125 replies to this topic

[VU+NL]

That's really poor.

Well: I suggest you reopen your Blog, so everybody can discus that matter.........

[reichi]

Well, as people are pretty much just focus on insulting. I can really do without it.

[VU+NL]

Well, as people are pretty much just focus on insulting. I can really do without it.

Yes off course, but that's all in the game. Especially when you're trying to ruin their hobby.
But you don't actually have to read everything.

[Alias1]

Well, as people are pretty much just focus on insulting. I can really do without it.

Go hide under a rock then you are starting to sound like matrix10.
PLi have been developing images for the Vu+Duo and the et9000 since they have come out and you are now just complaining.
Makes you wonder why

[MiLo]

http://openpli.git.s...4d55e6cea709f0f

THIS commit ist just ridiculous and still as license violation as the patch you applied before!
And everyone who understands what it's technically all about (with tpm) knows why...

That's really poor. And i am very sure you know what I am talking about (@milo/pieterg).

Well, explain it then. Because for as far as I can see, the current implementation is way more efficient. I see no reason for duplicating all the identical hashing code all over the place.

[reichi]

Two possibilities:
1. You actually do really not have a clue about the tpm-stuff - i apologize if so, though i don't believe that
2. You really think I am plain stupid... that would be sad

In case 1 please read http://git.opendream...5d63b9f;hb=HEAD
You are completely spoiling the tpm security model by centralizing all checks.

Case 2:

You have control over that dreamtpm.check(), if you just return True all the time the rest of the code is plain useless, and I do think you know about that.

Stop trying to fool me, I actually DO understand how the TPM works, you won't outsmart me there.

In any case:
Leave the tpm-checks untouched if you're serious.
If you are not serious, rest assured i won't argue anymore.

[Jeroensky]

In case 1 please read http://git.opendream...5d63b9f;hb=HEAD

That link says:

you can protect your plugin against execution
6 on Non-Dream Multimedia Hardware

. So can, that means you don't have to.

For you it's "spoil the security model", for others it's porting functionality to VU+ & ET tuners. /images/smiley/pfft.gif
So in your link i don't see any official license agreement.

[tom09]

@reichi: congrats, you´re really cool. that´s what the open source idea is all about.

is there a working ipk, to manually install webinterface?

[reichi]

That link says:

you can protect your plugin against execution
6 on Non-Dream Multimedia Hardware

. So can, that means you don't have to.

For you it's "spoil the security model", for others it's porting functionality to VU+ & ET tuners. /images/smiley/pfft.gif
So in your link i don't see any official license agreement.

You souldn't argue if you have no clue what people are talking about...
That link also says:

The main TPM check is implemented into the "main" function. You need to providethis code yourself in your plugin. So copy&paste the code into your own as wellas the needed functions- bin2long- long2bin- rsa_pub1024- decrypt_block- validate_cert- read_randomImporting the functions from somewhere else would spoil the security model. Soyou need to provide the code with your plugin.

The original Webinterface License is here: https://schwerkraft....02279a7a2b1d08ePS: Next time read the WHOLE text please...

[reichi]

@reichi: congrats, you´re really cool. that´s what the open source idea is all about.

What YOU mean is free software, the webinterface ist not free software, it never was.
Open source does not necessarily mean free.
Really... stop mixing up all the stuff.
It was the decision of ALL initial webinterface developers to license it the way it is licensed.
The same applies for the rest of the plugins affected.

This is NOT about arguing about the license it's about respecting it.
Last time I've reacted on a comment like that...

[MiLo]

The whole TPM is a pointless waste of CPU resources anyway. It can only work if both ends of the platform are on a trusted system, in this case only one end is.

Any silly user can always just remove the check anyway, be it in the plugin's code or elsewhere.

I think my dm8000 takes long enough to boot already, and I don't want it to wait for yet another bunch of number crunching while it loads a few plugins. When I attempted to "benchmark" the TPM check (when it had just been introduced) by just doing the check thing in a loop and timing it, the enigma process crashed, probably a resource leak of some kind. So I definitely did't want to use the TPM more than absolutely necessary.


Having said that - I want to be really sure about this before I spend some more of my rare free time on this subject - I want to have it from you guys in writing:

If I put the TPM checks back into the code exactly as they were, can we continue to pull from the schwerkraft.elitedvb.net sources and distribute your plugins to Dreambox users?

And if not, clearly state what you expect us to do then.

[VU+NL]

The way you react, the tone you use, the fact that you close down your Blog if people show you hurt them, that you act as a DM-puppet, that you try to spoil our hobby, that you shoot both yourself & DM in both feet etc etc: it all does reveal a lot about you........

But don't worry: the non-DM adepts with the "open source-mind" will gloriously win the battle you started. Won't take long.

