Slashdot Log In
Clean-Room RTMPE Spec Created From rtmpdump
Posted by
kdawson
on Sat May 23, 2009 05:21 PM
from the streisand-in-action dept.
from the streisand-in-action dept.
lkcl writes "A clean-room RTMPE specification has been created using the source code of rtmpdump-v1.6 for guidance. Adobe recently issued a DMCA take-down notice against SourceForge, resulting in copies of rtmpdump hitting quite a few bittorrent sites worldwide."
Related Stories
[+]
Your Rights Online: Adobe Uses DMCA On Protocol It Promised To Open 203 comments
An anonymous reader writes "Despite promising in January to open RTMP, Adobe has issued a DMCA take down request for an open source implementation of the protocol. The former SourceForge project page for rtmpdump now reports 'Invalid Project.' rtmpdump has been used in tools such as get_iplayer and get-flash-videos. Adobe is no stranger to the DMCA, having previously used it against Dmitry Sklyarov."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Why? (Score:5, Insightful)
Re: (Score:3, Insightful)
That is easy to deal with, just hand off the spec to a developer outside the USA. The DMCA does not matter anywhere else.
Re: (Score:3, Informative)
That is easy to deal with, just hand off the spec to a developer outside the USA. The DMCA does not matter anywhere else.
Unless they have their own DCMA. Trade agreements tend to make these things spread to other countries.
Re:Why? (Score:4, Insightful)
Parent
Importation of the reimplementation (Score:4, Informative)
That is easy to deal with, just hand off the spec to a developer outside the USA. The DMCA does not matter anywhere else.
Unless other major developed countries have legislation substantially equivalent to 17 USC 1201, as MichaelSmith pointed out. France has DADVSI, for instance. The United States government has been pushing such legislation as part of "free trade" agreements with several countries. And even if the spec is reimplemented in a country with no DMCA-alike, it also matters once the implementation is imported into the United States.
Parent
Re: (Score:2)
That is easy to deal with, just hand off the spec to a developer outside the USA. The DMCA does not matter anywhere else.
Try telling that to Dmitry Skylarov [cybercrime.gov].
Re: (Score:3, Informative)
http://www.chillingeffects.org/anticircumvention/notice.cgi?NoticeID=25159 [chillingeffects.org]
It's a takedown. Technically, based on the letter itself, I think they abused this one.
Re: (Score:3, Interesting)
Thanks for the link, but is it a proper takedown?
I think the problem hinges on the use in the law (17 USC 512) of the phrase "material that is claimed to be infringing or to be the subject of infringing activity" (emphasis mine).
The rtmpdump does not infringe on any of Adobe's rtmp copyrights and Adobe don't claim it does (see section (a) of the letter). Thus Adobe must be claiming that rtmpdump is the subject of infringing activity. However this raises two issues.
First, does Adobe own the copyright on an
WTF is RTMPE? (Score:5, Insightful)
If you're going to post an article about some obscure bullshit nobody's ever heard of, you could at least give people some hint at WTF you're talking about. "RTMPE" doesn't even show up on Wikipedia. God forbid you elaborate your terse, two sentence summary.
Re: (Score:2)
It does, however, show up in a Google search [lmgtfy.com]. You had the initiative to check Wikipedia, but you were too lazy to check Google?
Re: (Score:3, Insightful)
You're missing the point. Providing an introduction to what you're about to discuss is covered in probably 5th grade English. It's pretty basic shit.
If the "editor" or submitter wanted me to take their information seriously they should have given some idea of what they were talking about. As it stands, all I got out of the summary was "OMG! Here are some links to illegal content on torrent sites." If it's as important as they seem to think, maybe they should expend the extra 30 seconds of effort and
Re:WTF is RTMPE? (Score:5, Insightful)
It's a common problem with the summaries on slashdot that less-common acronyms are not explained. The world of nerds is pretty vast and it's impossible for all of us to keep up with every possible acronym, system, software, etc.
It would have been trivial to add ", a proprietary protocol developed by Adobe Systems for streaming audio, video and data over the Internet," right after the first instance of RTMPE and it would have made the summary much more useful and informative.
