13

Maybe it's just my impression, but I have the impression that DRM questions are quite tendentious on this site.

Currently I am reviewing this question which is about how one could limit the number of times a flash disk is being used. I remember having seen a lot of such questions about how one can prevent a software from being copied, data form being shared, etc. passing on the "Off-topic" closing review queue.

I understand that DRM is quite a specific domain, clearly separated from classical IT infrastructure protection and using different security methods. For this reason honestly I may even have approved such close votes.

However, while thinking about it, we are not on the "IT infrastructure security" website, but on "Information security". The On-topic web page describes it as a place "for Information Security professionals to discuss protecting assets from threats and vulnerabilities".

I think that intellectual property can be considered an asset, whose main threat would be piracy, making DRM discussion perfectly on-topic here, whether the OP question has an answer or not: "No, with current technology what you ask is not possible" can be a valid answer to some questions without making the question off-topic at all. I feel it would also need a more lax reaction toward security through obscurity since it composes most DRM "security" core.

I also see that there is a tag, but I cannot take this as a definitive statement that these questions are on-topic here.

That's why I'm asking it here: are such DRM related questions on topic here?

13

DRM itself as a topic, absolutely is in scope here.

Questions on DRM, however, may be difficult to ask here, as DRM itself is fundamentally useless for most implementations - such as preventing piracy - and if we exclude environments where every piece of hardware and every access is completely controlled, it just doesn't work. So most questions on it seem to ask about how to use it to protect X or how strong it is etc - these questions are of no value.

1
  • 1
    I agree and actually goes even further that, depending on the context, DRM may actually even encourage piracy (when the DRM technology prevents legitimate users to legally use their acquired content). However, I know no firewall nor IDS who made attackers and malicious users to completely disappear, I know no spam blocker who made all spam to disappear, etc. To make it short: I know no security system providing full & complete security. It's all a matter of mitigation, of efforts vs. benefits ratio, and it seems just the same to me with DRM's.
    – WhiteWinterWolf
    Dec 26 '15 at 18:25
8

I disagree with the characterization this the question is about DRM. I agree that the question is tangentially related to DRM, and hence security and therefore on topic, but the question as asked is about how it would be possible to implement a feature over USB, which is a function of the USB drivers, the OS, and then a programming question of how to implement as a feature of the USB drive. These are hardware, driver, OS, and programming questions.

Your answer seems to support my claims. You are imagining a new use of firmware and drivers, one that does not seem to exist yet.

I note that you, yourself added the drm tag, and not the OP.

4
  • Yes, I've edited the tags, as I often do when I think it is beneficial to the question. How do you define "DRM"? According to Wikipedia, this is "a term referring to various access control technologies that are used to restrict the usage of proprietary software, hardware, or content", the OP asks how to restrict the usage of the hardware USB flash disk and the software stored therein, why do you think it is only "tangentially related to DRM" then?
    – WhiteWinterWolf
    Dec 26 '15 at 18:03
  • Moreover I've largely edited my answer, mostly adding "Feasibility / credibility" section: a firmware is not a magic thing, it's just a program which can do all you want. I've read about a modem presenting itself as a storage device containing it's driver's installation files, then once the driver is installed it sends a special message to the modem which then turns itself into the actual modem. Moreover, the division of the storage area is not a new idea, it is how DRM is officially implemented on SD Cards which uses the same technology as USB flash drives. There's nothing really new...
    – WhiteWinterWolf
    Dec 26 '15 at 18:08
  • That's a cool trick @WhiteWinterWolf! Never heard of it before.
    – Neil Smithline
    Dec 27 '15 at 19:31
  • @NeilSmithline: Wikipedia calls this "flip flop" devices.
    – WhiteWinterWolf
    Dec 27 '15 at 20:58
2

I'm going to agree and disagree with Rory. I agree that DRM questions are on-topic. I disagree that asking questions about the ability of DRM aren't of any value.

DRM is often a failing game depending on who you're trying to protect your thing from. But much of the world is still convinced that you can somehow have perfect protection, or that it's simply a "cat and mouse game". The latter is at least a little true, but is still a vast oversimplification. It's more like a cat/mouse game where Tom is the Cat, and Jerry is the mouse. The protector (Tom) largely always loses and is overpowered by the mouse, Jerry.

1
  • Do not hesitate to take a look at my comment below Rory's answer, since I think it also applies here but I don't like copy-pastes ;). The effectiveness of DRM and of a lot of other security tools is a greatly overrated IMO, it's like these anti-virus pretending to block 100% of all known and unknown viruses. However, running no anti-virus at all is just asking for trouble, I can understand that some use-case need some way to not let the "Jerry's" completely free. It will never be a definitive fence, but at least a ban sign the end-user cannot pretend to ignore.
    – WhiteWinterWolf
    Dec 26 '15 at 18:36
0

The querent appears to be primarily asking for DRM-like functionality, but wrapped in a specific question regarding USB flash drives. Telling them to ask over on SuperUser may get them a direct technical answer, like "USB doesn't support auto-erase". But if they are actually trying to prevent copying, that won't help them. They may blame their technology choice, and come back tomorrow to ask "Script / method to erase DVD disk content after a certain number of uses", followed by CD-ROMs, followed by portable hard disks, etc.

If they understand why the concept is flawed, perhaps they won't continue to pursue the idea.

Alternately, they may be handing the flash drive to a person who they trust won't attempt to copy it, but don't trust their ability to erase it afterwards. The answer to them might be to recommend an online service. Again, the technology-specific nature of USB isn't the answer, it's a red herring.

The question is about securing data, not about USB. I think it should remain open.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .