The Microsoft Palladium case

[Juliennew]

It is a post from DeviantArt forum that is been written in June. It talks about the new technology being developped by Microsoft : The Palladium
It is quite long but very interesting.

Sorry, I just had to post this, as this is quite possibly the most disgusting thing I've ever heard. I've been reading up on it all week, and now I've got some time on my hand I thought I might write up about it so that all of you people who don't read The Register and Slashdot can hear about the Beast's latest scheme. I thought this was probably the most relevant forum since it concerns everyone who uses a computer, but feel free to put it wherever. I would just like some of this to be known by the masses.

And for those of you who are afraid of long posts: ignore this at your peril. I would also like to see what your reaction to this is.

Earlier this week, Microsoft outlined their plans for their next generation of operting systems, codenamed Longhorn/Palladium. Among the features touted was the "secure networking" functions that OS would offer.

Firstly:
Microsoft plans to implement Palladium DRM (digital rights management) in a hardware chip, initially implanted on the mobo, but later on embedded in the CPU, and employing hardwired encryption throughout. The purpose of this is to flag every file on the computer with a digital signature telling a remote server what it is. If it's an unauthorised file, the remote server will tell your computer not to let you execute it.

This is basically an attempt to stop the trading of mp3's and/or warez.

Secondly:
Before an application can run, it too must have a digital signature remotely verified by another server. If the program binary doesn't match with any of the authenticated binaries, your computer won't run it. This, again, is meant to stop your computer running "unauthorised" software - which might be warez, or it might just be a nifty freewrae program that the authors acn't afford to have certified. Microsoft will be able to control exactly what your computer can and can't run.

Thirdly:
As most of you know, Microsoft employ a strategy of making their software deliberately obsolete - they make it forwrd compatible, but not backward compatible. With the laws of the DMCA, it will soon be illegal to try to make a software product that is compatible with another programs file types (for example, take the many office applications there are for Linux which have had some success in translating their arcane file formats).
This has the effect of killing any competition in the water - since you're not allowed to make your new product compatible with any of the others, no-one will use it. And eventually people will give up using any of the others instead, since no-one else can read their documents. So the entire world will be left with one choice only for software - Microsoft.

Fourthly (I don't know if that's a word, but it should be):
Palladium will effectively ban free software, not just free stuff for Windows platforms, but free stuff for Linux, Mac, in fact every OS that runs on a Palladium enabled motherboard/processor. Why?
In order to get the program to run on a palladium platform, you will need to pay to have your binary certified as "safe" by Microsoft's software authentification branch. And who in their right mind is going to pay for a piece of software they spent hours working on? It just wouldn't be worth it.

It gets worse when it comes to open source projects, such as Linux and BSD. Those of you who know about these things will know that open source projects are created by freelance coders all over the world who create programs in their spare time and then give them to the rest of the world for free. Many of them also release the source code for free too, so that if you wish you can alter the program (such as to fix bugs, add features etc).
Now, it would be bad enough if the owner has to pay a certification fee. But EVERY CHANGE that is made to the source code will require a new, seperate certificate to be created. Those of you who use Linux will know that so many things get updated so quickly, that this just isn't practical, and would cost the open source developement people millions of dollars. This is money they just don't have, and Microsoft knows it.

Fifthly:
The "secure network". This is the real clincher for Palladium. At first, they're going to make it so that it is possible to turn Palladium off at the hardware level. But it is created in such a way so that, if you try to connect to a Palladium web server, you won't be allowed to. Palladium machines will only be able to talk to other Palladium machines, and non-Palladium machines won't be able to talk to any Palladium machines.
Hence, if Palladium reaches critical mass, there will be thousands of people the world over who won't be able to access the internet or even work on a network with Palladium machines, so by extension they will be forced to "upgrade" to Palladium machines.

Sixthly:
At first I thought: what the hell, this is only going to apply to x86 architecture (namely Athlon and Pentium chips, since it's only AMD and Intel who are involved at the moment). So, I could try another hardware architecture: such as the Mac/PPC, or the Sun Sparc, or an ARM, or any other kind of processor.
But then I realside that even if I did, I wouldn't be able to access the "Palladium network" which could encompass the entire internet if this concept goes far enough. So all you Mac users would be effectively locked out; you too would have adopt a Palladium machine if you wanted your computer to actually do anything.