Parent
Re: (Score:2)
It would have been trivial to add ", a proprietary protocol developed by Adobe Systems for streaming audio, video and data over the Internet," right after the first instance of RTMPE and it would have made the summary much more useful and informative.
That would imply /. has editors.
Re:WTF is RTMPE? (Score:5, Informative)
Parent
Re: (Score:2)
This is used to make sure your project is 100% legal.
Isn't it strictly speaking used to make sure that you 100% avoid a particular way of being illegal?
Say I write a program which prints "Niggers are evil" and exits. You can create a clean room implementation of the same program and avoid copyright problems. Depending on your local laws regarding hate speech or similar, what the program does might still be illegal.
(I don't think anything bad of people of any particular skin color or ethnicity.)
Re: (Score:2)
FOSDEM talk about the reverse engineering work (Score:3, Informative)
Rob Savoye (long time GNU developer) talks at FOSDEM 2009 about how he did the cleanroom reverse engineering of RTMP, on which rtmpdump is based.
Also he mentions about how wireshark includes an RTMP decoder based on his work.
http://www.fosdem.org/2009/interview/rob+savoye
Can't seem to find the link to the video of the actual talk, but it must be somewhere around there.
http://www.fosdem.org/2009/schedule/events/reverse_engineering
Re:FOSDEM talk about the reverse engineering work (Score:4, Informative)
Can't seem to find the link to the video of the actual talk, but it must be somewhere around there.
The FOSDEM site doesn't seem to have links to the 2009 videos on their main page, but at least they don't have index files in the appropriate directories on their web server, allowing us to dig it up.
Reverse Engineering of Proprietary Network Protocols, Tools, and Techniques:
Ogg Theora (239M) [belnet.be]
Xvid.avi (183M) [belnet.be]
Parent
RTMPE? WTF! (Score:2, Informative)
OK WTF is that all about and should I care?
Subbys, please don't assume everyone reading your article is as clued up as you and do try and add a little explanation to your text - especially if you use abbreviations.
Yeah, I could Google it, but that would be like needing an encyclopedia by your side just to read a newspaper.
Re:RTMPE? WTF! (Score:5, Informative)
OK WTF is that all about...
RTMP is the Real Time Messaging Protocol that Adobe has developed for streaming stuff over the Internet.
Red5 [wikipedia.org] is a Free Software (LGPL) implementation of the RTMP.
Cygnal [gnashdev.org] is the Gnash project's [gnashdev.org] RTMP server (also Free Software).
Also see more docs on RTMP on the Gnash wiki [gnashdev.org], and RTMPE on this other wiki [multimedia.cx].
... and should I care?
Would you like to have control over the software that you run and use? Are you concerned about your software and/or hardware implementing things like the Broadcast Flag [wikipedia.org]? Do you believe in Free Software because it gives you control over your computer?
If you answered "yes" to any of those questions, then you probably should care, as what's going on right now is making it difficult or impossible for you to run Free Software (or even to pick software) to interact with the RTMP protocol -- a protocol that a given website might require you to use to interact with their media content.
Parent
A more human-readable summary. (Score:4, Informative)
I, also, was confused. This is the issue, as I understand it after reading some of the links.
Copyright holders want to be able to paste something resembling their previous business model onto the internet. The urge is understandable, but it's not really a plausible goal--consider the hoops that had to be jumped to get books on the Kindle--so we see attempts to enforce the business model with laws rather than code.
More concretely, if you're just sending a regular old HTTP request to get some flash video, it's vulnerable to a trivial replay attack--just resend your request from your downloader. Adding cookies makes the replay attack only slightly less trivial. So, Adobe engineered their own (presumably obfuscated; I haven't looked) protocol, RTMP. It was reverse-engineered. Adobe then released an encrypted variant of RTMP, RTMPE.
RTMPE was, of course, reverse-engineered, but because it used cryptography, it's apparently covered under the DMCA, and so Adobe can sue people who explain how to get around it.
The fundamental problem is that data is being sent to an untrusted player on an uncontrolled host. Without something like Trusted Computing, it's impossible to completely prevent users from doing what they want with data that you send to them--which is why this is a DRM issue.
