TransGaming Tagging Downloads to Combat Piracy

SeanTobin writes "It seems that TransGaming is implementing a new watermarking system to combat piracy. For now it seems that every tgz of Cedega 4.0.1 is individually tagged, and this has been frustrating Gentoo users who (like many others) like to be sure their archives are unmodified. Is this the future of software downloads? Is this tiny loss of personal privacy worth the increase in TransGaming's security?" Update: 08/16 17:42 GMT by S : There's an official response on the TransGaming forums indicating: "We can confirm that Cedega 4.0.1 included some basic watermarking... The objective behind the watermarking was to deal with some peer-to-peer piracy issues that we've been seeing over the past several months... We have suspended the watermarking feature for now and Gentoo users no longer need to be concerned with work-arounds."

Breaks gentoo ebuilds

[ChronoWiz]

This is a real pain because it actually breaks the gentoo ebuilds!

Re:Breaks gentoo ebuilds

[codergeek42]

Not necessarily. Just do

# cd /usr/portage/
# ebuild app-emulation/cedega/cedega-4.0.1.ebuild digest

and it will ask you to place the tarball in /usr/portage/distfiles. Then, so long as you don't remove it, the md5sum will match. Hope this helps!

Re:Breaks gentoo ebuilds

[Nasarius]

You're right, but that's just a workaround. There's no way for the Gentoo developers to really fix this without disabling an important security feature of portage.

Re:Breaks gentoo ebuilds

[KentoNET]

Or just 'emerge --digest cedega'.

These will entirely destroy any kind of verification about the dist tarball, though, which is what the focus of the Transgaming forums post was about (and rightly so).

Re:Breaks gentoo ebuilds

[Bert64]

Yes, here you can download cedega from www.evil-black-hat.com/trojans/cedega.tgz.
Don't worry about the modifications it makes to /etc/passwd, they're necessary for the game to run.

Re:Breaks gentoo ebuilds

[peterprior]

Hmm.. I'm trying this on our server at work, but the website seems broken :(

Mirror ?

Re:Breaks gentoo ebuilds

[zerocool^]

Funny... I'm trying it on your server at work, too...

Re:Breaks gentoo ebuilds

[SillyNickName4me]

> Wrong, And even if they are defeated you will find that the goal of this security method is to deter piracy, not to prevent it.

ANd while I know that that is the idea, the idea is wrong and flawed.

What happens in reality is that piracy is not stopped, those interested in a pirated copy can still easily get it, while the legitimate and paying user is bothered, treated like a soon to be criminal, and that legitimate uses of the software are at times prevented.

So, original poster is right, it is completely and utterly ineffective, and in fact does more damage then that it does good.

Re:Breaks gentoo ebuilds

[SillyNickName4me]

> I'd say that copyright protections do hamper casual copying of games, for those individuals who WOULD copy it but aren't technical to figure out workarounds by themselves.

I know that this line of reasoning is often used, and at first glance it really makes sense.

What it ignores is the following:

Whenever someoen puts up a method to prevent copying, there are people who find reason to circumvent it, not just to the point of being able to copy the original (game) itself, but going as far as providing a version without the copy protection or creating a program that will fool the copy protection.

In either case, the non technical user can now make copies of existing (illegal) copies without needing more knowledge then clicking 'copy' in Nero or whatever CD writer tool they happen to use.

This has been true since the early 80s at least, and I do not see anythign havign changed there in the almost quarter century since.

So no, it does not prevent non-technical people from copying the games or other software, but it does stop those who want to make a legitimate backup copy and don't want to get into illegal activity alltogether.

> But lets face it, Gentoo users are more than technical enough to pirate anything if they really want to.

Well... being a good unix administrator will do fine for setting up and usign Gentoo, but in many cases you need to be a somewhat decent 'hacker' in order to circumvent copy protection.. its not the same set of skills (there are quite a few peopel who happen to have both tho)

Re:Breaks gentoo ebuilds

[BRock97]

Firstly, as mentioned in the transgaming forum, the twat that got all worked up about this has been using Gentoo for a grand total of 13 days, and he still has the nerve to mobilise everyone..to comlain[sic]../. will publish anything these days!!

How foolish we are to follow someone so blindly. If you look at the reference to how long the guy has been posting, it is August 3 2003, not 2004. So, the dude has been running Gentoo for quite some time.

Re:Breaks gentoo ebuilds

[repvik]

Wrong, And even if they are defeated you will find that the goal of this security method is to deter piracy, not to prevent it. I.e. If you are a cracker, you will circumvent the system. If you are a general user you won't know where to start. For example, the company I work for uses SecuROM CD protection which can be overcome without too much difficulty, but most customers don't know how to.

Look... before the digital age, this way of thinking could work. Now that we're in the digital age, it's enough for one little fucker to pirate whatever you've made, and (fanfare), it's out on p2p for everybody and his dog to download.
Seriously, software is going to be pirated (Until someone comes up with a better scheme). Until then, all it does is annoy legitimate users. Pirates bypass the copy-protection anyways. Hell, pirates even get the software before it hits the street (ref. DooM 3, Condition Zero, UT2004).
So basically it's better to be a pirate. Not only do you get the latest über-cool game before that annoying neighbour, but you can laugh at him while he struggles to play his game (bought with his hard-earned money), fighting a copy-protection scheme that seems to be designed for one reason only... To make it hard for normal users to play.
Also, the fact that several of the programs I've bought actually denies me the right I have to make a backup copy (Yes, I *do* make archival copies and store them off-site. I've been through two fires in my life). A pirated version allows me to make as many backup copies I'd like. With *no* fuzz.
So, for the average user, can we extrapolate where this is going? I still buy stuff that I want. But if there's a copy-protection scheme of some sort, I'm not going to buy from that vendor again.

Also, you can run arbitrary bit sums which would be ideal in this case. For exaple, the Java language has classes for this. You can download the .tgz on one machine, run an arbitrary crc or adler checksum on a portion of the file that does NOT include the signature. Then simply download on another machine and repeat. This should give cynical people like you the reassurance you need. If both sums are the same you might be ok, of course you can have as many sum checks as you want..

What on earth are you smoking? If a l33t script kiddie has managed to replace that damn .tgz with a one containing a r00t kit, do you think it'll help downloading it twice?
I'm not saying Gentoo's way of checking the sources isn't flawed. But it's a hell of a lot better than downloading the r00ted tarball twice.

Fairly straightforward solution

[paulproteus]

Have the portage, instead of simply downloading the file, do this:

• Step 1: download the file.
• Step 2: Blank out the watermark, saving it elsewhere.
• Step 3: MD5sum the watermark-free file.
• Step 4: Restore the watermark.
• Step 5: Act like nothing's wrong. [plastic.com]

<flame>I've always held that Gentoo users are like Debian users, but with less ingenuity ;-).</flame> Should Gentoo choose to use it, I'd love an email saying thanks, but I formally reserve no rights.

easy workaround

[Sparr0]

unzip two copies, find any differences, produce a third copy with random garbage in place of whatever the watermark is.

Re:easy workaround

[riprjak]

Or, as an alternative; fsck transgaming and use traditional WINE... or simply use the gentoo ebuild tools to generate a new MD5 hash based on the .tgz you downloaded... you *DO* trust transgaming's own binaries, dont you??? hmmm??? :)

Trust

[Kaseijin]

simply use the gentoo ebuild tools to generate a new MD5 hash based on the .tgz you downloaded... you *DO* trust transgaming's own binaries, dont you??? hmmm??? :)

You may have been joking, but whoever modded this insightful presumably wasn't. The Portage hash check assures the user that the Cedega tarball isn't really a rootkit uploaded by whoever 0wned TransGaming's server. It would be best if all publishers cryptographically signed their releases, but since most don't, comparing hashes with a trusted third party like Gentoo is a reasonable compromise.

Re:Trust

[riprjak]

I can assure you I was as surprised as anyone to be modded insightful or interesting... I expected a funny or two.

For reference people; NEVER do what I suggested to manually change the expected MD5 hash. Kaseijin is dead right in suggesting that the cause of variance may indeed be due to l337 hax0rz pwnZing a server and modding the downloads to infect your system...

In fact, Kaseijins entire comment is informative, mine was a joke in VERY bad taste.

Hell, I dont recommend taking my advice at the best of times :)

err!
jak

Re:Trust

[Anonymous Coward]

This is slashdot; you can't underestimate the intelligence of the mods.

insightful or interesting is mod-speak for "me no understand, but you sound smarts"

What if MD5 utility is root'ed ?

[anti-NAT]

Reading through the post, it is surprising that, after at least 10 downloads, he (she?) never suspected that the MD5 utility being used has either become corrupt, or has been cracked, causing it to not produce correct hash output.

After the third or fouth failure, you should start considering more unlikely causes - corrupt MD5 utility, OS bugs, memory errors, etc. Any one of those could have cause the problems being described.

Re:easy workaround

[pc486]

From the article:

Bytes 0x10 through 0x23 in the tgz are the signature. They are unique in every download and are probably recorded by transgaming to know who downloaded what archive. Also, all hopes of using md5 or any other form of checksumming to verify valid files are out the window.

So there you have it. Gentoo is forced to download from Transgaming's website and they keep changing signatures. Unless you are installed a warezed copy of it, MD5 checksums arn't going to be of much use.

Re:easy workaround

[Anonymous Coward]

If byte 0x10 through 0x23 are always going to be unknown then assume byte 0x0 to byte 0x23 are unknown.

Then publish the md5sum of bytes 0x23 and on. It wouldn't be very difficult to modify md5sum to start reading from a given byte offset.

Re:easy workaround

[Spoing]

1. If byte 0x10 through 0x23 are always going to be unknown then assume byte 0x0 to byte 0x23 are unknown.

   Then publish the md5sum of bytes 0x23 and on. It wouldn't be very difficult to modify md5sum to start reading from a given byte offset.

That's not even necessary. A few lines of a shell script plus programs to split the file would do it.

The only messy thing is that the check would have to be specific to this one program...and if Transgaming changes how they tag the file it would cause problems once again.

Re:easy workaround

[Waffle Iron]

A few lines of a shell script plus programs to split the file would do it.

Here you go:

python -c 'import md5, sys; print md5.new(sys.stdin.read()[0x24:]).hexdigest()'

Re:easy workaround

[Black Acid]

For those not blessed with Python: dd if=file.tar skip=36 | md5

Re:easy workaround

[ActiveSX]

I would enjoy seeing somebody hiding a trojan in the header of a tarball.

Re:easy workaround

[PedanticSpellingTrol]

And so the race begins!!

Re:easy workaround

[John Hurliman]

So, anyone who is going to pirate this make sure to scramble those bytes, or just unpack the tgz then repackage it.

The pirates are slowed down for about 8 seconds while many legitimate customers are screwed over. Thanks Transgaming!

Re:easy workaround

[Ryan Huddleston]

It's trivially easy to do.

cp cedega-4.01.tgz cedega-4.01-backup.tgz &&
dd bs=1 seek=16 count=19 if=/dev/zero of=cedega-4.01.tgz &&
dd if=yay2.txtcedega-4.01-backupt.tgz of=cedega-4.01.tgz seek=36 bs=1

and later you can remove the backup.

For the not-quite-as-geeky-as-me crowd, that zeroes out the marked bytes. That took me maybe five minutes (due to OBO errors) when I am blearily tired at 3 am.

They're going to have to do better than that.

Re:easy workaround

[Anonymous Coward]

It's trivially easy to do.
cp cedega-4.01.tgz cedega-4.01-backup.tgz &&
dd bs=1 seek=16 count=19 if=/dev/zero of=cedega-4.01.tgz &&
dd if=yay2.txtcedega-4.01-backupt.tgz of=cedega-4.01.tgz seek=36 bs=1

Linux is just like Windows! Linux is ready for the average user! Linux is easier than Windows!

Re:easy workaround

[SnowZero]

Ok weenie, how do you do that in Windows, using only built-in (non third party) tools?

Re:easy workaround

[desplesda]

The guy who posted this, Q3Man, posted this followup:

With some help from cyph in #cedega, I've come to the conclusion that the builds are infact watermarked, although simply tagged might be a better description. Bytes 0x10 through 0x23 in the tgz are the signature. They are unique in every download and are probably recorded by transgaming to know who downloaded what archive. Also, all hopes of using md5 or any other form of checksumming to verify valid files are out the window.

Marker

[mfh]

And I was going to the trouble of getting out my magic marker and drawing on the download!

Re:easy workaround

[Jah-Wren Ryel]

It seems that

a) Only the .TGZ, aka .tar.gz for real unix people, is marked. So, just re-tar it and the tag (that ain't even deserving of the term watermark) is gone.

b) If they did something more hardcore, two copies would not necessarily be enough remove all identifiers. It isn't hard to come up with a scheme in which there are multiple sets of tags and any one combination of those tags defines a single download, but if say, 3 of the 4 tags are the same, then a straight diff only picks up 1 of the 4 tags and thus leaves the other 3 to identify a group of downloads from which both "pirates" took their copies. Play enough games assigning different users to different sets of tags for different releases and you could probably narrow down the pool to the exact people who are participating in unauthorized sharing in a month or two. It just a practical application of set theory to do it.

Re:easy workaround

[Vreejack]

I think that was the original point. All the cracked versions will have 0x00 in the tags, but legitimate users will be encumbered.

When a copy protection scheme makes it desireable for legitimate users to used cracked versions of the software then there needs to be a rethink.

Re:easy workaround

[Lisandro]

Exactly. Developers and publisher houses; take notice. This is the very same reason "No-CD" cracks are so damn popular.

Re:easy workaround

[asdfghjklqwertyuiop]

That would certainly locate the watermark, but random garbage doesn't cure the problem. The watermark probably has a checksum with it. Like the last digit on your average barcode. Some function of the watermark data must be equal to the checksum value. Certainly someone can reverse engineer that or crack the program and remove the check, but it will be harder.

And even if there is a checksum in this 19 byte string, why would anyone need to pay any attention to it? The whole point of this watermark is t

blargh

[B3ryllium]

Come on people, is it really THIS important to protect stuff?

Why not focus on a service-based business model, like the MMORPG setup?

One-off profits are nowhere near as lucrative as service contracts, after all.

Pshaw, software fingerprinting protection is just silly ...

Re:blargh

[Dorsai65]

Me, when I do a lot of work, I like to get paid for it. TG is 'fronting' the money needed to develope until they sell the product; if they don't sell enough, then it's not worth it to them to keep doing it and they fold up their tent and go home. If somebody likes their stuff *that* much, then pay for it.

Re:blargh

[conway]

Thats exactly why TransGaming is a subscription based service. You pay $5/month, and get access to any new versions that come out, support, and a vote in the games TG works on next.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Tis good!

[OverlordQ]

Look at nearly every product with 'activation' or a 'cd-key' and it's been cracked. All these 'protections' do is make it easier for pirates to pirate and harder for legit users to get to work.

Re:Tis good!

[Spoing]

1. Look at nearly every product with 'activation' or a 'cd-key' and it's been cracked. All these 'protections' do is make it easier for pirates to pirate and harder for legit users to get to work.

(corrections appreciated)

That's not the case here. This isn't restricting use at all...just making it clear which copy goes where (if found later).

If they put in code to actively thwart copying -- and I agree it would 'make it easier for pirates to pirate and harder for legit users' to use what they bought --

Re:Tis good!

