hackers.
Pity the RIAA (Score:5, Insightful)
Exchanging music is not about piracy, it is about exchanging culture, just like when my grandfather leant me some old Jazz records and said, "here, you might like this".
Today culture moves at the speed of light and the RIAA believes it has the right to tax this movement. It cannot succeed except by destroying the Internet.
I'm starting to believe, watching this debate evolve over many years, that the file traders are right, for the wrong reasons.
Human culture depends on exchange of ideas and information, and music and films are a large part of this in today's world. No album, no movie scene, no written text is a personal creation, they are all taken from the pool of common culture, modified, and redistributed.
Seeking all means to do this faster than ever - and ignoring the barriers, such as "ownership", that stand in the way - is the prerrogative of today's world. We simply can't put the genie back into the bottle and start exchanging pieces of paper and vinyl discs again.
The debate is huge, but the results already seem clear: any laws designed to stop the process from continuing will be further and further ignored until they are seen by a majority of people to be useless vestiges of a material-obsessed past.
A failure to comunicate (Score:5, Insightful)
There is an interesting pattern here:
- Some one comments that the IP laws have not kept up with technolgical and social change, and that they are now impeding the cultural goals they origonally served. They may have made sense when we were limited to exchaging physical objects, but they don't make sense now.
And the responses are allong the lines of:The respondents are completely missing the point. To see this, imagine what the discussion might have looked like if it had happened way back when:
- The rule about not eating X hasn't kept up with the times. It made sense when we didn't know about the parasites, but now that we know how to clean and cook them it doesn't makes sense.
I suspect the responses would have been along the lines of:Every time I see this played out, my response is, "Gee, IP law really is dying, isn't it?", with the same sort of awe I had watching little bits of sand wash downstream at the bottom of the grand canyon.
-- MarkusQ
Re:A failure to comunicate (Score:3, Interesting)
Michelangelo's David (Score:3)
The statue sits there, the result of laborious work by its creator (made possible thanks to a decade of training at the hands of other masters, but that's another story).
Now the statue is in the hands of a private collector who charges people to view it. He claims he owns it, but the state decides that the statue is far too important. They buy it, and put it on public display. Now everyone can see it, be inspired by it, make rough imitations, photos, even tiny or full-scaled replic
Easy (Score:5, Informative)
The only problem is that a lot of file sharing software uses the fact that 2 files (from different sources) have the same hash in order to swarm the download from multiple sources. If everybody goes around intentionally making their mp3s have different hashes, swarming basically won't work anymore.
Re:Easy (Score:3, Insightful)
Also, if we did use a non-used ID3v2 tag field, then the RIAA would just go ahead and ignore that field in their hashing technique, since it's located in a specific part of the file
The problem with letting the whole world know about a technique like that, is that the RIAA is part of that world.
Besides, this whole MD5 checking & database the RIAA may be assembling doe
Give up (Score:5, Funny)
Hail to the king!
RIAA Propaganda (Score:3, Funny)
MD5? (Score:4, Insightful)
Protection (Score:3, Insightful)
Rus
How About An MP3 Outguess? (Score:5, Interesting)
MD5 sums and different encoders (Score:5, Informative)
First step: the *.wav is ripped. Using libcdparanoia, which i personally perfer, i find slight variation in size depending on the machine and cdrom drive i rip them on.
Second step: encoding on different machines, with different encoders, using different algorythms, using different levels of floating point precision, on different architectures etc... produces vastly different files.
Third step: sharing. Oftentimes an mp3 is downloaded 99.8% before the connection is broken. You keep the mp3 becuase mp3 is a sequential file format and you only lose a second or two of music. The rest of the file is intact.
Their md5 searching scheme could be circumvented quite easily by changing a comment in the id3 but they could get around that by cutting out the id3 part of the file when they make their md5sum.
The downside to this is that if you are searching for music on something like gnutella by the ***sum, the content would differ and you would not get as many results. Gnutella would not download from multiple sources becuase the file would not have the same signature.
Whatever the case, it is clear that some form of file obfuscation is now needed for safety online. Or we can wait for freenet to mature.
Protection (Score:3, Interesting)
I hope the next kazaa lite comes with file altering/deleting/anti-riaa utilities
From the Napster Network?? (Score:5, Funny)
Yikes.
A problem with this (Score:3, Interesting)
I suppose that (if its possible) you would either want to swamp these guys with false positives, or distribute the hash keys and the files somehow to make it more difficult and protracted to discover who actually owns that file.
I suppose that one viable option in P2P would be a freenet model where downloading involves a number of encrypted hops between peers to search or get the data, and where peers cache popular data and indexes in encrypted form. It would be much, much harder to figure out who shared that file then.
Obviously there is a trade off going this route. You wouldn't want the sluglike performance of Freenet so it would not be as secure, but I'm sure you could reduce the number of hops and other measures and still make life massively more difficult for RIAA and their ilk to track down your activities.
Similar story on BBC (Score:3, Informative)
Virus (Score:3, Funny)
Then, when people get busted, they can say "It was a virus".
Of course, this would make the search feature of Kazza useless...
What is illegal here? (Score:5, Interesting)
sharing their songs - as is their right - AND I
also rip my entire 1000+ CD/LP/8track collection
to the same computer AND I intellegently store
all the files in the same heirarchy.
Have any laws been broken?
KaZaa is configured to share everything in my
heirarchy so that the indie songs can continue to
be shared.
Have any laws been broken?
I go in for Jury Duty, meanwhile Another Kazaa
user downloads the indie shared files.
Have any laws been broken?