Seventhly:
Palladium will enable all your documents to be controlled remotely. No, this is not a joke. If Microsoft find you are using an outdated version of Office, all they need to do is send a message to your computer and it will no longer let you read any of your documents that were created with that application.
Even more sinister is that if Microsoft take offence at any of the documents on your machine (this could be porn, it could be a simple document containing DeCSS information or anti-Palladium information) then they can delete or alter it not just from your PC but from every other Palladium PC on the network.
This has a remarkable similarity to the "Ministry of Truth" in George Orwell's "1984" where the government continually faked information, both new and old, the entire country over to make themsleves appear "correct" all the time.


If Palladium ever becomes widespread enough, the internet as we know it today will be dead. Instead of being controlled by us, it will be controlled by Microsoft, and you will have no choice to do exectly what they say.

Hence why I want to tell as many people about this atrocious idea before it become spopular, and M$ administer their miraculous spin to it to make it sound like the best thing since sliced bread.


Darn, I forgot to post the links explaining about it. I'll also put up a few emails from some mailing lists me and my friends are members of.

Initial outline of Palladium : http://www.theregister.co.uk/content/4/25852.html

Analysis on how Palladium is solely designed to protect IT businesses such as Microsoft : http://www.theregister.co.uk/content/4/25940.html

The Palladium FAQ : http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

How Palladium has the potential to eradicate Linux : http://www.theregister.co.uk/content/4/25891.html

 

[Juliennew]

The following is an excerpt from an email by "Lucky Green" one of the worlds most renowned cryptography hackers:

[Minor plug: I am scheduled to give a talk on TCPA at this year's DEF CON security conference. I promise it will be an interesting talk. http://www.defcon.org/]

Below are two more additional TCPA plays that I am in a position to mention:

1) Permanently lock out competitors from your file formats.

- From Steven Levy's article:
"A more interesting possibility is that Palladium could help introduce DRM to business and just plain people. It's a funny thing," says Bill Gates. "We came at this thinking about music, but then we realized that e-mail and documents were far more interesting domains."

Here it is why it is a more interesting possibility to Microsoft for Palladium to help introduce DRM to business and "just plain people" than to solely utilize DRM to prevent copying of digital entertainment content:

It is true that Microsoft, Intel, and other key TCPA members consider DRM an enabler of the PC as the hub of the future home entertainment network. As Ross pointed out, by adding DRM to the platform, Microsoft
and Intel, are able to grow the market for the platform.

However, this alone does little to enhance Microsoft's already sizable existing core business. As Bill Gates stated, Microsoft plans to wrap their entire set of file formats with DRM. How does this help Microsoft's core business? Very simple: enabling DRM for MS Word
documents makes it illegal under the DMCA to create competing software that can read or otherwise process the application's file format without the application vendor's permission.

Future maintainers of open source office suites will be faced with a very simple choice: don't enable the software to read Microsoft's file formats or go to jail. Anyone who doubts that such a thing could happen
is encouraged to familiarize themselves with the case of Dmitry Skylarov, who was arrested after last year's DEF CON conference for creating software that permitted processing of a DRM- wrapped document
file format.

Permanently locking out competition is a feature that of course does not just appeal to Microsoft alone. A great many dominant application vendors are looking forward to locking out their competition. The beauty of this play is that the application vendors themselves never need to make that call to the FBI themselves and incur the resultant backlash from the public that Adobe experienced in the Skylarov case. The content
providers or some of those utilizing the ubiquitously supported DRM features will eagerly make that call instead.

In one fell swoop, application vendors, such as Microsoft and many others, create a situation in which the full force of the U.S. judicial system can be brought to bear on anyone attempting to compete with a
dominant application vendor. This is one of the several ways in which TCPA enables stifling competition.

The above is one of the near to medium objectives the TCPA helps meet. [The short-term core application objective is of course to ensure payment for any and all copies of your application out there]. Below is a mid to long term objective:

2) Lock documents to application licensing

As the Levy article mentions, Palladium will permit the creation of documents with a given lifetime. This feature by necessity requires a secure clock, not just at the desktop of the creator of the document, but also on the desktops of all parties that might in the future read
such documents. Since PC's do not ship with secure clocks that the owner of the PC is unable to alter and since the TCPA's specs do not mandate such an expensive hardware solution, any implementation of limited lifetime documents must by necessity obtain the time elsewhere. The obvious source for secure time is a TPM authenticated time server that distributes the time over the Internet.