[DroopyStonx]

Think of it this way: they spend weeks implementing and thinking out an activation scheme only to have it completely and utterly CRACKED within hours of the product being leaked/released.

The fact is, it doesn't affect piracy one bit, but now users gotta deal with additional BS. For example, piece together a new PC and put your copy of XP on it. Now, after activation fails, try to convince Microsoft that you destroyed or got rid of the old computer!

It's not the fact that activation makes it easier, it's that the second a company boasts of having software that's uncrackable, it makes headlines and is often one of the first things to be cracked. In addition, the crack is often spread around so much to the point where it's hard NOT to find it.

All because they decided to announce to the world that their new copy-protection/activation scheme is the shit.

Re:Tis good!

[Richard_at_work]

The fact is, it doesn't affect piracy one bit, but now users gotta deal with additional BS. For example, piece together a new PC and put your copy of XP on it. Now, after activation fails, try to convince Microsoft that you destroyed or got rid of the old computer!

I have actually done this, and there is no problem at all. Ive changed my PC 5 times since I bought the XP license that requires activation, and only on the latest switch did the online activation fail. I rang a 0845 number (UK) and got hold of a very nice girl in a call center. All she asked me was if this installation was a unique install IE I hadnt installed it on other PCs. When I said yes, she reset my activations and gave me the option of activating through her or redoing the online activation, which I chose and was carried out without a problem.

Yes, anti piracy schemes get cracked, but cars also get broken into, you wouldnt see Ford selling cars without a doorlock. They are there to slow down the casual pirates, not the hardcore people.

Re:Tis good!

[wolrahnaes]

but cars also get broken into, you wouldnt see Ford selling cars without a doorlock

The difference is a car owner WANTS the lock to be there. I am glad to take an extra 2 seconds to get my keys out of my pocket if it helps prevent the stuff in my car from being jacked.

I don't benefit in any way from software activation or CD keys. It is nothing but a hassle when you buy the software. It's easier in many cases to install the cracked version.

I'll stick to free software, thanks

[etymxris]

I was recently getting back into gaming and considering becoming a Transgaming subscriber again. Maybe I would have chosen not to anyway, but I'm certainly not after this. Not because it's really worse than anything any other proprietary software company would do, but because it reminds me of why I prefer free (libre) software over proprietary software.

I remember when Transgaming was going to open source everything they wrote, if only they got enough subscribers. Well that pipe dream fell through. I'll stick to free software. There's no going back on such a promise with free software.

Re:I'll stick to free software, thanks

[cleverhandle]

I remember when Transgaming was going to open source everything they wrote, if only they got enough subscribers. Well that pipe dream fell through.

Um... AFAIK, everything is in CVS apart from the copy protection code, which they have contracts not to release. What more can you ask for? If you want to play games with copy protection (that being basically all of them), what other choice do you see for them?

Different md5sum is a problem.

[nayigeta]

How would one verify that an archive is correct, or packaged from a reliable source, if the md5sum differs?

In my opinion, the cons outweight the pros for doing so.

Re:Different md5sum is a problem.

[evilviper]

How would one verify that an archive is correct,

Well, how about the following?

1) Use dd (or some other tool) to zero-out the range that they keep modifying, and then verify checksum.

2) Uncompress (and possibly untar) the package, then do an MD5 sum on all the files in the package. If they only modify one, unimportant, file, you can easily just do an MD5 on the rest. It might even be simpler than that... The changed bytes may exist only in the package, and may not have changed any files inside the t

Re:Different md5sum is a problem.

[AuMatar]

Except they AREN'T a reliable source. Their server can be hacked as easily as anyone's. MD5 sums are meant to protect against situatons like that- getting comprimised data from trusted sources.

Re:Different md5sum is a problem.

[Dot.Com.CEO]

INSIGHTGUL?? MD5 sums do not "protect" from anything. You choose to trust whoever gave you the sum as a valid and trustworthy source, that is all. If someone can hack their server and place a different binary package in it, do you think they cannot hack a web server and display the new MD5 sum?

Don't Like it?

[Dr. Bent]

Don't buy it.

Re:Don't Like it?

[visualight]

Pirating's not enough. I subscribed thinking that the winex code would all be given to the wine project when they had enough subscriptions (15000?). They lied to me and I think they should suffer for it. Breach of contract?

Microsoft has done this already...

[tisme]

Microsoft did this with Windows XP beta to see what beta testers were "leaking" the information. Somebody figured it out though and testers were in an uproar shortly thereafter. Frankly, if you buy (or rent) electronic hardware from a store, the serial number is recorded on the receipt to avoid a switcheroo... this is simply an extension of that in my opinion. Not a good thing for people who misuse their licenses... but nothing major for people who follow the rules.

Re:Microsoft has done this already...

[Trelane]

Except that it's a major PITA for those of us who do subscribe and do like the integration/installation ease of Gentoo.

Just like it's a major PITA to carry around all those double-danged game CDs despite the fact that I could install the full version on my laptop and not have to worry about tracking the original media and making sure it doesn't get lost/damaged/stolen. Does it hurt the pirates? No, they are just using a burned copy anyway; they can make a burned copy as a backup. Backups don't work for me, the legal user, but they sure work well for the pirates! Gee, thanks!