In short, it's the same DRM story. Companies try to use bound-to-fail technologies to prevent users from doing what they want with data on their own machines--usually, this means copying it--and when this inevitably fails, they start suing people. We're at the "suing people" stage.
Parent
Define acronyms in the article! (Score:5, Informative)
Clearly, Slashdot editors are strategically shaved monkeys trained to click "accept" or "reject" in exchange for bananas.
Define obscure acronyms in the articles!
RTMP is the Real Time Messaging Protocol [wikipedia.org] used by Adobe Flash
seeding (Score:3)
59KB is kind of absurdly small to justify a torrent, but what the hell, I'll seed it.
Re: (Score:2)
Thanks [wikipedia.org] for linking [wikipedia.org] to wikipedia [wikipedia.org]
Vote for it (Score:2, Interesting)
We need people to nominate it on sourceforge
heres a handy dandy link(everyone who reads this should vote for it):
http://sourceforge.net/community/cca09/nominate/?project_name=rtmpdump&project_url=http://sourceforge.net/projects/rtmpdump/ [sourceforge.net]"
I like it! (Score:2)
I just went and nominated rtmpdump, and you, dear reader, should go nominate them, too!
I would find it deliciously amusing if we could get the /. editors to post this link as a new article, seeing as how /. shares corporate overlords with SourceForge.
Perhaps (Score:2)
Re: (Score:2)
Academic RTMP discussion? (Score:4, Insightful)
Just as Prof. David Touretzky has his Gallery of DeCSS Descramblers [cmu.edu], perhaps some other CS Prof would like to put up a website talking about the protocol?
I haven't looked at the code yet, but I'd assume that the bulk of it is considered acceptable by Adobe. So what small piece of it is the target of Adobe's DMCA takedown? Is it something that we can put on a T-shirt? :-)
more detailed info on the RTMPdump DMCA takedown (Score:3, Informative)
Here is some more detailed info on the RTMPdump DMCA takedown.
http://linuxcentre.net/rtmpdump-can-be-used-to-download-copyrighted-works-like-a-web-browser/ [linuxcentre.net]
RTMPE nothing more effective than SSL (Score:3, Informative)
i've updated the RTMPE.txt document, after doing some analysis this morning. there are two aspects to it: one is an end-to-end secrecy algorithm that is similar to SSL; the other aspect links the size and a hash of the original SWF file (through which the content is supposed to be streamed) into the handshake process.
there are no passwords used. there is no security. there is no authentication.
conclusion: RTMPE is definitely not a copyright protection mechanism. all the information needed to obtain the content is publicly available.
Re: (Score:3, Interesting)
Sadly, I don't think the former doesn't follow from the latter--you don't need to be a good or even plausible system to be considered a copyright protection mechanism.
By the way--thank you for doing this work. It's usually pretty thankless, and it has the potential to piss off armies of lawyers. Thank you.
Re:The OP doesn't know what "clean room" means (Score:5, Informative)
Quite.
Parent
Re:The OP doesn't know what "clean room" means (Score:5, Funny)
That's not what my mom told me a "clean room" meant.
Parent
Re: (Score:2)
***That's not what my mom told me a "clean room" meant.***
Maybe. Or maybe you never really understood what she was trying to tell you. Who's to know?
Re:The OP doesn't know what "clean room" means (Score:4, Informative)
Here's the DMCA takedown notice issued to the rtmpdump project:
http://www.chillingeffects.org/anticircumvention/notice.cgi?NoticeID=25159 [chillingeffects.org]
Note that they are just claiming the ability to download copyrighted content as the reason for takedown (will we see a DMCA notice for IE and Firefox soon?). They might as easily use the same "reason" to issue notices to projects implementing this clean room specification.
Parent
Re: (Score:3, Informative)
Interesting. According to Wikipedia [wikipedia.org], rtmpdump included encryption keys taken from Adobe Flash, which unfortunately means Adobe most likely has a legitimate DMCA case against it and any other implementation that were to include a copy of the encryption keys. Clean rooming would be irrelevant if the actual encryption keys were included in any other project.