In other words, Palladium and other TCPA-based applications will require at least occasional Internet access to operate. It is during such mandatory Internet access that licensing-related information will be pushed to the desktop. One such set of information would be blacklists of widely-distributed pirated copies of application software (you don't need TCPA for this feature if the user downloads and installs periodic software updates, but the user may choose to live with
application bugs that are fixed in the update rather than see her unpaid software disabled).

With TCPA and DRM on all documents, the application vendor's powers increase vastly: the application vendor can now not just invalidate copies of applications for failure to pay ongoing licensing fees, but can invalidate all documents that were ever created with the help of
this application. Regardless how widely the documents may have been distributed or on who's computer the documents may reside at present.

Furthermore, this feature enables world-wide remote invalidation of a document file for reasons other than failure to pay ongoing licensing fees to the application vendor. To give just one example, documents can
be remotely invalidated pursuant to a court order, as might be given if the author of the document were to distribute DeCSS v3 or Scientology scriptures in the future DRM protected format. All that is required to
perform such an administrative invalidation of a document is either a sample copy of the document from which one can obtain its globally unique ID, the serial number of the application that created the document, or the public key of the person who licensed the application. (Other ways to exist but are omitted in the interest of brevity).

- --Lucky Green


And another...

======================================

JUNE 27, 2002
I Told You So
Alas, a Couple of Bob's Dire Predictions Have Come True

By Robert X. Cringely

Just over three years ago I wrote a column titled "Cooking the Books: How Clever Accounting Techniques are Used to Make Internet Millionaires." It explained how telecom companies were using accounting tricks to create revenue where there really was none. Take another look at the column (it's among the links on the "I Like It" page), and think of Worldcom with its recently revealed $3.7 billion in hidden expenses. Then last August, I wrote a column titled "The Death of TCP/IP: Why the Age of Internet Innocence is Over." Take a look at that column, too, and think about Microsoft's just-revealed project called Palladium.

The end is near.

Sometimes I'd rather be wrong, but it's a no-brainer to guess that accountancy, which has apparently become something of an art form or interpretive dance, could have a dark side. And you'll never lose money betting for Microsoft and against Microsoft's competitors and customers.

Let's concentrate on the Microsoft story. Last August, I wrote of a rumor that Microsoft wanted to replace TCP/IP with a proprietary protocol -- a protocol owned by Microsoft -- that it would tout as being more secure. Actually, the new protocol would likely be TCP/IP with some of the reserved fields used as pointers to proprietary extensions, quite similar to Vines IP, if you remember that product from Banyan Systems. I called it TCP/MS in the column. How do you push for the acceptance of such a protocol? First, make the old one unworkable by placing millions of exploitable TCP/IP
stacks out on the Net, ready-to-use by any teenage sociopath. When the Net slows or crashes, the blame would not be assigned to Microsoft. Then ship the new protocol with every new copy of Windows, and install it with every Windows Update over the Internet. Zero to 100 million copies could happen in less than a year.

This week, Microsoft announced Palladium through an exclusive story in Newsweek written by Steven Levy, who ought to have known better. Palladium is the code name for a Microsoft project to make all Internet communication safer by essentially pasting a digital certificate on every application, message, byte, and machine on the Net, then encrypting the data EVEN INSIDE YOUR COMPUTER PROCESSOR. Palladium compatible hardware (presumably chipsets and motherboards) will come from both AMD and Intel, and the software will, of course, come from Microsoft. That software is what I had dubbed TCP/MS.

The point of all this is simple. It may actually make the Internet somewhat safer. But the real purpose of this stuff, I fear, is to take technology owned by nobody (TCP/IP) and replace it with technology owned by Redmond. That's taking the Internet and turning it into MSN. Oh, and we'll all have to buy new computers.

This is diabolical. If Microsoft is successful, Palladium will give Bill Gates a piece of every transaction of any type while at the same time marginalizing the work of any competitor who doesn't choose to be Palladium-compliant. So much for Linux and Open Source, but it goes even further than that. So much for Apple and the Macintosh. It's a militarized network architecture only Dick Cheney could love.

Ironically, Microsoft says they will reveal Palladium's source code, which is little more than a head feint toward the Open Source movement. Nobody at Microsoft is saying anything about giving the ownership of that source code away or of allowing just anyone to change it.

Under Palladium as I understand it, the Internet goes from being ours to being theirs. The very data on your hard drive ceases to be yours because it could self-destruct at any time. We'll end up paying rent to use our own data!