[BTW, a major thank you to Bioware and Unreal Tournament 2004: at least for the Linux native versions, no cd is required to play! Yaaaay!]

Re:NWN

[EvilIdler]

Bioware also removed the copy-protection from the Windows version of
Neverwinter Nights, around 1.29, I think. It caused more trouble than good,
I guess.

(Can't be arsed to dig through the patchnotes)

one of two methods...

[zoloto]

Another point I'd like to make. Lets say that transgaming's servers get rooted and their archives infected with some arbitrarily nasty virus. How can I trust that the file I'm getting is not infected? I'll even go one step further... How can I be sure that this has not already happened?

You can't be sure.
For now, take the .rpm or .deb and use a utility that takes X and turns it into .tgz i think slackware has this utility.

that's what i'd try to do. rpm's be damned. heh

CVS anyone?

[ernstp]

They DO have an open cvs-server. Kindof make you think that they are not so scared about people downloading their app?

My $5x10^-2

Re:CVS anyone?

[conway]

The CVS does not include some parts. Most notably, things which make games with copy protection run correctly (since the code is licensed from Macrovision, or something). There are also other missing pieces such as "Point2Play" (sp?) which lets you keep different wine settings for different games, and I believe comes with presets for many games to run properly.

It's not so bad...

[chrispyman]

Honestly, thats probably the most non-intrusive copy protection there could be. The problem is why did they include it without telling anyone? These people paid for it, so don't they deserve an explanation? And even more odd is that, since their "protection" scheme is now known, whats to stop, say, a pirate from altering the archive and putting it on P2P?

Is it worth it?

[TeraCo]

Is this tiny loss of personal privacy worth the increase in TransGaming's security?

From Transgamers point of view... yes.. yes it is.

Re:Is it worth it?

[HiThere]

And from my point of view, no, I'm not going to sign up again for a new subscription. I never used it much anyway, and if they're going to act like that they can take a flying leap.

I've been a bit suspicious ever since they split from Wine, but this is the point beyond the limit. If I can't check signatures, why should I trust them?

No surprise here

[Lord Byron II]

I think it was no secret that this was going to happen eventually, although the article makes it sound like just the tgz is tagged, not the binaries themselves. So you should be able to open it, re-zip it, and be on your way. I hope that they are providing md5's for those of us who are smart enough to check.

But from reading the article, I don't get the impression that this is an anti-piracy effort either. Consider that the RPMs and DEBs are unaffected. Could be anti-piracy, but it could also be just a download counting system or maybe per-user customization.

Certainly, it seems clear that they're not actively tracking you and that they're not going to be able to tell if you happen to install it on your desktop and laptop. The only way you're going to get in trouble (if that is indeed their goal) is if your unaltered tgz starts appearing en masse on the p2p networks.

Well, it was bound to happen sooner or later.

[Anonymous Coward]

If Linux is going to go bigtime on the desktop, you are just going to have to put up with this kind of stuff. Hell, I would bet that distributors put even more protection on commercial Linux apps/games since (pardon my generalization) Linux users are used to software being free (as in beer). Prepare for it to get worse in the coming years.

Re:Well, it was bound to happen sooner or later.

[HiThere]

Personally, I intend to refuse to do business with companies that have this, or some similar policy.

I like to be able to be certain that the file I am installing came from the people that it purports to have come from. That means I need to be able to check signatures, or get in on a CD. I don't really care that much which. (I lie. I vastly prefer CDs because I frequently reformat my hard disk and switch distributions regularly.)

Loss of Privacy?

[LochNess]

Is this tiny loss of personal privacy worth the increase in TransGaming's security?

If you don't download it, you don't have any "loss" of privacy.

People throw around the idea of the loss of privacy as though they are being compelled to download whatever it is.

It's not the best way to do it...

[zarthrag]

..but I feel their pain.

I've discussed this option before, and it's difficult to do without developing an entirely new online distribution format, however it is (in the end) an infinite uphill battle when it comes to copyprotecting non-multiplayer games. Signing a download will simply thward willy-nilly copiers. Any warez producer worth their salt will breeze by this one by either producing their own archives by simply ferreting out the watermark.

I'm not familiar with cedega, but I'm sure it's no different from any other title. If it ain't an MMO, you can't attain near-zero piracy - period.

Maybe someday, when bandwidth is free, we can write games that you simply "connect" to. It'll connect to your kb/mouse/controllers, and you'll get a video feed back, or some commands for your 3D renderer. No updates, no piracy, no privacy.

Re:It's not the best way to do it...

[ZorbaTHut]

. . . and I feel their pain . . .

. . . but I still don't agree.

There's a game called Gish. I played the demo. I loved it. I bought it and installed it. And still loved it!

So I brought it to a friend's house, and installed it there, and we played it, and she said "this game rocks!". And before I left I erased it. She said she'd probably buy it.

So I brought it to another friend's house, a few days later! Or I tried to. Because, see, I'd just been downloading it off their website, but their website locked me out because I'd downloaded it too many times. So I emailed them, and they said yes, they'd unlock it so I could download it again, but I was only allowed to install it three times. The verification system wouldn't let me install it more than that.

What the hell? They hadn't mentioned this before. Like, you know. When I paid them money for it.

