Comment by furi
7 years ago
>All you're saying is that DRM isn't perfect. Nothing is perfect, and it isn't exactly a revelation.
DRM and servers are fundamentally different in that securing a server is an achievable goal. There is nothing fundamental that stops you from exposing an interface without any holes in it, even if it's quite hard. DRM is the polar opposite. Where servers are physically isolated from attackers in a manner that allows for perfect security* DRM is physically colocated on the attacker's machine in a manner that explicitly denies perfect security.
Servers are also broken into fairly sporadically for short periods of time and many of them never at all. Data stolen from servers usually slowly goes stale as people change their passwords and so on. On the other side of the fence I cannot think of a DRM that wasn't compromised relatively quickly and excluding anti-cheats once DRM is compromised it stays that way forever.
You can even see the discrepancy in the availability of files. I can pirate basically any game almost immediately after launch but if I want background production files lifted from server, even for an ancient game, the Half-Life 2 beta is almost the only example. One of them is certainly more niche but not enough to explain the size of the gulf.
Both are examples of imperfect things but there's always going to be a line between "imperfect" and "too imperfect to bother with" and personally I feel DRM falls on the "too imperfect" side of that line.
* = Assuming breaking into the data center is outside of the threat model, which it usually is.
Breaking into the data center is NOT outside of the threat model. We spend considerable amount of time detailing what can be done With physical access and various levels of physical access (for example, can I open the box versus being at the terminal vs having access to ports).
If you’re not doing that with your data centers then you are not even close to doing security right. And if you think it is close to feasible to completely lock down a server then you’re probably not being realistic.