Windows Vista Cost Analysis of Windows Vista Content Protection

Peter Gutmann, pgut001@cs.auckland.ac.nz
http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.txt
Last updated 27 December 2006

Peter Gutmann

Some more from Bruce Schneier and a link he leads to should be read as well.

This is actually pretty frightening.

 

Where is the cost analysis?d Other than some weird mutterings by ATI about forcing people to upgrade their display adapters, I so no mention of cost.

But in any case, Gates has made clear for years that in his vision the Internet would be the transport for content, and the PC the hub. I doubt anyone will purchase a non-Media Center equipped Vista version.

Therein lies the rub. The content owners have mixed, unclear, ridiculous, contradictory and even worse, ideas as how to protect their rights to the content.

A lot of the paper discusses concepts that are not implemented, but can be found discussed in industry white papers, and in MSFT technical documents. "Bit Tilts" for example.

MSFT unfortunately has to accommodate some of this nonsense in Vista. The fact that it is not used to date, and may never be used, is a missing piece in the article.

Nor is Gates happy about it. Google "gates drm bloggers" for his recent meeting with 31 bloggers, and his comments about DRM.

But in the main, not only was no cost analysis done by the article, the bulk is FUD about provisions the Vista folks had to do to satisfy content providers; ignoring that it is not now, nor are there any specific future plans, for these DRM "features" to be used.

And the whole issue of "Global" certificate removal from signed drivers is just nutso stuff. The only version to date of Vista that enforces driver signing is Vista 64. So discussions of outdated drivers is odd, to say the least. Moreover, show me an instance where Microsoft has done so. Moreover, show me that the driver publisher would not immediately remedy the defect if in Microsoft's opinion a driver exposed a security flaw so egregious that it forced a security revocation through Windows Update. This has been in the 32-bit world how it has been handled -- ask Broadcom or Intel. (The driver is checked only at installation; so revoking the license on an in-use driver means nothing.)

Finally consider the sources used for much of the article. ATI -- (who feels their adapters should receive higher rating scores within Vista); and known AV software companies who are angry that they can no longer hook ring 0 under Vista 64. (Note, they in their diatribes never mention that the criticisms are for the 64-bit product, only).

Nobody is happy about the current state of DRM and content provider protections. For the AV authors, MSFT has made very substantial efforts to tell them how and how not to hook the OS. They have every right to do so. The fact that they cannot do an easy port of their XP **** to make it Vista **** does not break my heart. Consider the mess that McAfee and Symantec/Norton, to name two notorious culprits, have made of XP in the past, when they were allowed to hook the kernel.