So I complained, and they refused to do anything. It's to protect against piracy! It's for everyone's better good! If you need to install it more than three times, why not just buy another copy? It's not that expensive!

I'd been planning to install it on my second computer so I could play around with it when my main computer was doing computationally intensive stuff.

I'd been planning to reformat and rebuild my main computer in half a year or so, and obviously that would require reinstalling as well.

Three installs? What the hell? I paid good money for this game. I BOUGHT this game. Why am I being treated like a criminal?

Well, make the crime fit the punishment, I guess. I downloaded the crack. It took about a tenth as long as it had taken to argue with them about copy protection.

I installed it on my friend's computer. We played it. I didn't bother deleting it. He said he'd probably have bought it if it wasn't for that 3-install limit (he reformats often.)

I called up my first friend and told her the bad news. She thanked me for the warning, and said she'd changed her mind on buying it.

I now have the crack stored on a server of mine so I can install it wherever I want.

That sure helped them defend against piracy, didn't it?

If you want people to buy your software, there's one and only one way to do it. You can't force them. You can't tell them they must. You simply make them want to. This, however, doesn't make me want to - and therefore it's a failure. Any software developer who thinks they can get around this is living in a state of denial. Accept piracy - and embrace piracy, because it can be a fantastic word-of-mouth network. One percent of a million users is a hell of a lot more sales than one hundred percent of a thousand users.

And who is to blame???

[vandan]

Obviously they're concerned about the amount of piracy.

For the money that they charge, you'd think that people who actually choose to use their product could bring themselves to pay for it.

I know there are a lot of people who take the 'boycott WineX' approach because they think WineX harms gaming on Linux in the long run. This post obviously has nothing to do with them, as they choose not to run it.

For those of us who choose to run it, I really can't see what the problem with paying for it is. I've paid on 3 separate occassions. On each occasion I'd paid because another game I wanted to play was now supported, and I've been satisfied each time.

So how about the leeches among us start supporting the rare breed of company that shows any interest in Linux on the desktop?

Re:And who is to blame???

[cleverhandle]

So how about the leeches among us start supporting the rare breed of company that shows any interest in Linux on the desktop?

No joke - somebody mod this fellow up. TG is, by all evidence I've seen, a totally community oriented gig. They let you vote on future developments, send status updates containing at least a modicum of technical detail, provide packages in all sorts of formats, and have their devs man their message boards with reasonable regularity. What the hell more could you ask of a company?

If you rip off TG, you're ripping off the good guys. Don't even try to tell yourself otherwise.

Re:And who is to blame???

[k8to]

Transgaming is selling a product based on Wine, a totally free software project. TransGaming has added to that codebase, but without contributing most of those additions back to the Wine codebase.

They have brought value to their product, which is why it is worth any money at all, but they have not really been a team player with the free software community.

In addition, there have been various sketchy issues, including a promise (unfulfilled) of opening their codebase when they get a bunch of subscribers. They also damaged sales of a native linux port by wine-porting it redundantly (kohan), have used linux-subscriber funds to port games to macintosh instead of linux which were not made available to linux subscribers.

Now, these are oversimplified descriptions, and I'm not suggesting they are an evil bunch of people. But describing them as "totally community oriented" is simply inaccurate. There is also the contestable issue that they may be helping to prevent the growth of the native Linux games market by diverting demand to windows games, while also providing a poor linux gaming experience (look at the list of fully supported games, it's quite small). This view is not airtight but it's not invalid either.

In short, they are not the "good guys". They are a business out to make a profit regardless of whether their actions are "good" or "bad".

Re:And who is to blame???

[polyp2000]

From the Transgaming Website...

Can I run my Windows version of The Sims in WineX?

No. Unfortunately to make The Sims run under Linux Transgaming Technologies had to make some substantial changes to the original source code. This change makes it impossible to run The Sims for Windows under WineX

They must think Linux users are stupid or something , just how does making substantial changes to the source code (to make a linux version) affect the retail windows version of The Sims? If they have a beleivable reason for this , eg, IP issues or something similar that meant they had to remove stuff from the distribution, or whatever. But as it stands that seems like a completely fabricated reason for lack of support (particularly if what you say is true and it worked with an earlier version) Does it work with the GPL Wine from sourceforge ?

Nick ...

Re:And who is to blame???

[Rich0]

Uh, you do realize that they've threatened to close down the CVS if anyone mirrors it or if it becomes "too popular".

Gentoo used to allow users to download and build from the cvs automatically. They got a nasty-gram from the TransGaming folks.

In my view this whole mess is simply the result of the Wine developers not using the GPL. If they had, all the code modifications would be public and Wine would be advancing. If WineX is "good enough" then it slows the development of Wine, which is the only truly free alternative.

There are other benefits to free software besides the price. One is not having to deal with CVS-access politics...

Re:And who is to blame???

[Sancho]

It's not lying. They aren't preventing anyone from doing anything legal (granted by the license). They /asked/ people not to distribute it that way, but they sought no legal action.

In fact, the license says upfront why they provide the CVS and that they would prefer that people not use it to distribute binaries, etc. They ask that you don't do it, but they can't stop you. All they can do is threaten to stop offering the CVS.

...what a waste of time.

