Comment by stcredzero | Hacker News Reader

Comment by stcredzero | Hacker News Reader

DRM period isn't a waste of money. DRM as it's commonly practiced is.

DRM always entails a hit to the customer's convenience. If you're not giving the customer more convenience in a different way, then you're fighting an uphill battle.

When you implement DRM, please be aware that you are engaged in an asymmetric conflict, and that you are the underdogs. The subset of the internet community interested in cracking your DRM most likely outnumbers and outguns whatever department in whatever company you're at. But asymmetric conflicts can be won:

    - concentrate on detection, bias to false negatives
    - separate by a significant interval in time the 
      detection and any consequences of detection 
    - never do anything that looks like a bug
    - never fight where you are weak and the enemy is strong

You are strong where functionality depends on a server. If you ever have to keep someone out, do it there. If you can avoid doing that at all and fight in even sneakier ways, then do that instead. Remember, in this conflict you are the guerrillas, and the pirates are the big empire. You can only win if you keep them guessing where you will strike, not the other way around.

> DRM period isn't a waste of money. DRM as it's commonly practiced is.

Not necessarily disagreeing, but DRM would always be a waste of money if it wasn't for the anti-circumvention laws that prevent disseminating DRM work-arounds.

The law serves to raise the bar on just how annoying DRM has to be before most people are willing to work around it.

Not necessarily disagreeing

Actually, part of my point is that DRM doesn't have to be very annoying at all. It's just that most companies are short sighted in how they apply it, which is foolish. Those companies are annoying their best customers the most.

- separate by a significant interval in time the detection and any consequences of detection

Why?

To reduce false positives.

Consider the case in which an app has to connect to an online server for authorization. Well, what if the Internet connection is down? What if your server is unreachable for some reason? What if your server malfunctions?

In such a case, triggering an error right away may punish legitimate users. And this is the biggest problem with DRM and why I think it is fundamentally flawed, making piracy totally justified - any draconian DRM scheme that's effective against piracy will also punish legitimate users.

any draconian DRM scheme that's effective against piracy will also punish legitimate users.

I disagree. Draconian schemes as they've largely been practiced do punish legit users and drive more piracy. I contend that not enough emphasis has been placed on the economics of producing cracks and not enough care has been taken to avoid the unproductive punishment of legit users.

Basically, do subtle things to drive the cost of pirate software engineering through the roof while being as kind and attentive to your most faithful customers as possible.

The consequences of detection are also the validation step for people cracking your DRM. They won't release something until they can confirm they've broken it.

It's much harder to work through removing DRM if you have to play the game for half an hour each time you want to test a partial solution. Games that dump you before even showing the title screen are actually making this confirmation activity easier.

It's much harder to work through removing DRM if you have to play the game for half an hour each time you want to test a partial solution.

Actually, I think it's best if the time interval is something like two weeks. Shift much of the revenue to downloadable content and online multiplayer. Make the consequences for having been detected completely invisible until then.

This gives the pirates two choices: either they can release their crack early, and their customers will be screwed, because even if a new crack is released, those users will already have been identified, or they can wait until well after the release, when the downloadable content comes online, in which case, you've won a reprieve where there are no sales lost to that pirate.

See also an early scheme by Microsoft. "The Tree of Evil Bears Bitter Fruit" - there are differing versions of what was actually happening.

(http://books.google.co.uk/books?id=OC8EAAAAMBAJ&pg=PA8&#...)

Reply on news.ycombinator.com