[MiLo]

Please be aware that I seriously try to avoid in-depth technical discussions about the TPM. If there are to be technical discussions about it, I will only do that with a representative from DMM, out of respect for the company and all they have accomplished. You (that is, reichi) can contact me by PM or E-mail, if you want me to elaborate on that.

[littlesat]

that means you don't have to.

Indeed, but Reichi do not want that his work is running on a ET or VU box and based on his licences this should be respected - Unless I and everyone else do not like it!!! It is Reichi's wish!!! And a wish cannot be discussed!!!

But below a quote I found on the i-h-a-d forum about something I do not like. Reichi is stating there that PLi will run on all clone boxes. This statement is not true.

I (only can) suggest Reichi sees the ET end VU boxes also as clone boxes. I think this is not true as the ET and VU boxes are creating their own drivers. Clone boxes do completely rely on (older) true drivers from DreamMultimedia. But that is my personal meaning.

Aber nicht erst seit gestern.
Ich habe persönlich eigentlich nichts dagegen wenn jmd. e2 und webif auf seine Kathi installiert oder so. Soll mir recht sein.
Wogegen ich etwas habe ist, wenn Firmen Produkte verkaufen die auf e2 basieren, aber kein Stück zur Softwareentwicklung beitragen (stichwort, VU+/Marusys, Clarketech mit den ETxxx, etc).

PLI macht Images die primär genau diese Zielgruppe ansprechen, außerdem laufen PLI Images auf allen Clones, da ja a sämtliche Checks ausgebaut werden.

Und damit habe ich tats. pers. ein Problem. Ich möchte nicht, dass "meine" (ist ja nicht nur mein Werk) Software auf diesen Produkten läuft, und ich erwarte, dass man meinen Wunsch respektiert.

[VU+NL]

..... But that is my personal meaning.

You're absolutely right there. I also contradicted that statement already, but no comment from TS on that......

[reichi]

The whole TPM is a pointless waste of CPU resources anyway. It can only work if both ends of the platform are on a trusted system, in this case only one end is.

OK, that tells a lot about how serious you actually are about all this. I wonder if it's even worth arguing anymore?!?

Any silly user can always just remove the check anyway, be it in the plugin's code or elsewhere.

good one, how many users do you think are actually capable of doing things like that? I think it's not a lot, just look at the comments here, most people do not even understand the most essential basics.

I think my dm8000 takes long enough to boot already, and I don't want it to wait for yet another bunch of number crunching while it loads a few plugins. When I attempted to "benchmark" the TPM check (when it had just been introduced) by just doing the check thing in a loop and timing it, the enigma process crashed, probably a resource leak of some kind. So I definitely did't want to use the TPM more than absolutely necessary.

The webif ist not doing a "big" number of requests, it's about 5 queries, two of them for getting l2 and l3certs

Having said that - I want to be really sure about this before I spend some more of my rare free time on this subject - I want to have it from you guys in writing:
If I put the TPM checks back into the code exactly as they were, can we continue to pull from the schwerkraft.elitedvb.net sources and distribute your plugins to Dreambox users?
And if not, clearly state what you expect us to do then.

Keep ALL the tpm stuff original (meaning exactly the way it is on schwerkraft) and you're welcome to add them to any image built specifically for geniune dreamboxes.
I do not want a single tpm-related line of code changed, moved or even touched.
You are also not allowed to do/implement ANYTHING that would circumvent the tpm-checks of being executed (cmon... it's stated very very clearly within the license).

Just see what the License clearly states:

As an exception regarding Modifcations, you are NOT permitted to remove
any geniune checks implemented in this Software or change them for means of disabling
or working around the genuine checks, unless the change has been explicitly permitted
by the original Author(s).

In short: If you do anything that would actually make the webinterface work on non-geniuen dreamboxes you are violating the license.

I can only speak for stuff I actually own code of, so _dr.best_ will have to give his very own statement about that.

[reichi]

[quote=littlesat][quote]I (only can) suggest Reichi sees the ET end VU boxes also as clone boxes. I think this is not true as the ET and VU boxes are creating their own drivers. Clone boxes do completely rely on (older) true drivers from DreamMultimedia. But that is my personal meaning. [/quote]

Hi, Yes, i really was wrong there ( thought i fixed that, but the thread is closed now, so i can't do anything about it anymore). Or well... i just forgot an explaining sentence...
I already explained earlier in this thread, that, though pli does not directly provide images that do run on clones, they provide everything to easily build those images. All you need to do is change the drivers and use the already patched, tpm-free code of the pli-git. And you can't deny that, can you?

[MiLo]

I wonder if it's even worth arguing anymore

The point I was trying to make in my last post: I will not argue about it at all.

good one, how many users do you think are actually capable of doing things like that? I think it's not a lot, just look at the comments here, most people do not even understand the most essential basics.

They don't have to, there are enough "underground" script kiddies that will do it for them.

[littlesat]

All you need to do is change the drivers and use the already patched, tpm-free code of the pli-git. And you can't deny that, can you?