[DroopyStonx]

If a person knows enough to be using Linux AND this application, chances are they can easily get around the watermark, so what's the point in it?

I don't understand when companies go off on this tangent and act as if what they're doing will combat piracy. Piracy will always exist. No matter what you do, you can't get rid of it.

Yeah, it's wrong, but people will do it. Just be thankful EVERYONE isn't doing it. Bottom line: it will not bring back your "lost" sales, and people will have a workaround in a matter of hours.

There's also a reason why Microsoft more or less turns a blind eye to it - the more people who pirate a particular piece of software just means it's on that many more computers. MS would rather you have a pirated copy of Windows XP than to flat out run Linux simply because it gives them more of a place in the market.

No one likes to think on the flipside of things, so go on and mod this as troll ;)

Re:...what a waste of time.

[photon317]

It's a bad analogy. An equally bad version of the analogy that's closer to explaining the realities of software piracy would be:

If your house doesn't have a front door, it's easier for you and your family to walk in and out every day, which you spend a lot of time doing. If you put a door in place, it makes things a pain in the ass. If any criminal decided to steal things from your house, they're either gonna walk in through the big front door hole, or if you installed a rather inconvenient door they'll just kick it open on their way in.

Re:...what a waste of time.

[kfg]

If I walk into your house and take your TV all I have to distribute is your TV to one "customer."

If I obtain your software, crack it, all I have to distribute is an infinate number of copies.

The "casual priracy" argument has never held water and never will, because it only takes one noncasual pirate to provide casual piracy to everyone.

When companies use pain in the ass proctection that only drives downloads of the pirate version, since paying customers buy the CD, then run the pirate version. A paying c

Why would they do this?

[nwbvt]

<sarcasm>
I honestly do not understand why they would want to do this. To protect against software piracy? Who would do such a thing? Surely the general population has enough respect for software developers that they would refrain from pirating software without copy protection schemes.
</sarcasm>

What happened to the free version?

[Guspaz]

What happened to being able to download the source to WineX (Or Cedega) and compiling it yourself? Are TransGaming violating the GPL by not providing the source, or are they claiming that the subscription is to cover distribution costs to get around the GPL?

Or, am I completely wrong, and does Transgaming provide the source on their website, just hidden somewhere?

Re:What happened to the free version?

[BenV666]

You can download and build the CVS version yourself: cvs instructions [transgaming.com].

Re:What happened to the free version?

[Anonymous Coward]

X11 / MIT yes.

Cedega itself is Aladin license. But it is no-so free [debian.org]:

Within hours after posting the ITP (Intent to Package) on the Debian
bug database and on the debian-devel mailing list, a mail from Trans-
Gaming's CEO/CTE Gavriel State was received, which indicates
1. "We noticed that you intend to package our AFPLed WineX package
for release in debian (presumably non-free). We would really prefer
that this not happen, for a number of reasons."
2. " We would prefer not to have to change our license to expli

Apart from the moral/ethical questions...

[cleverhandle]

I'm not really sure what the point of this watermarking is. It's really not copy protection - they would need a proper activation system to enforce that. And, even apart from the huge political backlash that would entail, I can't imagine that TG would devote the technical and clerical resources required to make an activation system work. Especially since so many Linux users change distros and hardware more often than their socks. They can't be crazy enough to try activation.

So what's the point, then? Copies will still make their way through P2P. I guess they could go after people that share the file (if they're dumb enough not to wipe the watermark), but there's no way they'd do more than cancel that person's subscription. Again, apart from political issues, any legal proceedings would be ridiculously expensive for the damages involved. Are they saving dev time on support? No, not really - you have to have a subscription to access the message boards. There's IRC, I guess, but if a dev's sitting there already, that's not much of a loss.

I feel like we're missing something here. The guys at TG are clearly not dumb. They can't believe this will help them sell more copies. There's got to be more to it somewhere...

Privacy?

[JamesKPolk]

How is this a loss of privacy unless you were planning to violate the company's copyright?

Who is going to see your personally tagged tarball that you download?

Re:Privacy?

[JamesKPolk]

Repeating the assertion doesn't make it so.

The only possible way your personal information gets out here is if YOU distribute it. In that case it's YOU, not this company, that is violating your privacy.

As far as I'm concerned...

[Ghostgate]

... any action that makes things more difficult / inconvenient / annoying / etc. for legitimate users of a piece of software (or anything else - like an audio CD) is an action that should not be taken.

When I am using software that I am a legitimate owner of, the last thing I want to do is jump through a million hoops just to prove I'm legit. For example, I'll be the first to admit that when I BUY a PC game, the first thing I do is go looking for a "no CD crack" to download. Why? Because I own the game and don't WANT to be forced to swap CDs all the time, just to constantly prove that I paid for the damn thing. I shouldn't have to. Honestly, it's insulting.

AFAIK, every form of copy/piracy protection that has ever existed has been cracked, and typically in a relatively short amount of time. The ones doing the pirating don't care - they have come to expect it, and finding out how to crack the software will be widely preferred to forking over the cash anyway. The crackers/warez distributors don't care either - indeed, quite the opposite, as many crackers will love the chance to be the first to crack a new protection scheme. The only ones who care are the legitimate users, because they're the ones who usually suffer.