Re:The OP doesn't know what "clean room" means (Score:4, Informative)
You're not correct. Clean room is legally carefully defined. It means reverse engineering a protocol or specification with no access to any outside information of any form. The germane importance of clean room is to prove that no tainted or protected information was used, as it clearly is in this case. Clean room requires an enormous amount of documentation which has not been produced here. This is not a clean room reimplementation by any stretch of the imagination.
You can get a clearer idea of the issues by reading about how Compaq defended itself against IBM when cloning the IBM PC BIOS, because it had carefully kept all documentation necessary to prove that its reimplementation was clean room, which is why IBM couldn't stop them from opening the PC clone market.
It's a far stronger statement than "no access to original code", which is effectively meaningless: you get caught ripping code off, you just write it again while looking at the ripoff? You do realize that'd entirely destroy every protection the GPL affords, don't you?
Clueless. Please don't pretend to yourself that you know what clean room means. Grandparent poster was correct. You are not.
Parent
Re: (Score:3, Informative)
Clean room is legally carefully defined.
[citation needed]
It's not as if copyright law explicitly makes exceptions for "clean room" procedures. It's something the judge decides on a case by case basis and is informed by precedent, and therefore is more like fair use -- which is hardly the most precise of definitions.
It means reverse engineering a protocol or specification with no access to any outside information of any form.
No. From Sony v Connectix, on appeal:
Re:The OP doesn't know what "clean room" means (Score:5, Informative)
The developer of the clean implementation does not see one byte of the original code, onnly the reversed specs. This is how the original IBM BIOS was cleaned, allowing the PC explosion.
Parent
Re:Someone doesn't know what "clean room" means (Score:5, Informative)
Well, one thing is clean-room IMPLEMENTATION. A very different thing is clean room SPECIFICATION (whatever that's supposed to mean).
The article clearly states that this one's a spec.
Parent
Re: (Score:2)
clean room SPECIFICATION (whatever that's supposed to mean).
I imagine it's something like this:
It used to be said [...] that AIX looks like one space alien discovered Unix, and described it to another different space alien who then implemented AIX. But their universal translators were broken and they'd had to gesture a lot.
Paul Tomblin
Re: (Score:2, Informative)
Indeed "Someone" doesn't know what "clean room" means. That "Someone" is you.
p.s. I commented because I don't have mod points for the other comment (http://tech.slashdot.org/comments.pl?sid=1243387&cid=28070177) which seems to have been downmodded.
Mods: How difficult would it have been to look up wikipedia (http://en.wikipedia.org/wiki/Clean_room_des
Re: (Score:2)
You tell 'em comic book store guy!
Nice quotes. :)
Re:Someone doesn't know what "clean room" means (Score:4, Informative)
Someone doesn't know what "clean room" means
Evidently, you don't. It's really quite simple: Party A looks at the rtmpdump source code and writes a document describing the protocol at the level necessary to create a compatible implementation. Party B looks at the document describing the protocol and creates an implementation of the protocol that contains no source code from rtmpdump. Party B now has a clean-room implementation of RTMPE.
Parent
Re: (Score:3, Insightful)
So in other words,
Right?
Re: (Score:2)
the IP is lost in translation
Yes, Coppola... :-)
Joking aside, I believe the idea is that by having the specification serve as the only transmission medium, the resultant code is based solely on the "distilled fundamental properties" of the original product. The argument is that these fundamental properties are the necessary components to, for example, create an interoperable product, and as such are not protected by copyright.
I'm not exactly sure how reverse engineering works if we're talking about patented file formats or protocols su
Copyrights, not patents (Score:3, Informative)
Clean room is a way to make sure that you don't have any copyrighted code in your project. This will prevent a programmer from 'inadvertently' including a copyrighted code sequence in his new implementation.
However, it does nothing to protect against patents on methods in the code. If the patented methods are reproduced in the new code, they will still have patent issues.
Re:What!? (Score:4, Funny)
Wow, apoplexy induced by the poor summary killed the anonymous coward!
(OK, so it's not quite as punchy as “Video killed the radio star” .)
Parent
Re: (Score:3, Funny)