The same you can do with the opendreambox git... not more complicated then with PLi. I suggest you mean the old pvr switch which is still available that may allow using older dream multimedia drivers. As we do not need this anymore we could consider to remove this one indeed. I agree this makes it easier to create clone images on later Enigma2 releases. Is this what you mean with this? I think nobody did notify this here truly.

But what I do not inderstand is why making such big issues here.... before you know in the internet you can find illegal ipk packages and all hours of work and discussions are for nothing. It is only spilling of energy... The IPKs are probably already available via all the other closed source image teams... The users are creative...

[OldDeuteronomy]

What I don't understand about what Reichi's doing is this: When I think about what my motivation would be to develop plugins, then I think about 2 things: First, it would obviously be my hobby to code stuff and to see how it works. Second, I would be ecxited about EVERYONE who's using my work, as long as no-one tries to hide that it is my work or, even worse, trying to have my work look like to be the work from someone else.

But, I would certainly NOT care about that my work is only being used together with the work from some company, given that I am neither the owner or an employee of that company. Why should I? I mean, take the PC industry as an example. And here we are not even talking about an area which is mainly based on the idea of Open-Source software. No-one would ever code a program and request users to use it only on a Dell PC, except for Dell itself of course. This would be totally ridiculous. And the argument that companies (or "brands" for that matter) like VU+ or Xtrend benefit from DMM's work without contributing something on their own might sound nice and romantic, but can also be thrashed by looking at the PC industry: Who ever cared for the fact that the PC was originally founded by IBM? Almost no-one. On the contrary! Even though IBM actually DID founded the PC and thus created the base for all the other PC makers in the world, every attempt of IBM to enforce their patents was highly critizised by, well, everyone except for IBM folks of course.

We all know where this ended: IBM no longer produces PCs, they have sold the business 6 years ago to Lenovo (China). No-one cares about who originally founded the PC. The opposite is true - those companies who layed the base for all this business (IBM, Microsoft) are usually disrespected for what they do (or did in the past). Today we have PCs from various companies that are technically identical and run 100% the same software and device drivers. The only proprietary stuff in PC industry are some tools from the manufacturer itself, with which they try (more or less successful) to differentiate from each other.

Having that said, an E2 developer might still be free to request that his software runs only on devices from manufacturer xyz. But the question is: why would he/she want to do that? There are only 4 possible answers:

1. He/she is an employee of xyz.
2. He/she is working for xyz as a privateer.
3. He/she is receiving some sort of incentive from xyz to develop exculively for xyz.
4. He/she is, for some completely ridiculous reasons, thinking that he/she is somehow in debt for xyz because they are so overwhelmingly nice people.

Reichi (and Dr. Best) would probably deny all of this, but I would simply not believe them. And since I don't think they are stupid, I would bet on 1-3 rather than on 4. Just in case the truth would really be 4: How stupid can one be to believe an individual could really be in debt for whatever reason for a company that is selling stuff to make money?! There are really very very few companies in this world that really care about people. XYZ is surely none of them. And that's no criticism. It's simply the way how our society works. XYZ would always do whatever they think that is best for the company. They wouldn't care for anything that you, Reichi and Dr. Best, think (or "feel") if it's for their own good. If you really think that you have to fight against "Dreambox-compatible" devices from other manufacturers, then it's really either point 4, or (what I rather thing as said above) 1, 2 or 3.

You can rest assured that what you are trying to achieve will not turn out the way you hope. You will instead see that the opposite will hapen. You won't stop those VU+'es and ET9000'es from spreading. Instead you will see more and more of these boxes in the future. On the long run, genuine Dreamboxes will mainly be purchased by people who would give a "yes" as answer to 1-3, and by fanboys (see answer 4 ). All the other people who understand how society and business work and who just work too hard for their money to spend it for a company that wants you to think of them as the Messias will purchases these VU+'es and ET9000'es and whatever similar boxes will be introduced in the future. And there will be plenty of people who will develop software of ALL boxes, no matter what brand name is on there. There already are.

At the very end, DMM will most likely not sell any own hardware any longer, the same way as IBM is no longer selling PCs. Instead, we will have a huge variety of Open-Source boxes that all run the same Open-Source OS and software on it. Guys like you can either adopt to this. Or loose. There are plenty of examples in various fields that show that what you are trying to accomplish will fail. The PC industry is just one (the most obvious) example. You need to realize that xyz is not something you should worship. All they do, they do for money, which, as said above, is perfectly ok. But for exactly this reason, NOTHING that this company or any of its employees ever did or will do in the future, is adorable. Because you simply don't adore something that someone else makes for money. Actually, what YOU do IS adorable, because you do it for free and to make people happy. But you render all of your own efforts completely worthless and unadorable if you do it for a company that wouldn't bet a single penny on you if it's not for their own good.

People like you should do what they do for other people, not for the sake of a company...