Re:As far as I'm concerned...

[JamesKPolk]

I agree with your first sentence, but tagging a tarball doesn't make a legitimate user's installation, use, or backup of his software any more difficult or inconvenient or annoying.

The only thing made inconvenient is the unlicensed redistribution of that tarball.

Comment removed

[account_deleted]

Comment removed based on user account deletion

There is only one answer

[Graabein]

Is this tiny loss of personal privacy worth the increase in TransGaming's security?

No.

And make that "perceived security".

My subscription is cancelled...

[oldosadmin]

I love transgaming, and was encouraging everyone I heard was using CVS to buy a subscription... but not anymore. I won't buy stuff from a company that would do something like this... well, the fact they did it isn't so bad, the fact they hid it is.

CVS Tree

[polyp2000]

Those who want to use Cedega, but not pay the licensing fee, can just use the CVS tree download from the transgaming website, that comes free and no subscription required. All that is missing is the point2play system and their installer. What is to stop people packaging up the CVS version and distributing that instead?

IMHO the fact that they provide a CVS version negates the requirement to go and pirate it anyway.

Nick...

Changes

[rpdillon]

Apparently it is watermarking...I downloaded two copies:

$tar xvzf cedega1.tgz
$ls
cedega1.tgz cedega2.tgz usr
$mv usr usr1
$tar xvzf cedgea2.tgz
$mv usr usr2
$ls
cedega1.tgz cedega2.tgz usr1 usr2
$diff -r usr1 usr2
$

'Nuff said. Its just a watermark, not in the actual files. If you do a:

$diff -rs usr1 usr2

it'll report that every file is identical, just to verify.

Then, make an unwatermarked version:

$mv usr1 usr
$tar czf cedega_clean.tgz usr

Sadly, if you compress the *exact* same folder twice with tar czf it will not md5sum the same (try it!). I can't say I know why. So basically, this helps with piracy but not with the verification problem. =( Don't know how to fix the ebuild problem. Anyone that knows more about why the md5sums for two .tgzs of the same data would be different?

Re:Changes

[Craig Ringer]

Most likely the MD5sums don't match because tar is storing the access times on the files. The access time will change when tar reads the file. To work around it, use the 'noatime' mount option on the FS or pass the appropriate parameters to tar so that it doesn't record atimes or resets them after reading the file.

Official response here

[gavriels]

Hi all,

I've posted an official response here:

http://transgaming.org/forum/viewtopic.php?p=400 9# 4009

Take care,
-Gav

--
Gavriel State, Co-CEO & CTO
TransGaming Technologies Inc.
[e-mail]

Re:If MS did this....

[tisme]

quote: "If Microsoft did this"

(they already have... Windows XP beta builds).

Re:If MS did this....

[prichardson]

Every time a company (usually Apple) does something even remotely questionable regarding YRO people say that if Microsoft did it there would be a huge uproar.

If it's something anticompetitive someone usually clamors about how Microsoft is a convicted monopolist. I wish people could come up with a new ways to attack Microsoft and a new ways to be Microsoft apologists. I suppose we should stop rewarding those who rehash old arguments (I swear I've read your comment before, word for word) with Karma.

Re:If MS did this....

[JWSmythe]

Just imagine if they did something insane like making you call for permission to reinstall if you've changed some of your hardware.

Oh..

Re:Great Idea

[maxpublic]

People who steal should be punished.

Agreed. Unfortunately you seem to have bought the line that copyright violation is somehow equivalent to theft.

It isn't. It never has been. But if enough people like you refuse to exercise their brains concerning the matter and keep insisting that the two are one and the same, then some day they will be - at least legally. And then we're all fucked, since from that point on we won't even have the right to back up the product that we PAID FOR.

We'll be just what the software companies want us to be: licensees. We'll never own anything we purchase from them, and if they can get away with that sort of fucked-up bullshit, what's to stop other companies from doing the same thing with their products? I suppose you'd be happy RENTING everything in your house for the rest of your life, unable to do anything with it that isn't specified in the EULA that comes with those items?

If so, whoredom is just a short step away for you and everyone else like you.

Max

Re:Will software companies ever learn?

[CAIMLAS]

Um. I'm not sure if your comment is off-topic, or if you simply don't understand what TG is doing.

They're "watermarking" stuff to to be able to essentially track legit users. IE, they will give support to people with legit watermarked tarballs. IE, service. Warezed copies will not receive services, thus not costing the company any direct money. You didn't honestly think the company was stupid enough to think they could 'prevent' piracy, did you? No, there will always be morally corrupt people such as yourself out there that have no compunction about not paying for what they get.

Hopefully this makes sense to you.

Oh, and one more thing - TG's software is making niche software. They are not making popular software. Your own argument is self-defeating.

Re:Background, please.

[BlurredWeasel]

As far as I know:

Most games have some sort of copy protection in them, making simple WINEing of the executable not work (tries doing magical windows assembly voodoo or some such).

What TransGaming have done is to take WINE (legally under a permissive licence) and continue to develop it for games, in addtion to licencing these copy protection schemes from the people who make them. They are under a contract to not reveal these copy protection schemes, and hence don't. Everything else is avaliable for downl

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:

[account_deleted]

Comment removed based on user account deletion