Another Kazaa user downloads the rips from my
personal collection because their 8track player
is on the fritz.
Have any laws been broken?
Another Kazaa user downloads the rips from my
personal collection because their LPs were
destroyed in a flood.
Have any laws been broken?
Another Kazaa user downloads the rips from my
collection because they want to see what the
latest Madonna single sounds like before going
out and buying the CD.
Have any laws been broken?
If any laws were broken here - who broke them?
Just because I leave the front door open does not
mean that anyone can enter and take what they
want from my house. Same as my computer.
The action of downloading is at question not
making the article available.
YMMV. Consult a lawyer.
Re:What is illegal here? (Score:4, Insightful)
Nonsense.
To use your analogy, if you leave the front door of your house open (while you're away), you should expect that someone will come in, and if you're lucky, take something.
Your situation gets significantly worse if you have, say, a handgun under your pillow, and some random neighborhood kid comes in, finds it, and shoots himself (or someone else).
The issue here is that you've knowingly left your front door open, making you at least partially liable for the harm that occurs as a result (indirect or otherwise). Same thing if you leave the keys in your car and someone takes it and mows down a bunch of pedestrians with it. In either case, you cannot claim innocence simply because you didn't do the deed. You've made a substantial contribution in the commission of a crime, and you would be expected to pay for that crime.
Re:What is illegal here? (Score:3, Insightful)
There are few people I know that lock up every door and window before they leave the house (I live in a small town). I've been to rural areas where people leave their keys in their cars. In both cases, there is no expectation of B&E or theft.
If a kid enters my house, finds a gun (that's even hidden in your example), and shoots themselves I am not liable. If someone steals my car I am not liable. Negligence is leaving a loaded gun on the front lawn. You cannot be negligent just bec
Re:What is illegal here? (Score:3, Insightful)
You then make a photocopy of the entire book.
You take that photocopy around with you to read leaving the original at home.
Now lets say that someone breaks into your house while you are home and steals your photocopy leaving you your original (it was locked up in a safe for example).
The crime in this instance is two-fold. Breaking and entering, and copyright infringement. Who is responsible for the copyright infringement? You are.
Now lets remove the breaking and entering.
I wonder... (Score:3, Interesting)
By comparing the fingerprints of music files on a person's computer against its library, the RIAA believes it can determine in some cases whether someone recorded a song from a legally purchased CD or downloaded it from someone else over the Internet.
So, the RIAA has been downloading illegal copies of music for years, in fact probably has a huge library of music. Simultaneously, in their broad sword efforts to completely end p2p, they're arguing that it's illegal to download songs you've already bought. So, even if the RIAA has gone through all the hoops with this library, obtaining licenses for each song they swiped off of file traders in their investigations-- which I doubt; recall Microsoft's slip ups-- they're arguing that the methods they've been using to track down illegal file traders are actually illegal themselves! In fact, the RIAA might have the largest collection of illegal music of anyone, even larger than mine! Of course, this should come as no surprise, after all of the attempts to make it legal for them to attack suspected infringers PC's, it's pretty clear that the RIAA's privilege and property makes them above the law.
P2P modifying files.. (Score:5, Funny)
I can see it now... "And in recent news, according to the RIAA there are over 10 billion songs being traded. The organization is quoted as saying 'We intend to sue individual users for having more songs than we've created...'"
It's possible (Score:4, Interesting)
The ripping stage can also produce slightly different checksums, depending on the condition of the CD - Audiograbber actually reports "potential speed errors". Unlike data CDs, some level of read error is considered acceptable on music CDs; you don't want the player to keep re-trying a bad sector if it detects a big problem - it would ruin your listening pleasure!
Those poor lil Country Music singers (Score:4, Insightful)
Musicians and music labels alike need to come to grips with the fact that their moneymaker, (CD sales) will need to take a back seat to actual performances by the artist. We need to take it back to the old days when music artists actually sang and performed and didn't just sit in a dark room behind some curtain tooling away on their synthesizer.
http://www.cnn.com/2003/LAW/08/07/findlaw.analysi
Music Hashing with musicbrainz (Score:3, Informative)
I've compared albums I've ripped myself to the database and gotten "100%" matches (along with some matches of a much lower percentage) That leads me to think that if the RIAA kept its own database like that, they could do a whole lot of comparison with similarity or quasi-unique (ala MD5) hashes. I'd also venture that, with enough work at the comparison system, they could make court-valid assertions. They can hire plenty of geeks to handle the statistics necessary to call something 'beyond a reasonable doubt.' (for criminal proof)
What nobody seemed to notice. (Score:5, Insightful)
The reason for md5 matching is so they can nail someone as the 'origin' of the ripped song, then hold them liable for all the copies of a matching md5 on P2P networks. It would be more a demonstration of "look how much damage one copy did to us!".
Anyone thought of setting a honeytrap for RIAA? (Score:3, Interesting)
RIAA Taxes (Score:5, Interesting)
Re:own rip identical to download (Score:4, Funny)
Audio rippers aren't always perfect AFAIK.
... or even competent! How many rippers can't get the tagging right when the song and artist ARE PRINTED RIGHT THERE ON THE LOUSY CD COVERSLIP! Sheesh! Learn the difference betwenn Meat Loaf and Leo Sayer for cryin' out loud!
Re:Or Perhaps... (Score:5, Insightful)
Re:Time for a new WinAMP Plug-in (Score:3, Informative)
If the hash is using ID3 tags, you could change some unused field in there, but there would be a much smaller number of permutations available (although probelby still enough to be useful)
Re:Now what? (Score:5, Interesting)