Can you tell I think this is a bad idea?

What bothers me the most about it is not just that we are being sold a bill of goods by the very outfit responsible for making possible most current Internet security problems. "The world is a fearful place because we allowed it to be by introducing vulnerable designs followed by clueless security initiatives) so let us fix it for you." Yeah, right. Yet Palladium has a very real chance of succeeding.

How long until only code signed by Microsoft will be allowed to run on the platform? It seems that Microsoft is trying to implement a system that will enable them, once and for all, to charge game console-like royalties to software developers.

But how will this stop the "I just e-mailed you a virus" problem? How does this stop my personal information being sucked out of my PC using cookies? It won't. Solving those particular problems is not Palladium's real
purpose, which is to increase Microsoft's market share. It is a marketing concept that will be sold as the solution to a problem. It won't really work.

Let's understand here that not all Microsoft products are bad and many are very good. Those products serve real customer needs and do so with genuine purpose, not marketing artifice. But Palladium isn't that way at all. This is NOT about making things better for the user. This is about removing the ability for the end user to make decisions about how his or her computer functions. It is an effort by Microsoft to take literal ownership of Internet technology, Microsoft's "embrace and extend" strategy applied for the Nth time, though on a grander scale than we've ever seen before. While
there is some doubt that the PC will survive a decade from now as a product category, nobody is suggesting the Internet will do anything but grow and grow over that time. Palladium assures that whatever hardware is running on the network of 10 years from now, it will be generating revenue for Microsoft. There is nothing wrong with Microsoft having a survival strategy, but plenty wrong with presenting it as some big favor they are doing for us and for the world.

What's saddest about this story is that it could be positive. The world is a dangerous place and finding ways to make people responsible for what they do on the Net is probably good, not bad. I just don't think we have the right people on the job.

======================================

All those in favour of losing your right to use a computer with YOUR data owned by YOU please do nothing.

"Those who are willing to lose some of their essential liberties in favour of security deserve neither and will lose both"
-- Thomas Jefferson

Some others sources :
http://www.theregister.co.uk/content/4/25852.html

http://www.theregister.co.uk/content/4/25940.html

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

http://www.theregister.co.uk/content/4/25891.html

http://cryptome.org/ms-drm-os.htm

 

[heliogabalus]

What can the average person do to prevent Palladium from becoming a reality or to at least delay the launch?

I am not asking this in order to defend an "I am not concerned, as long as I can play Solitaire and print invitations on my computer"-attitude. Rather, I am really lost for ideas.

Appreciate your input!

 

[Blitz79]

WHAT!WHAT!


What the hell is this?!!

Who do they think they are. That is IT! I am through with them. I am SO going to buy a Mac and turn my back on them forever. How the Hell can they get away with that? GRRRR!!!

This is seriously bad news dude. Seriously bad.

 

[CornMaster]

There is nothing you can do. When you have support of all the major manufacturers, support of the government and the businesses, there is nothing to stop you. Even Linux and AMD are going to be putting this stuff in. It's a brave new world.

 

[Mikoyan]

This is really old news, if this comes through, then boycott Microsoft.
But know that the hackers and crackers will always be one step ahead of Micro$oft and will find ways to evade Palladium...

I'm not too bothered, nor surprised.
But i'll stand by and watch the progress, if it turns ugly, i'm switching OS.

 

[Blitz79]

It is a brave new World. Gates above!

 

[Smaasnekje]

Why arent anyone opposing this?
Where are the hackers when you need them?
Hackers of the world! Please 2114205 (this is a code so that authoroties dont say that i are doing something illegal)

 

[Juliennew]

What can the average person do to prevent Palladium from becoming a reality or to at least delay the launch?

At our level, I can see only 2 things we can do :
- Inform as much as people as possible on this Palladium project because Microsoft is counting on ignorance of the mass in order to make it
- As a customer, boycott everything that will have the Palladium technology enbedded ---> Motherboards, processors, softwares and OS
All the predominant companies in their sector will surely adopt this technology as it will ensure their perennity and more cash. Big video games editors like Infogrammes will surely be of the party.

The author of this post is also trying to prevent the UK gov from giving the "green card" to Microsoft that will give the right to the company of selling OS and software enbedded with this technology. Now, everything belongs to the govs and by prolongation to the possible customers ---> Us ...

But know that the hackers and crackers will always be one step ahead of Micro$oft and will find ways to evade Palladium...

It could be possible if this technology would be only affecting software. But this system will be implemented even in the processors. So even if you hack OS and softwares, you won't be capable of using it because of the Palladium code will be in your processor.

You can also see the original thread here :
http://forum.deviantart.com/403142
The author answers to common questions we could ask about this technology.

I was also wondering : What is the current situation of the anti-trust trials against Microsoft in the USA ?

Julien

 

[Greadius]

So... what is stoping me from using this old machine I run now to indefinately download things Microsoft doesn't want me to have?

 

[Blitz79]

Originally posted by Greadius
So... what is stoping me from using this old machine I run now to indefinately download things Microsoft doesn't want me to have?

Because in the article he said that they are going to update software continuously to be incompatible with the old stuff, and also the internet is going to shut out anyone without this technology if it gets a critical mass. You won't be able to download anything from the net without the technology; you may not feel it now, but what about when Civ 4 comes out, then civ 5. What about 5 years from now? You can't stick to the same computer forever. And when you change, you're gonna be in their hands for good.

 

[Richard III]

You all know my feelings on this.

[dance]

If all of you damn pirates out that hadn't been busy destroying the foundation of the information economy for the sake of a couple of free tunes, this would never have even been proposed in the first place.

If there is "blood" (and I doubt there will be, even metaphorically) from Palladium, it isn't on my hands.

R.III

 

[Juliennew]

If all of you damn pirates out that hadn't been busy destroying the foundation of the information economy for the sake of a couple of free tunes, this would never have even been proposed in the first place.

Let's say this to companies like Symantec that, for their most part, owe their existence and their profits to piracy, virus makers and hackers
And if you read carrefully the text, you will see that the Palladium technology goes far beyond this fight against piracy.

 

[Perfection]

Its a totally F****D up idea, if any hacker could break into it, he could effectily controll the world, and same with microsoft, they could take the power and use it to literally take over the world. It wouldn't be hard after all commercial systems had to be controlled by this server, NOT GOOD NOT GOOD AT ALL!!!!

 

[Akka]

Originally posted by Richard III
You all know my feelings on this.

[dance]

If all of you damn pirates out that hadn't been busy destroying the foundation of the information economy for the sake of a couple of free tunes, this would never have even been proposed in the first place.

If there is "blood" (and I doubt there will be, even metaphorically) from Palladium, it isn't on my hands.

R.III

Ah, the goo' ol' excuse of piracy.
What a red herring.

Palladium has nothing to do with piracy. It uses it as a justification. The thing is : Palladium is one step next to get a full-Microsoft computer. It's the logical continuity of the Microsoft policy.

 

[Richard III]

Originally posted by Akka
Ah, the goo' ol' excuse of piracy.
What a red herring.

Palladium has nothing to do with piracy. It uses it as a justification.

I am at a complete loss as to how this takes away from my point. In fact, in some ways, it IS my point.

 

[cgannon64]

If the government doesn't stop this, I have lost total faith in internet laws. That would easily give Microsoft a monoply, shutting out everyone from buisness, probably ending computer innovation forever.

Strange, I read a short article about Longhorn in a newspaper (NYT, Circuits section) and it described something totally different.

CG

 

[Vitterand1944]

The government is all for it and in Pallidium, Microsoft can easily just give your data to the FBI without your knowledge. Talk about big brother. What next Mr. Ascroft, what's that you say? Barcodes? Where? On our bodies? Tattooed? But what about our personal liberti--- zap!! I WILL COMPLY MR ASHCROFT
Sheesh! That's why I vote liberal. God help the conservatives if this is put into the limelight.

 

[Juliennew]

I was wondering about the situation of the anti-trust trials against Microsoft in the USA ? Does someone has any information about it ?

 

[Greadius]

Originally posted by Blitz79
Because in the article he said that they are going to update software continuously to be incompatible with the old stuff, and also the internet is going to shut out anyone without this technology if it gets a critical mass. You won't be able to download anything from the net without the technology; you may not feel it now, but what about when Civ 4 comes out, then civ 5. What about 5 years from now? You can't stick to the same computer forever. And when you change, you're gonna be in their hands for good.

I don't have to get rid of my old computer just because I get a new one.

But that is besides the point. I'm wondering what my motivation (as well as anyone else who enjoys P2P servers, although I don't dabble in anything illegal on them) would update to this stuff. It would defeat the purpose of me having anything more than a type-writer/dail-up, so why would I buy on top of that?